class FileSaveUploadTest

class FileSaveUploadTest extends FileHookTestCase {
    
    /**
     * An image file path for uploading.
     */
    protected $image;
    
    /**
     * A PHP file path for upload security testing.
     */
    protected $phpfile;
    
    /**
     * The largest file id when the test starts.
     */
    protected $maxFidBefore;
    
    /**
     * An image extension.
     */
    protected $image_extension;
    public static function getInfo() {
        return array(
            'name' => 'File uploading',
            'description' => 'Tests the file uploading functions.',
            'group' => 'File API',
        );
    }
    function setUp() {
        parent::setUp();
        $account = $this->drupalCreateUser(array(
            'access content',
        ));
        $this->drupalLogin($account);
        $image_files = $this->drupalGetTestFiles('image');
        $this->image = current($image_files);
        list(, $this->image_extension) = explode('.', $this->image->filename);
        $this->assertTrue(is_file($this->image->uri), "The image file we're going to upload exists.");
        $this->phpfile = current($this->drupalGetTestFiles('php'));
        $this->assertTrue(is_file($this->phpfile->uri), "The PHP file we're going to upload exists.");
        $this->maxFidBefore = db_query('SELECT MAX(fid) AS fid FROM {file_managed}')->fetchField();
        // Upload with replace to guarantee there's something there.
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called then clean out the hook
        // counters.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        file_test_reset();
    }
    
    /**
     * Test the file_save_upload() function.
     */
    function testNormal() {
        $max_fid_after = db_query('SELECT MAX(fid) AS fid FROM {file_managed}')->fetchField();
        $this->assertTrue($max_fid_after > $this->maxFidBefore, 'A new file was created.');
        $file1 = file_load($max_fid_after);
        $this->assertTrue($file1, 'Loaded the file.');
        // MIME type of the uploaded image may be either image/jpeg or image/png.
        $this->assertEqual(substr($file1->filemime, 0, 5), 'image', 'A MIME type was set.');
        // Reset the hook counters to get rid of the 'load' we just called.
        file_test_reset();
        // Upload a second file.
        $max_fid_before = db_query('SELECT MAX(fid) AS fid FROM {file_managed}')->fetchField();
        $image2 = current($this->drupalGetTestFiles('image'));
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($image2->uri),
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('You WIN!'));
        $max_fid_after = db_query('SELECT MAX(fid) AS fid FROM {file_managed}')->fetchField();
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        $file2 = file_load($max_fid_after);
        $this->assertTrue($file2);
        // MIME type of the uploaded image may be either image/jpeg or image/png.
        $this->assertEqual(substr($file2->filemime, 0, 5), 'image', 'A MIME type was set.');
        // Load both files using file_load_multiple().
        $files = file_load_multiple(array(
            $file1->fid,
            $file2->fid,
        ));
        $this->assertTrue(isset($files[$file1->fid]), 'File was loaded successfully');
        $this->assertTrue(isset($files[$file2->fid]), 'File was loaded successfully');
        // Upload a third file to a subdirectory.
        $image3 = current($this->drupalGetTestFiles('image'));
        $image3_realpath = drupal_realpath($image3->uri);
        $dir = $this->randomName();
        $edit = array(
            'files[file_test_upload]' => $image3_realpath,
            'file_subdir' => $dir,
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('You WIN!'));
        $this->assertTrue(is_file('temporary://' . $dir . '/' . trim(drupal_basename($image3_realpath))));
        // Check that file_load_multiple() with no arguments returns FALSE.
        $this->assertFalse(file_load_multiple(), 'No files were loaded.');
    }
    
