← All changes | app/Hooks/Handlers/ExternalPages.php +132 -5 1.13 → 2.2.0 View file →

		@@ -1,13 +1,140 @@
1	1	<?php
2	2
3	3	namespace FluentBoards\App\Hooks\Handlers;
4	4
5		-use FluentBoards\App\Models\Attachment;
6		-use FluentBoards\App\App;
7		-use FluentBoards\App\Models\Meta;
8		-use FluentBoards\App\Services\Constant;
	5	+use FluentBoards\App\Models\CommentImage;
	6	+use FluentBoards\App\Models\Task;
	7	+use FluentBoards\App\Services\AttachmentAccessService;
	8	+use FluentBoards\App\Services\PermissionManager;
	9	+use FluentBoards\App\Services\Libs\FileSystem;
9	10
10	11	class ExternalPages
11	12	{
	13	+ public function view_uploaded_comment_image()
	14	+ {
	15	+ nocache_headers();
	16	+ header('Cache-Control: private, no-store, no-cache, must-revalidate, max-age=0');
12	17
13		-}
	18	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only endpoint; current permissions are checked for every request
	19	+ $attachmentHash = isset($_REQUEST['fbs_comment_image']) && is_string($_REQUEST['fbs_comment_image'])
	20	+ ? sanitize_text_field(wp_unslash($_REQUEST['fbs_comment_image'])) : '';
	21	+
	22	+ if (empty($attachmentHash)) {
	23	+ wp_die(esc_html__('Invalid Attachment Hash', 'fluent-boards'), '', ['response' => 404]);
	24	+ }
	25	+
	26	+ $attachment = $this->getUploadedImageByHash($attachmentHash);
	27	+
	28	+ if (!$attachment) {
	29	+ wp_die(esc_html__('Invalid Attachment Hash', 'fluent-boards'), '', ['response' => 404]);
	30	+ }
	31	+
	32	+ $boardId = (new AttachmentAccessService())->getAccessibleBoardId($attachment);
	33	+ if (!$boardId) {
	34	+ wp_die(esc_html__('You do not have permission to view this image.', 'fluent-boards'), '', ['response' => 403]);
	35	+ }
	36	+
	37	+ // Old URLs may include a board ID, but it can never choose the file directory.
	38	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Optional compatibility parameter is checked against the attachment's board
	39	+ if (isset($_REQUEST['fbs_bid']) && (!is_scalar($_REQUEST['fbs_bid']) || absint(wp_unslash($_REQUEST['fbs_bid'])) !== $boardId)) {
	40	+ wp_die(esc_html__('You do not have permission to view this image.', 'fluent-boards'), '', ['response' => 403]);
	41	+ }
	42	+
	43	+ if ('local' !== $attachment->driver) {
	44	+ if(!empty($attachment->file_path)){
	45	+ $this->redirectToExternalAttachment($attachment->full_url);
	46	+ }else{
	47	+ wp_die(esc_html__('File could not be found', 'fluent-boards'), '', ['response' => 404]);
	48	+ }
	49	+ return;
	50	+ }
	51	+
	52	+ // Preserve legacy absolute paths inside plugin uploads; bare filenames use the trusted board.
	53	+ $filePath = FileSystem::resolveLocalAttachmentPath($attachment->file_path)
	54	+ ?: FileSystem::resolveLocalAttachmentPath($attachment->file_path, $boardId);
	55	+
	56	+ if (!$filePath || !is_readable($filePath)) {
	57	+ wp_die(esc_html__('File could not be found.', 'fluent-boards'), '', ['response' => 404]);
	58	+ }
	59	+
	60	+ $this->serveLocalAttachment($attachment, $filePath);
	61	+ }
	62	+
	63	+ public function view_comment_image()
	64	+ {
	65	+ $this->view_uploaded_comment_image();
	66	+ }
	67	+
	68	+ private function getUploadedImageByHash($attachmentHash)
	69	+ {
	70	+ return CommentImage::where('file_hash', $attachmentHash)->first();
	71	+ }
	72	+
	73	+ private function serveLocalAttachment($attachment, $filePath)
	74	+ {
	75	+ if (ob_get_level()) {
	76	+ ob_end_clean();
	77	+ }
	78	+ header("Content-Type: {$attachment->attachment_type}");
	79	+ header("Content-Disposition: inline; filename=\"{$attachment->title}\"");
	80	+ // phpcs:ignore WordPress.WP.AlternativeFunctions.file_system_operations_readfile -- Serving binary file content directly to browser, WP_Filesystem not suitable for this use case
	81	+ readfile($filePath);
	82	+ die();
	83	+ }
	84	+
	85	+ public function redirectToPage()
	86	+ {
	87	+ nocache_headers();
	88	+ header('Cache-Control: private, no-store, no-cache, must-revalidate, max-age=0');
	89	+
	90	+ // phpcs:ignore WordPress.Security.NonceVerification.Recommended -- Read-only redirect; current board access is checked below
	91	+ $taskId = isset($_GET['taskId']) && is_scalar($_GET['taskId']) ? absint(wp_unslash($_GET['taskId'])) : 0;
	92	+
	93	+ if (!$taskId) {
	94	+ wp_die(esc_html__('Task not found', 'fluent-boards'), '', ['response' => 404]);
	95	+ }
	96	+
	97	+ // Authenticate before looking up task metadata, retaining the email link after login.
	98	+ if (!is_user_logged_in()) {
	99	+ $returnUrl = add_query_arg(['redirect' => 'to_task', 'taskId' => $taskId], site_url('/'));
	100	+ // Match WordPress login redirects, including trusted SSO login_url filters.
	101	+ wp_redirect(wp_login_url($returnUrl));
	102	+ exit;
	103	+ }
	104	+
	105	+ $task = Task::find($taskId);
	106	+ if (!$task || !PermissionManager::userHasPermission($task->board_id)) {
	107	+ wp_die(esc_html__('Task not found', 'fluent-boards'), '', ['response' => 404]);
	108	+ }
	109	+ if ($this->isFrontendEnabled() == 'no') {
	110	+ $urlBase = apply_filters('fluent_boards/app_url', admin_url('admin.php?page=fluent-boards#/'));
	111	+ $page_url = $urlBase . 'boards/' . $task->board_id . '/tasks/' . $task->id . '-' .substr($task->title, 0, 10);
	112	+ wp_redirect($page_url);
	113	+ exit;
	114	+ } else {
	115	+ $urlBase = apply_filters('fluent_boards/app_url', admin_url('admin.php?page=fluent-boards#/'));
	116	+ $page_url = $urlBase . 'boards/' . $task->board_id . '/tasks/' . $task->id . '-' .substr($task->title, 0, 10);
	117	+ wp_redirect($page_url);
	118	+ exit;
	119	+ }
	120	+
	121	+ die();
	122	+ }
	123	+
	124	+ private function isFrontendEnabled()
	125	+ {
	126	+ $storedSettings = get_option('fluent_boards_modules', []);
	127	+ $settings = is_string($storedSettings) ? maybe_unserialize($storedSettings) : $storedSettings;
	128	+
	129	+ if (is_array($settings) && isset($settings['frontend']['enabled'])) {
	130	+ return $settings['frontend']['enabled'];
	131	+ }
	132	+
	133	+ return 'no';
	134	+ }
	135	+ private function redirectToExternalAttachment($redirectUrl)
	136	+ {
	137	+ wp_redirect($redirectUrl, 307);
	138	+ exit();
	139	+ }
	140	+}