Media firewall 2: Differentiate between mediaRoot/mediaDir

config/components.php

@@ -76,7 +76,7 @@
 		}
 
 		// create url and root
-		$mediaRoot = dirname($file->mediaRoot());
+		$mediaRoot = $file->mediaDir();
 		$template  = $mediaRoot . '/{{ name }}{{ attributes }}.{{ extension }}';
 		$thumbRoot = (new Filename($file->root(), $template, $options))->toString();
 		$thumbName = basename($thumbRoot);
@@ -102,7 +102,7 @@
 			'modifications' => $options,
 			'original'      => $file,
 			'root'          => $thumbRoot,
-			'url'           => dirname($file->mediaUrl()) . '/' . $thumbName,
+			'url'           => $file->mediaUrl($thumbName),
 		]);
 	},
 

src/Cms/File.php

@@ -371,6 +371,16 @@ public function isReadable(): bool
 		return $readable[$role][$template] ??= $this->permissions()->can('read');
 	}
 
+	/**
+	 * Returns the absolute path to the media folder for the file and its versions
+	 * @internal
+	 * @since 5.0.0
+	 */
+	public function mediaDir(): string
+	{
+		return $this->parent()->mediaDir() . '/' . $this->mediaHash();
+	}
+
 	/**
 	 * Creates a unique media hash
 	 * @internal
@@ -383,10 +393,14 @@ public function mediaHash(): string
 	/**
 	 * Returns the absolute path to the file in the public media folder
 	 * @internal
+	 *
+	 * @param string|null $filename Optional override for the filename
 	 */
-	public function mediaRoot(): string
+	public function mediaRoot(string|null $filename = null): string
 	{
-		return $this->parent()->mediaRoot() . '/' . $this->mediaHash() . '/' . $this->filename();
+		$filename ??= $this->filename();
+
+		return $this->mediaDir() . '/' . $filename;
 	}
 
 	/**
@@ -402,10 +416,15 @@ public function mediaToken(): string
 	/**
 	 * Returns the absolute Url to the file in the public media folder
 	 * @internal
+	 *
+	 * @param string|null $filename Optional override for the filename
 	 */
-	public function mediaUrl(): string
+	public function mediaUrl(string|null $filename = null): string
 	{
-		return $this->parent()->mediaUrl() . '/' . $this->mediaHash() . '/' . $this->filename();
+		$url        = $this->parent()->mediaUrl() . '/' . $this->mediaHash();
+		$filename ??= $this->filename();
+
+		return $url . '/' . $filename;
 	}
 
 	/**

src/Cms/Media.php

@@ -104,7 +104,7 @@ public static function thumb(
 				=> $media . '/assets/' . $model . '/' . $hash,
 			// parent files for file model that already included hash
 			$model instanceof File
-				=> dirname($model->mediaRoot()),
+				=> $model->mediaDir(),
 			// model files
 			default
 			=> $model->mediaRoot() . '/' . $hash

src/Cms/Page.php

@@ -770,14 +770,23 @@ public function isUnlisted(): bool
 	}
 
 	/**
-	 * Returns the root to the media folder for the page
+	 * Returns the absolute path to the media folder for the page
 	 * @internal
 	 */
-	public function mediaRoot(): string
+	public function mediaDir(): string
 	{
 		return $this->kirby()->root('media') . '/pages/' . $this->id();
 	}
 
+	/**
+	 * @see `::mediaDir`
+	 * @internal
+	 */
+	public function mediaRoot(): string
+	{
+		return $this->mediaDir();
+	}
+
 	/**
 	 * The page's base URL for any files
 	 * @internal

src/Cms/Site.php

@@ -275,14 +275,23 @@ public function is($site): bool
 	}
 
 	/**
-	 * Returns the root to the media folder for the site
+	 * Returns the absolute path to the media folder for the page
 	 * @internal
 	 */
-	public function mediaRoot(): string
+	public function mediaDir(): string
 	{
 		return $this->kirby()->root('media') . '/site';
 	}
 
