1*7e687fd8SAndreas Gohr<?php 2*7e687fd8SAndreas Gohr 3*7e687fd8SAndreas Gohruse dokuwiki\test\mock\AuthPlugin; 4*7e687fd8SAndreas Gohr 5*7e687fd8SAndreas Gohr/** 6*7e687fd8SAndreas Gohr * Tests for mediaAclPath() and its effect on media ACL evaluation. 7*7e687fd8SAndreas Gohr */ 8*7e687fd8SAndreas Gohrclass auth_mediaaclpath_test extends DokuWikiTest 9*7e687fd8SAndreas Gohr{ 10*7e687fd8SAndreas Gohr public function setUp(): void 11*7e687fd8SAndreas Gohr { 12*7e687fd8SAndreas Gohr parent::setUp(); 13*7e687fd8SAndreas Gohr global $auth; 14*7e687fd8SAndreas Gohr $auth = new AuthPlugin(); 15*7e687fd8SAndreas Gohr } 16*7e687fd8SAndreas Gohr 17*7e687fd8SAndreas Gohr public function provideMediaIds(): array 18*7e687fd8SAndreas Gohr { 19*7e687fd8SAndreas Gohr return [ 20*7e687fd8SAndreas Gohr // [media id, expected ACL path] 21*7e687fd8SAndreas Gohr 'nested namespace' => ['wiki:sub:image.png', 'wiki:sub:*'], 22*7e687fd8SAndreas Gohr 'single namespace' => ['wiki:image.png', 'wiki:*'], 23*7e687fd8SAndreas Gohr 'root namespace' => ['image.png', '*'], 24*7e687fd8SAndreas Gohr 'empty id' => ['', '*'], 25*7e687fd8SAndreas Gohr 'page-like id' => ['wiki:secret.png', 'wiki:*'], 26*7e687fd8SAndreas Gohr ]; 27*7e687fd8SAndreas Gohr } 28*7e687fd8SAndreas Gohr 29*7e687fd8SAndreas Gohr /** 30*7e687fd8SAndreas Gohr * @dataProvider provideMediaIds 31*7e687fd8SAndreas Gohr */ 32*7e687fd8SAndreas Gohr public function test_mediaAclPath_transform($id, $expected) 33*7e687fd8SAndreas Gohr { 34*7e687fd8SAndreas Gohr $this->assertSame($expected, mediaAclPath($id)); 35*7e687fd8SAndreas Gohr } 36*7e687fd8SAndreas Gohr 37*7e687fd8SAndreas Gohr /** 38*7e687fd8SAndreas Gohr * A page-intended exact-ID rule (e.g. wiki:secret.png as a page) must NOT 39*7e687fd8SAndreas Gohr * govern a media file with the same ID. The media file's permission is 40*7e687fd8SAndreas Gohr * decided solely by its namespace ACL. 41*7e687fd8SAndreas Gohr */ 42*7e687fd8SAndreas Gohr public function test_mediaAclPath_ignores_exact_id_rule() 43*7e687fd8SAndreas Gohr { 44*7e687fd8SAndreas Gohr global $conf; 45*7e687fd8SAndreas Gohr global $AUTH_ACL; 46*7e687fd8SAndreas Gohr $conf['useacl'] = 1; 47*7e687fd8SAndreas Gohr 48*7e687fd8SAndreas Gohr $AUTH_ACL = [ 49*7e687fd8SAndreas Gohr '* @ALL 8', // everyone has upload on root 50*7e687fd8SAndreas Gohr 'wiki:secret.png @ALL 0', // page-intended deny on this exact ID 51*7e687fd8SAndreas Gohr ]; 52*7e687fd8SAndreas Gohr 53*7e687fd8SAndreas Gohr // raw-id check (the old buggy pattern) hits the deny rule 54*7e687fd8SAndreas Gohr $this->assertEquals(AUTH_NONE, auth_aclcheck('wiki:secret.png', '', [])); 55*7e687fd8SAndreas Gohr 56*7e687fd8SAndreas Gohr // the helper produces wiki:*, which the deny rule does not match 57*7e687fd8SAndreas Gohr $this->assertEquals(AUTH_UPLOAD, auth_aclcheck(mediaAclPath('wiki:secret.png'), '', [])); 58*7e687fd8SAndreas Gohr } 59*7e687fd8SAndreas Gohr 60*7e687fd8SAndreas Gohr /** 61*7e687fd8SAndreas Gohr * Namespace-level ACLs must still apply to media via mediaAclPath(). 62*7e687fd8SAndreas Gohr */ 63*7e687fd8SAndreas Gohr public function test_mediaAclPath_applies_namespace_rule() 64*7e687fd8SAndreas Gohr { 65*7e687fd8SAndreas Gohr global $conf; 66*7e687fd8SAndreas Gohr global $AUTH_ACL; 67*7e687fd8SAndreas Gohr $conf['useacl'] = 1; 68*7e687fd8SAndreas Gohr 69*7e687fd8SAndreas Gohr $AUTH_ACL = [ 70*7e687fd8SAndreas Gohr '* @ALL 8', 71*7e687fd8SAndreas Gohr 'private:* @ALL 0', 72*7e687fd8SAndreas Gohr ]; 73*7e687fd8SAndreas Gohr 74*7e687fd8SAndreas Gohr $this->assertEquals(AUTH_NONE, auth_aclcheck(mediaAclPath('private:image.png'), '', [])); 75*7e687fd8SAndreas Gohr $this->assertEquals(AUTH_UPLOAD, auth_aclcheck(mediaAclPath('public:image.png'), '', [])); 76*7e687fd8SAndreas Gohr } 77*7e687fd8SAndreas Gohr 78*7e687fd8SAndreas Gohr /** 79*7e687fd8SAndreas Gohr * Root-namespace media must still resolve against the root ACL rule. 80*7e687fd8SAndreas Gohr */ 81*7e687fd8SAndreas Gohr public function test_mediaAclPath_root_namespace() 82*7e687fd8SAndreas Gohr { 83*7e687fd8SAndreas Gohr global $conf; 84*7e687fd8SAndreas Gohr global $AUTH_ACL; 85*7e687fd8SAndreas Gohr $conf['useacl'] = 1; 86*7e687fd8SAndreas Gohr 87*7e687fd8SAndreas Gohr $AUTH_ACL = [ 88*7e687fd8SAndreas Gohr '* @ALL 8', 89*7e687fd8SAndreas Gohr ]; 90*7e687fd8SAndreas Gohr 91*7e687fd8SAndreas Gohr $this->assertEquals(AUTH_UPLOAD, auth_aclcheck(mediaAclPath('image.png'), '', [])); 92*7e687fd8SAndreas Gohr } 93*7e687fd8SAndreas Gohr} 94