← All changes | app/Http/Controllers/UploaderController.php +31 -0 2.3.2 → 2.4.0 View file →

		@@ -3,8 +3,9 @@
3	3	namespace FluentSupport\App\Http\Controllers;
4	4
5	5	use FluentSupport\App\Models\Attachment;
6	6	use FluentSupport\App\Models\Ticket;
	7	+use FluentSupport\App\Modules\PermissionManager;
7	8	use FluentSupport\App\Services\EmailNotification\Settings;
8	9	use FluentSupport\App\Services\Helper;
9	10	use FluentSupport\Framework\Http\Request\Request;
10	11	use FluentSupport\App\Services\Includes\UploadService;
		@@ -44,8 +45,12 @@
44	45	if ($permissionError = $this->checkPermissionToUploadFile($person)) {
45	46	return $permissionError;
46	47	}
47	48
	49	+ if ($accessError = $this->checkTicketAccess($ticketId)) {
	50	+ return $accessError;
	51	+ }
	52	+
48	53	if ($quotaError = $this->checkAttachmentQuota($files, $person, $ticketId, $maxFileUpload)) {
49	54	return $quotaError;
50	55	}
51	56
		@@ -90,8 +95,30 @@
90	95
91	96	return null;
92	97	}
93	98
	99	+ /**
	100	+ * resolveTicketId() passes an agent's ticket_id through unchecked, so authorize it
	101	+ * before anything is written. No ticket id is legitimate — the Add Ticket form
	102	+ * uploads before the ticket exists.
	103	+ */
	104	+ private function checkTicketAccess($ticketId)
	105	+ {
	106	+ if (!$ticketId || !Helper::getCurrentAgent()) {
	107	+ return null;
	108	+ }
	109	+
	110	+ $ticket = Ticket::find($ticketId);
	111	+
	112	+ if (!$ticket || !PermissionManager::canAccessTicket($ticket)) {
	113	+ return $this->sendError([
	114	+ 'message' => __('You do not have permission to upload a file to this ticket', 'fluent-support'),
	115	+ ], 403);
	116	+ }
	117	+
	118	+ return null;
	119	+ }
	120	+
94	121	private function checkAttachmentQuota($files, $person, $ticketId, $maxFileUpload)
95	122	{
96	123	if ($maxFileUpload <= 0) {
97	124	return null;
		@@ -235,8 +262,12 @@
235	262	public function uploadImage(Request $request)
236	263	{
237	264	$images = $request->files();
238	265	$ticketId = $this->resolveTicketId($request);
	266	+
	267	+ if ($accessError = $this->checkTicketAccess($ticketId)) {
	268	+ return $accessError;
	269	+ }
239	270
240	271	$validationError = $this->isValidImageType($images);
241	272	if ($validationError) {
242	273	return $validationError;