mirror of
https://github.com/Part-DB/Part-DB-server.git
synced 2026-03-09 16:59:37 +00:00
Add manual backup creation and delete buttons to Update Manager (#1255)
* Add manual backup creation and delete buttons to Update Manager - Add "Create Backup" button in the backups tab for on-demand backups - Add delete buttons (trash icons) for update logs and backups - New controller routes with CSRF protection and permission checks - Use data-turbo-confirm for CSP-safe confirmation dialogs - Add deleteLog() method to UpdateExecutor with filename validation * Add Docker backup support: download button, SQLite restore fix, decouple from auto-update - Decouple backup creation/restore UI from can_auto_update so Docker and other non-git installations can use backup features - Add backup download endpoint for saving backups externally - Fix SQLite restore to use configured DATABASE_URL path instead of hardcoded var/app.db (affects Docker and custom SQLite paths) - Show Docker-specific warning about var/backups/ not being persisted - Pass is_docker flag to template via InstallationTypeDetector * Add tests for backup/update manager improvements - Controller tests: auth, CSRF validation, 404 for missing backups, restore disabled check - UpdateExecutor: deleteLog validation, non-existent file, successful deletion - BackupManager: deleteBackup validation for missing/non-zip files * Fix test failures: add locale prefix to URLs, correct log directory path * Fix auth test: expect 401 instead of redirect for HTTP Basic auth * Improve test coverage for update manager controller Add happy-path tests for backup creation, deletion, download, and log deletion with valid CSRF tokens. Also test the locked state blocking backup creation. * Fix CSRF tests: initialize session before getting tokens * Fix CSRF tests: extract tokens from rendered page HTML * Harden backup security: password confirmation, CSRF, env toggle Address security review feedback from jbtronics: - Add IS_AUTHENTICATED_FULLY to all sensitive endpoints (create/delete backup, delete log, download backup, start update, restore) - Change backup download from GET to POST with CSRF token - Require password confirmation before downloading backups (backups contain sensitive data like password hashes and secrets) - Add DISABLE_BACKUP_DOWNLOAD env var (default: disabled) to control whether backup downloads are allowed - Add password confirmation modal with security warning in template - Add comprehensive tests: auth checks, env var blocking, POST-only enforcement, status/progress endpoint auth * Fix download modal: use per-backup modals for CSP/Turbo compatibility - Replace shared modal + inline JS with per-backup modals that have filename pre-set in hidden fields (no JavaScript needed) - Add data-turbo="false" to download forms for native browser handling - Add data-bs-dismiss="modal" to submit button to auto-close modal - Add hidden username field for Chrome accessibility best practice - Fix test: GET on POST-only route returns 404 not 405 * Fixed translation keys * Fixed text justification in download modal * Hardenened security of deleteLogEndpoint * Show whether backup, restores and updates are allowed or disabled by sysadmin on update manager * Added documentation for update manager related env variables --------- Co-authored-by: Jan Böhmer <mail@jan-boehmer.de>
This commit is contained in:
Sebastian Almberg
GitHub
parent
db8881621c
commit
0d58262e19
11 changed files with 1077 additions and 246 deletions
381
tests/Controller/UpdateManagerControllerTest.php
Normal file
381
tests/Controller/UpdateManagerControllerTest.php
Normal file
|
|
@ -0,0 +1,381 @@
|
|||
<?php
|
||||
/*
|
||||
* This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
|
||||
*
|
||||
* Copyright (C) 2019 - 2024 Jan Böhmer (https://github.com/jbtronics)
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU Affero General Public License as published
|
||||
* by the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU Affero General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU Affero General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
declare(strict_types=1);
|
||||
|
||||
namespace App\Tests\Controller;
|
||||
|
||||
use App\Entity\UserSystem\User;
|
||||
use App\Services\System\BackupManager;
|
||||
use App\Services\System\UpdateExecutor;
|
||||
use PHPUnit\Framework\Attributes\Group;
|
||||
use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
|
||||
|
||||
#[Group("slow")]
|
||||
#[Group("DB")]
|
||||
final class UpdateManagerControllerTest extends WebTestCase
|
||||
{
|
||||
private function loginAsAdmin($client): void
|
||||
{
|
||||
$entityManager = $client->getContainer()->get('doctrine')->getManager();
|
||||
$userRepository = $entityManager->getRepository(User::class);
|
||||
$user = $userRepository->findOneBy(['name' => 'admin']);
|
||||
|
||||
if (!$user) {
|
||||
$this->markTestSkipped('Admin user not found');
|
||||
}
|
||||
|
||||
$client->loginUser($user);
|
||||
}
|
||||
|
||||
/**
|
||||
* Extract a CSRF token from the rendered update manager page.
