Changeset 55764 for trunk/tests/phpunit/tests/ajax/wpAjaxSendAttachmentToEditor.php

Timestamp:

05/16/2023 02:26:01 PM (17 months ago)

Author:

audrasjb

Message:

Media: Prevent CSRF setting attachment thumbnails.

Props martinkrcho, paulkevan, peterwilsoncc, xknown, peterwilsoncc.

File:

• trunk/tests/phpunit/tests/ajax/wpAjaxSendAttachmentToEditor.php (modified) (1 diff)

trunk/tests/phpunit/tests/ajax/wpAjaxSendAttachmentToEditor.php

@@ -102 +102 @@
         $this->assertSame( $expected, $response['data'] );
     }
+
+    public function test_wp_ajax_set_attachment_thumbnail_success() {
+        // Become an administrator.
+        $post    = $_POST;
+        $user_id = self::factory()->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'user_36578_administrator',
+                'user_email' => 'user_36578_administrator@example.com',
+            )
+        );
+        wp_set_current_user( $user_id );
+        $_POST = array_merge( $_POST, $post );
+
+        // Upload the attachment itself.
+        $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+        $contents = file_get_contents( $filename );
+
+        $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $attachment = $this->_make_attachment( $upload );
+
+        // Upload the thumbnail.
+        $filename = DIR_TESTDATA . '/images/waffles.jpg';
+        $contents = file_get_contents( $filename );
+
+        $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $thumbnail = $this->_make_attachment( $upload );
+
+        // Set up a default request.
+        $_POST['_ajax_nonce']  = wp_create_nonce( 'set-attachment-thumbnail' );
+        $_POST['thumbnail_id'] = $thumbnail;
+        $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+        // Make the request.
+        try {
+            $this->_handleAjax( 'set-attachment-thumbnail' );
+        } catch ( WPAjaxDieContinueException $e ) {
+            unset( $e );
+        }
+
+        // Get the response.
+        $response = json_decode( $this->_last_response, true );
+
+        // Ensure everything is correct.
+        $this->assertTrue( $response['success'] );
+    }
+
+    public function test_wp_ajax_set_attachment_thumbnail_missing_nonce() {
+        // Become an administrator.
+        $post    = $_POST;
+        $user_id = self::factory()->user->create(
+            array(
+                'role'       => 'administrator',
+                'user_login' => 'user_36578_administrator',
+                'user_email' => 'user_36578_administrator@example.com',
+            )
+        );
+        wp_set_current_user( $user_id );
+        $_POST = array_merge( $_POST, $post );
+
+        // Upload the attachment itself.
+        $filename = DIR_TESTDATA . '/uploads/small-audio.mp3';
+        $contents = file_get_contents( $filename );
+
+        $upload     = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $attachment = $this->_make_attachment( $upload );
+
+        // Upload the thumbnail.
+        $filename = DIR_TESTDATA . '/images/waffles.jpg';
+        $contents = file_get_contents( $filename );
+
+        $upload    = wp_upload_bits( wp_basename( $filename ), null, $contents );
+        $thumbnail = $this->_make_attachment( $upload );
+
+        // Set up a default request.
+        $_POST['thumbnail_id'] = $thumbnail;
+        $_POST['urls']         = array( wp_get_attachment_url( $attachment ) );
+
+        // Make the request.
+        try {
+            $this->_handleAjax( 'set-attachment-thumbnail' );
+        } catch ( WPAjaxDieContinueException $e ) {
+            unset( $e );
+        }
+
+        // Get the response.
+        $response = json_decode( $this->_last_response, true );
+
+        // Check that success is false without sending nonce.
+        $this->assertFalse( $response['success'] );
+    }
 }