<?php

[0] Fix | Delete

[1] Fix | Delete

namespace Nextend\Framework\Browse;

[2] Fix | Delete

[3] Fix | Delete

use Exception;

[4] Fix | Delete

use Nextend\Framework\Browse\BulletProof\BulletProof;

[5] Fix | Delete

use Nextend\Framework\Controller\Admin\AdminAjaxController;

[6] Fix | Delete

use Nextend\Framework\Filesystem\Filesystem;

[7] Fix | Delete

use Nextend\Framework\Image\Image;

[8] Fix | Delete

use Nextend\Framework\Notification\Notification;

[9] Fix | Delete

use Nextend\Framework\Request\Request;

[10] Fix | Delete

use Nextend\Framework\ResourceTranslator\ResourceTranslator;

[11] Fix | Delete

use Joomla\CMS\Component\ComponentHelper;

[12] Fix | Delete

[13] Fix | Delete

class ControllerAjaxBrowse extends AdminAjaxController {

[14] Fix | Delete

[15] Fix | Delete

public function actionIndex() {

[16] Fix | Delete

$this->validateToken();

[17] Fix | Delete

$requestedPath = Request::$REQUEST->getVar('path', '');

[18] Fix | Delete

[19] Fix | Delete

$root = Filesystem::convertToRealDirectorySeparator(Filesystem::getImagesFolder());

[20] Fix | Delete

[21] Fix | Delete

$originalFullPath = $root . DIRECTORY_SEPARATOR . ltrim(rtrim($requestedPath, '/'), '/');

[22] Fix | Delete

$path = Filesystem::realpath($originalFullPath);

[23] Fix | Delete

[24] Fix | Delete

if (strpos($path, $root) !== 0) {

[25] Fix | Delete

$path = $root;

[26] Fix | Delete

[27] Fix | Delete

if ($requestedPath) {

[28] Fix | Delete

$isLinkDir = is_link($originalFullPath) ? true : false;

[29] Fix | Delete

if (!$isLinkDir) {

[30] Fix | Delete

/**

[31] Fix | Delete

* If the full path isn't a Symlink, then we should also check if one of the parent folders is a symlink or not.

[32] Fix | Delete

*/

[33] Fix | Delete

$parentDir = $originalFullPath;

[34] Fix | Delete

while (is_dir($parentDir) && $parentDir !== $root && !$isLinkDir) {

[35] Fix | Delete

$parentDir = dirname($parentDir);

[36] Fix | Delete

$isLinkDir = is_link($parentDir);

[37] Fix | Delete

}

[38] Fix | Delete

}

[39] Fix | Delete

[40] Fix | Delete

if ($isLinkDir) {

[41] Fix | Delete

if (str_ends_with($requestedPath, '..')) {

[42] Fix | Delete

/**

[43] Fix | Delete

* Move one level up in a folder that is located inside a Symlink

[44] Fix | Delete

*/

[45] Fix | Delete

$oneLevelUpRequestedPath = substr($requestedPath, 0, -2);

[46] Fix | Delete

$path = dirname($root . DIRECTORY_SEPARATOR . ltrim(rtrim($oneLevelUpRequestedPath, '/'), '/'));

[47] Fix | Delete

} else {

[48] Fix | Delete

/**

[49] Fix | Delete

* Get the Symlink path.

[50] Fix | Delete

*/

[51] Fix | Delete

$path = $originalFullPath;

[52] Fix | Delete

}

[53] Fix | Delete

}

[54] Fix | Delete

}

[55] Fix | Delete

}

[56] Fix | Delete

[57] Fix | Delete

[58] Fix | Delete

$_directories = glob($path . '/*', GLOB_ONLYDIR);

[59] Fix | Delete

$directories = array();

[60] Fix | Delete

for ($i = 0; $i < count($_directories); $i++) {

[61] Fix | Delete

$directories[basename($_directories[$i])] = Filesystem::toLinux($this->relative($_directories[$i], $root));

[62] Fix | Delete

}

[63] Fix | Delete

[64] Fix | Delete

$extensions = array(

[65] Fix | Delete

'jpg',

[66] Fix | Delete

'jpeg',

[67] Fix | Delete

'png',

[68] Fix | Delete

'gif',

[69] Fix | Delete

'mp4',

[70] Fix | Delete

'mp3',

[71] Fix | Delete

'svg',

[72] Fix | Delete

'webp'

