Merge pull request #224 from splitbrain/fetchimagetokexternal

Added check of token in fetch.php for external images.

3 files changed, 165 insertions, 23 deletions

diff --git a/_test/tests/inc/common_ml.test.php b/_test/tests/inc/common_ml.test.php
index 6f3b71db4..415c0a88d 100644
--- a/_test/tests/inc/common_ml.test.php
+++ b/_test/tests/inc/common_ml.test.php
@@ -90,6 +90,25 @@ class common_ml_test extends DokuWikiTest {
         $this->assertEquals($expect, ml($id, $args));
     }
 
+    function test_ml_img_external() {
+        global $conf;
+        $conf['useslash']   = 0;
+        $conf['userewrite'] = 0;
+
+        $ids  = array(
+            'https://example.com/lib/tpl/dokuwiki/images/logo.png',
+            'http://example.com/lib/tpl/dokuwiki/images/logo.png',
+            'ftp://example.com/lib/tpl/dokuwiki/images/logo.png'
+        );
+
+        foreach($ids as $id) {
+            $tok = media_get_token($id, 0, 0);
+
+            $expect = DOKU_BASE.$this->script.'?tok='.$tok.'&media='.rawurlencode($id);
+            $this->assertEquals($expect, ml($id));
+        }
+    }
+
     function test_ml_imgresize_array_external() {
         global $conf;
         $conf['useslash']   = 0;
@@ -107,8 +126,24 @@ class common_ml_test extends DokuWikiTest {
             $tok = media_get_token($id, $w, 0);
             $hash = substr(PassHash::hmac('md5', $id, auth_cookiesalt()), 0, 6);
 
-            $expect = DOKU_BASE.$this->script.'?hash='.$hash.'&w='.$w.'&tok='.$tok.'&media='.rawurlencode($id);
+            $expect = DOKU_BASE.$this->script.'?w='.$w.'&tok='.$tok.'&media='.rawurlencode($id);
             $this->assertEquals($expect, ml($id, $args));
         }
+
+        $h    = 50;
+        $args = array('h' => $h);
+        $tok = media_get_token($id, $h, 0);
+
+        $expect = DOKU_BASE.$this->script.'?h='.$h.'&tok='.$tok.'&media='.rawurlencode($id);
+        $this->assertEquals($expect, ml($id, $args));
+
+        $w    = 80;
+        $h    = 50;
+        $args = array('w' => $w, 'h' => $h);
+        $tok = media_get_token($id, $w, $h);
+
+        $expect = DOKU_BASE.$this->script.'?w='.$w.'&h='.$h.'&tok='.$tok.'&media='.rawurlencode($id);
+        $this->assertEquals($expect, ml($id, $args));
+
     }
 }
diff --git a/_test/tests/lib/exe/fetch_imagetoken.test.php b/_test/tests/lib/exe/fetch_imagetoken.test.php
index 9e5b6e4a2..99e642557 100644
--- a/_test/tests/lib/exe/fetch_imagetoken.test.php
+++ b/_test/tests/lib/exe/fetch_imagetoken.test.php
@@ -23,10 +23,10 @@ class fetch_imagetoken_test extends DokuWikiTest {
         parent::setUp();
 
         global $conf;
-        $conf['sendfile'] = 0;
+        $conf['xsendfile'] = 0;
 
         global $MIME, $EXT, $CACHE, $INPUT;    // variables fetch creates in global scope -- should this be in fetch?
-    }

+    }
 
     function getUri() {
        $w = $this->width ? 'w='.$this->width.'&' : '';
@@ -39,14 +39,14 @@ class fetch_imagetoken_test extends DokuWikiTest {
         $request = new TestRequest();
         return $request->get(array(),str_replace('{%token%}',$token,$this->getUri()));
     }
-

-    /**

+
+    /**
      *  modified image request with valid token
      *  expect: header with mime-type
      *  expect: content
      *  expect: no error response
-     */

-    function test_valid_token(){

+     */
+    function test_valid_token(){
         $valid_token = 'tok='.media_get_token($this->media, $this->width, $this->height).'&';
         $response = $this->fetchResponse($valid_token);
         $this->assertTrue((bool)$response->getHeader('Content-Type'));
@@ -54,24 +54,24 @@ class fetch_imagetoken_test extends DokuWikiTest {
         
         $status_code = $response->getStatusCode();
         $this->assertTrue(is_null($status_code) || (200 == $status_code));
-    }

-    

-    /**

+    }
+    
+    /**
      *  modified image request with invalid token
-     *  expect: 412 status code

-     */

-    function test_invalid_token(){

-        $invalid_token = 'tok='.media_get_token('junk',200,100).'&';

-        $this->assertEquals(412,$this->fetchResponse($invalid_token)->getStatusCode());

