From fdcaa31ffe92344728b263cef2ed7982fc96951c Mon Sep 17 00:00:00 2001 From: Too Date: Tue, 26 Jun 2018 21:39:24 +0800 Subject: [PATCH 1/3] Add upload file maxsize checking in booking controller --- app/Http/Controllers/BookingController.php | 30 +++++++++++- database/seeds/DatabaseSeeder.php | 1 + tests/Feature/BookingTest.php | 55 +++++++++++++--------- 3 files changed, 63 insertions(+), 23 deletions(-) diff --git a/app/Http/Controllers/BookingController.php b/app/Http/Controllers/BookingController.php index 5f6ae880..e1095315 100644 --- a/app/Http/Controllers/BookingController.php +++ b/app/Http/Controllers/BookingController.php @@ -284,7 +284,7 @@ class BookingController extends Controller return response()->json(['book_id'=>$book_id],200); } - + //upload public function uploadbankslip(Request $request, $id) { $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first(); @@ -304,6 +304,14 @@ class BookingController extends Controller return response()->json(['message'=>'Incorrect format'],200); } + $validator = Validator::make($request->all(), [ + 'file' => 'max:3072' + ]); + + if($validator->fails()) + { + return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400); + } if(!$bankslip_file = $request->file('file')) { @@ -361,6 +369,15 @@ class BookingController extends Controller return response()->json(['message'=>'Incorrect format'],200); } + $validator = Validator::make($request->all(), [ + 'file' => 'max:3072' + ]); + + if($validator->fails()) + { + return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400); + } + if(!$user_input_file = $request->file('file')) { return response()->json(['message' => 'No file detected'], 400); @@ -523,7 +540,7 @@ class BookingController extends Controller return response()->json(['message'=>'Success'],200); } - + //upload public function uploadInvoice(Request $request, $id) { $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first(); @@ -543,6 +560,15 @@ class BookingController extends Controller return response()->json(['message'=>'Incorrect format'],200); } + $validator = Validator::make($request->all(), [ + 'invoice_path' => 'max:3072' + ]); + + if($validator->fails()) + { + return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400); + } + if(!$input_file = $request->file('invoice_path')) { return response()->json(['message'=>'No file detected'], 400); diff --git a/database/seeds/DatabaseSeeder.php b/database/seeds/DatabaseSeeder.php index bcf98f78..d40a4e4b 100644 --- a/database/seeds/DatabaseSeeder.php +++ b/database/seeds/DatabaseSeeder.php @@ -1,6 +1,7 @@ image('comp.jpg'); - - if(!file_exists($bankslip_path)){ - $response->assertStatus(400); - } + $size_in_kb = 3072; // 3072KB = 3MB + $bankslip_path = UploadedFile::fake()->image('comp.jpg')->size($size_in_kb); + $response = $this->actingAs($this->user) ->json('POST', '/api/booking/' . $this->booking->id . '/upload-user-bankslip', [ 'file' => $bankslip_path - ]) - ->assertSuccessful(); + ]); + + if(!file_exists($bankslip_path) || $size_in_kb > 3072){ + $response->assertStatus(400); + } + else{ + $response->assertSuccessful(); + } } public function testUpdateBankslipAmount() @@ -108,18 +113,22 @@ class BookingTest extends TestCase public function testuploadPO() { Storage::fake('file'); - $image_path = UploadedFile::fake()->image('comp.jpg'); - - if(!file_exists($image_path)){ - $response->assertStatus(400); - } + $size_in_kb = 3072; // 3072KB = 3MB + $image_path = UploadedFile::fake()->image('comp.jpg')->size($size_in_kb); + $response = $this->actingAs($this->user) ->json('POST', '/api/booking/' . $this->booking->id . '/upload-po', [ 'file' => $image_path, 'amount' => '12345' - ]) - ->assertSuccessful(); + ]); + + if(!file_exists($image_path) || $size_in_kb > 3072){ + $response->assertStatus(400); + } + else{ + $response->assertSuccessful(); + } } public function testCancel() @@ -152,18 +161,22 @@ class BookingTest extends TestCase $this->user->roles()->sync([]); $this->user->attachRole(Role::Where('name','admin')->first()); + $size_in_kb = 3072; Storage::fake('invoice_path'); - $invoice_path = UploadedFile::fake()->create('document.pdf'); - - if(!file_exists($invoice_path)){ - $response->assertStatus(400); - } + $invoice_path = UploadedFile::fake()->create('document.pdf',$size_in_kb); + $response = $this->actingAs($this->user) ->json('POST', '/api/booking/' . $this->booking->id . '/upload-invoice', [ 'invoice_path' => $invoice_path, 'amount' => '12345' - ]) - ->assertSuccessful(); + ]); + + if(!file_exists($invoice_path) || $size_in_kb > 3072){ + $response->assertStatus(400); + } + else{ + $response->assertSuccessful(); + } } } From 436b284a3b15f2525204712b5b4f66d40d79d0bc Mon Sep 17 00:00:00 2001 From: Too Date: Tue, 26 Jun 2018 22:23:10 +0800 Subject: [PATCH 2/3] Add file size checking. Rename bankslip_url