|
||||
*/
|
||||
private function getCsrfTokenFromPage($crawler, string $formAction): string
|
||||
{
|
||||
$form = $crawler->filter('form[action*="' . $formAction . '"]');
|
||||
if ($form->count() === 0) {
|
||||
$this->fail('Form with action containing "' . $formAction . '" not found on page');
|
||||
}
|
||||
|
||||
return $form->filter('input[name="_token"]')->attr('value');
|
||||
}
|
||||
|
||||
// ---- Authentication tests ----
|
||||
|
||||
public function testIndexPageRequiresAuth(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
|
||||
$client->request('GET', '/en/system/update-manager');
|
||||
|
||||
// Should deny access (401 with HTTP Basic auth in test env)
|
||||
$this->assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
public function testIndexPageAccessibleByAdmin(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('GET', '/en/system/update-manager');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
|
||||
// ---- Backup creation tests ----
|
||||
|
||||
public function testCreateBackupRequiresCsrf(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/backup', [
|
||||
'_token' => 'invalid',
|
||||
]);
|
||||
|
||||
// Should redirect with error flash
|
||||
$this->assertResponseRedirects();
|
||||
}
|
||||
|
||||
public function testCreateBackupWithValidCsrf(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// Load the page and extract CSRF token from the backup form
|
||||
$crawler = $client->request('GET', '/en/system/update-manager');
|
||||
$csrfToken = $this->getCsrfTokenFromPage($crawler, 'backup');
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/backup', [
|
||||
'_token' => $csrfToken,
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects();
|
||||
|
||||
// Clean up: delete the backup that was just created
|
||||
$backupManager = $client->getContainer()->get(BackupManager::class);
|
||||
$backups = $backupManager->getBackups();
|
||||
foreach ($backups as $backup) {
|
||||
if (str_contains($backup['file'], 'manual')) {
|
||||
$backupManager->deleteBackup($backup['file']);
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
public function testCreateBackupBlockedWhenLocked(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// Load the page first to get CSRF token before locking
|
||||
$crawler = $client->request('GET', '/en/system/update-manager');
|
||||
$csrfToken = $this->getCsrfTokenFromPage($crawler, 'backup');
|
||||
|
||||
// Acquire lock to simulate update in progress
|
||||
$updateExecutor = $client->getContainer()->get(UpdateExecutor::class);
|
||||
$updateExecutor->acquireLock();
|
||||
|
||||
try {
|
||||
$client->request('POST', '/en/system/update-manager/backup', [
|
||||
'_token' => $csrfToken,
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects();
|
||||
} finally {
|
||||
// Always release lock
|
||||
$updateExecutor->releaseLock();
|
||||
}
|
||||
}
|
||||
|
||||
// ---- Backup deletion tests ----
|
||||
|
||||
public function testDeleteBackupRequiresCsrf(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/backup/delete', [
|
||||
'_token' => 'invalid',
|
||||
'filename' => 'test.zip',
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects();
|
||||
}
|
||||
|
||||
public function testDeleteBackupWithValidCsrf(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// Create a temporary backup file so the page shows the delete form
|
||||
$backupManager = $client->getContainer()->get(BackupManager::class);
|
||||
$backupDir = $backupManager->getBackupDir();
|
||||
if (!is_dir($backupDir)) {
|
||||
mkdir($backupDir, 0755, true);
|
||||
}
|
||||
$testFile = 'test-delete-' . uniqid() . '.zip';
|
||||
file_put_contents($backupDir . '/' . $testFile, 'test');
|
||||
|
||||
// Load the page and extract CSRF token from the delete form
|
||||
$crawler = $client->request('GET', '/en/system/update-manager');
|
||||
$csrfToken = $this->getCsrfTokenFromPage($crawler, 'backup/delete');
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/backup/delete', [
|
||||
'_token' => $csrfToken,
|
||||
'filename' => $testFile,
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects();
|
||||
$this->assertFileDoesNotExist($backupDir . '/' . $testFile);
|
||||
}
|
||||
|
||||
// ---- Log deletion tests ----
|
||||
|
||||
public function testDeleteLogRequiresCsrf(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/log/delete', [
|
||||
'_token' => 'invalid',
|
||||
'filename' => 'test.log',
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects();
|
||||
}
|
||||
|
||||
public function testDeleteLogWithValidCsrf(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// Create a temporary log file so the page shows the delete form
|
||||
$projectDir = $client->getContainer()->getParameter('kernel.project_dir');
|
||||
