From 802022a9269bd34a62fd7e055ca5737871760877 Mon Sep 17 00:00:00 2001 From: lukinovec Date: Fri, 21 Aug 2026 16:07:01 +0200 Subject: [PATCH] Exercise the valid asset path before testing traversal Request photo.jpg and assert success before asserting rejection of ../media-originals/photo.jpg (addresses https://github.com/archtechx/tenancy/pull/1479#pullrequestreview-4984403598) --- tests/TenantAssetTest.php | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tests/TenantAssetTest.php b/tests/TenantAssetTest.php index cb789a40..9ffa1f05 100644 --- a/tests/TenantAssetTest.php +++ b/tests/TenantAssetTest.php @@ -404,6 +404,10 @@ test('tenant asset controller throws an exception when accessing a file in a dir Storage::disk('media')->put('photo.jpg', 'public file'); + pest()->get(tenant_asset('photo.jpg'), [ + 'X-Tenant' => $tenant->id, + ])->assertSuccessful(); + // A directory next to the asset root, e.g. one holding files that shouldn't be served mkdir($privateDirectory = storage_path('app/media-originals'), recursive: true); file_put_contents($privateDirectory . '/photo.jpg', 'private file');