Merge remote-tracking branch 'origin/MAGETWO-95550' into 2.1.16-develop-pr60

Author: zakdma

app/code/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/DeleteFiles.php

@@ -82,7 +82,7 @@ public function execute()
                 $filesystem = $this->_objectManager->get(\Magento\Framework\Filesystem::class);
                 $dir = $filesystem->getDirectoryRead(DirectoryList::MEDIA);
                 $filePath = $path . '/' . \Magento\Framework\File\Uploader::getCorrectFileName($file);
-                if ($dir->isFile($dir->getRelativePath($filePath))) {
+                if ($dir->isFile($dir->getRelativePath($filePath)) && !preg_match('/^\\.htaccess$/', $file)) {
                     $this->getStorage()->deleteFile($filePath);
                 }
             }

dev/tests/integration/testsuite/Magento/Cms/Controller/Adminhtml/Wysiwyg/Images/DeleteFilesTest.php

@@ -88,5 +88,64 @@ public static function tearDownAfterClass()
         if ($directory->isExist('wysiwyg')) {
             $directory->delete('wysiwyg');
         }
+        if ($directory->isExist('.htaccess')) {
+            $directory->delete('.htaccess');
+        }
+        if ($directory->isExist('thtaccess')) {
+            $directory->delete('thtaccess');
+        }
+    }
+
+    /**
+     * Creates file and tries to delete it via
+     * \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images\DeleteFiles::execute method
+     *
+     * @param  string $fileName
+     * @return void
+     */
+    private function createFileAndExecuteDelete($fileName)
+    {
+        $path = '/' . $fileName;
+        if (!$this->mediaDirectory->isFile($path)) {
+            $this->mediaDirectory->writeFile($path, "Order deny,allow\nDeny from all");
+        }
+        $this->model->getRequest()->setMethod('POST')
+            ->setPostValue('files', [$this->imagesHelper->idEncode($fileName)]);
+        $this->model->getStorage()->getSession()->setCurrentPath($this->mediaDirectory->getAbsolutePath());
+        $this->model->execute();
+    }
+
+    /**
+     * Check that htaccess file couldn't be removed via
+     * \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images\DeleteFiles::execute method
+     *
+     * @return void
+     */
+    public function testCouldNotDeleteHtaccess()
+    {
+        $fileName = '.htaccess';
+        $this->createFileAndExecuteDelete($fileName);
+        $this->assertTrue(
+            $this->mediaDirectory->isExist(
+                $this->mediaDirectory->getRelativePath($fileName)
+            )
+        );
+    }
+
+    /**
+     * Check that random file could be removed via
+     * \Magento\Cms\Controller\Adminhtml\Wysiwyg\Images\DeleteFiles::execute method
+     *
+     * @return void
+     */
+    public function testDeleteAnyFile()
+    {
+        $fileName = 'thtaccess';
+        $this->createFileAndExecuteDelete($fileName);
+        $this->assertFalse(
+            $this->mediaDirectory->isExist(
+                $this->mediaDirectory->getRelativePath($fileName)
+            )
+        );
     }
 }