← All changes | app/Http/Controllers/FileUploadController.php +44 -2 1.4.2 → 1.6.6 View file →

		@@ -2,11 +2,13 @@
2	2
3	3	namespace FluentCart\App\Http\Controllers;
4	4
5	5	use FluentCart\Api\Resource\UserResource;
	6	+use FluentCart\Api\StorageDrivers;
6	7	use FluentCart\App\Hooks\Handlers\GlobalStorageHandler;
7	8	use FluentCart\App\Http\Requests\UserRequest;
8	9	use FluentCart\App\Services\FileSystem\FileManager;
	10	+use FluentCart\App\Services\FileSystem\StoragePath;
9	11	use FluentCart\Framework\Http\Request\File;
10	12	use FluentCart\Framework\Http\Request\Request;
11	13	use FluentCart\Framework\Support\Arr;
12	14	use FluentCart\Framework\Support\Str;
		@@ -15,9 +17,14 @@
15	17	{
16	18
17	19	public function index(Request $request)
18	20	{
19		- $driver = sanitize_text_field($request->get('driver', 'local'));
	21	+ $driver = sanitize_text_field($request->get('driver', 'local')) ?: 'local';
	22	+
	23	+ if ($error = $this->invalidDriverResponse($driver)) {
	24	+ return $error;
	25	+ }
	26	+
20	27	return [
21	28	'files' => (new FileManager($driver))->listFiles($request->all())
22	29	];
23	30	}
		@@ -23,9 +30,14 @@
23	30	}
24	31
25	32	public function getBucketList(Request $request)
26	33	{
27		- $driver = sanitize_text_field($request->get('driver', ''));
	34	+ $driver = sanitize_text_field($request->get('driver', 'local')) ?: 'local';
	35	+
	36	+ if ($error = $this->invalidDriverResponse($driver)) {
	37	+ return $error;
	38	+ }
	39	+
28	40	$bucketList = (new FileManager($driver))->bucketLists();
29	41	$buckets = [];
30	42	foreach ($bucketList as $bucket) {
31	43	$buckets[] = array(
		@@ -41,8 +53,29 @@
41	53	"buckets" => $buckets
42	54	];
43	55	}
44	56
	57	+ private function invalidDriverResponse($driver)
	58	+ {
	59	+ $availableDrivers = array_keys((new StorageDrivers())->getActive());
	60	+
	61	+ if (in_array($driver, $availableDrivers, true)) {
	62	+ return null;
	63	+ }
	64	+
	65	+ if (empty($availableDrivers)) {
	66	+ $message = __('No storage drivers are enabled. Please enable a storage driver from the storage settings.', 'fluent-cart');
	67	+ } else {
	68	+ /* translators: %1$s: comma separated list of available storage drivers */
	69	+ $message = sprintf(__('Invalid driver. Available drivers: %1$s', 'fluent-cart'), implode(', ', $availableDrivers));
	70	+ }
	71	+
	72	+ return $this->sendError([
	73	+ 'message' => $message,
	74	+ 'available_drivers' => $availableDrivers
	75	+ ], 422);
	76	+ }
	77	+
45	78	public function upload(Request $request)
46	79	{
47	80	/**
48	81	* @var $file File
		@@ -108,8 +141,17 @@
108	141
109	142	$filePath = sanitize_text_field($request->get('file_path'));
110	143	$driver = sanitize_text_field($request->get('driver'));
111	144	$bucket = sanitize_text_field($request->get('bucket'));
	145	+
	146	+ // `..` survives sanitize_text_field(). The local driver contains the
	147	+ // path itself, but no driver has a use for a relative segment, so it is
	148	+ // refused here for every driver.
	149	+ if (!StoragePath::isSafe($filePath)) {
	150	+ return $this->sendError([
	151	+ 'message' => __('Invalid file path', 'fluent-cart')
	152	+ ], 422);
	153	+ }
112	154
113	155	$result = (new FileManager($driver))->deleteFile($filePath, $bucket);
114	156
115	157	if (is_wp_error($result)) {