Skip to content

Commit 5b53109

Browse files
StasKozarStasKozar
committed
Merge remote-tracking branch 'origin/MAGETWO-85143' into 2.3-develop-pr3
2 parents 5263f47 + 6caa592 commit 5b53109

File tree

2 files changed

+135
-30
lines changed

2 files changed

+135
-30
lines changed

‎app/code/Magento/Downloadable/Controller/Download.php

Lines changed: 21 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
namespace Magento\Downloadable\Controller;
77

88
use Magento\Downloadable\Helper\Download as DownloadHelper;
9+
use Magento\Framework\App\Response\Http as HttpResponse;
910

1011
/**
1112
* Download controller
@@ -14,6 +15,13 @@
1415
*/
1516
abstract class Download extends \Magento\Framework\App\Action\Action
1617
{
18+
/**
19+
* @var array
20+
*/
21+
private $disallowedContentTypes = [
22+
'text/html',
23+
];
24+
1725
/**
1826
* Prepare response to output resource contents
1927
*
@@ -28,9 +36,12 @@ protected function _processDownload($path, $resourceType)
2836

2937
$helper->setResource($path, $resourceType);
3038
$fileName = $helper->getFilename();
39+
3140
$contentType = $helper->getContentType();
3241

33-
$this->getResponse()->setHttpResponseCode(
42+
/** @var HttpResponse $response */
43+
$response = $this->getResponse();
44+
$response->setHttpResponseCode(
3445
200
3546
)->setHeader(
3647
'Pragma',
@@ -47,15 +58,19 @@ protected function _processDownload($path, $resourceType)
4758
);
4859

4960
if ($fileSize = $helper->getFileSize()) {
50-
$this->getResponse()->setHeader('Content-Length', $fileSize);
61+
$response->setHeader('Content-Length', $fileSize);
5162
}
5263

53-
if ($contentDisposition = $helper->getContentDisposition()) {
54-
$this->getResponse()->setHeader('Content-Disposition', $contentDisposition . '; filename=' . $fileName);
64+
$contentDisposition = $helper->getContentDisposition();
65+
if (!$contentDisposition || in_array($contentType, $this->disallowedContentTypes)) {
66+
// For security reasons we force browsers to download the file instead of opening it.
67+
$contentDisposition = \Zend_Mime::DISPOSITION_ATTACHMENT;
5568
}
5669

57-
$this->getResponse()->clearBody();
58-
$this->getResponse()->sendHeaders();
70+
$response->setHeader('Content-Disposition', $contentDisposition . '; filename=' . $fileName);
71+
//Rendering
72+
$response->clearBody();
73+
$response->sendHeaders();
5974

6075
$helper->output();
6176
}

‎app/code/Magento/Downloadable/Test/Unit/Controller/Download/LinkTest.php

Lines changed: 114 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -273,7 +273,13 @@ public function testGetLinkForWrongCustomer()
273273
$this->assertEquals($this->response, $this->link->execute());
274274
}
275275

276-
public function testExceptionInUpdateLinkStatus()
276+
/**
277+
* @param string $mimeType
278+
* @param string $disposition
279+
* @dataProvider downloadTypesDataProvider
280+
* @return void
281+
*/
282+
public function testExceptionInUpdateLinkStatus($mimeType, $disposition)
277283
{
278284
$this->objectManager->expects($this->at(0))
279285
->method('get')
@@ -303,7 +309,7 @@ public function testExceptionInUpdateLinkStatus()
303309
$this->linkPurchasedItem->expects($this->once())->method('getLinkType')->willReturn('url');
304310
$this->linkPurchasedItem->expects($this->once())->method('getLinkUrl')->willReturn('link_url');
305311

306-
$this->processDownload('link_url', 'url');
312+
$this->processDownload('link_url', 'url', $mimeType, $disposition);
307313

308314
$this->linkPurchasedItem->expects($this->any())->method('setNumberOfDownloadsUsed')->willReturnSelf();
309315
$this->linkPurchasedItem->expects($this->any())->method('setStatus')->with('expired')->willReturnSelf();
@@ -317,8 +323,18 @@ public function testExceptionInUpdateLinkStatus()
317323
$this->assertEquals($this->response, $this->link->execute());
318324
}
319325

320-
private function processDownload($resource, $resourceType)
326+
/**
327+
* @param string $resource
328+
* @param string $resourceType
329+
* @param string $mimeType
330+
* @param string $disposition
331+
* @return void
332+
*/
333+
private function processDownload($resource, $resourceType, $mimeType, $disposition)
321334
{
335+
$fileSize = 58493;
336+
$fileName = 'link.jpg';
337+
322338
$this->objectManager->expects($this->at(3))
323339
->method('get')
324340
->with(\Magento\Downloadable\Helper\Download::class)
@@ -327,30 +343,23 @@ private function processDownload($resource, $resourceType)
327343
->method('setResource')
328344
->with($resource, $resourceType)
329345
->willReturnSelf();
330-
$this->downloadHelper->expects($this->once())->method('getFilename')->willReturn('file_name');
331-
$this->downloadHelper->expects($this->once())->method('getContentType')->willReturn('content_type');
346+
$this->downloadHelper->expects($this->once())->method('getFilename')->willReturn($fileName);
347+
$this->downloadHelper->expects($this->once())->method('getContentType')->willReturn($mimeType);
332348
$this->response->expects($this->once())->method('setHttpResponseCode')->with(200)->willReturnSelf();
333-
$this->response->expects($this->at(1))->method('setHeader')->with('Pragma', 'public', true)->willReturnSelf();
334-
$this->response->expects($this->at(2))
335-
->method('setHeader')
336-
->with('Cache-Control', 'must-revalidate, post-check=0, pre-check=0', true)
337-
->willReturnSelf();
338-
$this->response->expects($this->at(3))
349+
$this->response
350+
->expects($this->any())
339351
->method('setHeader')
340-
->with('Content-type', 'content_type', true)
341-
->willReturnSelf();
342-
$this->downloadHelper->expects($this->once())->method('getFileSize')->willReturn('file_size');
343-
$this->response->expects($this->at(4))
344-
->method('setHeader')
345-
->with('Content-Length', 'file_size')
346-
->willReturnSelf();
347-
$this->downloadHelper->expects($this->once())
348-
->method('getContentDisposition')
349-
->willReturn('content_disposition');
350-
$this->response->expects($this->at(5))
351-
->method('setHeader')
352-
->with('Content-Disposition', 'content_disposition; filename=file_name')
352+
->withConsecutive(
353+
['Pragma', 'public', true],
354+
['Cache-Control', 'must-revalidate, post-check=0, pre-check=0', true],
355+
['Content-type', $mimeType, true],
356+
['Content-Length', $fileSize],
357+
['Content-Disposition', $disposition . '; filename=' . $fileName]
358+
)
353359
->willReturnSelf();
360+
361+
$this->downloadHelper->expects($this->once())->method('getContentDisposition')->willReturn($disposition);
362+
$this->downloadHelper->expects($this->once())->method('getFileSize')->willReturn($fileSize);
354363
$this->response->expects($this->once())->method('clearBody')->willReturnSelf();
355364
$this->response->expects($this->once())->method('sendHeaders')->willReturnSelf();
356365
$this->downloadHelper->expects($this->once())->method('output');
@@ -394,6 +403,76 @@ public function testLinkNotAvailable($messageType, $status, $notice)
394403
$this->assertEquals($this->response, $this->link->execute());
395404
}
396405

406+
/**
407+
* @param string $mimeType
408+
* @param string $disposition
409+
* @dataProvider downloadTypesDataProvider
410+
* @return void
411+
*/
412+
public function testContentDisposition($mimeType, $disposition)
413+
{
414+
$this->objectManager->expects($this->any())
415+
->method('get')
416+
->willReturnMap([
417+
[
418+
\Magento\Customer\Model\Session::class,
419+
$this->session,
420+
],
421+
[
422+
\Magento\Downloadable\Helper\Data::class,
423+
$this->helperData,
424+
],
425+
[
426+
\Magento\Downloadable\Helper\Download::class,
427+
$this->downloadHelper,
428+
],
429+
]);
430+
431+
$this->request->expects($this->once())->method('getParam')->with('id', 0)->willReturn('some_id');
432+
$this->objectManager->expects($this->at(1))
433+
->method('create')
434+
->with(\Magento\Downloadable\Model\Link\Purchased\Item::class)
435+
->willReturn($this->linkPurchasedItem);
436+
$this->linkPurchasedItem->expects($this->once())
437+
->method('load')
438+
->with('some_id', 'link_hash')
439+
->willReturnSelf();
440+
$this->linkPurchasedItem->expects($this->once())->method('getId')->willReturn(5);
441+
$this->helperData->expects($this->once())
442+
->method('getIsShareable')
443+
->with($this->linkPurchasedItem)
444+
->willReturn(true);
445+
$this->linkPurchasedItem->expects($this->any())->method('getNumberOfDownloadsBought')->willReturn(10);
446+
$this->linkPurchasedItem->expects($this->any())->method('getNumberOfDownloadsUsed')->willReturn(9);
447+
$this->linkPurchasedItem->expects($this->once())->method('getStatus')->willReturn('available');
448+
$this->linkPurchasedItem->expects($this->once())->method('getLinkType')->willReturn('url');
449+
$this->linkPurchasedItem->expects($this->once())->method('getLinkUrl')->willReturn('link_url');
450+
451+
$fileSize = 58493;
452+
$fileName = 'link.jpg';
453+
454+
$this->downloadHelper->expects($this->once())
455+
->method('setResource')
456+
->with('link_url', 'url')
457+
->willReturnSelf();
458+
$this->downloadHelper->expects($this->once())->method('getFilename')->willReturn($fileName);
459+
$this->downloadHelper->expects($this->once())->method('getContentType')->willReturn($mimeType);
460+
$this->response->expects($this->once())->method('setHttpResponseCode')->with(200)->willReturnSelf();
461+
$this->response
462+
->expects($this->any())
463+
->method('setHeader')
464+
->withConsecutive(
465+
['Pragma', 'public', true],
466+
['Cache-Control', 'must-revalidate, post-check=0, pre-check=0', true],
467+
['Content-type', $mimeType, true],
468+
['Content-Length', $fileSize],
469+
['Content-Disposition', $disposition . '; filename=' . $fileName]
470+
)
471+
->willReturnSelf();
472+
473+
$this->assertEquals($this->response, $this->link->execute());
474+
}
475+
397476
/**
398477
* @return array
399478
*/
@@ -406,4 +485,15 @@ public function linkNotAvailableDataProvider()
406485
['addError', 'wrong_status', 'Something went wrong while getting the requested content.']
407486
];
408487
}
488+
489+
/**
490+
* @return array
491+
*/
492+
public function downloadTypesDataProvider()
493+
{
494+
return [
495+
['mimeType' => 'text/html', 'disposition' => \Zend_Mime::DISPOSITION_ATTACHMENT],
496+
['mimeType' => 'image/jpeg', 'disposition' => \Zend_Mime::DISPOSITION_INLINE],
497+
];
498+
}
409499
}

0 commit comments

Comments
 (0)