    /**
     * Test extension handling.
     */
    function testHandleExtension() {
        // The file being tested is a .gif which is in the default safe list
        // of extensions to allow when the extension validator isn't used. This is
        // implicitly tested at the testNormal() test. Here we tell
        // file_save_upload() to only allow ".foo".
        $extensions = 'foo';
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'extensions' => $extensions,
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $extensions . '</em>';
        $this->assertRaw($message, 'Cannot upload a disallowed extension');
        $this->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
        ));
        // Reset the hook counters.
        file_test_reset();
        $extensions = 'foo ' . $this->image_extension;
        // Now tell file_save_upload() to allow the extension of our test image.
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'extensions' => $extensions,
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertNoRaw(t('Only files with the following extensions are allowed:'), 'Can upload an allowed extension.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'load',
            'update',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Now tell file_save_upload() to allow any extension.
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'allow_all_extensions' => 'empty_array',
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertNoRaw(t('Only files with the following extensions are allowed:'), 'Can upload any extension.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'load',
            'update',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Now tell file_save_upload() to allow any extension and try and upload a
        // malicious file.
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->phpfile->uri),
            'is_image_file' => FALSE,
            'allow_all_extensions' => 'empty_array',
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>';
        $this->assertRaw($message, 'Dangerous file was renamed.');
        $this->assertText('File name is php-2.php_.txt.');
        $this->assertRaw(t('File MIME type is text/plain.'), "Dangerous file's MIME type was changed.");
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
    }
    
    /**
     * Test dangerous file handling.
     */
    function testHandleDangerousFile() {
        // Allow the .php extension and make sure it gets munged and given a .txt
        // extension for safety. Also check to make sure its MIME type was changed.
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->phpfile->uri),
            'is_image_file' => FALSE,
            'extensions' => 'php',
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $message = t('For security reasons, your upload has been renamed to') . ' <em class="placeholder">' . $this->phpfile->filename . '_.txt' . '</em>';
        $this->assertRaw($message, 'Dangerous file was renamed.');
        $this->assertRaw('File name is php-2.php_.txt.');
        $this->assertRaw(t('File MIME type is text/plain.'), "Dangerous file's MIME type was changed.");
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Ensure dangerous files are not renamed when insecure uploads is TRUE.
        // Turn on insecure uploads.
        variable_set('allow_insecure_uploads', 1);
        // Reset the hook counters.
        file_test_reset();
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
        $this->assertRaw(t('File name is !filename', array(
            '!filename' => $this->phpfile->filename,
        )), 'Dangerous file was not renamed when insecure uploads is TRUE.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Even with insecure uploads allowed, the .php file should not be uploaded
        // if it is not explicitly included in the list of allowed extensions.
        $edit['extensions'] = 'foo';
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $edit['extensions'] . '</em>';
        $this->assertRaw($message, 'Cannot upload a disallowed extension');
        $this->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Turn off insecure uploads, then try the same thing as above (ensure that
        // the .php file is still rejected since it's not in the list of allowed
        // extensions).
        variable_set('allow_insecure_uploads', 0);
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $message = t('Only files with the following extensions are allowed:') . ' <em class="placeholder">' . $edit['extensions'] . '</em>';
        $this->assertRaw($message, 'Cannot upload a disallowed extension');
        $this->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
        ));
        // Reset the hook counters.
        file_test_reset();
    }
    