[73] Fix | Delete

);

[74] Fix | Delete

$_files = scandir($path);

[75] Fix | Delete

$files = array();

[76] Fix | Delete

for ($i = 0; $i < count($_files); $i++) {

[77] Fix | Delete

$_files[$i] = $path . DIRECTORY_SEPARATOR . $_files[$i];

[78] Fix | Delete

$ext = strtolower(pathinfo($_files[$i], PATHINFO_EXTENSION));

[79] Fix | Delete

if (self::check_utf8($_files[$i]) && in_array($ext, $extensions)) {

[80] Fix | Delete

$files[basename($_files[$i])] = ResourceTranslator::urlToResource(Filesystem::pathToAbsoluteURL($_files[$i]));

[81] Fix | Delete

}

[82] Fix | Delete

}

[83] Fix | Delete

$relativePath = Filesystem::toLinux($this->relative($path, $root));

[84] Fix | Delete

if (!$relativePath) {

[85] Fix | Delete

$relativePath = '';

[86] Fix | Delete

}

[87] Fix | Delete

$this->response->respond(array(

[88] Fix | Delete

'fullPath' => $path,

[89] Fix | Delete

'path' => $relativePath,

[90] Fix | Delete

'directories' => (object)$directories,

[91] Fix | Delete

'files' => (object)$files

[92] Fix | Delete

));

[93] Fix | Delete

}

[94] Fix | Delete

[95] Fix | Delete

private static function check_utf8($str) {

[96] Fix | Delete

$len = strlen($str);

[97] Fix | Delete

for ($i = 0; $i < $len; $i++) {

[98] Fix | Delete

$c = ord($str[$i]);

[99] Fix | Delete

if ($c > 128) {

[100] Fix | Delete

if (($c > 247)) return false; elseif ($c > 239) $bytes = 4;

[101] Fix | Delete

elseif ($c > 223) $bytes = 3;

[102] Fix | Delete

elseif ($c > 191) $bytes = 2;

[103] Fix | Delete

else return false;

[104] Fix | Delete

if (($i + $bytes) > $len) return false;

[105] Fix | Delete

while ($bytes > 1) {

[106] Fix | Delete

$i++;

[107] Fix | Delete

$b = ord($str[$i]);

[108] Fix | Delete

if ($b < 128 || $b > 191) return false;

[109] Fix | Delete

$bytes--;

[110] Fix | Delete

}

[111] Fix | Delete

}

[112] Fix | Delete

}

[113] Fix | Delete

[114] Fix | Delete

return true;

[115] Fix | Delete

}

[116] Fix | Delete

[117] Fix | Delete

public function actionUpload() {

[118] Fix | Delete

if (defined('N2_IMAGE_UPLOAD_DISABLE')) {

[119] Fix | Delete

Notification::error(n2_('You are not allowed to upload!'));

[120] Fix | Delete

$this->response->error();

[121] Fix | Delete

}

[122] Fix | Delete

if (!current_user_can('upload_files')) {

[123] Fix | Delete

Notification::error(n2_('You are not allowed to upload!'));

[124] Fix | Delete

$this->response->error();

[125] Fix | Delete

}

[126] Fix | Delete

[127] Fix | Delete

[128] Fix | Delete

$this->validateToken();

[129] Fix | Delete

[130] Fix | Delete

$image = Request::$FILES->getVar('image');

[131] Fix | Delete

$imageMime = $this->get_image_mime($image['tmp_name']);

[132] Fix | Delete

$allowedMimes = array(

[133] Fix | Delete

'png' => 'image/png',

[134] Fix | Delete

'jpg' => 'image/jpeg',

[135] Fix | Delete

'jpeg' => 'image/jpeg',

[136] Fix | Delete

'gif' => 'image/gif',

[137] Fix | Delete

'webp' => 'image/webp',

[138] Fix | Delete

'svg' => 'image/svg+xml'

[139] Fix | Delete

);

[140] Fix | Delete

if (!in_array($imageMime, get_allowed_mime_types()) || !in_array($imageMime, $allowedMimes)) {

[141] Fix | Delete

Notification::error(n2_('You are not allowed to upload this filetype!'));

[142] Fix | Delete

$this->response->error();

[143] Fix | Delete

}

[144] Fix | Delete

[145] Fix | Delete

$requestedPath = Request::$REQUEST->getVar('path', '');

