| 1 |
<?php |
| 2 |
/** |
| 3 |
* @package VikBooking |
| 4 |
* @subpackage core |
| 5 |
* @author E4J s.r.l. |
| 6 |
* @copyright Copyright (C) 2025 E4J s.r.l. All Rights Reserved. |
| 7 |
* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL |
| 8 |
* @link https://vikwp.com |
| 9 |
*/ |
| 10 |
|
| 11 |
// No direct access |
| 12 |
defined('ABSPATH') or die('No script kiddies please!'); |
| 13 |
|
| 14 |
/** |
| 15 |
* VikBooking service controller (admin). |
| 16 |
* |
| 17 |
* @since 1.18.3 (J) - 1.8.3 (WP) |
| 18 |
*/ |
| 19 |
class VikBookingControllerService extends JControllerAdmin |
| 20 |
{ |
| 21 |
/** |
| 22 |
* AJAX endpoint to upload one or more files. |
| 23 |
* |
| 24 |
* @return void |
| 25 |
* |
| 26 |
* @see VBOParamsRendering |
| 27 |
*/ |
| 28 |
public function upload() |
| 29 |
{ |
| 30 |
$app = JFactory::getApplication(); |
| 31 |
|
| 32 |
if (!JSession::checkToken()) { |
| 33 |
// missing CSRF-proof token |
| 34 |
VBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN')); |
| 35 |
} |
| 36 |
|
| 37 |
$files = $app->input->files->get('vbo_files', [], 'array'); |
| 38 |
$allowed_exts = $app->input->getString('allowed_types', ''); |
| 39 |
$safe_name = $app->input->getBool('safe_file_name', false); |
| 40 |
|
| 41 |
if (!$files) { |
| 42 |
VBOHttpDocument::getInstance($app)->close(400, 'No files to process for upload.'); |
| 43 |
} |
| 44 |
|
| 45 |
if (VBOPlatformDetection::isWordPress()) { |
| 46 |
VikBookingLoader::import('update.manager'); |
| 47 |
} |
| 48 |
|
| 49 |
if ($files['tmp_name'] ?? null) { |
| 50 |
// unusual single-array structure |
| 51 |
$files = [$files]; |
| 52 |
} |
| 53 |
|
| 54 |
// result default properties |
| 55 |
$result = [ |
| 56 |
'processed' => 0, |
| 57 |
'paths' => [], |
| 58 |
'urls' => [], |
| 59 |
'fileNames' => [], |
| 60 |
]; |
| 61 |
|
| 62 |
// upload base path and URI |
| 63 |
$upload_base_path = implode(DIRECTORY_SEPARATOR, [VBO_ADMIN_PATH, 'resources', 'pmsdata', '']); |
| 64 |
$upload_base_uri = VBO_ADMIN_URI . 'resources/pmsdata/'; |
| 65 |
|
| 66 |
// file type and extension default filtering rule |
| 67 |
$allowed_types_list = [ |
| 68 |
// images |
| 69 |
'png', |
| 70 |
'jpg', |
| 71 |
'jpeg', |
| 72 |
'webp', |
| 73 |
'bmp', |
| 74 |
'heic', |
| 75 |
// archives |
| 76 |
'zip', |
| 77 |
'rar', |
| 78 |
// documents |
| 79 |
'pdf', |
| 80 |
'doc', |
| 81 |
'docx', |
| 82 |
'rtf', |
| 83 |
'odt', |
| 84 |
'pages', |
| 85 |
'xls', |
| 86 |
'xlsx', |
| 87 |
'csv', |
| 88 |
'ods', |
| 89 |
'numbers', |
| 90 |
'txt', |
| 91 |
'md', |
| 92 |
// public certificates |
| 93 |
'crt', |
| 94 |
'cer', |
| 95 |
'pem', |
| 96 |
'der', |
| 97 |
'p7b', |
| 98 |
// private keys/chains |
| 99 |
'key', |
| 100 |
'pem', |
| 101 |
'p12', |
| 102 |
'pfx', |
| 103 |
// certificate requests |
| 104 |
'csr', |
| 105 |
'req', |
| 106 |
]; |
| 107 |
|
| 108 |
// check if only specific file types must be accepted |
| 109 |
if ($allowed_exts) { |
| 110 |
// convert the filtering rule string into an array |
| 111 |
$allowed_exts = array_values(array_filter(explode(',', $allowed_exts))); |
| 112 |
// get the known (safe) file types requested |
| 113 |
$known_exts = array_intersect($allowed_exts, $allowed_types_list); |
| 114 |
if ($known_exts) { |
| 115 |
// given filtering rule is accepted |
| 116 |
$allowed_types_list = $known_exts; |
| 117 |
} |
| 118 |
} |
| 119 |
|
| 120 |
// stringify files filtering rule |
| 121 |
$allowed_types_str = implode(',', $allowed_types_list); |
| 122 |
|
| 123 |
// process the file(s) to upload |
| 124 |
foreach ($files as $file) { |
| 125 |
try { |
| 126 |
// increase counter |
| 127 |
$result['processed']++; |
| 128 |
|
| 129 |
if ($safe_name) { |
| 130 |
// modify at runtime the original file name |
| 131 |
if (preg_match("/(.*?)(\.[0-9a-z]{2,})$/i", basename($file['name']), $match)) { |
| 132 |
// extract file name and extension |
| 133 |
$orig_filename = $match[1]; |
| 134 |
$orig_fileext = $match[2]; |
| 135 |
// generate a new safe file name |
| 136 |
$file['name'] = uniqid(rand(1, 99999) . '_') . $orig_fileext; |
| 137 |
} |
| 138 |
} |
| 139 |
|
| 140 |
// attempt to upload the file and obtain the result information |
| 141 |
$uploaded = (array) VikBooking::uploadFileFromRequest($file, $upload_base_path, $allowed_types_str); |
| 142 |
|
| 143 |
// push uploaded file path |
| 144 |
$result['paths'][] = $uploaded['path']; |
| 145 |
|
| 146 |
// push uploaded file uri |
| 147 |
$result['urls'][] = $upload_base_uri . $uploaded['filename']; |
| 148 |
|
| 149 |
// push uploaded file name |
| 150 |
$result['fileNames'][] = $uploaded['filename']; |
| 151 |
|
| 152 |
if (VBOPlatformDetection::isWordPress()) { |
| 153 |
VikBookingUpdateManager::triggerUploadBackup($uploaded['path']); |
| 154 |
} |
| 155 |
} catch (Exception $e) { |
| 156 |
// do nothing |
| 157 |
} |
| 158 |
} |
| 159 |
|
| 160 |
// send the response to output |
| 161 |
VBOHttpDocument::getInstance($app)->json($result); |
| 162 |
} |
| 163 |
} |
| 164 |
|
