]> BookStack Code Mirror - bookstack/blob - app/Http/Controllers/Images/ImageController.php
Updated showImage file serving to not be traversable
[bookstack] / app / Http / Controllers / Images / ImageController.php
1 <?php
2
3 namespace BookStack\Http\Controllers\Images;
4
5 use BookStack\Exceptions\ImageUploadException;
6 use BookStack\Exceptions\NotFoundException;
7 use BookStack\Http\Controllers\Controller;
8 use BookStack\Uploads\Image;
9 use BookStack\Uploads\ImageRepo;
10 use BookStack\Uploads\ImageService;
11 use Exception;
12 use Illuminate\Filesystem\Filesystem as File;
13 use Illuminate\Filesystem\FilesystemAdapter;
14 use Illuminate\Http\Request;
15 use Illuminate\Support\Facades\Storage;
16 use Illuminate\Validation\ValidationException;
17 use League\Flysystem\Util;
18
19 class ImageController extends Controller
20 {
21     protected $image;
22     protected $file;
23     protected $imageRepo;
24     protected $imageService;
25
26     /**
27      * ImageController constructor.
28      */
29     public function __construct(Image $image, File $file, ImageRepo $imageRepo, ImageService $imageService)
30     {
31         $this->image = $image;
32         $this->file = $file;
33         $this->imageRepo = $imageRepo;
34         $this->imageService = $imageService;
35     }
36
37     /**
38      * Provide an image file from storage.
39      *
40      * @throws NotFoundException
41      */
42     public function showImage(string $path)
43     {
44         if (!$this->imageService->pathExistsInLocalSecure($path)) {
45             throw (new NotFoundException(trans('errors.image_not_found')))
46                 ->setSubtitle(trans('errors.image_not_found_subtitle'))
47                 ->setDetails(trans('errors.image_not_found_details'));
48         }
49
50         return $this->imageService->streamImageFromStorageResponse('gallery', $path);
51     }
52
53     /**
54      * Update image details.
55      *
56      * @throws ImageUploadException
57      * @throws ValidationException
58      */
59     public function update(Request $request, string $id)
60     {
61         $this->validate($request, [
62             'name' => 'required|min:2|string',
63         ]);
64
65         $image = $this->imageRepo->getById($id);
66         $this->checkImagePermission($image);
67         $this->checkOwnablePermission('image-update', $image);
68
69         $image = $this->imageRepo->updateImageDetails($image, $request->all());
70
71         $this->imageRepo->loadThumbs($image);
72
73         return view('pages.parts.image-manager-form', [
74             'image'          => $image,
75             'dependantPages' => null,
76         ]);
77     }
78
79     /**
80      * Get the form for editing the given image.
81      *
82      * @throws Exception
83      */
84     public function edit(Request $request, string $id)
85     {
86         $image = $this->imageRepo->getById($id);
87         $this->checkImagePermission($image);
88
89         if ($request->has('delete')) {
90             $dependantPages = $this->imageRepo->getPagesUsingImage($image);
91         }
92
93         $this->imageRepo->loadThumbs($image);
94
95         return view('pages.parts.image-manager-form', [
96             'image'          => $image,
97             'dependantPages' => $dependantPages ?? null,
98         ]);
99     }
100
101     /**
102      * Deletes an image and all thumbnail/image files.
103      *
104      * @throws Exception
105      */
106     public function destroy(string $id)
107     {
108         $image = $this->imageRepo->getById($id);
109         $this->checkOwnablePermission('image-delete', $image);
110         $this->checkImagePermission($image);
111
112         $this->imageRepo->destroyImage($image);
113
114         return response('');
115     }
116
117     /**
118      * Check related page permission and ensure type is drawio or gallery.
119      */
120     protected function checkImagePermission(Image $image)
121     {
122         if ($image->type !== 'drawio' && $image->type !== 'gallery') {
123             $this->showPermissionError();
124         }
125
126         $relatedPage = $image->getPage();
127         if ($relatedPage) {
128             $this->checkOwnablePermission('page-view', $relatedPage);
129         }
130     }
131 }