Changeset 57358 for branches/6.4/tests/phpunit/tests/canonical.php

Timestamp:

01/25/2024 07:41:24 PM (16 months ago)

Author:

jorbin

Message:

Media: Redirect inactive attachment pages for logged-out users.

Ensure logged out users are redirected to the media file when attachment pages are inactive. This removes the read_post capability check from the canonical redirects as anonymous users lack the permission.

This was previously committed in [57310] before being reverted in [57318]. This update includes a fix to cover instances where revealing a URL could be considered a data leak and greatly expands the unit tests to ensure that this is covered along with many other instances.

Follow-up to [56657], [56658], [56711], [57310], [57318].

Reviewed by joemcgill.
Merges [57357] to 6.4 branch.

Props peterwilsoncc, jorbin, afercia, aristath, chesio, joppuyo, jorbin, lakshmananphp, poena, sergeybiryukov, swissspidy, johnbillion, mukesh27.
Fixes #59866.
See #57913.

Location:

branches/6.4

Files:

• . (modified) (1 prop)
• tests/phpunit/tests/canonical.php (modified) (3 diffs)

branches/6.4/tests/phpunit/tests/canonical.php

@@ -15 +15 @@
         wp_set_current_user( self::$author_id );
 
-        add_filter( 'pre_option_wp_attachment_pages_enabled', '__return_true' );
+        update_option( 'wp_attachment_pages_enabled', 1 );
     }
 
@@ -407 +407 @@
 
     /**
+     * Test canonical redirects for attachment pages when the option is disabled.
+     *
      * @ticket 57913
-     */
-    public function test_canonical_attachment_page_redirect_with_option_disabled() {
-        add_filter( 'pre_option_wp_attachment_pages_enabled', '__return_false' );
+     * @ticket 59866
+     *
+     * @dataProvider data_canonical_attachment_page_redirect_with_option_disabled
+     */
+    public function test_canonical_attachment_page_redirect_with_option_disabled( $expected, $user = null, $parent_post_status = '' ) {
+        update_option( 'wp_attachment_pages_enabled', 0 );
+
+        if ( '' !== $parent_post_status ) {
+            $parent_post_id = self::factory()->post->create(
+                array(
+                    'post_status' => $parent_post_status,
+                )
+            );
+        } else {
+            $parent_post_id = 0;
+        }
 
         $filename = DIR_TESTDATA . '/images/test-image.jpg';
@@ -416 +431 @@
         $upload   = wp_upload_bits( wp_basename( $filename ), null, $contents );
 
-        $attachment_id   = $this->_make_attachment( $upload );
+        $attachment_id   = $this->_make_attachment( $upload, $parent_post_id );
+        $attachment_url  = wp_get_attachment_url( $attachment_id );
         $attachment_page = get_permalink( $attachment_id );
 
+        // Set as anonymous/logged out user.
+        if ( null !== $user ) {
+            wp_set_current_user( $user );
+        }
+
         $this->go_to( $attachment_page );
 
-        $url      = redirect_canonical( $attachment_page, false );
-        $expected = wp_get_attachment_url( $attachment_id );
+        $url = redirect_canonical( $attachment_page, false );
+        if ( is_string( $expected ) ) {
+            $expected = str_replace( '%%attachment_url%%', $attachment_url, $expected );
+        }
 
         $this->assertSame( $expected, $url );
     }
+
+    /**
+     * Data provider for test_canonical_attachment_page_redirect_with_option_disabled().
+     *
+     * @return array[]
+     */
+    public function data_canonical_attachment_page_redirect_with_option_disabled() {
+        return array(
+            'logged out user, no parent'      => array(
+                '%%attachment_url%%',
+                0,
+            ),
+            'logged in user, no parent'       => array(
+                '%%attachment_url%%',
+            ),
+            'logged out user, private parent' => array(
+                null,
+                0,
+                'private',
+            ),
+            'logged in user, private parent'  => array(
+                '%%attachment_url%%',
+                null,
+                'private',
+            ),
+            'logged out user, public parent'  => array(
+                '%%attachment_url%%',
+                0,
+                'publish',
+            ),
+            'logged in user, public parent'   => array(
+                '%%attachment_url%%',
+                null,
+                'publish',
+            ),
+        );
+    }
 }