Skip to content

Commit 250532a

Browse files
OlgaVasyltsunOlgaVasyltsun
committed
MAGETWO-86718: x-frame-options missing from a few templates
1 parent 70c5c51 commit 250532a

File tree

6 files changed

+203
-13
lines changed

6 files changed

+203
-13
lines changed

‎app/code/Magento/MediaStorage/Model/File/Storage/Response.php

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,11 @@ public function __construct(
5656
public function sendResponse()
5757
{
5858
if ($this->_filePath && $this->getHttpResponseCode() == 200) {
59-
$this->_transferAdapter->send($this->_filePath);
59+
$options = [
60+
'filepath' => $this->_filePath,
61+
'headers' => $this->getHeaders(),
62+
];
63+
$this->_transferAdapter->send($options);
6064
} else {
6165
parent::sendResponse();
6266
}

‎app/code/Magento/MediaStorage/Test/Unit/Model/File/Storage/ResponseTest.php

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\MediaStorage\Test\Unit\Model\File\Storage;
9+
10+
use Magento\Framework\TestFramework\Unit\Helper\ObjectManager;
11+
12+
/** Unit tests for \Magento\MediaStorage\Model\File\Storage\Response class */
13+
class ResponseTest extends \PHPUnit\Framework\TestCase
14+
{
15+
/**
16+
* @var \Magento\MediaStorage\Model\File\Storage\Response
17+
*/
18+
private $response;
19+
20+
/**
21+
* @var \Magento\Framework\File\Transfer\Adapter\Http|\PHPUnit_Framework_MockObject_MockObject
22+
*/
23+
private $transferAdapter;
24+
25+
/**
26+
* @inheritdoc
27+
*/
28+
protected function setUp()
29+
{
30+
$objectManager = new ObjectManager($this);
31+
$this->transferAdapter = $this->getMockBuilder(\Magento\Framework\File\Transfer\Adapter\Http::class)
32+
->disableOriginalConstructor()
33+
->setMethods(['send'])
34+
->getMock();
35+
$this->response = $objectManager->getObject(
36+
\Magento\MediaStorage\Model\File\Storage\Response::class,
37+
[
38+
'transferAdapter' => $this->transferAdapter,
39+
'statusCode' => 200,
40+
]
41+
);
42+
}
43+
44+
/**
45+
* @return void
46+
*/
47+
public function testSendResponse(): void
48+
{
49+
$filePath = 'file_path';
50+
$headers = $this->getMockBuilder(\Zend\Http\Headers::class)->getMock();
51+
$this->response->setFilePath($filePath);
52+
$this->response->setHeaders($headers);
53+
$this->transferAdapter
54+
->expects($this->atLeastOnce())
55+
->method('send')
56+
->with(
57+
[
58+
'filepath' => $filePath,
59+
'headers' => $headers,
60+
]
61+
);
62+
63+
$this->response->sendResponse();
64+
}
65+
66+
/**
67+
* @return void
68+
*/
69+
public function testSendResponseWithoutFilePath(): void
70+
{
71+
$this->transferAdapter->expects($this->never())->method('send');
72+
$this->response->sendResponse();
73+
}
74+
}

‎dev/tests/integration/testsuite/Magento/MediaStorage/Model/File/Storage/ResponseTest.php

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
<?php
2+
/**
3+
* Copyright © Magento, Inc. All rights reserved.
4+
* See COPYING.txt for license details.
5+
*/
6+
declare(strict_types=1);
7+
8+
namespace Magento\MediaStorage\Model\File\Storage;
9+
10+
/**
11+
* Tests for \Magento\MediaStorage\Model\File\Storage\Response class
12+
*/
13+
class ResponseTest extends \PHPUnit\Framework\TestCase
14+
{
15+
/**
16+
* test for \Magento\MediaStorage\Model\File\Storage\Response::sendResponse()
17+
*
18+
* @return void
19+
*/
20+
public function testSendResponse(): void
21+
{
22+
$expectedHeaders = [
23+
[
24+
'field_name' => 'X-Content-Type-Options',
25+
'field_value' => 'nosniff',
26+
],
27+
[
28+
'field_name' => 'X-XSS-Protection',
29+
'field_value' => '1; mode=block',
30+
],
31+
[
32+
'field_name' => 'X-Frame-Options',
33+
'field_value' => 'SAMEORIGIN',
34+
],
35+
];
36+
$filePath = realpath(__DIR__ . '/../../../_files/test_file.html');
37+
/** @var \Magento\MediaStorage\Model\File\Storage\Response $response */
38+
$mediaStorageResponse = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->create(
39+
\Magento\MediaStorage\Model\File\Storage\Response::class
40+
);
41+
$mediaStorageResponse->setFilePath($filePath);
42+
ob_start();
43+
$mediaStorageResponse->sendResponse();
44+
ob_end_clean();
45+
/** @var \Magento\Framework\App\Response\Http $frameworkResponse */
46+
$frameworkResponse = \Magento\TestFramework\Helper\Bootstrap::getObjectManager()->get(
47+
\Magento\Framework\HTTP\PhpEnvironment\Response::class
48+
);
49+
$actualHeaders = [];
50+
foreach ($frameworkResponse->getHeaders() as $responseHeader) {
51+
$actualHeaders[] = [
52+
'field_name' => $responseHeader->getFieldName(),
53+
'field_value' => $responseHeader->getFieldValue(),
54+
];
55+
}
56+
foreach ($expectedHeaders as $expected) {
57+
$this->assertTrue(in_array($expected, $actualHeaders));
58+
}
59+
}
60+
}

