← All changes | app/Http/Controllers/UploaderController.php +13 -115 trunk → 2.1.1 View file →

		@@ -3,9 +3,8 @@
3	3	namespace FluentSupport\App\Http\Controllers;
4	4
5	5	use FluentSupport\App\Models\Attachment;
6	6	use FluentSupport\App\Models\Ticket;
7		-use FluentSupport\App\Modules\PermissionManager;
8	7	use FluentSupport\App\Services\EmailNotification\Settings;
9	8	use FluentSupport\App\Services\Helper;
10	9	use FluentSupport\Framework\Http\Request\Request;
11	10	use FluentSupport\App\Services\Includes\UploadService;
		@@ -27,38 +26,20 @@
27	26	public function uploadTicketFiles(Request $request)
28	27	{
29	28	$settings = (new Settings())->globalBusinessSettings();
30	29	$maxFileSize = floatval($settings['max_file_size']);
31		- $maxFileUpload = intval($settings['max_file_upload']);
32	30	$mimeHeadings = Helper::getAcceptedMimeHeadings();
33	31	$maxSizeBytes = $maxFileSize * 1024;
34	32	$imageType = $request->type ? $request->type : null;
35	33
36		- $files = $request->files();
37		-
38		- if ($partsError = $this->rejectUnexpectedFileParts($files)) {
39		- return $partsError;
40		- }
41		-
	34	+ $this->validateUploadedFiles($request->files(), $maxSizeBytes, $mimeHeadings, $maxFileSize);
42	35	$ticketId = $this->resolveTicketId($request);
43	36	$person = $this->resolvePerson($ticketId, $request);
44	37
45		- if ($permissionError = $this->checkPermissionToUploadFile($person)) {
46		- return $permissionError;
47		- }
	38	+ $this->checkPermissionToUploadFile($person);
48	39
49		- if ($accessError = $this->checkTicketAccess($ticketId)) {
50		- return $accessError;
51		- }
52		-
53		- if ($quotaError = $this->checkAttachmentQuota($files, $person, $ticketId, $maxFileUpload)) {
54		- return $quotaError;
55		- }
56		-
57		- $this->validateUploadedFiles($files, $maxSizeBytes, $mimeHeadings, $maxFileSize);
58		-
59	40	try {
60		- $uploadedFiles = UploadService::handleTempFileUpload($files);
	41	+ $uploadedFiles = UploadService::handleTempFileUpload($request->files());
61	42	} catch (\Exception $e) {
62	43	return $this->sendError([
63	44	'message' => Helper::getSafeErrorMessage($e),
64	45	]);
		@@ -76,73 +57,8 @@
76	57	'attachments' => $attachmentHashes,
77	58	];
78	59	}
79	60
80		- /**
81		- * Only the "file" multipart part is validated and processed downstream
82		- * (UploadService/FileSystem::put() loops every top-level part it is given), so
83		- * any other part name must be rejected here rather than silently passed through.
84		- */
85		- private function rejectUnexpectedFileParts($files)
86		- {
87		- $files = (array) $files;
88		- $unexpectedKeys = array_diff(array_keys($files), ['file']);
89		-
90		- if ($unexpectedKeys || empty($files['file'])) {
91		- return $this->sendError([
92		- 'message' => __('Invalid file upload request.', 'fluent-support'),
93		- ]);
94		- }
95		-
96		- return null;
97		- }
98		-
99		- /**
100		- * resolveTicketId() passes an agent's ticket_id through unchecked, so authorize it
101		- * before anything is written. No ticket id is legitimate — the Add Ticket form
102		- * uploads before the ticket exists.
