archtechx/tenancy
1
0
Fork 0
mirror of https://github.com/archtechx/tenancy.git synced 2026-09-20 11:14:03 +00:00
Code Activity

Exercise the valid asset path before testing traversal

Browse source 
Request photo.jpg and assert success before asserting rejection of ../media-originals/photo.jpg

(addresses https://github.com/archtechx/tenancy/pull/1479#pullrequestreview-4984403598)
This commit is contained in:
lukinovec 2026-08-21 16:07:01 +02:00 • committed by Samuel Stancl
parent e70057e3ba
commit 802022a926
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
tests/TenantAssetTest.php
View file

@ -404,6 +404,10 @@ test('tenant asset controller throws an exception when accessing a file in a dir
Storage::disk('media')->put('photo.jpg', 'public file');
pest()->get(tenant_asset('photo.jpg'), [
'X-Tenant' => $tenant->id,
])->assertSuccessful();
// A directory next to the asset root, e.g. one holding files that shouldn't be served
mkdir($privateDirectory = storage_path('app/media-originals'), recursive: true);
file_put_contents($privateDirectory . '/photo.jpg', 'private file');