BookStack Code Mirror - bookstack/blob - app/Http/Controllers/Api/AttachmentApiController.php

   1 <?php
   2
   3 namespace BookStack\Http\Controllers\Api;
   4
   5 use BookStack\Entities\Models\Page;
   6 use BookStack\Exceptions\FileUploadException;
   7 use BookStack\Uploads\Attachment;
   8 use BookStack\Uploads\AttachmentService;
   9 use Exception;
  10 use Illuminate\Contracts\Filesystem\FileNotFoundException;
  11 use Illuminate\Http\Request;
  12 use Illuminate\Validation\ValidationException;
  13
  14 class AttachmentApiController extends ApiController
  15 {
  16     protected $attachmentService;
  17
  18     protected $rules = [
  19         'create' => [
  20             'name' => 'required|min:1|max:255|string',
  21             'uploaded_to' => 'required|integer|exists:pages,id',
  22             'file' => 'required_without:link|file',
  23             'link' => 'required_without:file|min:1|max:255|safe_url'
  24         ],
  25         'update' => [
  26             'name' => 'min:1|max:255|string',
  27             'uploaded_to' => 'integer|exists:pages,id',
  28             'file' => 'file',
  29             'link' => 'min:1|max:255|safe_url'
  30         ],
  31     ];
  32
  33     public function __construct(AttachmentService $attachmentService)
  34     {
  35         $this->attachmentService = $attachmentService;
  36     }
  37
  38     /**
  39      * Get a listing of attachments visible to the user.
  40      * The external property indicates whether the attachment is simple a link.
  41      * A false value for the external property would indicate a file upload.
  42      */
  43     public function list()
  44     {
  45         return $this->apiListingResponse(Attachment::visible(), [
  46             'id', 'name', 'extension', 'uploaded_to', 'external', 'order', 'created_at', 'updated_at', 'created_by', 'updated_by',
  47         ]);
  48     }
  49
  50     /**
  51      * Create a new attachment in the system.
  52      * An uploaded_to value must be provided containing an ID of the page
  53      * that this upload will be related to.
  54      *
  55      * If you're uploading a file the POST data should be provided via
  56      * a multipart/form-data type request instead of JSON.
  57      *
  58      * @throws ValidationException
  59      * @throws FileUploadException
  60      */
  61     public function create(Request $request)
  62     {
  63         $this->checkPermission('attachment-create-all');
  64         $requestData = $this->validate($request, $this->rules['create']);
  65
  66         $pageId = $request->get('uploaded_to');
  67         $page = Page::visible()->findOrFail($pageId);
  68         $this->checkOwnablePermission('page-update', $page);
  69
  70         if ($request->hasFile('file')) {
  71             $uploadedFile = $request->file('file');
  72             $attachment = $this->attachmentService->saveNewUpload($uploadedFile, $page->id);
  73         } else {
  74             $attachment = $this->attachmentService->saveNewFromLink(
  75                 $requestData['name'], $requestData['link'], $page->id
  76             );
  77         }
  78
  79         $this->attachmentService->updateFile($attachment, $requestData);
  80         return response()->json($attachment);
  81     }
  82
  83     /**
  84      * Get the details & content of a single attachment of the given ID.
  85      * The attachment link or file content is provided via a 'content' property.
  86      * For files the content will be base64 encoded.
  87      *
  88      * @throws FileNotFoundException
  89      */
  90     public function read(string $id)
  91     {
  92         /** @var Attachment $attachment */
  93         $attachment = Attachment::visible()
  94             ->with(['createdBy', 'updatedBy'])
  95             ->findOrFail($id);
  96
  97         $attachment->setAttribute('links', [
  98             'html'     => $attachment->htmlLink(),
  99             'markdown' => $attachment->markdownLink(),
 100         ]);
 101
 102         if (!$attachment->external) {
 103             $attachmentContents = $this->attachmentService->getAttachmentFromStorage($attachment);
 104             $attachment->setAttribute('content', base64_encode($attachmentContents));
 105         } else {
 106             $attachment->setAttribute('content', $attachment->path);
 107         }
 108
 109         return response()->json($attachment);
 110     }
 111
 112     /**
 113      * Update the details of a single attachment.
 114      * As per the create endpoint, if a file is being provided as the attachment content
 115      * the request should be formatted as a multipart/form-data request instead of JSON.
 116      *
 117      * @throws ValidationException
 118      * @throws FileUploadException
 119      */
 120     public function update(Request $request, string $id)
 121     {
 122         $requestData = $this->validate($request, $this->rules['update']);
 123         /** @var Attachment $attachment */
 124         $attachment = Attachment::visible()->findOrFail($id);
 125
 126         $page = $attachment->page;
 127         if ($requestData['uploaded_to'] ?? false) {
 128             $pageId = $request->get('uploaded_to');
 129             $page = Page::visible()->findOrFail($pageId);
 130             $attachment->uploaded_to = $requestData['uploaded_to'];
 131         }
 132
 133         $this->checkOwnablePermission('page-view', $page);
 134         $this->checkOwnablePermission('page-update', $page);
 135         $this->checkOwnablePermission('attachment-update', $attachment);
 136
 137         if ($request->hasFile('file')) {
 138             $uploadedFile = $request->file('file');
 139             $attachment = $this->attachmentService->saveUpdatedUpload($uploadedFile, $attachment);
 140         }
 141
 142         $this->attachmentService->updateFile($attachment, $requestData);
 143         return response()->json($attachment);
 144     }
 145
 146     /**
 147      * Delete an attachment of the given ID.
 148      *
 149      * @throws Exception
 150      */
 151     public function delete(string $id)
 152     {
 153         /** @var Attachment $attachment */
 154         $attachment = Attachment::visible()->findOrFail($id);
 155         $this->checkOwnablePermission('attachment-delete', $attachment);
 156
 157         $this->attachmentService->deleteFile($attachment);
 158
 159         return response('', 204);
 160     }
 161
 162 }