Add optional screenshots to bug reports

2026-09-15 21:16:06 +02:00
parent 39af9ecdb4
commit 5d3ae10036
10 changed files with 263 additions and 12 deletions
@@ -234,6 +234,41 @@ class FeatureApiTests(unittest.TestCase):
        self.assertEqual(self.client.get('/bug-report', follow_redirects=False).status_code, 303)
        self.assertEqual(self.client.post('/bug-report', data=data, follow_redirects=False).status_code, 303)

+    def test_report_form_screenshot_is_optional_and_localized(self):
+        for language,label in (('de','Screenshot anhängen (optional)'),('en','Attach a screenshot (optional)')):
+            self.client.get('/language/'+language, follow_redirects=False)
+            page=self.client.get('/bug-report')
+            self.assertIn('enctype="multipart/form-data"',page.text)
+            self.assertIn('name="screenshot" type="file"',page.text)
+            self.assertIn(label,page.text)
+
+    def test_report_attaches_only_sanitized_image_bytes(self):
+        from io import BytesIO
+        from PIL import Image
+        image=Image.new('RGB',(20,15),(50,80,100)); exif=Image.Exif(); exif[270]='secret exif test fixture'
+        source=BytesIO(); image.save(source,format='PNG',exif=exif)
+        data=self.report()
+        with patch.object(GiteaService,'create_issue',return_value=123) as create:
+            response=self.client.post('/bug-report',data=data,
+                files={'screenshot':('../../payload.svg',source.getvalue()+b'<script>fixture</script>','image/svg+xml')})
+        self.assertEqual(response.status_code,200)
+        self.assertIn('#123',response.text)
+        create.assert_called_once()
+        filename,contents,media_type=create.call_args.kwargs['screenshot']
+        self.assertRegex(filename,r'^screenshot-[0-9a-f]{32}\.jpg$')
+        self.assertEqual(media_type,'image/jpeg')
+        self.assertNotIn(b'secret exif test fixture',contents)
+        self.assertNotIn(b'<script>',contents)
+        self.assertNotIn('../../payload.svg',str(create.call_args))
+
+    def test_report_rejects_non_image_upload_without_calling_gitea(self):
+        with patch.object(GiteaService,'create_issue') as create:
+            response=self.client.post('/bug-report',data=self.report(),
+                files={'screenshot':('malware.svg',b'<svg onload="alert(1)"></svg>','image/png')})
+        self.assertEqual(response.status_code,400)
+        self.assertIn('Bitte lade ein gültiges JPG-, PNG- oder WebP-Bild hoch.',response.text)
+        create.assert_not_called()
+
    def test_report_validation(self):
        for changes in ({'title':''}, {'description':''}, {'expected':''}, {'title':'x'*161},
                        {'description':'x'*5001}, {'expected':'x'*3001}, {'steps':'x'*3001},