function ImageStyleDownloadAccessControlTest::testPublicThroughPrivateRoute

Ensures that public:// access is forbidden through image.style.private.

File

core/modules/image/tests/src/Functional/ImageStyleDownloadAccessControlTest.php, line 117

Class

ImageStyleDownloadAccessControlTest

Tests access control for downloading image styles.

Namespace

Code

public function testPublicThroughPrivateRoute() : void {
    $this->fileSystem
        ->copy(\Drupal::root() . '/core/tests/fixtures/files/image-1.png', 'public://image.png');
    $token = $this->style
        ->getPathToken('public://image.png');
    $private_route_public_scheme = Url::fromRoute('image.style_private', [
        'image_style' => $this->style
            ->id(),
        'scheme' => 'public',
    ])
        ->setAbsolute(TRUE);
    $generate_url = $private_route_public_scheme->toString() . '/image.png?itok=' . $token;
    $this->drupalGet($generate_url);
    $this->assertSession()
        ->statusCodeEquals(403);
}