1<?php 2 3/** 4 * Tests for the ACL enforcement of media_metasave(). 5 * 6 * media_metasave() authorizes the target media id itself. 7 */ 8class media_metasave_test extends DokuWikiTest { 9 10 public function setUp(): void { 11 parent::setUp(); 12 13 global $conf, $AUTH_ACL, $USERINFO; 14 15 $conf['useacl'] = 1; 16 $conf['mediarevisions'] = 1; 17 $_SERVER['REMOTE_USER'] = 'john'; 18 $USERINFO['grps'] = ['user']; 19 20 // upload allowed in public:*, but denied in the child public:private:* 21 $AUTH_ACL = [ 22 '* @ALL 0', 23 'public:* @user 8', // AUTH_UPLOAD 24 'public:private:* @user 0', // AUTH_NONE 25 ]; 26 } 27 28 /** 29 * Saving metadata for a media file in an ACL-denied namespace must be 30 * rejected. 31 */ 32 public function test_metasave_rejects_denied_namespace() { 33 $id = 'public:private:secret.jpg'; 34 $file = mediaFN($id); 35 io_makeFileDir($file); 36 file_put_contents($file, 'PROTECTED'); 37 $rev = filemtime($file); 38 39 // a valid token, so the ACL check is the only thing that can reject 40 $_REQUEST['sectok'] = getSecurityToken(); 41 42 $res = media_metasave($id, ['Title' => 'hacked']); 43 44 // a bypass reaches media_saveOldRevision() before any metadata write, 45 // so the absence of a stored revision proves the ACL check blocked it 46 $this->assertFileDoesNotExist(mediaFN($id, $rev), 'denied metasave must not create a revision'); 47 $this->assertSame('PROTECTED', file_get_contents($file), 'protected file must be untouched'); 48 $this->assertFalse($res); 49 } 50} 51