Merge 9a823591a4 into 1650ade338

tests/Controller/UpdateManagerControllerTest.php

@@ -0,0 +1,138 @@
+<?php
+/*
+ * This file is part of Part-DB (https://github.com/Part-DB/Part-DB-symfony).
+ *
+ *  Copyright (C) 2019 - 2024 Jan Böhmer (https://github.com/jbtronics)
+ *
+ *  This program is free software: you can redistribute it and/or modify
+ *  it under the terms of the GNU Affero General Public License as published
+ *  by the Free Software Foundation, either version 3 of the License, or
+ *  (at your option) any later version.
+ *
+ *  This program is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ *  GNU Affero General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Affero General Public License
+ *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+declare(strict_types=1);
+
+namespace App\Tests\Controller;
+
+use App\Entity\UserSystem\User;
+use PHPUnit\Framework\Attributes\Group;
+use Symfony\Bundle\FrameworkBundle\Test\WebTestCase;
+
+#[Group("slow")]
+#[Group("DB")]
+final class UpdateManagerControllerTest extends WebTestCase
+{
+    private function loginAsAdmin($client): void
+    {
+        $entityManager = $client->getContainer()->get('doctrine')->getManager();
+        $userRepository = $entityManager->getRepository(User::class);
+        $user = $userRepository->findOneBy(['name' => 'admin']);
+
+        if (!$user) {
+            $this->markTestSkipped('Admin user not found');
+        }
+
+        $client->loginUser($user);
+    }
+
+    public function testIndexPageRequiresAuth(): void
+    {
+        $client = static::createClient();
+
+        $client->request('GET', '/en/system/update-manager');
+
+        // Should deny access (401 with HTTP Basic auth in test env)
+        $this->assertResponseStatusCodeSame(401);
+    }
+
+    public function testIndexPageAccessibleByAdmin(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        $client->request('GET', '/en/system/update-manager');
+
+        $this->assertResponseIsSuccessful();
+    }
+
+    public function testCreateBackupRequiresCsrf(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        $client->request('POST', '/en/system/update-manager/backup', [
+            '_token' => 'invalid',
+        ]);
+
+        // Should redirect with error flash
+        $this->assertResponseRedirects();
+    }
+
+    public function testDeleteBackupRequiresCsrf(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        $client->request('POST', '/en/system/update-manager/backup/delete', [
+            '_token' => 'invalid',
+            'filename' => 'test.zip',
+        ]);
+
+        $this->assertResponseRedirects();
+    }
+
+    public function testDeleteLogRequiresCsrf(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        $client->request('POST', '/en/system/update-manager/log/delete', [
+            '_token' => 'invalid',
+            'filename' => 'test.log',
+        ]);
+
+        $this->assertResponseRedirects();
+    }
+
+    public function testDownloadBackupReturns404ForNonExistent(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        $client->request('GET', '/en/system/update-manager/backup/download/nonexistent.zip');
+
+        $this->assertResponseStatusCodeSame(404);
+    }
+
+    public function testBackupDetailsReturns404ForNonExistent(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        $client->request('GET', '/en/system/update-manager/backup/nonexistent.zip');
+
+        $this->assertResponseStatusCodeSame(404);
+    }
+
+    public function testRestoreBlockedWhenDisabled(): void
+    {
+        $client = static::createClient();
+        $this->loginAsAdmin($client);
+
+        // DISABLE_BACKUP_RESTORE=1 is the default in .env, so this should return 403
+        $client->request('POST', '/en/system/update-manager/restore', [
+            '_token' => 'invalid',
+            'filename' => 'test.zip',
+        ]);
+
+        $this->assertResponseStatusCodeSame(403);
+    }
+}

tests/Services/System/BackupManagerTest.php

@@ -82,6 +82,16 @@ final class BackupManagerTest extends KernelTestCase
         $this->assertSame('2.6.0', $matches[2]);
     }
 
+    public function testDeleteBackupReturnsFalseForNonExistentFile(): void
+    {
+        $this->assertFalse($this->backupManager->deleteBackup('non-existent.zip'));
+    }
+
+    public function testDeleteBackupReturnsFalseForNonZipFile(): void
+    {
+        $this->assertFalse($this->backupManager->deleteBackup('not-a-zip.txt'));
+    }
+
     /**
      * Test version parsing with different filename formats.
      */

tests/Services/System/UpdateExecutorTest.php

@@ -139,6 +139,38 @@ final class UpdateExecutorTest extends KernelTestCase
         $this->assertFalse($this->updateExecutor->isLocked());
     }
 
+    public function testDeleteLogRejectsInvalidFilename(): void
+    {
+        // Path traversal attempts should be rejected
+        $this->assertFalse($this->updateExecutor->deleteLog('../../../etc/passwd'));
+        $this->assertFalse($this->updateExecutor->deleteLog('malicious.txt'));
+        $this->assertFalse($this->updateExecutor->deleteLog(''));
+        // Must start with "update-"
+        $this->assertFalse($this->updateExecutor->deleteLog('backup-v1.0.0.log'));
+    }
+
+    public function testDeleteLogReturnsFalseForNonExistentFile(): void
+    {
+        $this->assertFalse($this->updateExecutor->deleteLog('update-nonexistent-file.log'));
+    }
+
+    public function testDeleteLogDeletesExistingFile(): void
+    {
+        // Create a temporary log file in the update logs directory
+        $projectDir = self::getContainer()->getParameter('kernel.project_dir');
+        $logDir = $projectDir . '/var/log/updates';
+
+        if (!is_dir($logDir)) {
+            mkdir($logDir, 0755, true);
+        }
+
+        $testFile = 'update-test-delete-' . uniqid() . '.log';
+        file_put_contents($logDir . '/' . $testFile, 'test log content');
+
+        $this->assertTrue($this->updateExecutor->deleteLog($testFile));
+        $this->assertFileDoesNotExist($logDir . '/' . $testFile);
+    }
+
     public function testEnableAndDisableMaintenanceMode(): void
     {
         // First, ensure maintenance mode is off