|
17 | 17 |
|
18 | 18 | namespace phpMyFAQ\Controller\Administration\Api; |
19 | 19 |
|
| 20 | +use DateTime; |
20 | 21 | use phpMyFAQ\Controller\AbstractController; |
21 | 22 | use phpMyFAQ\Core\Exception; |
22 | 23 | use phpMyFAQ\Enums\PermissionType; |
|
30 | 31 | class ImageController extends AbstractController |
31 | 32 | { |
32 | 33 | /** |
33 | | - * @throws Exception |
| 34 | + * @throws Exception|\Exception |
34 | 35 | */ |
35 | 36 | #[Route('admin/api/content/images')] |
36 | 37 | public function upload(Request $request): JsonResponse |
37 | 38 | { |
38 | 39 | $this->userHasPermission(PermissionType::FAQ_EDIT); |
39 | 40 |
|
| 41 | + $session = $this->container->get('session'); |
| 42 | + |
40 | 43 | $uploadDir = PMF_CONTENT_DIR . '/user/images/'; |
41 | 44 | $validFileExtensions = ['gif', 'jpg', 'jpeg', 'png']; |
42 | 45 | $timestamp = time(); |
43 | 46 |
|
44 | | - if ( |
45 | | - !Token::getInstance($this->container->get('session')) |
46 | | - ->verifyToken('edit-faq', $request->query->get('csrf')) |
47 | | - ) { |
48 | | - return $this->json(['error' => Translation::get('msgNoPermission')], Response::HTTP_UNAUTHORIZED); |
| 47 | + if (!Token::getInstance($session)->verifyToken('edit-faq', $request->query->get('csrf'))) { |
| 48 | + return $this->json( |
| 49 | + [ |
| 50 | + 'success' => false, |
| 51 | + 'data' => ['code' => Response::HTTP_UNAUTHORIZED], |
| 52 | + 'messages' => [Translation::get('msgNoPermission')] |
| 53 | + ], |
| 54 | + Response::HTTP_UNAUTHORIZED |
| 55 | + ); |
49 | 56 | } |
50 | 57 |
|
51 | | - $file = $request->files->get('file'); |
52 | | - $headers = []; |
53 | | - if ($file && $file->isValid()) { |
54 | | - if ( |
55 | | - $request->server->get('HTTP_ORIGIN') !== null && |
56 | | - $request->server->get('HTTP_ORIGIN') . '/' === $this->configuration->getDefaultUrl() |
57 | | - ) { |
58 | | - $headers = ['Access-Control-Allow-Origin', $request->server->get('HTTP_ORIGIN')]; |
59 | | - } |
| 58 | + $files = $request->files->get('files'); |
60 | 59 |
|
61 | | - // Sanitize input |
62 | | - if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $file->getClientOriginalName())) { |
63 | | - return $this->json([], Response::HTTP_BAD_REQUEST, $headers); |
64 | | - } |
| 60 | + $uploadedFiles = []; |
| 61 | + foreach ($files as $file) { |
| 62 | + $headers = []; |
| 63 | + if ($file && $file->isValid()) { |
| 64 | + if ( |
| 65 | + $request->server->get('HTTP_ORIGIN') !== null && |
| 66 | + $request->server->get('HTTP_ORIGIN') . '/' === $this->configuration->getDefaultUrl() |
| 67 | + ) { |
| 68 | + $headers = ['Access-Control-Allow-Origin', $request->server->get('HTTP_ORIGIN')]; |
| 69 | + } |
65 | 70 |
|
66 | | - // Verify extension |
67 | | - if (!in_array(strtolower($file->getClientOriginalExtension()), $validFileExtensions)) { |
68 | | - return $this->json([], Response::HTTP_BAD_REQUEST, $headers); |
69 | | - } |
| 71 | + // Sanitize input |
| 72 | + if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $file->getClientOriginalName())) { |
| 73 | + return $this->json( |
| 74 | + [ |
| 75 | + 'success' => false, |
| 76 | + 'data' => ['code' => Response::HTTP_BAD_REQUEST], |
| 77 | + 'messages' => ['Data contains invalid characters'] |
| 78 | + ], |
| 79 | + Response::HTTP_BAD_REQUEST, |
| 80 | + $headers |
| 81 | + ); |
| 82 | + } |
70 | 83 |
|
71 | | - // Accept upload if there was no origin, or if it is an accepted origin |
72 | | - $fileName = $timestamp . '_' . $file->getClientOriginalName(); |
73 | | - $file->move($uploadDir, $fileName); |
| 84 | + // Verify extension |
| 85 | + if (!in_array(strtolower($file->getClientOriginalExtension()), $validFileExtensions)) { |
| 86 | + return $this->json( |
| 87 | + [ |
| 88 | + 'success' => false, |
| 89 | + 'data' => ['code' => Response::HTTP_BAD_REQUEST], |
| 90 | + 'messages' => ['File extension not allowed'] |
| 91 | + ], |
| 92 | + Response::HTTP_BAD_REQUEST, |
| 93 | + $headers |
| 94 | + ); |
| 95 | + } |
74 | 96 |
|
75 | | - // Respond to the successful upload with JSON with the full URL of the uploaded image. |
76 | | - return $this->json( |
77 | | - ['location' => $this->configuration->getDefaultUrl() . 'content/user/images/' . $fileName], |
78 | | - Response::HTTP_OK, |
79 | | - $headers |
80 | | - ); |
81 | | - } else { |
82 | | - return $this->json([], Response::HTTP_BAD_REQUEST, $headers); |
| 97 | + // Accept upload if there was no origin, or if it is an accepted origin |
| 98 | + $fileName = $timestamp . '_' . $file->getClientOriginalName(); |
| 99 | + $file->move($uploadDir, $fileName); |
| 100 | + |
| 101 | + // Add to the list of uploaded files |
| 102 | + $uploadedFiles[] = $fileName; |
| 103 | + } else { |
| 104 | + return $this->json(['success' => false], Response::HTTP_BAD_REQUEST, $headers); |
| 105 | + } |
83 | 106 | } |
| 107 | + |
| 108 | + $response = [ |
| 109 | + 'success' => true, |
| 110 | + 'time' => (new DateTime())->format('Y-m-d H:i:s'), |
| 111 | + 'data' => [ |
| 112 | + 'sources' => [ |
| 113 | + [ |
| 114 | + 'baseurl' => $this->configuration->getDefaultUrl(), |
| 115 | + 'path' => 'content/user/images/', |
| 116 | + 'files' => $uploadedFiles, |
| 117 | + 'name' => 'default' |
| 118 | + ] |
| 119 | + ], |
| 120 | + 'code' => 220 |
| 121 | + ] |
| 122 | + ]; |
| 123 | + |
| 124 | + return $this->json($response, Response::HTTP_OK); |
84 | 125 | } |
85 | 126 | } |
0 commit comments