+	/**
+	 * @see `::mediaDir`
+	 * @internal
+	 */
+	public function mediaRoot(): string
+	{
+		return $this->mediaDir();
+	}
+
 	/**
 	 * The site's base url for any files
 	 * @internal

src/Cms/User.php

@@ -427,14 +427,23 @@ public function logout(Session|array|null $session = null): void
 	}
 
 	/**
-	 * Returns the root to the media folder for the user
+	 * Returns the absolute path to the media folder for the user
 	 * @internal
 	 */
-	public function mediaRoot(): string
+	public function mediaDir(): string
 	{
 		return $this->kirby()->root('media') . '/users/' . $this->id();
 	}
 
+	/**
+	 * @see `::mediaDir`
+	 * @internal
+	 */
+	public function mediaRoot(): string
+	{
+		return $this->mediaDir();
+	}
+
 	/**
 	 * Returns the media url for the user object
 	 * @internal

tests/Cms/File/FileMediaTest.php

@@ -15,16 +15,32 @@ public function setUp(): void
 		parent::setUp();
 
 		$this->app = $this->app->clone([
+			'roots' => [
+				'index' => self::TMP
+			],
 			'options' => [
 				'content.salt' => 'test'
 			]
 		]);
 	}
 
+	public function testMediaDir(): void
+	{
+		F::write($root = static::TMP . '/content/test.jpg', 'test');
+		touch($root, 5432112345);
+
+		$file = new File([
+			'filename' => 'test.jpg',
+			'parent'   => $this->app->site()
+		]);
+
+		$this->assertSame(self::TMP . '/media/site/08756f3115-5432112345', $file->mediaDir());
+	}
+
 	public function testMediaHash(): void
 	{
-		F::write($file = static::TMP . '/content/test.jpg', 'test');
-		touch($file, 5432112345);
+		F::write($root = static::TMP . '/content/test.jpg', 'test');
+		touch($root, 5432112345);
 
 		$file = new File([
 			'filename' => 'test.jpg',
@@ -34,6 +50,20 @@ public function testMediaHash(): void
 		$this->assertSame('08756f3115-5432112345', $file->mediaHash());
 	}
 
+	public function testMediaRoot(): void
+	{
+		F::write($root = static::TMP . '/content/test.jpg', 'test');
+		touch($root, 5432112345);
+
+		$file = new File([
+			'filename' => 'test.jpg',
+			'parent'   => $this->app->site()
+		]);
+
+		$this->assertSame(self::TMP . '/media/site/08756f3115-5432112345/test.jpg', $file->mediaRoot());
+		$this->assertSame(self::TMP . '/media/site/08756f3115-5432112345/test-120x.jpg', $file->mediaRoot('test-120x.jpg'));
+	}
+
 	public function testMediaToken(): void
 	{
 		$file = new File([
@@ -43,4 +73,18 @@ public function testMediaToken(): void
 
 		$this->assertSame('08756f3115', $file->mediaToken());
 	}
+
+	public function testMediaUrl(): void
+	{
+		F::write($root = static::TMP . '/content/test.jpg', 'test');
+		touch($root, 5432112345);
+
+		$file = new File([
+			'filename' => 'test.jpg',
+			'parent'   => $this->app->site()
+		]);
+
+		$this->assertSame('/media/site/08756f3115-5432112345/test.jpg', $file->mediaUrl());
+		$this->assertSame('/media/site/08756f3115-5432112345/test-120x.jpg', $file->mediaUrl('test-120x.jpg'));
+	}
 }

tests/Cms/File/FileUrlTest.php

@@ -2,13 +2,29 @@
 
 namespace Kirby\Cms;
 
+use Kirby\Filesystem\F;
 use PHPUnit\Framework\Attributes\CoversClass;
 
