From fdcaa31ffe92344728b263cef2ed7982fc96951c Mon Sep 17 00:00:00 2001
From: Too <sengweitoo@gmail.com>
Date: Tue, 26 Jun 2018 21:39:24 +0800
Subject: [PATCH] Add upload file maxsize checking in booking controller

---
 app/Http/Controllers/BookingController.php | 30 +++++++++++-
 database/seeds/DatabaseSeeder.php          |  1 +
 tests/Feature/BookingTest.php              | 55 +++++++++++++---------
 3 files changed, 63 insertions(+), 23 deletions(-)

diff --git a/app/Http/Controllers/BookingController.php b/app/Http/Controllers/BookingController.php
index 5f6ae880..e1095315 100644
--- a/app/Http/Controllers/BookingController.php
+++ b/app/Http/Controllers/BookingController.php
@@ -284,7 +284,7 @@ class BookingController extends Controller
  
         return response()->json(['book_id'=>$book_id],200);
     }
-
+    //upload
     public function uploadbankslip(Request $request, $id)
     {
         $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
@@ -304,6 +304,14 @@ class BookingController extends Controller
             return response()->json(['message'=>'Incorrect format'],200);
         }
 
+        $validator = Validator::make($request->all(), [
+            'file'   => 'max:3072'
+        ]);
+
+        if($validator->fails())
+        {
+            return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400);
+        }
 
         if(!$bankslip_file = $request->file('file'))
         {
@@ -361,6 +369,15 @@ class BookingController extends Controller
                 return response()->json(['message'=>'Incorrect format'],200);
             }
 
+            $validator = Validator::make($request->all(), [
+                'file'   => 'max:3072'
+            ]);
+
+            if($validator->fails())
+            {
+                return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400);
+            }
+
             if(!$user_input_file = $request->file('file'))
             {
                 return response()->json(['message' => 'No file detected'], 400);
@@ -523,7 +540,7 @@ class BookingController extends Controller
 
         return response()->json(['message'=>'Success'],200);
     }
-
+    //upload
     public function uploadInvoice(Request $request, $id)
     {
         $booking = Booking::where('user_id',Auth::user()->id)->where('id',$id)->first();
@@ -543,6 +560,15 @@ class BookingController extends Controller
                 return response()->json(['message'=>'Incorrect format'],200);
             }
 
+            $validator = Validator::make($request->all(), [
+                'invoice_path'   => 'max:3072'
+            ]);
+
+            if($validator->fails())
+            {
+                return response()->json(['message'=>'Image too large, upload files up to 3 MB'], 400);
+            }
+
             if(!$input_file = $request->file('invoice_path'))
             {
                 return response()->json(['message'=>'No file detected'], 400);
diff --git a/database/seeds/DatabaseSeeder.php b/database/seeds/DatabaseSeeder.php
index bcf98f78..d40a4e4b 100644
--- a/database/seeds/DatabaseSeeder.php
+++ b/database/seeds/DatabaseSeeder.php
@@ -1,6 +1,7 @@
 <?php
 
 use Illuminate\Database\Seeder;
+use Illuminate\Support\Facades\DB;
 
 class DatabaseSeeder extends Seeder
 {
diff --git a/tests/Feature/BookingTest.php b/tests/Feature/BookingTest.php
index c44ed4b5..7e1ef5fd 100644
--- a/tests/Feature/BookingTest.php
+++ b/tests/Feature/BookingTest.php
@@ -17,6 +17,7 @@ use App\Booking;
 use App\UserBankSlip;
 use App\Role; 
 use App\SettingCredit;
+use Illuminate\Support\Facades\File;
 
 class BookingTest extends TestCase
 {
@@ -83,17 +84,21 @@ class BookingTest extends TestCase
     public function testuploadbankslip()
     {
         Storage::fake('file');
-        $bankslip_path = UploadedFile::fake()->image('comp.jpg');
-
-        if(!file_exists($bankslip_path)){
-            $response->assertStatus(400);
-        }
+        $size_in_kb = 3072;    // 3072KB = 3MB
+        $bankslip_path = UploadedFile::fake()->image('comp.jpg')->size($size_in_kb);
 
+        $response = 
         $this->actingAs($this->user)
             ->json('POST', '/api/booking/' . $this->booking->id . '/upload-user-bankslip', [
                 'file' => $bankslip_path
-            ])
-            ->assertSuccessful();
+            ]);
+
+        if(!file_exists($bankslip_path) || $size_in_kb > 3072){
+            $response->assertStatus(400);    
+        }
+        else{
+            $response->assertSuccessful();
+        }
     }
 
     public function testUpdateBankslipAmount()
@@ -108,18 +113,22 @@ class BookingTest extends TestCase
     public function testuploadPO()
     {
         Storage::fake('file');
-        $image_path = UploadedFile::fake()->image('comp.jpg');
-
-        if(!file_exists($image_path)){
-            $response->assertStatus(400);    
-        }
+        $size_in_kb = 3072;    // 3072KB = 3MB
+        $image_path = UploadedFile::fake()->image('comp.jpg')->size($size_in_kb);
         
+        $response = 
         $this->actingAs($this->user)
             ->json('POST', '/api/booking/' . $this->booking->id . '/upload-po', [
                 'file' =>  $image_path,
                 'amount' => '12345'
-            ])
-            ->assertSuccessful();
+            ]);
+
+        if(!file_exists($image_path) || $size_in_kb > 3072){
+            $response->assertStatus(400);    
+        }
+        else{
+            $response->assertSuccessful();
+        }
     }
 
     public function testCancel()
@@ -152,18 +161,22 @@ class BookingTest extends TestCase
         $this->user->roles()->sync([]);
         $this->user->attachRole(Role::Where('name','admin')->first());
 
+        $size_in_kb = 3072;
         Storage::fake('invoice_path');
-        $invoice_path = UploadedFile::fake()->create('document.pdf');
-
-        if(!file_exists($invoice_path)){
-            $response->assertStatus(400);    
-        }
+        $invoice_path = UploadedFile::fake()->create('document.pdf',$size_in_kb);
         
+        $response = 
         $this->actingAs($this->user)
             ->json('POST', '/api/booking/' . $this->booking->id . '/upload-invoice', [
                 'invoice_path' => $invoice_path,
                 'amount' => '12345'
-            ])
-            ->assertSuccessful();
+            ]);
+        
+        if(!file_exists($invoice_path) || $size_in_kb > 3072){
+            $response->assertStatus(400);    
+        }
+        else{
+            $response->assertSuccessful();
+        }
     }
 }