let user set avatar in nextcloud von LDAP provides invalid image data

Signed-off-by: Arthur Schiwon <blizzz@arthur-schiwon.de>

2 files changed, 166 insertions, 0 deletions

diff --git a/apps/user_ldap/tests/User/UserTest.php b/apps/user_ldap/tests/User/UserTest.php
index ccf584aa300..a8d17554011 100644
--- a/apps/user_ldap/tests/User/UserTest.php
+++ b/apps/user_ldap/tests/User/UserTest.php
@@ -626,6 +626,9 @@ class UserTest extends \Test\TestCase {
 			->will($this->returnValue(array('this is a photo')));
 
 		$image->expects($this->once())
+			->method('loadFromBase64')
+			->willReturn('imageResource');
+		$image->expects($this->once())
 			->method('valid')
 			->will($this->returnValue(true));
 		$image->expects($this->once())
@@ -681,6 +684,9 @@ class UserTest extends \Test\TestCase {
 			});
 
 		$image->expects($this->once())
+			->method('loadFromBase64')
+			->willReturn('imageResource');
+		$image->expects($this->once())
 			->method('valid')
 			->will($this->returnValue(true));
 		$image->expects($this->once())
@@ -716,6 +722,115 @@ class UserTest extends \Test\TestCase {
 		$user->updateAvatar();
 	}
 
+	public function testUpdateAvatarCorruptPhotoProvided() {
+		list(, $config, $filesys, $image, $log, $avaMgr, $userMgr, $notiMgr) =
+			$this->getTestInstances();
+
+		$this->access->expects($this->any())
+			->method('readAttribute')
+			->willReturnCallback(function($dn, $attr) {
+				if($dn === $dn
+					&& $attr === 'jpegPhoto')
+				{
+					return false;
+				} elseif($dn === $dn
+					&& $attr === 'thumbnailPhoto')
+				{
+					return ['this is a photo'];
+				}
+				return null;
+			});
+
+		$image->expects($this->once())
+			->method('loadFromBase64')
+			->willReturn(false);
+		$image->expects($this->never())
+			->method('valid');
+		$image->expects($this->never())
+			->method('width');
+		$image->expects($this->never())
+			->method('height');
+		$image->expects($this->never())
+			->method('centerCrop');
+
+		$filesys->expects($this->never())
+			->method('isLoaded');
+
+		$avatar = $this->createMock(IAvatar::class);
+		$avatar->expects($this->never())
+			->method('set');
+
+		$avaMgr->expects($this->never())
+			->method('getAvatar');
+
+		$uid = 'alice';
+		$dn  = 'uid=alice,dc=foo,dc=bar';
+
+		$user = new User(
+			$uid, $dn, $this->access, $config, $filesys, $image, $log, $avaMgr, $userMgr, $notiMgr);
+
+		$user->updateAvatar();
+	}
+
+	public function testUpdateAvatarUnsupportedThumbnailPhotoProvided() {
+		list(, $config, $filesys, $image, $log, $avaMgr, $userMgr, $notiMgr) =
+			$this->getTestInstances();
+
+		$uid = 'alice';
+		$dn  = 'uid=alice,dc=foo,dc=bar';
+
+		$this->access->expects($this->any())
+			->method('readAttribute')
+			->willReturnCallback(function($dn, $attr) {
+				if($dn === $dn
+					&& $attr === 'jpegPhoto')
+				{
+					return false;
+				} elseif($dn === $dn
+					&& $attr === 'thumbnailPhoto')
+				{
+					return ['this is a photo'];
+				}
+				return null;
+			});
+
+		$image->expects($this->once())
+			->method('loadFromBase64')
+			->willReturn('imageResource');
+		$image->expects($this->once())
+			->method('valid')
+			->will($this->returnValue(true));
+		$image->expects($this->once())
+			->method('width')
+			->will($this->returnValue(128));
+		$image->expects($this->once())
+			->method('height')
+			->will($this->returnValue(128));
+		$image->expects($this->once())
+			->method('centerCrop')
+			->will($this->returnValue(true));
+
+		$filesys->expects($this->once())
+			->method('isLoaded')
+			->will($this->returnValue(true));
+
+		$avatar = $this->createMock(IAvatar::class);
+		$avatar->expects($this->once())
+			->method('set')
+			->with($this->isInstanceOf($image))
+			->willThrowException(new \Exception());
+
+		$avaMgr->expects($this->once())
+			->method('getAvatar')
+			->with($this->equalTo($uid))
+			->will($this->returnValue($avatar));
+
+		$user = new User(
+			$uid, $dn, $this->access, $config, $filesys, $image, $log, $avaMgr, $userMgr, $notiMgr);
+
+		$this->assertFalse($user->updateAvatar());
+	}
+
 	public function testUpdateAvatarNotProvided() {
 		list(, $config, $filesys, $image, $log, $avaMgr, $userMgr, $notiMgr) =
 			$this->getTestInstances();
@@ -904,6 +1019,14 @@ class UserTest extends \Test\TestCase {
 		$photo = $user->getAvatarImage();
 	}
 