[146] Fix | Delete

[147] Fix | Delete

$root = Filesystem::getImagesFolder();

[148] Fix | Delete

$folder = ltrim(rtrim($requestedPath, '/'), '/');

[149] Fix | Delete

$originalFullPath = $root . DIRECTORY_SEPARATOR . $folder;

[150] Fix | Delete

$path = Filesystem::realpath($originalFullPath);

[151] Fix | Delete

[152] Fix | Delete

[153] Fix | Delete

if ($path === false || $path == '') {

[154] Fix | Delete

$folder = preg_replace("/[^A-Za-z0-9]/", '', $folder);

[155] Fix | Delete

if (empty($folder)) {

[156] Fix | Delete

Notification::error(n2_('Folder is missing!'));

[157] Fix | Delete

$this->response->error();

[158] Fix | Delete

} else {

[159] Fix | Delete

Filesystem::createFolder($root . '/' . $folder);

[160] Fix | Delete

$path = Filesystem::realpath($root . '/' . $folder);

[161] Fix | Delete

}

[162] Fix | Delete

}

[163] Fix | Delete

[164] Fix | Delete

[165] Fix | Delete

if (strpos($path, $root) !== 0) {

[166] Fix | Delete

if ($requestedPath) {

[167] Fix | Delete

$isLinkDir = is_link($originalFullPath) ? true : false;

[168] Fix | Delete

if (!$isLinkDir) {

[169] Fix | Delete

/**

[170] Fix | Delete

* If the full path isn't a Symlink, then we should also check if one of the parent folders is a symlink or not.

[171] Fix | Delete

*/

[172] Fix | Delete

$parentDir = $originalFullPath;

[173] Fix | Delete

while (is_dir($parentDir) && $parentDir !== $root && !$isLinkDir) {

[174] Fix | Delete

$parentDir = dirname($parentDir);

[175] Fix | Delete

$isLinkDir = is_link($parentDir);

[176] Fix | Delete

}

[177] Fix | Delete

}

[178] Fix | Delete

[179] Fix | Delete

if ($isLinkDir) {

[180] Fix | Delete

/**

[181] Fix | Delete

* Get the Symlink path.

[182] Fix | Delete

*/

[183] Fix | Delete

$path = $originalFullPath;

[184] Fix | Delete

}

[185] Fix | Delete

}

[186] Fix | Delete

}

[187] Fix | Delete

[188] Fix | Delete

$relativePath = Filesystem::toLinux($this->relative($path, $root));

[189] Fix | Delete

if (!$relativePath) {

[190] Fix | Delete

$relativePath = '';

[191] Fix | Delete

}

[192] Fix | Delete

$response = array(

[193] Fix | Delete

'path' => $relativePath

[194] Fix | Delete

);

[195] Fix | Delete

try {

[196] Fix | Delete

if ($image['name'] !== null) {

[197] Fix | Delete

$info = pathinfo($image['name']);

[198] Fix | Delete

[199] Fix | Delete

if ($imageMime != $allowedMimes[strtolower($info['extension'])]) {

[200] Fix | Delete

Notification::error(n2_('You are not allowed to upload a file with different extension (' . $info['extension'] . ') and mime type(' . $imageMime . ')!'));

[201] Fix | Delete

$this->response->error();

[202] Fix | Delete

}

[203] Fix | Delete

[204] Fix | Delete

$fileName = preg_replace('/[^a-zA-Z0-9_-]/', '', $info['filename']);

[205] Fix | Delete

if (strlen($fileName) == 0) {

[206] Fix | Delete

$fileName = '';

[207] Fix | Delete

}

[208] Fix | Delete

[209] Fix | Delete

$upload = new BulletProof();

[210] Fix | Delete

$file = $upload->uploadDir($path)

[211] Fix | Delete

->upload($image, $fileName);

[212] Fix | Delete

$response['name'] = basename($file);

[213] Fix | Delete

$response['url'] = ResourceTranslator::urlToResource(Filesystem::pathToAbsoluteURL($file));

[214] Fix | Delete

[215] Fix | Delete

Image::onImageUploaded($file);

[216] Fix | Delete

}

[217] Fix | Delete

} catch (Exception $e) {

[218] Fix | Delete

Notification::error($e->getMessage());

[219] Fix | Delete

$this->response->error();

[220] Fix | Delete

}

[221] Fix | Delete

[222] Fix | Delete

[223] Fix | Delete

$this->response->respond($response);

[224] Fix | Delete

}

[225] Fix | Delete

[226] Fix | Delete

/**

[227] Fix | Delete

* Returns the real mime type of an image file.