103		- */
104		- private function checkTicketAccess($ticketId)
105		- {
106		- if (!$ticketId || !Helper::getCurrentAgent()) {
107		- return null;
108		- }
109		-
110		- $ticket = Ticket::find($ticketId);
111		-
112		- if (!$ticket || !PermissionManager::canAccessTicket($ticket)) {
113		- return $this->sendError([
114		- 'message' => __('You do not have permission to upload a file to this ticket', 'fluent-support'),
115		- ], 403);
116		- }
117		-
118		- return null;
119		- }
120		-
121		- private function checkAttachmentQuota($files, $person, $ticketId, $maxFileUpload)
122		- {
123		- if ($maxFileUpload <= 0) {
124		- return null;
125		- }
126		-
127		- $newFiles = isset($files['file']) ? $files['file'] : null;
128		- $newFilesCount = is_array($newFiles) ? count($newFiles) : 1;
129		-
130		- $existingCount = Attachment::where('person_id', $person->id)
131		- ->where('ticket_id', $ticketId)
132		- ->where('status', 'in-active')
133		- ->count();
134		-
135		- if (($existingCount + $newFilesCount) > $maxFileUpload) {
136		- return $this->sendError([
137		- // translators: %d is the maximum number of files allowed per ticket
138		- 'message' => sprintf(__('You can upload a maximum of %d files.', 'fluent-support'), $maxFileUpload),
139		- ]);
140		- }
141		-
142		- return null;
143		- }
144		-
145	61	private function validateUploadedFiles($files, $maxSizeBytes, $mimeHeadings, $maxFileSize)
146	62	{
147	63	$validationRules = [
148	64	'file' => 'max:' . $maxSizeBytes . '|mimetypes:' . implode(',', Helper::ticketAcceptedFileMiles()),
		@@ -160,27 +76,15 @@
160	76
161	77	private function resolveTicketId($request)
162	78	{
163	79	$ticketId = $request->getSafe('ticket_id', 'intval');
164		-
165		- if ($ticketId == 'undefined' || !$ticketId) {
166		- return null;
167		- }
168		-
169		- if (Helper::getCurrentAgent()) {
170		- return $ticketId;
171		- }
172		-
173		- $ticket = Ticket::wherePublicIdentifier($ticketId)->first();
174		-
175		- return $ticket ? $ticket->id : null;
	80	+ return $ticketId == 'undefined' ? null : $ticketId;
176	81	}
177	82
178	83	private function resolvePerson($ticketId, Request $request)
179	84	{
180		- $agent = Helper::getCurrentAgent();
181		- if ($agent) {
182		- return $agent;
	85	+ if ($request->getSafe('is_agent', 'sanitize_text_field') == 'yes') {
	86	+ return Helper::getCurrentAgent();
183	87	}
184	88
185	89	if ($ticketId && Helper::isPublicSignedTicketEnabled()) {
186	90	$intendedTicketHash = $request->getSafe('intended_ticket_hash', 'sanitize_text_field');
		@@ -186,10 +90,9 @@
186	90	$intendedTicketHash = $request->getSafe('intended_ticket_hash', 'sanitize_text_field');
187	91	if ($intendedTicketHash && $intendedTicketHash != 'undefined') {
188	92	$ticket = Ticket::with(['customer'])
189	93	->where('hash', $intendedTicketHash)
190		- ->wherePublicIdentifier($ticketId)
191		- ->first();
	94	+ ->find($ticketId);
192	95
193	96	if ($ticket && $ticket->customer) {
194	97	return $ticket->customer;
195	98	}
		@@ -219,9 +122,9 @@
219	122
220	123	private function createAttachmentRecords($uploadedFiles, $ticketId, $person, $imageType)
221	124	{
222	125	$attachments = [];
223		- $directPasteUrl = null;
	126	+ $full_path = null;
224	127
225	128	foreach ($uploadedFiles as $file) {
226	129	if (empty($file['file_path'])) continue;
227	130
		@@ -238,16 +141,15 @@
238	141	'local_temp_path' => $file['file_path'],
239	142	]
240	143	];
241	144
	145	+ if($imageType == 'direct_paste'){
	146	+ $full_path = esc_url($file['url']);
	147	+ }
	148	+
242	149	try {
243	150	$attachment = Attachment::create($fileData);
244	151	$attachments[] = $attachment->file_hash;
245		-
246		- if ($imageType == 'direct_paste') {
247		- $directPasteUrl = $attachment->secureUrl;
248		- }
249		-
250	152	do_action('fluent_support/attachment_uploaded_as_temp', $attachment, $ticketId);
251	153	$driver = Helper::getUploadDriverKey();
252	154
253	155	do_action_ref_array('fluent_support/attachment_uploaded_as_temp_' . $driver, [&$attachment, $ticketId]);
		@@ -255,9 +157,9 @@
255	157	continue;
256	158	}
257	159	}
258	160
259		- return $imageType == 'direct_paste' ? $directPasteUrl : $attachments;
	161	+ return $imageType == 'direct_paste' ? $full_path : $attachments;
260	162	}
261	163
262	164	public function uploadImage(Request $request)
263	165	{
		@@ -262,12 +164,8 @@
262	164	public function uploadImage(Request $request)
263	165	{
264	166	$images = $request->files();
265	167	$ticketId = $this->resolveTicketId($request);
266		-
267		- if ($accessError = $this->checkTicketAccess($ticketId)) {
268		- return $accessError;
269		- }
270	168
271	169	$validationError = $this->isValidImageType($images);
272	170	if ($validationError) {
273	171	return $validationError;