fixed unit tests to work with team domain changes and update partial url regex for files

4 files changed, 53 insertions, 17 deletions

diff --git a/api/file.go b/api/file.go
index 1dd179422..82cee9d1e 100644
--- a/api/file.go
+++ b/api/file.go
@@ -297,15 +297,14 @@ func getPublicLink(c *Context, w http.ResponseWriter, r *http.Request) {
 	}
 
 	matches := model.PartialUrlRegex.FindAllStringSubmatch(filename, -1)
-	if len(matches) == 0 || len(matches[0]) < 5 {
+	if len(matches) == 0 || len(matches[0]) < 4 {
 		c.SetInvalidParam("getPublicLink", "filename")
 		return
 	}
 
-	getType := matches[0][1]
-	channelId := matches[0][2]
-	userId := matches[0][3]
-	filename = matches[0][4]
+	channelId := matches[0][1]
+	userId := matches[0][2]
+	filename = matches[0][3]
 
 	cchan := Srv.Store.Channel().CheckPermissionsTo(c.Session.TeamId, channelId, c.Session.UserId)
 
@@ -316,7 +315,7 @@ func getPublicLink(c *Context, w http.ResponseWriter, r *http.Request) {
 	data := model.MapToJson(newProps)
 	hash := model.HashPassword(fmt.Sprintf("%v:%v", data, utils.Cfg.ServiceSettings.PublicLinkSalt))
 
-	url := fmt.Sprintf("%s/api/v1/files/%s/%s/%s/%s?d=%s&h=%s&t=%s", c.GetSiteURL(), getType, channelId, userId, filename, url.QueryEscape(data), url.QueryEscape(hash), c.Session.TeamId)
+	url := fmt.Sprintf("%s/api/v1/files/get/%s/%s/%s?d=%s&h=%s&t=%s", c.GetSiteURL(), channelId, userId, filename, url.QueryEscape(data), url.QueryEscape(hash), c.Session.TeamId)
 
 	if !c.HasPermissionsToChannel(cchan, "getPublicLink") {
 		return
diff --git a/api/file_test.go b/api/file_test.go
index 3f414d768..a708e9bb1 100644
--- a/api/file_test.go
+++ b/api/file_test.go
@@ -5,6 +5,7 @@ package api
 
 import (
 	"bytes"
+	l4g "code.google.com/p/log4go"
 	"fmt"
 	"github.com/goamz/goamz/aws"
 	"github.com/goamz/goamz/s3"
@@ -197,8 +198,9 @@ func TestGetFile(t *testing.T) {
 		// wait a bit for files to ready
 		time.Sleep(5 * time.Second)
 
-		if _, downErr := Client.GetFile(filenames[0], true); downErr != nil {
-			t.Fatal("file get failed")
+		l4g.Debug(filenames)
+		if _, downErr := Client.GetFile(filenames[0], false); downErr != nil {
+			t.Fatal(downErr)
 		}
 
 		team2 := &model.Team{DisplayName: "Name", Name: "z-z-" + model.NewId() + "a", Email: "test@nowhere.com", Type: model.TEAM_OPEN}
@@ -217,35 +219,35 @@ func TestGetFile(t *testing.T) {
 
 		Client.LoginByEmail(team2.Name, user2.Email, "pwd")
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t="+team.Id, true); downErr != nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t="+team.Id, false); downErr != nil {
 			t.Fatal(downErr)
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash), true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash), false); downErr == nil {
 			t.Fatal("Should have errored - missing team id")
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=junk", true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=junk", false); downErr == nil {
 			t.Fatal("Should have errored - bad team id")
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=12345678901234567890123456", true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h="+url.QueryEscape(hash)+"&t=12345678901234567890123456", false); downErr == nil {
 			t.Fatal("Should have errored - bad team id")
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&t="+team.Id, true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&t="+team.Id, false); downErr == nil {
 			t.Fatal("Should have errored - missing hash")
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h=junk&t="+team.Id, true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d="+url.QueryEscape(data)+"&h=junk&t="+team.Id, false); downErr == nil {
 			t.Fatal("Should have errored - bad hash")
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?h="+url.QueryEscape(hash)+"&t="+team.Id, true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?h="+url.QueryEscape(hash)+"&t="+team.Id, false); downErr == nil {
 			t.Fatal("Should have errored - missing data")
 		}
 