 #[CoversClass(File::class)]
 class FileUrlTest extends ModelTestCase
 {
+	public const FIXTURES = __DIR__ . '/fixtures/files';
 	public const TMP = KIRBY_TMP_DIR . '/Cms.FileUrl';
 
+	public function setUp(): void
+	{
+		parent::setUp();
+
+		$this->app = $this->app->clone([
+			'roots' => [
+				'index' => self::TMP
+			],
+			'options' => [
+				'content.salt' => 'test'
+			]
+		]);
+	}
+
 	public function testPermalink(): void
 	{
 		$page = new Page(['slug' => 'test']);
@@ -21,7 +37,7 @@ public function testPermalink(): void
 		$this->assertSame('//@/file/my-file-uuid', $file->permalink());
 	}
 
-	public function testUrl(): void
+	public function testUrlFixed(): void
 	{
 		$file = new File([
 			'filename' => 'test.pdf',
@@ -31,4 +47,17 @@ public function testUrl(): void
 
 		$this->assertSame($url, $file->url());
 	}
+
+	public function testUrlMedia(): void
+	{
+		F::copy(self::FIXTURES . '/test.pdf', $root = self::TMP . '/content/test.pdf');
+		touch($root, 1234567890);
+
+		$file = new File([
+			'filename' => 'test.pdf',
+			'parent'   => $this->app->site()
+		]);
+
+		$this->assertSame('/media/site/b22a2d4f82-1234567890/test.pdf', $file->url());
+	}
 }

tests/Cms/Media/MediaTest.php

@@ -190,23 +190,23 @@ public function testThumb()
 
 		// get file object
 		$file  = $this->app->file('test.jpg');
-		Dir::make(dirname($file->mediaRoot()));
+		Dir::make($file->mediaDir());
 		$this->assertIsFile($file);
 
 		// create job file
 		$jobString = '{"width":64,"height":64,"quality":null,"crop":"center","filename":"test.jpg"}';
-		F::write(dirname($file->mediaRoot()) . '/.jobs/' . $file->filename() . '.json', $jobString);
+		F::write($file->mediaDir() . '/.jobs/' . $file->filename() . '.json', $jobString);
 
 		// copy to media folder
-		$file->asset()->copy($mediaPath = $file->mediaRoot());
+		$file->asset()->copy($mediaRoot = $file->mediaRoot());
 
 		$thumb = Media::thumb($file, $file->mediaHash(), $file->filename());
 		$this->assertInstanceOf(Response::class, $thumb);
 		$this->assertNotFalse($thumb->body());
 		$this->assertSame(200, $thumb->code());
 		$this->assertSame('image/jpeg', $thumb->type());
 
-		$thumbInfo = getimagesize($mediaPath);
+		$thumbInfo = getimagesize($mediaRoot);
 		$this->assertSame(64, $thumbInfo[0]);
 		$this->assertSame(64, $thumbInfo[1]);
 	}
@@ -240,7 +240,7 @@ public function testThumbWithIncompleteJobFile()
 		$file = $this->app->file('test.jpg');
 
 		// create an empty job file
-		F::write(dirname($file->mediaRoot()) . '/.jobs/' . $file->filename() . '.json', '{}');
+		F::write($file->mediaDir() . '/.jobs/' . $file->filename() . '.json', '{}');
 
 		$this->expectException(\Kirby\Exception\InvalidArgumentException::class);
 		$this->expectExceptionMessage('Incomplete thumbnail configuration');
@@ -265,7 +265,7 @@ public function testThumbWhenGenerationFails()
 
 		// create a valid job file
 		$jobString = '{"width":64,"height":64,"quality":null,"crop":"center","filename":"test.jpg"}';
-		F::write(dirname($file->mediaRoot()) . '/.jobs/' . $file->filename() . '.json', $jobString);
+		F::write($file->mediaDir() . '/.jobs/' . $file->filename() . '.json', $jobString);
 
 		$this->expectException(\Exception::class);
 		$this->expectExceptionMessage('The file does not exist');