Search: Prevented negated terms filling in UI inputs

[bookstack] / app / Uploads / AttachmentService.php

diff --git a/app/Uploads/AttachmentService.php b/app/Uploads/AttachmentService.php
index d530d8fbe8ab12258c1e85397ed8e2d694c0edfe..bd319fbd795af717c4c026d63b9b8bc58ea7fabd 100644 (file)
--- a/app/Uploads/AttachmentService.php
+++ b/app/Uploads/AttachmentService.php
@@ -4,22 +4,21 @@ namespace BookStack\Uploads;
 
 use BookStack\Exceptions\FileUploadException;
 use Exception;
 
 use BookStack\Exceptions\FileUploadException;
 use Exception;

-use Illuminate\Contracts\Filesystem\Factory as FileSystem;
-use Illuminate\Contracts\Filesystem\FileNotFoundException;
-use Illuminate\Contracts\Filesystem\Filesystem as FileSystemInstance;
+use Illuminate\Contracts\Filesystem\Filesystem as Storage;
+use Illuminate\Filesystem\FilesystemManager;

 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Str;

-use League\Flysystem\Util;
+use League\Flysystem\WhitespacePathNormalizer;

 use Symfony\Component\HttpFoundation\File\UploadedFile;
 
 class AttachmentService
 {
 use Symfony\Component\HttpFoundation\File\UploadedFile;
 
 class AttachmentService
 {

-    protected $fileSystem;
+    protected FilesystemManager $fileSystem;

 
     /**
      * AttachmentService constructor.
      */
 
     /**
      * AttachmentService constructor.
      */

-    public function __construct(FileSystem $fileSystem)
+    public function __construct(FilesystemManager $fileSystem)

     {
         $this->fileSystem = $fileSystem;
     }
     {
         $this->fileSystem = $fileSystem;
     }


@@ -27,7 +26,7 @@ class AttachmentService
     /**
      * Get the storage that will be used for storing files.
      */
     /**
      * Get the storage that will be used for storing files.
      */

-    protected function getStorage(): FileSystemInstance
+    protected function getStorageDisk(): Storage

     {
         return $this->fileSystem->disk($this->getStorageDiskName());
     }
     {
         return $this->fileSystem->disk($this->getStorageDiskName());
     }


@@ -41,7 +40,7 @@ class AttachmentService
 
         // Change to our secure-attachment disk if any of the local options
         // are used to prevent escaping that location.
 
         // Change to our secure-attachment disk if any of the local options
         // are used to prevent escaping that location.

-        if ($storageType === 'local' || $storageType === 'local_secure') {
+        if ($storageType === 'local' || $storageType === 'local_secure' || $storageType === 'local_secure_restricted') {

             $storageType = 'local_secure_attachments';
         }
 
             $storageType = 'local_secure_attachments';
         }
 


@@ -54,7 +53,7 @@ class AttachmentService
      */
     protected function adjustPathForStorageDisk(string $path): string
     {
      */
     protected function adjustPathForStorageDisk(string $path): string
     {

-        $path = Util::normalizePath(str_replace('uploads/files/', '', $path));
+        $path = (new WhitespacePathNormalizer())->normalizePath(str_replace('uploads/files/', '', $path));

 
         if ($this->getStorageDiskName() === 'local_secure_attachments') {
             return $path;
 
         if ($this->getStorageDiskName() === 'local_secure_attachments') {
             return $path;


@@ -64,13 +63,21 @@ class AttachmentService
     }
 
     /**
     }
 
     /**

-     * Get an attachment from storage.
+     * Stream an attachment from storage.