-		if _, downErr := Client.GetFile(filenames[0]+"?d=junk&h="+url.QueryEscape(hash)+"&t="+team.Id, true); downErr == nil {
+		if _, downErr := Client.GetFile(filenames[0]+"?d=junk&h="+url.QueryEscape(hash)+"&t="+team.Id, false); downErr == nil {
 			t.Fatal("Should have errored - bad data")
 		}
 
@@ -429,6 +431,7 @@ func TestGetPublicLink(t *testing.T) {
 				t.Fatal(err)
 			}
 		} else {
+			l4g.Debug(resp.Data.(*model.FileUploadResponse).Filenames[0])
 			filenames := strings.Split(resp.Data.(*model.FileUploadResponse).Filenames[0], "/")
 			filename := filenames[len(filenames)-2] + "/" + filenames[len(filenames)-1]
 			fileId := strings.Split(filename, ".")[0]
diff --git a/api/post.go b/api/post.go
index 2d25f7ab0..70ff13497 100644
--- a/api/post.go
+++ b/api/post.go
@@ -160,6 +160,40 @@ func CreatePost(c *Context, post *model.Post, doUpdateLastViewed bool) (*model.P
 
 	post.UserId = c.Session.UserId
 
+	if len(post.Filenames) > 0 {
+		doRemove := false
+		for i := len(post.Filenames) - 1; i >= 0; i-- {
+			path := post.Filenames[i]
+
+			doRemove = false
+			l4g.Debug(path)
+			if model.UrlRegex.MatchString(path) {
+				continue
+			} else if model.PartialUrlRegex.MatchString(path) {
+				matches := model.PartialUrlRegex.FindAllStringSubmatch(path, -1)
+				if len(matches) == 0 || len(matches[0]) < 4 {
+					doRemove = true
+				}
+
+				channelId := matches[0][1]
+				if channelId != post.ChannelId {
+					doRemove = true
+				}
+
+				userId := matches[0][2]
+				if userId != post.UserId {
+					doRemove = true
+				}
+			} else {
+				doRemove = true
+			}
+			if doRemove {
+				l4g.Error("Bad filename discarded, filename=%v", path)
+				post.Filenames = append(post.Filenames[:i], post.Filenames[i+1:]...)
+			}
+		}
+	}
+
 	var rpost *model.Post
 	if result := <-Srv.Store.Post().Save(post); result.Err != nil {
 		return nil, result.Err
diff --git a/api/post_test.go b/api/post_test.go
index 0cccc74d3..19a88f737 100644
--- a/api/post_test.go
+++ b/api/post_test.go
@@ -37,7 +37,7 @@ func TestCreatePost(t *testing.T) {
 	channel2 := &model.Channel{DisplayName: "Test API Name", Name: "a" + model.NewId() + "a", Type: model.CHANNEL_OPEN, TeamId: team.Id}
 	channel2 = Client.Must(Client.CreateChannel(channel2)).Data.(*model.Channel)
 
-	filenames := []string{"/api/v1/files/get/12345678901234567890123456/12345678901234567890123456/test.png", "/api/v1/files/get/" + channel1.Id + "/" + user1.Id + "/test.png"}
+	filenames := []string{"/12345678901234567890123456/12345678901234567890123456/12345678901234567890123456/test.png", "/" + channel1.Id + "/" + user1.Id + "/test.png", "www.mattermost.com/fake/url", "junk"}
 
 	post1 := &model.Post{ChannelId: channel1.Id, Message: "#hashtag a" + model.NewId() + "a", Filenames: filenames}
 	rpost1, err := Client.CreatePost(post1)