| 1 |
<?php |
| 2 |
|
| 3 |
namespace FluentBoards\App\Services; |
| 4 |
|
| 5 |
use FluentBoards\App\Models\Attachment; |
| 6 |
use FluentBoards\App\Models\Board; |
| 7 |
use FluentBoards\App\Models\Comment; |
| 8 |
use FluentBoards\App\Models\Task; |
| 9 |
|
| 10 |
class AttachmentAccessService |
| 11 |
{ |
| 12 |
/** |
| 13 |
* Return the attachment's trusted board ID if the current visitor may read it, or zero. |
| 14 |
* URL hashes and legacy signatures identify images; they never grant access. |
| 15 |
*/ |
| 16 |
public function getAccessibleBoardId(Attachment $attachment) |
| 17 |
{ |
| 18 |
$boardId = $this->getBoardId($attachment); |
| 19 |
if (!$boardId) { |
| 20 |
return 0; |
| 21 |
} |
| 22 |
|
| 23 |
$board = Board::find($boardId); |
| 24 |
if (!$board) { |
| 25 |
return 0; |
| 26 |
} |
| 27 |
|
| 28 |
// Unsaved uploads remain private to their uploader, who must still have board access. |
| 29 |
if (empty($attachment->object_id)) { |
| 30 |
$settings = $attachment->settings; |
| 31 |
if (absint($settings[Constant::ATTACHMENT_UPLOAD_USER_ID] ?? 0) !== get_current_user_id()) { |
| 32 |
return 0; |
| 33 |
} |
| 34 |
|
| 35 |
return PermissionManager::userHasPermission($boardId) ? $boardId : 0; |
| 36 |
} |
| 37 |
|
| 38 |
if (PermissionManager::userHasPermission($boardId)) { |
| 39 |
return $boardId; |
| 40 |
} |
| 41 |
|
| 42 |
// PublicBoardController exposes board backgrounds, but hides task descriptions and comments. |
| 43 |
if ($attachment->object_type === Constant::BOARD_BACKGROUND_IMAGE |
| 44 |
&& !$board->archived_at |
| 45 |
&& $board->getMetaByKey('public_access_enabled')) { |
| 46 |
return $boardId; |
| 47 |
} |
| 48 |
|
| 49 |
return 0; |
| 50 |
} |
| 51 |
|
| 52 |
private function getBoardId(Attachment $attachment) |
| 53 |
{ |
| 54 |
if ($attachment->object_type === Constant::COMMENT_IMAGE) { |
| 55 |
if (empty($attachment->object_id)) { |
| 56 |
$settings = $attachment->settings; |
| 57 |
return absint($settings[Constant::ATTACHMENT_UPLOAD_BOARD_ID] ?? 0); |
| 58 |
} |
| 59 |
|
| 60 |
$comment = Comment::withoutGlobalScopes()->find($attachment->object_id); |
| 61 |
return $comment ? absint($comment->board_id) : 0; |
| 62 |
} |
| 63 |
|
| 64 |
if ($attachment->object_type === Constant::TASK_DESCRIPTION) { |
| 65 |
$task = Task::find($attachment->object_id); |
| 66 |
return $task ? absint($task->board_id) : 0; |
| 67 |
} |
| 68 |
|
| 69 |
if ($attachment->object_type === Constant::BOARD_BACKGROUND_IMAGE) { |
| 70 |
return absint($attachment->object_id); |
| 71 |
} |
| 72 |
|
| 73 |
return 0; |
| 74 |
} |
| 75 |
} |
| 76 |
|