-    }

-    

-    /**

-     *  modified image request with no token

      *  expect: 412 status code
-     */

-    function test_missing_token(){

-        $no_token = '';

-        $this->assertEquals(412,$this->fetchResponse($notoken)->getStatusCode());
+     */
+    function test_invalid_token(){
+        $invalid_token = 'tok='.media_get_token('junk',200,100).'&';
+        $this->assertEquals(412,$this->fetchResponse($invalid_token)->getStatusCode());
+    }
+    
+    /**
+     *  modified image request with no token
+     *  expect: 412 status code
+     */
+    function test_missing_token(){
+        $no_token = '';
+        $this->assertEquals(412,$this->fetchResponse($no_token)->getStatusCode());
     }
 
     /**
diff --git a/_test/tests/lib/exe/fetch_statuscodes_external.test.php b/_test/tests/lib/exe/fetch_statuscodes_external.test.php
new file mode 100644
index 000000000..79a45ec93
--- /dev/null
+++ b/_test/tests/lib/exe/fetch_statuscodes_external.test.php
@@ -0,0 +1,107 @@
+<?php
+
+/**
+ * @group internet
+ */
+class fetch_statuscodes_external_test extends DokuWikiTest {
+
+    private $media = 'http://www.google.com/images/srpr/logo3w.png'; //used in media_get_from_url test too
+    private $width = 200;
+    private $height = 0;
+
+    function setUp() {
+
+        header('X-Test: check headers working');
+        $header_check = function_exists('xdebug_get_headers') ? xdebug_get_headers() : headers_list();
+        if(empty($header_check)) {
+            $this->markTestSkipped('headers not returned, perhaps your sapi does not return headers, try xdebug');
+        } else {
+            header_remove('X-Test');
+        }
+
+        parent::setUp();
+
+        global $conf;
+        $conf['fetchsize'] = 500 * 1024; //500kb
+        $conf['xsendfile'] = 0;
+
+        global $MIME, $EXT, $CACHE, $INPUT; // variables fetch creates in global scope -- should this be in fetch?
+    }
+
+    function getUri() {
+        $w = $this->width ? 'w='.$this->width.'&' : '';
+        $h = $this->height ? 'h='.$this->height.'&' : '';
+        return '/lib/exe/fetch.php?'.$w.$h.'{%token%}media='.rawurlencode($this->media);
+    }
+
+    function fetchResponse($token) {
+        $request = new TestRequest();
+        return $request->get(array(), str_replace('{%token%}', $token, $this->getUri()));
+    }
+
+    /**
+     *  modified image request with valid token
+     *  and not-modified image request with valid token
+     *
+     *  expect: header with mime-type
+     *  expect: content
+     *  expect: no error response
+     */
+    function test_valid_token() {
+        $valid_token_resize = 'tok='.media_get_token($this->media, $this->width, $this->height).'&';
+
+        $this->handlevalidresponse($valid_token_resize);
+
+        //original size
+        $this->width          = $this->height = 0;
+        $valid_token_original = 'tok='.media_get_token($this->media, $this->width, $this->height).'&';
+
+        $this->handlevalidresponse($valid_token_original);
+
+    }
+
+    /**
+     * Performs asserts for valid request
+     *
+     * @param $valid_token
+     */
+    private function handlevalidresponse($valid_token){
+        $response = $this->fetchResponse($valid_token);
+        $this->assertTrue((bool) $response->getHeader('Content-Type'));
+        $this->assertTrue((bool) ($response->getContent()));
+
+        $status_code = $response->getStatusCode();
+        $this->assertTrue(is_null($status_code) || (200 == $status_code));
+    }
+
+    /**
+     *  modified image request with invalid token
+     *  expect: 412 status code
+     */
+    function test_invalid_token() {
+        $invalid_tokens = array(
+            'invalid_token_wrongid' => media_get_token('junk', 200, 100),
+            'invalid_token_wrongh'  => media_get_token($this->media, 200, 10),
+            'invalid_token_wrongw'  => media_get_token($this->media, 20, 100),
+            'invalid_token_wrongwh' => media_get_token($this->media, 20, 10)
+        );
+        foreach($invalid_tokens as $invalid_token)
+            $this->assertEquals(412, $this->fetchResponse('tok='.$invalid_token.'&')->getStatusCode());
+
+    }
+
+    /**
+     *  modified image request with no token
+     *  and not modified image with no token
+     *  expect: 412 status code
+     */
+    function test_missing_token() {
+        $no_token = '';
+
+        $this->assertEquals(412, $this->fetchResponse($no_token)->getStatusCode());
+
+        $this->width = $this->height = 0;
+        $this->assertEquals(412, $this->fetchResponse($no_token)->getStatusCode());
+    }
+}
+//Setup VIM: ex: et ts=4 :