+	public function imageDataProvider() {
+		return [
+			[ false, false ],
+			[ 'corruptData', false ],
+			[ 'validData', true ],
+		];
+	}
+
 	public function testProcessAttributes() {
 		list(, $config, $filesys, $image, $log, $avaMgr, $userMgr, $notiMgr) =
 			$this->getTestInstances();
diff --git a/apps/user_ldap/tests/User_LDAPTest.php b/apps/user_ldap/tests/User_LDAPTest.php
index 3262a2360ad..d84cb52c5e6 100644
--- a/apps/user_ldap/tests/User_LDAPTest.php
+++ b/apps/user_ldap/tests/User_LDAPTest.php
@@ -46,6 +46,7 @@ use OC\HintException;
 use OCA\User_LDAP\User\User;
 use OCA\User_LDAP\User_LDAP as UserLDAP;
 use OCA\User_LDAP\User_LDAP;
+use OCA\User_LDAP\UserPluginManager;
 use OCP\IAvatarManager;
 use OCP\IConfig;
 use OCP\IDBConnection;
@@ -1476,6 +1477,48 @@ class User_LDAPTest extends TestCase {
 		$this->assertEquals($ldap->setPassword('uid', 'password'),'result');
 	}	
 
+	public function avatarDataProvider() {
+		return [
+			[ 'validImageData', false ],
+			[ 'corruptImageData', true ],
+			[ false, true]
+		];
+	}
+
+	/** @dataProvider avatarDataProvider */
+	public function testCanChangeAvatar($imageData, $expected) {
+		$isValidImage  = strpos((string)$imageData, 'valid') === 0;
+
+		$user = $this->createMock(User::class);
+		$user->expects($this->once())
+			->method('getAvatarImage')
+			->willReturn($imageData);
+		$user->expects($this->atMost(1))
+			->method('updateAvatar')
+			->willReturn($isValidImage);
+
+		$access = $this->getAccessMock();
+		$access->userManager->expects($this->atLeastOnce())
+			->method('get')
+			->willReturn($user);
+
+		$config = $this->createMock(IConfig::class);
+		$noti = $this->createMock(INotificationManager::class);
+		$session = $this->createMock(Session::class);
+		$pluginManager = $this->createMock(UserPluginManager::class);
+
+		$ldap = new User_LDAP(
+			$access,
+			$config,
+			$noti,
+			$session,
+			$pluginManager
+		);
+
+		/** @noinspection PhpUnhandledExceptionInspection */
+		$this->assertSame($expected, $ldap->canChangeAvatar('uid'));
+	}
+
 	public function testCanChangeAvatarWithPlugin() {
 		$pluginManager = $this->getMockBuilder('\OCA\User_LDAP\UserPluginManager')
 			->setMethods(['implementsActions','canChangeAvatar'])