to china_bank_slip_path in chinabankslip table --- app/ChinaBankSlip.php | 2 +- .../Controllers/ChinaBankSlipController.php | 17 +++++++- ...abanksli_path_in_china_bank_slip_table.php | 31 +++++++++++++++ tests/Feature/BookingTest.php | 1 - tests/Feature/ChinaBankSlipTest.php | 39 +++++++++++++++++++ 5 files changed, 86 insertions(+), 4 deletions(-) create mode 100644 database/migrations/2018_06_26_141337_rename_bankslip_url_to_chinabanksli_path_in_china_bank_slip_table.php create mode 100644 tests/Feature/ChinaBankSlipTest.php diff --git a/app/ChinaBankSlip.php b/app/ChinaBankSlip.php index c607ec34..d7354956 100644 --- a/app/ChinaBankSlip.php +++ b/app/ChinaBankSlip.php @@ -6,5 +6,5 @@ use Illuminate\Database\Eloquent\Model; class ChinaBankSlip extends Model { - protected $fillable = ['actual_transfer_amount','date','details','china_bank_slips']; + protected $fillable = ['actual_transfer_amount','date','details','china_bank_slip_path']; } diff --git a/app/Http/Controllers/ChinaBankSlipController.php b/app/Http/Controllers/ChinaBankSlipController.php index 9a2048d6..fd781cbd 100644 --- a/app/Http/Controllers/ChinaBankSlipController.php +++ b/app/Http/Controllers/ChinaBankSlipController.php @@ -4,6 +4,8 @@ namespace App\Http\Controllers; use App\ChinaBankSlip; use Illuminate\Http\Request; +use Illuminate\Support\Facades\Storage; +use Validator; class ChinaBankSlipController extends Controller { @@ -45,6 +47,16 @@ class ChinaBankSlipController extends Controller $extension = $request->file('china_bank_slips')->getClientOriginalExtension(); // Filename to store $fileNameToStore= $filename.'_'.time().'.'.$extension; + + // File size checking + $validator = Validator::make($request->all(), [ + 'china_bank_slips' => 'max:3072' + ]); + + if($validator->fails()) + { + return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400); + } // Upload Image $path = $request->file('china_bank_slips')->storeAs('public/bankslip', $fileNameToStore); } else { @@ -55,8 +67,9 @@ class ChinaBankSlipController extends Controller $post->actual_transfer_amount = $request->input('actual_transfer_amount'); $post->date = $request->input('date'); $post->details = $request->input('details'); - $post->china_bank_slips = $fileNameToStore; - $post->save();; + $post->china_bank_slip_path = "123"; + $post->save(); + return response()->json(['message'=>$post], 200); } diff --git a/database/migrations/2018_06_26_141337_rename_bankslip_url_to_chinabanksli_path_in_china_bank_slip_table.php b/database/migrations/2018_06_26_141337_rename_bankslip_url_to_chinabanksli_path_in_china_bank_slip_table.php new file mode 100644 index 00000000..9c23bfc8 --- /dev/null +++ b/database/migrations/2018_06_26_141337_rename_bankslip_url_to_chinabanksli_path_in_china_bank_slip_table.php @@ -0,0 +1,31 @@ +renameColumn('bankslip_url', 'china_bank_slip_path'); + }); + } + + /** + * Reverse the migrations. + * + * @return void + */ + public function down() + { + // + } +} diff --git a/tests/Feature/BookingTest.php b/tests/Feature/BookingTest.php index 7e1ef5fd..616b6b25 100644 --- a/tests/Feature/BookingTest.php +++ b/tests/Feature/BookingTest.php @@ -17,7 +17,6 @@ use App\Booking; use App\UserBankSlip; use App\Role; use App\SettingCredit; -use Illuminate\Support\Facades\File; class BookingTest extends TestCase { diff --git a/tests/Feature/ChinaBankSlipTest.php b/tests/Feature/ChinaBankSlipTest.php new file mode 100644 index 00000000..9d499b33 --- /dev/null +++ b/tests/Feature/ChinaBankSlipTest.php @@ -0,0 +1,39 @@ +image('comp.jpg')->size($size_in_kb); + + $response = + $this->postJson('api/upload-china-bankslip',[ + 'china_bank_slips' => $china_bank_slips_path, + 'actual_transfer_amount' => '12', + 'details' => "123123", + 'date' => "123123" + ]); + + if(!file_exists($china_bank_slips_path) || $size_in_kb > 3072){ + $response->assertStatus(400); + } + else{ + $response->assertSuccessful(); + } + } +} From 819da146848363512f1e2d5835cbb2b8d8f74817 Mon Sep 17 00:00:00 2001 From: Too Date: Tue, 26 Jun 2018 22:24:47 +0800 Subject: [PATCH 3/3] revert back changes during debug --- app/Http/Controllers/ChinaBankSlipController.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/Http/Controllers/ChinaBankSlipController.php b/app/Http/Controllers/ChinaBankSlipController.php index fd781cbd..7e860d62 100644 --- a/app/Http/Controllers/ChinaBankSlipController.php +++ b/app/Http/Controllers/ChinaBankSlipController.php @@ -67,7 +67,7 @@ class ChinaBankSlipController extends Controller $post->actual_transfer_amount = $request->input('actual_transfer_amount'); $post->date = $request->input('date'); $post->details = $request->input('details'); - $post->china_bank_slip_path = "123"; + $post->china_bank_slip_path = $fileNameToStore; $post->save(); return response()->json(['message'=>$post], 200); }