[228] Fix | Delete

*

[229] Fix | Delete

* @param string $file Full path to the file.

[230] Fix | Delete

*

[231] Fix | Delete

* @return string|false The actual mime type or false if the type cannot be determined.

[232] Fix | Delete

*

[233] Fix | Delete

*/

[234] Fix | Delete

private function get_image_mime($file) {

[235] Fix | Delete

/*

[236] Fix | Delete

* Use exif_imagetype() to check the mimetype if available or fall back to

[237] Fix | Delete

* getimagesize() if exif isn't available. If either function throws an Exception

[238] Fix | Delete

* we assume the file could not be validated.

[239] Fix | Delete

*/

[240] Fix | Delete

try {

[241] Fix | Delete

if (is_callable('exif_imagetype')) {

[242] Fix | Delete

$imagetype = exif_imagetype($file);

[243] Fix | Delete

$mime = ($imagetype) ? image_type_to_mime_type($imagetype) : false;

[244] Fix | Delete

} elseif (function_exists('getimagesize')) {

[245] Fix | Delete

$imagesize = @getimagesize($file);

[246] Fix | Delete

$mime = (isset($imagesize['mime'])) ? $imagesize['mime'] : false;

[247] Fix | Delete

} else {

[248] Fix | Delete

$mime = false;

[249] Fix | Delete

}

[250] Fix | Delete

[251] Fix | Delete

if (false !== $mime) {

[252] Fix | Delete

return $mime;

[253] Fix | Delete

}

[254] Fix | Delete

[255] Fix | Delete

$magic = file_get_contents($file, false, null, 0, 12);

[256] Fix | Delete

[257] Fix | Delete

if (false === $magic) {

[258] Fix | Delete

return 'invalid';

[259] Fix | Delete

}

[260] Fix | Delete

[261] Fix | Delete

/*

[262] Fix | Delete

* Add WebP fallback detection when image library doesn't support WebP.

[263] Fix | Delete

* Note: detection values come from LibWebP, see

[264] Fix | Delete

* https://github.com/webmproject/libwebp/blob/master/imageio/image_dec.c#L30

[265] Fix | Delete

*/

[266] Fix | Delete

[267] Fix | Delete

$magic = bin2hex($magic);

[268] Fix | Delete

if (// RIFF.

[269] Fix | Delete

($this->str_starts_with($magic, '52494646')) && // WEBP.

[270] Fix | Delete

(16 === strpos($magic, '57454250'))) {

[271] Fix | Delete

$mime = 'image/webp';

[272] Fix | Delete

} else {

[273] Fix | Delete

// Required for SVG detection

[274] Fix | Delete

$mime = mime_content_type($file);

[275] Fix | Delete

if (!$this->str_starts_with($mime, 'image/')) {

[276] Fix | Delete

$mime = 'invalid';

[277] Fix | Delete

}

[278] Fix | Delete

[279] Fix | Delete

if ($mime === 'image/svg') {

[280] Fix | Delete

$mime = 'image/svg+xml';

[281] Fix | Delete

}

[282] Fix | Delete

}

[283] Fix | Delete

} catch (Exception $e) {

[284] Fix | Delete

$mime = 'invalid';

[285] Fix | Delete

}

[286] Fix | Delete

[287] Fix | Delete

return $mime;

[288] Fix | Delete

}

[289] Fix | Delete

[290] Fix | Delete

private function str_starts_with($haystack, $needle) {

[291] Fix | Delete

if (!function_exists('str_starts_with')) {

[292] Fix | Delete

if ('' === $needle) {

[293] Fix | Delete

return true;

[294] Fix | Delete

}

[295] Fix | Delete

[296] Fix | Delete

return 0 === strpos($haystack, $needle);

[297] Fix | Delete

} else {

[298] Fix | Delete

return str_starts_with($haystack, $needle);

[299] Fix | Delete

}

[300] Fix | Delete

}

[301] Fix | Delete

[302] Fix | Delete

private function relative($path, $root) {

[303] Fix | Delete

return substr(Filesystem::convertToRealDirectorySeparator($path), strlen($root));

[304] Fix | Delete

}

[305] Fix | Delete

}

[306] Fix | Delete

[307] Fix | Delete