Skip to content

Commit 5a6f472

Browse files
duncanmccleanduncanmcclean
authored
[5.x] Asset auth fix (#13883)
1 parent 3304a9f commit 5a6f472

File tree

8 files changed

+262
-12
lines changed

8 files changed

+262
-12
lines changed

‎routes/cp.php‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,6 @@
229229

230230
Route::resource('asset-containers', AssetContainersController::class);
231231
Route::post('asset-containers/{asset_container}/folders', [FoldersController::class, 'store']);
232-
Route::patch('asset-containers/{asset_container}/folders/{path}', [FoldersController::class, 'update'])->where('path', '.*');
233232
Route::get('asset-containers/{asset_container}/blueprint', [AssetContainerBlueprintController::class, 'edit'])->name('asset-containers.blueprint.edit');
234233
Route::patch('asset-containers/{asset_container}/blueprint', [AssetContainerBlueprintController::class, 'update'])->name('asset-containers.blueprint.update');
235234
Route::post('assets/actions', [AssetActionController::class, 'run'])->name('assets.actions.run');

‎src/Http/Controllers/CP/Assets/FoldersController.php‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,9 +37,4 @@ public function store(Request $request, $container)
3737

3838
return $container->assetFolder($path)->save();
3939
}
40-
41-
public function update(Request $request, $container, $folder)
42-
{
43-
return $container->assetFolder($folder)->save();
44-
}
4540
}

‎src/Http/Controllers/CP/Assets/PdfController.php‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,9 +15,11 @@ class PdfController extends Controller
1515
*/
1616
public function show($encodedAssetId)
1717
{
18-
if (! $contents = $this->asset($encodedAssetId)->contents()) {
19-
abort(500);
20-
}
18+
$asset = $this->asset($encodedAssetId);
19+
20+
abort_if(! $contents = $asset->contents(), 500);
21+
22+
$this->authorize('view', $asset);
2123

2224
return response($contents)->header('Content-Type', 'application/pdf');
2325
}

‎src/Http/Controllers/CP/Assets/SvgController.php‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,9 @@ public function show($asset)
1717
{
1818
$asset = $this->asset($asset);
1919

20-
if (! $contents = $asset->disk()->get($asset->path())) {
21-
abort(500);
22-
}
20+
abort_if(! $contents = $asset->disk()->get($asset->path()), 500);
21+
22+
$this->authorize('view', $asset);
2323

2424
return response($contents)->header('Content-Type', 'image/svg+xml');
2525
}

‎src/Http/Controllers/CP/Assets/ThumbnailController.php‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,8 @@ public function show($asset, $size = null, $orientation = null)
6565
$this->orientation = $orientation;
6666
$this->asset = $this->asset($asset);
6767

68+
$this->authorize('view', $this->asset);
69+
6870
if ($placeholder = $this->getPlaceholderResponse()) {
6971
return $placeholder;
7072
}

‎tests/Feature/Assets/ImageThumbnailTest.php‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
<?php
2+
3+
namespace Feature\Assets;
4+
5+
use Illuminate\Http\UploadedFile;
6+
use PHPUnit\Framework\Attributes\Test;
7+
use Statamic\Facades\AssetContainer;
8+
use Statamic\Facades\User;
9+
use Tests\FakesRoles;
10+
use Tests\PreventSavingStacheItemsToDisk;
11+
use Tests\TestCase;
12+
13+
class ImageThumbnailTest extends TestCase
14+
{
15+
use FakesRoles;
16+
use PreventSavingStacheItemsToDisk;
17+
18+
private $tempDir;
19+
20+
public function setUp(): void
21+
{
22+
parent::setUp();
23+
24+
config(['filesystems.disks.test' => [
25+
'driver' => 'local',
26+
'root' => $this->tempDir = __DIR__.'/tmp',
27+
]]);
28+
}
29+
30+
public function tearDown(): void
31+
{
32+
app('files')->deleteDirectory($this->tempDir);
33+
34+
parent::tearDown();
35+
}
36+
37+
#[Test]
38+
public function it_returns_thumbnail()
39+
{
40+
$container = AssetContainer::make('test')->disk('test')->save();
41+
$container
42+
->makeAsset('one.png')
43+
->upload(UploadedFile::fake()->image('one.png'));
44+
45+
$this->setTestRoles(['test' => ['access cp', 'view test assets']]);
46+
$user = User::make()->assignRole('test')->save();
47+
48+
$this
49+
->actingAs($user)
50+
->getJson('/cp/thumbnails/'.base64_encode('test::one.png'))
51+
->assertSuccessful();
52+
}
53+
54+
#[Test]
55+
public function it_404s_when_the_asset_doesnt_exist()
56+
{
57+
$container = AssetContainer::make('test')->disk('test')->save();
58+
59+
$this->setTestRoles(['test' => ['access cp', 'view test assets']]);
60+
$user = User::make()->assignRole('test')->save();
61+
62+
$this
63+
->actingAs($user)
64+
->getJson('/cp/thumbnails/'.base64_encode('test::unknown.png'))
65+
->assertNotFound();
66+
}
67+
68+
#[Test]
69+
public function it_denies_access_without_permission_to_view_asset()
70+
{
71+
$container = AssetContainer::make('test')->disk('test')->save();
72+
$container
73+
->makeAsset('one.png')
74+
->upload(UploadedFile::fake()->image('one.png'));
75+
76+
$this->setTestRoles(['test' => ['access cp']]);
77+
$user = User::make()->assignRole('test')->save();
78+
79+
$this
80+
->actingAs($user)
81+
->getJson('/cp/thumbnails/'.base64_encode('test::one.png'))
82+
->assertForbidden();
83+
}
84+
}

