72 lines
1.8 KiB
PHP
72 lines
1.8 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
namespace Tests\Feature;
|
|
|
|
use App\Models\User;
|
|
use Illuminate\Foundation\Testing\RefreshDatabase;
|
|
use Illuminate\Support\Facades\File;
|
|
use Tests\TestCase;
|
|
|
|
class BackupDownloadSecurityTest extends TestCase
|
|
{
|
|
use RefreshDatabase;
|
|
|
|
protected string $homeRoot;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
parent::setUp();
|
|
|
|
$this->homeRoot = storage_path('testing/home');
|
|
}
|
|
|
|
protected function tearDown(): void
|
|
{
|
|
File::deleteDirectory($this->homeRoot);
|
|
|
|
parent::tearDown();
|
|
}
|
|
|
|
public function test_user_can_download_backup_from_home_backup_directory(): void
|
|
{
|
|
$user = User::factory()->create([
|
|
'username' => 'backupuser',
|
|
'home_directory' => $this->homeRoot.'/backupuser',
|
|
]);
|
|
|
|
$backupDir = $user->home_directory.'/backups';
|
|
File::makeDirectory($backupDir, 0755, true);
|
|
|
|
$backupPath = $backupDir.'/backup.tar.gz';
|
|
File::put($backupPath, 'test-backup');
|
|
|
|
$response = $this->actingAs($user)
|
|
->get('/jabali-panel/backup-download?path='.base64_encode($backupPath));
|
|
|
|
$response->assertOk();
|
|
}
|
|
|
|
public function test_user_cannot_download_outside_backup_directory(): void
|
|
{
|
|
$user = User::factory()->create([
|
|
'username' => 'backupuser',
|
|
'home_directory' => $this->homeRoot.'/backupuser',
|
|
]);
|
|
|
|
$backupDir = $user->home_directory.'/backups';
|
|
File::makeDirectory($backupDir, 0755, true);
|
|
|
|
$secretPath = $user->home_directory.'/secret.txt';
|
|
File::put($secretPath, 'secret');
|
|
|
|
$traversalPath = $backupDir.'/../secret.txt';
|
|
|
|
$response = $this->actingAs($user)
|
|
->get('/jabali-panel/backup-download?path='.base64_encode($traversalPath));
|
|
|
|
$response->assertForbidden();
|
|
}
|
|
}
|