Added 404 response for non-existing setting categories

[bookstack] / app / Http / Controllers / SettingController.php

diff --git a/app/Http/Controllers/SettingController.php b/app/Http/Controllers/SettingController.php
index 65135eda3816079eea164c229acd89d9e57fe9ad..3d1c184cdcebe0acac5ac0ad441b8ef9c00aeb0d 100644 (file)
--- a/app/Http/Controllers/SettingController.php
+++ b/app/Http/Controllers/SettingController.php
@@ -1,46 +1,87 @@
-<?php namespace BookStack\Http\Controllers;
+<?php

 
 

-use Illuminate\Http\Request;
+namespace BookStack\Http\Controllers;

 
 

-use BookStack\Http\Requests;
-use Setting;
+use BookStack\Actions\ActivityType;
+use BookStack\Auth\User;
+use BookStack\Uploads\ImageRepo;
+use Illuminate\Http\Request;

 
 class SettingController extends Controller
 {
 
 class SettingController extends Controller
 {

+    protected ImageRepo $imageRepo;
+
+    protected array $settingCategories = ['features', 'customization', 'registration'];
+
+    public function __construct(ImageRepo $imageRepo)
+    {
+        $this->imageRepo = $imageRepo;
+    }
+

     /**
      * Display a listing of the settings.
     /**
      * Display a listing of the settings.

-     * @return Response

      */
      */

-    public function index()
+    public function index(string $category)

     {
     {

+        $this->ensureCategoryExists($category);

         $this->checkPermission('settings-manage');
         $this->checkPermission('settings-manage');

-        $this->setPageTitle('Settings');
+        $this->setPageTitle(trans('settings.settings'));

 
         // Get application version
         $version = trim(file_get_contents(base_path('version')));
 
 
         // Get application version
         $version = trim(file_get_contents(base_path('version')));
 

-        return view('settings/index', ['version' => $version]);
+        return view('settings.' . $category, [
+            'category'  => $category,
+            'version'   => $version,
+            'guestUser' => User::getDefault(),
+        ]);

     }
 
     /**
      * Update the specified settings in storage.
     }
 
     /**
      * Update the specified settings in storage.

-     * @param  Request $request
-     * @return Response

      */
      */

-    public function update(Request $request)
+    public function update(Request $request, string $category)

     {
     {

-        $this->preventAccessForDemoUsers();
+        $this->ensureCategoryExists($category);
+        $this->preventAccessInDemoMode();

         $this->checkPermission('settings-manage');
         $this->checkPermission('settings-manage');

+        $this->validate($request, [
+            'app_logo' => array_merge(['nullable'], $this->getImageValidationRules()),
+        ]);

 
         // Cycles through posted settings and update them
         foreach ($request->all() as $name => $value) {
 
         // Cycles through posted settings and update them
         foreach ($request->all() as $name => $value) {

-            if (strpos($name, 'setting-') !== 0) continue;

             $key = str_replace('setting-', '', trim($name));
             $key = str_replace('setting-', '', trim($name));

-            Setting::put($key, $value);
+            if (strpos($name, 'setting-') !== 0) {
+                continue;
+            }
+            setting()->put($key, $value);

         }
 
         }
 

-        session()->flash('success', 'Settings Saved');
-        return redirect('/settings');
+        // Update logo image if set
+        if ($category === 'customization' && $request->hasFile('app_logo')) {
+            $logoFile = $request->file('app_logo');
+            $this->imageRepo->destroyByType('system');
+            $image = $this->imageRepo->saveNew($logoFile, 'system', 0, null, 86);
+            setting()->put('app-logo', $image->url);
+        }
+
+        // Clear logo image if requested
+        if ($category === 'customization' &&  $request->get('app_logo_reset', null)) {
+            $this->imageRepo->destroyByType('system');
+            setting()->remove('app-logo');
+        }
+
+        $this->logActivity(ActivityType::SETTINGS_UPDATE, $category);
+        $this->showSuccessNotification(trans('settings.settings_save_success'));
+
+        return redirect("/settings/${category}");

     }
 
     }
 

+    protected function ensureCategoryExists(string $category): void
+    {
+        if (!in_array($category, $this->settingCategories)) {
+            abort(404);
+        }
+    }

 }
 }