‎dev/tests/integration/testsuite/Magento/MediaStorage/_files/test_file.html

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
test data

‎lib/internal/Magento/Framework/File/Test/Unit/Transfer/Adapter/HttpTest.php

Lines changed: 37 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,17 +24,23 @@ class HttpTest extends \PHPUnit\Framework\TestCase
2424
*/
2525
private $mime;
2626

27+
/**
28+
* @inheritdoc
29+
*/
2730
protected function setUp()
2831
{
2932
$this->response = $this->createPartialMock(
3033
\Magento\Framework\HTTP\PhpEnvironment\Response::class,
31-
['setHeader', 'sendHeaders']
34+
['setHeader', 'sendHeaders', 'setHeaders']
3235
);
3336
$this->mime = $this->createMock(\Magento\Framework\File\Mime::class);
3437
$this->object = new Http($this->response, $this->mime);
3538
}
3639

37-
public function testSend()
40+
/**
41+
* @return void
42+
*/
43+
public function testSend(): void
3844
{
3945
$file = __DIR__ . '/../../_files/javascript.js';
4046
$contentType = 'content/type';
@@ -56,20 +62,47 @@ public function testSend()
5662
$this->object->send($file);
5763
}
5864

65+
/**
66+
* @return void
67+
*/
68+
public function testSendWithOptions(): void
69+
{
70+
$file = __DIR__ . '/../../_files/javascript.js';
71+
$contentType = 'content/type';
72+
73+
$headers = $this->getMockBuilder(\Zend\Http\Headers::class)->getMock();
74+
$this->response->expects($this->atLeastOnce())
75+
->method('setHeader')
76+
->withConsecutive(['Content-length', filesize($file)], ['Content-Type', $contentType]);
77+
$this->response->expects($this->atLeastOnce())
78+
->method('setHeaders')
79+
->with($headers);
80+
$this->response->expects($this->once())
81+
->method('sendHeaders');
82+
$this->mime->expects($this->once())
83+
->method('getMimeType')
84+
->with($file)
85+
->will($this->returnValue($contentType));
86+
$this->expectOutputString(file_get_contents($file));
87+
88+
$this->object->send(['filepath' => $file, 'headers' => $headers]);
89+
}
5990
/**
6091
* @expectedException \InvalidArgumentException
6192
* @expectedExceptionMessage Filename is not set
93+
* @return void
6294
*/
63-
public function testSendNoFileSpecifiedException()
95+
public function testSendNoFileSpecifiedException(): void
6496
{
6597
$this->object->send([]);
6698
}
6799

68100
/**
69101
* @expectedException \InvalidArgumentException
70102
* @expectedExceptionMessage File 'nonexistent.file' does not exists
103+
* @return void
71104
*/
72-
public function testSendNoFileExistException()
105+
public function testSendNoFileExistException(): void
73106
{
74107
$this->object->send('nonexistent.file');
75108
}

‎lib/internal/Magento/Framework/File/Transfer/Adapter/Http.php

Lines changed: 26 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -40,20 +40,16 @@ public function __construct(
4040
*/
4141
public function send($options = null)
4242
{
43-
if (is_string($options)) {
44-
$filepath = $options;
45-
} elseif (is_array($options) && isset($options['filepath'])) {
46-
$filepath = $options['filepath'];
47-
} else {
48-
throw new \InvalidArgumentException("Filename is not set.");
49-
}
43+
$filepath = $this->getFilePath($options);
5044

5145
if (!is_file($filepath) || !is_readable($filepath)) {
5246
throw new \InvalidArgumentException("File '{$filepath}' does not exists.");
5347
}
5448

5549
$mimeType = $this->mime->getMimeType($filepath);
56-
50+
if (is_array($options) && isset($options['headers']) && $options['headers'] instanceof \Zend\Http\Headers) {
51+
$this->response->setHeaders($options['headers']);
52+
}
5753
$this->response->setHeader('Content-length', filesize($filepath));
5854
$this->response->setHeader('Content-Type', $mimeType);
5955

@@ -70,4 +66,26 @@ public function send($options = null)
7066
fclose($handle);
7167
}
7268
}
69+
70+
/**
71+
* Get filepath by provided parameter $optons.
72+
* If the $options is a string it assumes it's a file path. If the option is an array method will look for the
73+
* 'filepath' key and return it's value.
74+
*
75+
* @param string|array|null $options
76+
* @return string
77+
* @throws \InvalidArgumentException
78+
*/
79+
private function getFilePath($options): string
80+
{
81+
if (is_string($options)) {
82+
$filePath = $options;
83+
} elseif (is_array($options) && isset($options['filepath'])) {
84+
$filePath = $options['filepath'];
85+
} else {
86+
throw new \InvalidArgumentException("Filename is not set.");
87+
}
88+
89+
return $filePath;
90+
}
7391
}

0 commit comments

Comments
 (0)