      *
      *

-     * @throws FileNotFoundException
+     * @return resource|null

      */
      */

-    public function getAttachmentFromStorage(Attachment $attachment): string
+    public function streamAttachmentFromStorage(Attachment $attachment)

     {
     {

-        return $this->getStorage()->get($this->adjustPathForStorageDisk($attachment->path));
+        return $this->getStorageDisk()->readStream($this->adjustPathForStorageDisk($attachment->path));
+    }
+
+    /**
+     * Read the file size of an attachment from storage, in bytes.
+     */
+    public function getAttachmentFileSize(Attachment $attachment): int
+    {
+        return $this->getStorageDisk()->size($this->adjustPathForStorageDisk($attachment->path));

     }
 
     /**
     }
 
     /**


@@ -162,16 +169,17 @@ class AttachmentService
         $link = trim($requestData['link'] ?? '');
 
         if (!empty($link)) {
         $link = trim($requestData['link'] ?? '');
 
         if (!empty($link)) {

-            $attachment->path = $requestData['link'];

             if (!$attachment->external) {
                 $this->deleteFileInStorage($attachment);
                 $attachment->external = true;
             if (!$attachment->external) {
                 $this->deleteFileInStorage($attachment);
                 $attachment->external = true;

+                $attachment->extension = '';

             }
             }

+            $attachment->path = $requestData['link'];

         }
 
         $attachment->save();
 
         }
 
         $attachment->save();
 

-        return $attachment;
+        return $attachment->refresh();

     }
 
     /**
     }
 
     /**


@@ -194,7 +202,7 @@ class AttachmentService
      */
     protected function deleteFileInStorage(Attachment $attachment)
     {
      */
     protected function deleteFileInStorage(Attachment $attachment)
     {

-        $storage = $this->getStorage();
+        $storage = $this->getStorageDisk();

         $dirPath = $this->adjustPathForStorageDisk(dirname($attachment->path));
 
         $storage->delete($this->adjustPathForStorageDisk($attachment->path));
         $dirPath = $this->adjustPathForStorageDisk(dirname($attachment->path));
 
         $storage->delete($this->adjustPathForStorageDisk($attachment->path));


@@ -210,20 +218,19 @@ class AttachmentService
      */
     protected function putFileInStorage(UploadedFile $uploadedFile): string
     {
      */
     protected function putFileInStorage(UploadedFile $uploadedFile): string
     {

-        $attachmentData = file_get_contents($uploadedFile->getRealPath());
-
-        $storage = $this->getStorage();
+        $storage = $this->getStorageDisk();

         $basePath = 'uploads/files/' . date('Y-m-M') . '/';
 
         $basePath = 'uploads/files/' . date('Y-m-M') . '/';
 

-        $uploadFileName = Str::random(16) . '.' . $uploadedFile->getClientOriginalExtension();
+        $uploadFileName = Str::random(16) . '-' . $uploadedFile->getClientOriginalExtension();

         while ($storage->exists($this->adjustPathForStorageDisk($basePath . $uploadFileName))) {
             $uploadFileName = Str::random(3) . $uploadFileName;
         }
 
         while ($storage->exists($this->adjustPathForStorageDisk($basePath . $uploadFileName))) {
             $uploadFileName = Str::random(3) . $uploadFileName;
         }
 

+        $attachmentStream = fopen($uploadedFile->getRealPath(), 'r');

         $attachmentPath = $basePath . $uploadFileName;
 
         try {
         $attachmentPath = $basePath . $uploadFileName;
 
         try {

-            $storage->put($this->adjustPathForStorageDisk($attachmentPath), $attachmentData);
+            $storage->writeStream($this->adjustPathForStorageDisk($attachmentPath), $attachmentStream);

         } catch (Exception $e) {
             Log::error('Error when attempting file upload:' . $e->getMessage());
 
         } catch (Exception $e) {
             Log::error('Error when attempting file upload:' . $e->getMessage());
 


@@ -232,4 +239,12 @@ class AttachmentService
 
         return $attachmentPath;
     }
 
         return $attachmentPath;
     }

+
+    /**
+     * Get the file validation rules for attachments.
+     */
+    public function getFileValidationRules(): array
+    {
+        return ['file', 'max:' . (config('app.upload_limit') * 1000)];
+    }

 }
 }