Chris@0: <?php
Chris@0: 
Chris@0: namespace Drupal\system\Tests\System;
Chris@0: 
Chris@0: use Drupal\simpletest\WebTestBase;
Chris@0: 
Chris@0: /**
Chris@0:  * Tests .htaccess is working correctly.
Chris@0:  *
Chris@0:  * @group system
Chris@0:  */
Chris@0: class HtaccessTest extends WebTestBase {
Chris@0: 
Chris@0:   /**
Chris@0:    * Modules to enable.
Chris@0:    *
Chris@0:    * @var array
Chris@0:    */
Chris@0:   public static $modules = ['node', 'path'];
Chris@0: 
Chris@0:   /**
Chris@0:    * Get an array of file paths for access testing.
Chris@0:    *
Chris@0:    * @return int[]
Chris@0:    *   An array keyed by file paths. Each value is the expected response code,
Chris@0:    *   for example, 200 or 403.
Chris@0:    */
Chris@0:   protected function getProtectedFiles() {
Chris@0:     $path = drupal_get_path('module', 'system') . '/tests/fixtures/HtaccessTest';
Chris@0: 
Chris@0:     // Tests the FilesMatch directive which denies access to certain file
Chris@0:     // extensions.
Chris@0:     $file_exts_to_deny = [
Chris@0:       'engine',
Chris@0:       'inc',
Chris@0:       'install',
Chris@0:       'make',
Chris@0:       'module',
Chris@0:       'module~',
Chris@0:       'module.bak',
Chris@0:       'module.orig',
Chris@0:       'module.save',
Chris@0:       'module.swo',
Chris@0:       'module.swp',
Chris@0:       'php~',
Chris@0:       'php.bak',
Chris@0:       'php.orig',
Chris@0:       'php.save',
Chris@0:       'php.swo',
Chris@0:       'php.swp',
Chris@0:       'profile',
Chris@0:       'po',
Chris@0:       'sh',
Chris@0:       'sql',
Chris@0:       'theme',
Chris@0:       'twig',
Chris@0:       'tpl.php',
Chris@0:       'xtmpl',
Chris@0:       'yml',
Chris@0:     ];
Chris@0: 
Chris@0:     foreach ($file_exts_to_deny as $file_ext) {
Chris@0:       $file_paths["$path/access_test.$file_ext"] = 403;
Chris@0:     }
Chris@0: 
Chris@0:     // Tests the .htaccess file in vendor and created by a Composer script.
Chris@0:     // Try and access a non PHP file in the vendor directory.
Chris@0:     // @see Drupal\\Core\\Composer\\Composer::ensureHtaccess
Chris@0:     $file_paths['vendor/composer/installed.json'] = 403;
Chris@0: 
Chris@0:     // Tests the rewrite conditions and rule that denies access to php files.
Chris@0:     $file_paths['core/lib/Drupal.php'] = 403;
Chris@0:     $file_paths['vendor/autoload.php'] = 403;
Chris@0:     $file_paths['autoload.php'] = 403;
Chris@0: 
Chris@0:     // Test extensions that should be permitted.
Chris@0:     $file_exts_to_allow = [
Chris@0:       'php-info.txt'
Chris@0:     ];
Chris@0: 
Chris@0:     foreach ($file_exts_to_allow as $file_ext) {
Chris@0:       $file_paths["$path/access_test.$file_ext"] = 200;
Chris@0:     }
Chris@0: 
Chris@0:     // Ensure composer.json and composer.lock cannot be accessed.
Chris@0:     $file_paths["$path/composer.json"] = 403;
Chris@0:     $file_paths["$path/composer.lock"] = 403;
Chris@0: 
Chris@0:     return $file_paths;
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Iterates over protected files and calls assertNoFileAccess().
Chris@0:    */
Chris@0:   public function testFileAccess() {
Chris@0:     foreach ($this->getProtectedFiles() as $file => $response_code) {
Chris@0:       $this->assertFileAccess($file, $response_code);
Chris@0:     }
Chris@0: 
Chris@0:     // Test that adding "/1" to a .php URL does not make it accessible.
Chris@0:     $this->drupalGet('core/lib/Drupal.php/1');
Chris@0:     $this->assertResponse(403, "Access to core/lib/Drupal.php/1 is denied.");
Chris@0: 
Chris@0:     // Test that it is possible to have path aliases containing .php.
Chris@0:     $type = $this->drupalCreateContentType();
Chris@0: 
Chris@0:     // Create an node aliased to test.php.
Chris@0:     $node = $this->drupalCreateNode([
Chris@0:       'title' => 'This is a node',
Chris@0:       'type' => $type->id(),
Chris@0:       'path' => '/test.php'
Chris@0:     ]);
Chris@0:     $node->save();
Chris@0:     $this->drupalGet('test.php');
Chris@0:     $this->assertResponse(200);
Chris@0:     $this->assertText('This is a node');
Chris@0: 
Chris@0:     // Update node's alias to test.php/test.
Chris@0:     $node->path = '/test.php/test';
Chris@0:     $node->save();
Chris@0:     $this->drupalGet('test.php/test');
Chris@0:     $this->assertResponse(200);
Chris@0:     $this->assertText('This is a node');
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Asserts that a file exists and requesting it returns a specific response.
Chris@0:    *
Chris@0:    * @param string $path
Chris@0:    *   Path to file. Without leading slash.
Chris@0:    * @param int $response_code
Chris@0:    *   The expected response code. For example: 200, 403 or 404.
Chris@0:    *
Chris@0:    * @return bool
Chris@0:    *   TRUE if the assertion succeeded, FALSE otherwise.
Chris@0:    */
Chris@0:   protected function assertFileAccess($path, $response_code) {
Chris@0:     $result = $this->assertTrue(file_exists(\Drupal::root() . '/' . $path), "The file $path exists.");
Chris@0:     $this->drupalGet($path);
Chris@0:     $result = $result && $this->assertResponse($response_code, "Response code to $path is $response_code.");
Chris@0:     return $result;
Chris@0:   }
Chris@0: 
Chris@0:   /**
Chris@0:    * Tests that SVGZ files are served with Content-Encoding: gzip.
Chris@0:    */
Chris@0:   public function testSvgzContentEncoding() {
Chris@0:     $this->drupalGet('core/modules/system/tests/logo.svgz');
Chris@0:     $this->assertResponse(200);
Chris@0:     $header = $this->drupalGetHeader('Content-Encoding');
Chris@0:     $this->assertEqual($header, 'gzip');
Chris@0:   }
Chris@0: 
Chris@0: }