- foreach ($potentialHostPaths as $potentialBasePath) {
- $potentialBasePath = strtolower($potentialBasePath);
- if (strpos(strtolower($url), $potentialBasePath) === 0) {
- return 'uploads/images/' . trim(substr($url, strlen($potentialBasePath)), '/');
- }
+ /**
+ * Check that the current user has access to the relation
+ * of the image at the given path.
+ */
+ protected function checkUserHasAccessToRelationOfImageAtPath(string $path): bool
+ {
+ if (str_starts_with($path, 'uploads/images/')) {
+ $path = substr($path, 15);
+ }
+
+ // Strip thumbnail element from path if existing
+ $originalPathSplit = array_filter(explode('/', $path), function (string $part) {
+ $resizedDir = (str_starts_with($part, 'thumbs-') || str_starts_with($part, 'scaled-'));
+ $missingExtension = !str_contains($part, '.');
+
+ return !($resizedDir && $missingExtension);
+ });
+
+ // Build a database-format image path and search for the image entry
+ $fullPath = '/uploads/images/' . ltrim(implode('/', $originalPathSplit), '/');
+ $image = Image::query()->where('path', '=', $fullPath)->first();
+
+ if (is_null($image)) {
+ return false;
+ }
+
+ $imageType = $image->type;
+
+ // Allow user or system (logo) images
+ // (No specific relation control but may still have access controlled by auth)
+ if ($imageType === 'user' || $imageType === 'system') {
+ return true;
+ }
+
+ if ($imageType === 'gallery' || $imageType === 'drawio') {
+ return $this->queries->pages->visibleForList()->where('id', '=', $image->uploaded_to)->exists();
+ }
+
+ if ($imageType === 'cover_book') {
+ return $this->queries->books->visibleForList()->where('id', '=', $image->uploaded_to)->exists();
+ }
+
+ if ($imageType === 'cover_bookshelf') {
+ return $this->queries->shelves->visibleForList()->where('id', '=', $image->uploaded_to)->exists();