archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2025-12-12 12:54:05 +00:00
Code Activity

add extra $path validation to TenantAssetsController

Browse source
This commit is contained in:
Samuel Štancl 2023-08-24 18:21:23 +02:00
parent 395192442d
commit 4af70d302f
3 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

13
tests/TenantAssetTest.php
View file

@ -141,4 +141,17 @@ class TenantAssetTest extends TestCase
$response->assertNotFound();
}
public function test_asset_controller_returns_a_403_when_an_invalid_path_is_provided()
{
TenantAssetsController::$tenancyMiddleware = InitializeTenancyByRequestData::class;
$tenant = Tenant::create();
tenancy()->initialize($tenant);
$response = $this->get(tenant_asset('../foo.txt'), [
'X-Tenant' => $tenant->id,
]);
$response->assertForbidden();
}
}