*/ private array $tempFiles = []; protected function setUp(): void { parent::setUp(); Functions\when('get_option')->justReturn(['upload_mb' => 1]); Functions\when('wp_tempnam')->alias(function (): string { $file = (string) tempnam(sys_get_temp_dir(), 'lit-up'); $this->tempFiles[] = $file; return $file; }); Functions\when('wp_delete_file')->alias(static function (string $file): void { if (is_file($file)) { unlink($file); } }); Functions\when('sanitize_file_name')->returnArg(); Functions\when('wp_basename')->alias('basename'); Functions\when('wp_parse_url')->alias('parse_url'); Functions\when('get_allowed_mime_types')->justReturn(MediaImporter::MIMES); } protected function tearDown(): void { foreach ($this->tempFiles as $file) { if (is_file($file)) { unlink($file); } } parent::tearDown(); } private function importer(): MediaImporter { return new MediaImporter(new Limits()); } private function assertTempFilesRemoved(): void { foreach ($this->tempFiles as $file) { self::assertFileDoesNotExist($file); } } /** Lets the next wp_safe_remote_get write $body into the stream target and answer with $headers. */ private function respond(string $body, int $code = 200, array $headers = []): void { Functions\when('wp_safe_remote_get')->alias(static function (string $url, array $args) use ($body, $code, $headers): array { file_put_contents($args['filename'], $body); return ['response' => ['code' => $code], 'headers' => $headers, 'filename' => $args['filename']]; }); $this->responseReaders(); } private function responseReaders(): void { Functions\when('wp_http_validate_url')->returnArg(); Functions\when('wp_remote_retrieve_response_code')->alias(static fn (array $r): int => $r['response']['code']); Functions\when('wp_remote_retrieve_header')->alias( static fn (array $r, string $name): string => (string) ($r['headers'][$name] ?? '') ); } public function testBase64UploadIsSideloadedWithAltText(): void { Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\expect('media_handle_sideload')->once() ->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'logo.png' && is_file($file['tmp_name'])), 5, 'Logo') ->andReturnUsing(static function (array $file): int { unlink($file['tmp_name']); // WordPress moves the temp file into uploads. return 55; }); Functions\expect('update_post_meta')->once()->with(55, '_wp_attachment_image_alt', 'Firmenlogo')->andReturn(true); $id = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', [ 'title' => 'Logo', 'alt' => 'Firmenlogo', 'post_id' => 5, ]); self::assertSame(55, $id); } public function testOversizedBase64IsRejectedBeforeDecoding(): void { $result = $this->importer()->fromBase64(str_repeat('A', 2 * 1024 * 1024), 'big.png', []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertStringContainsString('Limit 1 MB', $result->get_error_message()); self::assertSame([], $this->tempFiles, 'no temp file may be written for an oversized upload'); } public function testInvalidBase64IsRejected(): void { $result = $this->importer()->fromBase64('***', 'x.png', []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertSame([], $this->tempFiles); } public function testDisguisedFileIsRejectedAndTheTempFileRemoved(): void { Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => false, 'type' => false, 'proper_filename' => false]); Functions\expect('media_handle_sideload')->never(); $result = $this->importer()->fromBase64(base64_encode('get_error_code()); self::assertNotSame([], $this->tempFiles); $this->assertTempFilesRemoved(); } public function testTheWhitelistOnlyKeepsTypesWordPressAllowsTheUser(): void { Functions\when('get_allowed_mime_types')->justReturn(['png' => 'image/png', 'svg' => 'image/svg+xml']); Functions\expect('wp_check_filetype_and_ext')->once() ->with(Mockery::type('string'), 'logo.png', ['png' => 'image/png']) ->andReturn(['ext' => false, 'type' => false, 'proper_filename' => false]); $result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertStringContainsString('png', $result->get_error_message()); } public function testSideloadFailureIsAWriteFailureAndCleansUp(): void { Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\when('media_handle_sideload')->justReturn(new WP_Error('upload_error', 'Verzeichnis nicht beschreibbar')); $result = $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', []); self::assertSame('lit_write_failed', $result->get_error_code()); self::assertStringContainsString('Verzeichnis nicht beschreibbar', $result->get_error_message()); $this->assertTempFilesRemoved(); } public function testFailedAltTextDeletesTheNewAttachmentAgain(): void { Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\when('media_handle_sideload')->justReturn(55); Functions\when('update_post_meta')->justReturn(false); Functions\when('get_post_meta')->justReturn(''); Functions\expect('wp_delete_attachment')->once()->with(55, true)->andReturn(new \stdClass()); try { $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']); self::fail('WriteFailed expected'); } catch (WriteFailed $e) { self::assertTrue($e->rolledBack); self::assertSame('lit_write_failed', $e->toError()->get_error_code()); } $this->assertTempFilesRemoved(); } public function testAltTextFailureWithoutRollbackIsAPartialWriteNamingTheAttachment(): void { Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\when('media_handle_sideload')->justReturn(55); Functions\when('update_post_meta')->justReturn(false); Functions\when('get_post_meta')->justReturn(''); Functions\when('wp_delete_attachment')->justReturn(false); try { $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo']); self::fail('WriteFailed expected'); } catch (WriteFailed $e) { self::assertFalse($e->rolledBack); self::assertSame(55, $e->postId); $error = $e->toError(); self::assertSame('lit_partial_write', $error->get_error_code()); self::assertStringContainsString('Medium 55', $error->get_error_message()); self::assertSame(55, $error->get_error_data()['attachment_id']); } } public function testAnAltTextAlreadyTakenFromTheImageIsNoFailure(): void { Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\when('media_handle_sideload')->justReturn(55); Functions\when('update_post_meta')->justReturn(false); // Same value already stored (IPTC alt). Functions\when('get_post_meta')->justReturn('Logo'); Functions\expect('wp_delete_attachment')->never(); self::assertSame(55, $this->importer()->fromBase64(base64_encode('PNGDATA'), 'logo.png', ['alt' => 'Logo'])); } public function testInternalUrlsAreRejectedWithoutRequest(): void { Functions\when('wp_http_validate_url')->justReturn(false); Functions\expect('wp_safe_remote_get')->never(); $result = $this->importer()->fromUrl('http://127.0.0.1/wp-config.php', null, []); self::assertSame('lit_validation_failed', $result->get_error_code()); } public function testOnlyHttpUrlsAreFetched(): void { Functions\when('wp_http_validate_url')->returnArg(); Functions\expect('wp_safe_remote_get')->never(); $result = $this->importer()->fromUrl('ftp://example.com/logo.png', null, []); self::assertSame('lit_validation_failed', $result->get_error_code()); } public function testUrlImportDownloadsSafelyWithTheSizeLimit(): void { $this->responseReaders(); Functions\expect('wp_safe_remote_get')->once()->with( 'https://example.com/bilder/logo.png', Mockery::on(static function (array $args): bool { file_put_contents($args['filename'], 'PNGDATA'); return $args['stream'] === true && $args['limit_response_size'] === 1024 * 1024 + 1; }) )->andReturn(['response' => ['code' => 200], 'headers' => []]); Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\expect('media_handle_sideload')->once() ->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'logo.png'), 0, null) ->andReturn(56); self::assertSame(56, $this->importer()->fromUrl('https://example.com/bilder/logo.png', null, [])); $this->assertTempFilesRemoved(); } public function testAMissingExtensionIsTakenFromTheContentType(): void { $this->respond('PNGDATA', 200, ['content-type' => 'image/png; charset=binary']); Functions\when('wp_check_filetype_and_ext')->justReturn(['ext' => 'png', 'type' => 'image/png', 'proper_filename' => false]); Functions\expect('media_handle_sideload')->once() ->with(Mockery::on(static fn (array $file): bool => $file['name'] === 'foto.png'), 0, null) ->andReturn(57); self::assertSame(57, $this->importer()->fromUrl('https://cdn.example.com/foto?w=800', null, [])); } public function testFailedDownloadIsReportedAndCleansUp(): void { Functions\when('wp_http_validate_url')->returnArg(); Functions\when('wp_safe_remote_get')->justReturn(new WP_Error('http_request_failed', 'Not Found')); $result = $this->importer()->fromUrl('https://example.com/fehlt.jpg', null, []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertStringContainsString('Not Found', $result->get_error_message()); $this->assertTempFilesRemoved(); } public function testHttpErrorStatusIsReported(): void { $this->respond('404', 404); Functions\expect('media_handle_sideload')->never(); $result = $this->importer()->fromUrl('https://example.com/fehlt.jpg', null, []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertStringContainsString('404', $result->get_error_message()); $this->assertTempFilesRemoved(); } public function testOversizedContentLengthIsRejected(): void { $this->respond('x', 200, ['content-length' => (string) (5 * 1024 * 1024)]); Functions\expect('media_handle_sideload')->never(); $result = $this->importer()->fromUrl('https://example.com/gross.jpg', null, []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertStringContainsString('Limit 1 MB', $result->get_error_message()); $this->assertTempFilesRemoved(); } public function testDownloadCutOffAtTheLimitIsRejected(): void { $this->respond(str_repeat('x', 1024 * 1024 + 1)); Functions\expect('media_handle_sideload')->never(); $result = $this->importer()->fromUrl('https://example.com/gross.jpg', null, []); self::assertSame('lit_validation_failed', $result->get_error_code()); self::assertStringContainsString('Limit 1 MB', $result->get_error_message()); $this->assertTempFilesRemoved(); } }