{{ log.file }}|
- {% if status.can_auto_update and validation.valid and not backup_restore_disabled %}
-
- {% endif %}
+
+ {% if is_granted('@system.manage_updates') %}
+
+
+
+ {% endif %}
+ {% if not backup_restore_disabled and is_granted('@system.manage_updates') %}
+
+ {% endif %}
+ {% if is_granted('@system.manage_updates') %}
+
+ {% endif %}
+
|
{% else %}
diff --git a/tests/Controller/UpdateManagerControllerTest.php b/tests/Controller/UpdateManagerControllerTest.php
new file mode 100644
index 00000000..e770a5bb
--- /dev/null
+++ b/tests/Controller/UpdateManagerControllerTest.php
@@ -0,0 +1,138 @@
+.
+ */
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller;
+
+use App\Entity\UserSystem\User;
+use PHPUnit\Framework\Attributes\Group;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+
+#[Group("slow")]
+#[Group("DB")]
+final class UpdateManagerControllerTest extends WebTestCase
+{
+ private function loginAsAdmin($client): void
+ {
+ $entityManager = $client->getContainer()->get('doctrine')->getManager();
+ $userRepository = $entityManager->getRepository(User::class);
+ $user = $userRepository->findOneBy(['name' => 'admin']);
+
+ if (!$user) {
+ $this->markTestSkipped('Admin user not found');
+ }
+
+ $client->loginUser($user);
+ }
+
+ public function testIndexPageRequiresAuth(): void
+ {
+ $client = static::createClient();
+
+ $client->request('GET', '/en/system/update-manager');
+
+ // Should deny access (401 with HTTP Basic auth in test env)
+ $this->assertResponseStatusCodeSame(401);
+ }
+
+ public function testIndexPageAccessibleByAdmin(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ $client->request('GET', '/en/system/update-manager');
+
+ $this->assertResponseIsSuccessful();
+ }
+
+ public function testCreateBackupRequiresCsrf(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ $client->request('POST', '/en/system/update-manager/backup', [
+ '_token' => 'invalid',
+ ]);
+
+ // Should redirect with error flash
+ $this->assertResponseRedirects();
+ }
+
+ public function testDeleteBackupRequiresCsrf(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ $client->request('POST', '/en/system/update-manager/backup/delete', [
+ '_token' => 'invalid',
+ 'filename' => 'test.zip',
+ ]);
+
+ $this->assertResponseRedirects();
+ }
+
+ public function testDeleteLogRequiresCsrf(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ $client->request('POST', '/en/system/update-manager/log/delete', [
+ '_token' => 'invalid',
+ 'filename' => 'test.log',
+ ]);
+
+ $this->assertResponseRedirects();
+ }
+
+ public function testDownloadBackupReturns404ForNonExistent(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ $client->request('GET', '/en/system/update-manager/backup/download/nonexistent.zip');
+
+ $this->assertResponseStatusCodeSame(404);
+ }
+
+ public function testBackupDetailsReturns404ForNonExistent(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ $client->request('GET', '/en/system/update-manager/backup/nonexistent.zip');
+
+ $this->assertResponseStatusCodeSame(404);
+ }
+
+ public function testRestoreBlockedWhenDisabled(): void
+ {
+ $client = static::createClient();
+ $this->loginAsAdmin($client);
+
+ // DISABLE_BACKUP_RESTORE=1 is the default in .env, so this should return 403
+ $client->request('POST', '/en/system/update-manager/restore', [
+ '_token' => 'invalid',
+ 'filename' => 'test.zip',
+ ]);
+
+ $this->assertResponseStatusCodeSame(403);
+ }
+}
diff --git a/tests/Services/System/BackupManagerTest.php b/tests/Services/System/BackupManagerTest.php
index f75ef8f3..9aa92813 100644
--- a/tests/Services/System/BackupManagerTest.php
+++ b/tests/Services/System/BackupManagerTest.php
@@ -82,6 +82,16 @@ final class BackupManagerTest extends KernelTestCase
$this->assertSame('2.6.0', $matches[2]);
}
+ public function testDeleteBackupReturnsFalseForNonExistentFile(): void
+ {
+ $this->assertFalse($this->backupManager->deleteBackup('non-existent.zip'));
+ }
+
+ public function testDeleteBackupReturnsFalseForNonZipFile(): void
+ {
+ $this->assertFalse($this->backupManager->deleteBackup('not-a-zip.txt'));
+ }
+
/**
* Test version parsing with different filename formats.
*/
diff --git a/tests/Services/System/UpdateExecutorTest.php b/tests/Services/System/UpdateExecutorTest.php
index 48cddf8d..8b95b3b0 100644
--- a/tests/Services/System/UpdateExecutorTest.php
+++ b/tests/Services/System/UpdateExecutorTest.php
@@ -139,6 +139,38 @@ final class UpdateExecutorTest extends KernelTestCase
$this->assertFalse($this->updateExecutor->isLocked());
}
+ public function testDeleteLogRejectsInvalidFilename(): void
+ {
+ // Path traversal attempts should be rejected
+ $this->assertFalse($this->updateExecutor->deleteLog('../../../etc/passwd'));
+ $this->assertFalse($this->updateExecutor->deleteLog('malicious.txt'));
+ $this->assertFalse($this->updateExecutor->deleteLog(''));
+ // Must start with "update-"
+ $this->assertFalse($this->updateExecutor->deleteLog('backup-v1.0.0.log'));
+ }
+
+ public function testDeleteLogReturnsFalseForNonExistentFile(): void
+ {
+ $this->assertFalse($this->updateExecutor->deleteLog('update-nonexistent-file.log'));
+ }
+
+ public function testDeleteLogDeletesExistingFile(): void
+ {
+ // Create a temporary log file in the update logs directory
+ $projectDir = self::getContainer()->getParameter('kernel.project_dir');
+ $logDir = $projectDir . '/var/log/updates';
+
+ if (!is_dir($logDir)) {
+ mkdir($logDir, 0755, true);
+ }
+
+ $testFile = 'update-test-delete-' . uniqid() . '.log';
+ file_put_contents($logDir . '/' . $testFile, 'test log content');
+
+ $this->assertTrue($this->updateExecutor->deleteLog($testFile));
+ $this->assertFileDoesNotExist($logDir . '/' . $testFile);
+ }
+
public function testEnableAndDisableMaintenanceMode(): void
{
// First, ensure maintenance mode is off
diff --git a/translations/messages.en.xlf b/translations/messages.en.xlf
index 7bf613ae..7b103574 100644
--- a/translations/messages.en.xlf
+++ b/translations/messages.en.xlf
@@ -12335,6 +12335,84 @@ Buerklin-API Authentication server: