github-mirror/BookStack
2
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-06-05 18:04:33 +08:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Updated showImage file serving to not be traversable

Browse Source 
For #3030
This commit is contained in:
Dan Brown
2021-10-31 23:53:17 +00:00
parent ae155d6745
commit 43830a372f
4 changed files with 84 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
app/Http/Controllers/Images/ImageController.php
View File

@ -7,25 +7,31 @@ use BookStack\Exceptions\NotFoundException;
use BookStack\Http\Controllers\Controller;
use BookStack\Uploads\Image;
use BookStack\Uploads\ImageRepo;
use BookStack\Uploads\ImageService;
use Exception;
use Illuminate\Filesystem\Filesystem as File;
use Illuminate\Filesystem\FilesystemAdapter;
use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;
use Illuminate\Validation\ValidationException;
use League\Flysystem\Util;
class ImageController extends Controller
{
protected $image;
protected $file;
protected $imageRepo;
protected $imageService;
/**
* ImageController constructor.
*/
public function __construct(Image $image, File $file, ImageRepo $imageRepo)
public function __construct(Image $image, File $file, ImageRepo $imageRepo, ImageService $imageService)
{
$this->image = $image;
$this->file = $file;
$this->imageRepo = $imageRepo;
$this->imageService = $imageService;
}
/**
@ -35,14 +41,13 @@ class ImageController extends Controller
*/
public function showImage(string $path)
{
$path = storage_path('uploads/images/' . $path);
if (!file_exists($path)) {
if (!$this->imageService->pathExistsInLocalSecure($path)) {
throw (new NotFoundException(trans('errors.image_not_found')))
->setSubtitle(trans('errors.image_not_found_subtitle'))
->setDetails(trans('errors.image_not_found_details'));
}
return response()->file($path);
return $this->imageService->streamImageFromStorageResponse('gallery', $path);
}
/**