‎tests/Feature/Assets/PdfThumbnailTest.php‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
<?php
2+
3+
namespace Feature\Assets;
4+
5+
use Illuminate\Http\UploadedFile;
6+
use PHPUnit\Framework\Attributes\Test;
7+
use Statamic\Facades\AssetContainer;
8+
use Statamic\Facades\User;
9+
use Tests\FakesRoles;
10+
use Tests\PreventSavingStacheItemsToDisk;
11+
use Tests\TestCase;
12+
13+
class PdfThumbnailTest extends TestCase
14+
{
15+
use FakesRoles;
16+
use PreventSavingStacheItemsToDisk;
17+
18+
private $tempDir;
19+
20+
public function setUp(): void
21+
{
22+
parent::setUp();
23+
24+
config(['filesystems.disks.test' => [
25+
'driver' => 'local',
26+
'root' => $this->tempDir = __DIR__.'/tmp',
27+
]]);
28+
}
29+
30+
public function tearDown(): void
31+
{
32+
app('files')->deleteDirectory($this->tempDir);
33+
34+
parent::tearDown();
35+
}
36+
37+
#[Test]
38+
public function it_returns_thumbnail()
39+
{
40+
$container = AssetContainer::make('test')->disk('test')->save();
41+
$container
42+
->makeAsset('one.pdf')
43+
->upload(UploadedFile::fake()->createWithContent('one.pdf', ' '));
44+
45+
$this->setTestRoles(['test' => ['access cp', 'view test assets']]);
46+
$user = User::make()->assignRole('test')->save();
47+
48+
$this
49+
->actingAs($user)
50+
->getJson('/cp/pdfs/'.base64_encode('test::one.pdf'))
51+
->assertSuccessful();
52+
}
53+
54+
#[Test]
55+
public function it_404s_when_the_asset_doesnt_exist()
56+
{
57+
$container = AssetContainer::make('test')->disk('test')->save();
58+
59+
$this->setTestRoles(['test' => ['access cp', 'view test assets']]);
60+
$user = User::make()->assignRole('test')->save();
61+
62+
$this
63+
->actingAs($user)
64+
->getJson('/cp/pdfs/'.base64_encode('test::unknown.pdf'))
65+
->assertNotFound();
66+
}
67+
68+
#[Test]
69+
public function it_denies_access_without_permission_to_view_asset()
70+
{
71+
$container = AssetContainer::make('test')->disk('test')->save();
72+
$container
73+
->makeAsset('one.pdf')
74+
->upload(UploadedFile::fake()->createWithContent('one.pdf', ' '));
75+
76+
$this->setTestRoles(['test' => ['access cp']]);
77+
$user = User::make()->assignRole('test')->save();
78+
79+
$this
80+
->actingAs($user)
81+
->getJson('/cp/pdfs/'.base64_encode('test::one.pdf'))
82+
->assertForbidden();
83+
}
84+
}

‎tests/Feature/Assets/SvgThumbnailTest.php‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
<?php
2+
3+
namespace Feature\Assets;
4+
5+
use Illuminate\Http\UploadedFile;
6+
use PHPUnit\Framework\Attributes\Test;
7+
use Statamic\Facades\AssetContainer;
8+
use Statamic\Facades\User;
9+
use Tests\FakesRoles;
10+
use Tests\PreventSavingStacheItemsToDisk;
11+
use Tests\TestCase;
12+
13+
class SvgThumbnailTest extends TestCase
14+
{
15+
use FakesRoles;
16+
use PreventSavingStacheItemsToDisk;
17+
18+
private $tempDir;
19+
20+
public function setUp(): void
21+
{
22+
parent::setUp();
23+
24+
config(['filesystems.disks.test' => [
25+
'driver' => 'local',
26+
'root' => $this->tempDir = __DIR__.'/tmp',
27+
]]);
28+
}
29+
30+
public function tearDown(): void
31+
{
32+
app('files')->deleteDirectory($this->tempDir);
33+
34+
parent::tearDown();
35+
}
36+
37+
#[Test]
38+
public function it_returns_thumbnail()
39+
{
40+
$container = AssetContainer::make('test')->disk('test')->save();
41+
$container
42+
->makeAsset('one.png')
43+
->upload(UploadedFile::fake()->createWithContent('one.svg', '<svg></svg>'));
44+
45+
$this->setTestRoles(['test' => ['access cp', 'view test assets']]);
46+
$user = User::make()->assignRole('test')->save();
47+
48+
$this
49+
->actingAs($user)
50+
->getJson('/cp/svgs/'.base64_encode('test::one.svg'))
51+
->assertSuccessful();
52+
}
53+
54+
#[Test]
55+
public function it_404s_when_the_asset_doesnt_exist()
56+
{
57+
$container = AssetContainer::make('test')->disk('test')->save();
58+
59+
$this->setTestRoles(['test' => ['access cp', 'view test assets']]);
60+
$user = User::make()->assignRole('test')->save();
61+
62+
$this
63+
->actingAs($user)
64+
->getJson('/cp/svgs/'.base64_encode('test::unknown.svg'))
65+
->assertNotFound();
66+
}
67+
68+
#[Test]
69+
public function it_denies_access_without_permission_to_view_asset()
70+
{
71+
$container = AssetContainer::make('test')->disk('test')->save();
72+
$container
73+
->makeAsset('one.svg')
74+
->upload(UploadedFile::fake()->createWithContent('one.svg', '<svg></svg>'));
75+
76+
$this->setTestRoles(['test' => ['access cp']]);
77+
$user = User::make()->assignRole('test')->save();
78+
79+
$this
80+
->actingAs($user)
81+
->getJson('/cp/svgs/'.base64_encode('test::one.svg'))
82+
->assertForbidden();
83+
}
84+
}

0 commit comments

Comments
 (0)