    /**
     * Test file munge handling.
     */
    function testHandleFileMunge() {
        // Ensure insecure uploads are disabled for this test.
        variable_set('allow_insecure_uploads', 0);
        $original_image_uri = $this->image->uri;
        $this->image = file_move($this->image, $this->image->uri . '.foo.' . $this->image_extension);
        // Reset the hook counters to get rid of the 'move' we just called.
        file_test_reset();
        $extensions = $this->image_extension;
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'extensions' => $extensions,
        );
        $munged_filename = $this->image->filename;
        $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
        $munged_filename .= '_.' . $this->image_extension;
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
        $this->assertRaw(t('File name is !filename', array(
            '!filename' => $munged_filename,
        )), 'File was successfully munged.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Ensure we don't munge the .foo extension if it is in the list of allowed
        // extensions.
        $extensions = 'foo ' . $this->image_extension;
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'extensions' => $extensions,
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
        $this->assertRaw(t('File name is @filename', array(
            '@filename' => 'image-test.png.foo.png',
        )), 'File was not munged when all extensions within it are allowed.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Ensure we don't munge files if we're allowing any extension.
        // Reset the hook counters.
        file_test_reset();
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'allow_all_extensions' => 'empty_array',
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found no security message.');
        $this->assertRaw(t('File name is !filename', array(
            '!filename' => $this->image->filename,
        )), 'File was not munged when allowing any extension.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Test that a dangerous extension such as .php is munged even if it is in
        // the list of allowed extensions.
        $this->image = file_move($this->image, $original_image_uri . '.php.' . $this->image_extension);
        // Reset the hook counters.
        file_test_reset();
        $extensions = 'php ' . $this->image_extension;
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'extensions' => $extensions,
        );
        $munged_filename = $this->image->filename;
        $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
        $munged_filename .= '_.' . $this->image_extension;
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
        $this->assertRaw(t('File name is @filename', array(
            '@filename' => $munged_filename,
        )), 'File was successfully munged.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Dangerous extensions are munged even when all extensions are allowed.
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'allow_all_extensions' => 'empty_array',
        );
        $munged_filename = $this->image->filename;
        $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
        $munged_filename .= '_.' . $this->image_extension;
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
        $this->assertRaw(t('File name is @filename.', array(
            '@filename' => 'image-test.png_.php_.png_.txt',
        )), 'File was successfully munged.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Dangerous extensions are munged if is renamed to end in .txt.
        $this->image = file_move($this->image, $original_image_uri . '.cgi.' . $this->image_extension . '.txt');
        // Reset the hook counters.
        file_test_reset();
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'allow_all_extensions' => 'empty_array',
        );
        $munged_filename = $this->image->filename;
        $munged_filename = substr($munged_filename, 0, strrpos($munged_filename, '.'));
        $munged_filename .= '_.' . $this->image_extension;
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
        $this->assertRaw(t('File name is @filename.', array(
            '@filename' => 'image-test.png_.cgi_.png_.txt',
        )), 'File was successfully munged.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
        // Reset the hook counters.
        file_test_reset();
        // Ensure that setting $validators['file_validate_extensions'] = array('')
        // rejects all files without munging or renaming.
        $edit = array(
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
            'allow_all_extensions' => 'empty_string',
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertNoRaw(t('For security reasons, your upload has been renamed'), 'Found security message.');
        $this->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
        ));
    }
    
    /**
     * Test renaming when uploading over a file that already exists.
     */
    function testExistingRename() {
        $edit = array(
            'file_test_replace' => FILE_EXISTS_RENAME,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'insert',
        ));
    }
    
    /**
     * Test replacement when uploading over a file that already exists.
     */
    function testExistingReplace() {
        $edit = array(
            'file_test_replace' => FILE_EXISTS_REPLACE,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('You WIN!'), 'Found the success message.');
        // Check that the correct hooks were called.
        $this->assertFileHooksCalled(array(
            'validate',
            'load',
            'update',
        ));
    }
    
    /**
     * Test for failure when uploading over a file that already exists.
     */
    function testExistingError() {
        $edit = array(
            'file_test_replace' => FILE_EXISTS_ERROR,
            'files[file_test_upload]' => drupal_realpath($this->image->uri),
        );
        $this->drupalPost('file-test/upload', $edit, t('Submit'));
        $this->assertResponse(200, 'Received a 200 response for posted test file.');
        $this->assertRaw(t('Epic upload FAIL!'), 'Found the failure message.');
        // Check that the no hooks were called while failing.
        $this->assertFileHooksCalled(array());
    }
    
    /**
     * Test for no failures when not uploading a file.
     */
    function testNoUpload() {
        $this->drupalPost('file-test/upload', array(), t('Submit'));
        $this->assertNoRaw(t('Epic upload FAIL!'), 'Failure message not found.');
    }

}