$logDir = $projectDir . '/var/log/updates';
|
||||
if (!is_dir($logDir)) {
|
||||
mkdir($logDir, 0755, true);
|
||||
}
|
||||
$testFile = 'update-test-delete-' . uniqid() . '.log';
|
||||
file_put_contents($logDir . '/' . $testFile, 'test log content');
|
||||
|
||||
// Load the page and extract CSRF token from the log delete form
|
||||
$crawler = $client->request('GET', '/en/system/update-manager');
|
||||
$csrfToken = $this->getCsrfTokenFromPage($crawler, 'log/delete');
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/log/delete', [
|
||||
'_token' => $csrfToken,
|
||||
'filename' => $testFile,
|
||||
]);
|
||||
|
||||
$this->assertResponseRedirects();
|
||||
$this->assertFileDoesNotExist($logDir . '/' . $testFile);
|
||||
}
|
||||
|
||||
// ---- Backup download tests ----
|
||||
|
||||
public function testDownloadBackupBlockedByDefault(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// DISABLE_BACKUP_DOWNLOAD=1 is the default in .env, so this should return 403
|
||||
$client->request('POST', '/en/system/update-manager/backup/download', [
|
||||
'_token' => 'any',
|
||||
'filename' => 'test.zip',
|
||||
'password' => 'test',
|
||||
]);
|
||||
|
||||
$this->assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testDownloadBackupRequiresPost(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// GET returns 404 since no GET route exists for this path
|
||||
$client->request('GET', '/en/system/update-manager/backup/download');
|
||||
|
||||
$this->assertResponseStatusCodeSame(404);
|
||||
}
|
||||
|
||||
public function testDownloadBackupRequiresAuth(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/backup/download', [
|
||||
'_token' => 'any',
|
||||
'filename' => 'test.zip',
|
||||
'password' => 'test',
|
||||
]);
|
||||
|
||||
// Should deny access (401 with HTTP Basic auth in test env)
|
||||
$this->assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
// ---- Backup details tests ----
|
||||
|
||||
public function testBackupDetailsReturns404ForNonExistent(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('GET', '/en/system/update-manager/backup/nonexistent.zip');
|
||||
|
||||
$this->assertResponseStatusCodeSame(404);
|
||||
}
|
||||
|
||||
// ---- Restore tests ----
|
||||
|
||||
public function testRestoreBlockedWhenDisabled(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// DISABLE_BACKUP_RESTORE=1 is the default in .env, so this should return 403
|
||||
$client->request('POST', '/en/system/update-manager/restore', [
|
||||
'_token' => 'invalid',
|
||||
'filename' => 'test.zip',
|
||||
]);
|
||||
|
||||
$this->assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
public function testRestoreRequiresAuth(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/restore', [
|
||||
'_token' => 'invalid',
|
||||
'filename' => 'test.zip',
|
||||
]);
|
||||
|
||||
$this->assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
// ---- Start update tests ----
|
||||
|
||||
public function testStartUpdateRequiresAuth(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
|
||||
$client->request('POST', '/en/system/update-manager/start', [
|
||||
'_token' => 'invalid',
|
||||
'version' => 'v1.0.0',
|
||||
]);
|
||||
|
||||
$this->assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
public function testStartUpdateBlockedWhenWebUpdatesDisabled(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
// DISABLE_WEB_UPDATES=1 is the default in .env
|
||||
$client->request('POST', '/en/system/update-manager/start', [
|
||||
'_token' => 'invalid',
|
||||
'version' => 'v1.0.0',
|
||||
]);
|
||||
|
||||
$this->assertResponseStatusCodeSame(403);
|
||||
}
|
||||
|
||||
// ---- Status and progress tests ----
|
||||
|
||||
public function testStatusEndpointRequiresAuth(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
|
||||
$client->request('GET', '/en/system/update-manager/status');
|
||||
|
||||
$this->assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
public function testStatusEndpointAccessibleByAdmin(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('GET', '/en/system/update-manager/status');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
|
||||
public function testProgressStatusEndpointRequiresAuth(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
|
||||
$client->request('GET', '/en/system/update-manager/progress/status');
|
||||
|
||||
$this->assertResponseStatusCodeSame(401);
|
||||
}
|
||||
|
||||
public function testProgressStatusEndpointAccessibleByAdmin(): void
|
||||
{
|
||||
$client = static::createClient();
|
||||
$this->loginAsAdmin($client);
|
||||
|
||||
$client->request('GET', '/en/system/update-manager/progress/status');
|
||||
|
||||
$this->assertResponseIsSuccessful();
|
||||
}
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue