Added ability to secure images behind auth

[bookstack] / app / Http / Controllers / ImageController.php

diff --git a/app/Http/Controllers/ImageController.php b/app/Http/Controllers/ImageController.php
index 77c320e07db7989203f87284914ba39e68803672..d783507545d421ba63a536eaf5cbfeaaaf51dccd 100644 (file)
--- a/app/Http/Controllers/ImageController.php
+++ b/app/Http/Controllers/ImageController.php
@@ -1,6 +1,7 @@
 <?php namespace BookStack\Http\Controllers;
 
 use BookStack\Exceptions\ImageUploadException;
+use BookStack\Exceptions\NotFoundException;
 use BookStack\Repos\EntityRepo;
 use BookStack\Repos\ImageRepo;
 use Illuminate\Filesystem\Filesystem as File;
@@ -28,6 +29,21 @@ class ImageController extends Controller
         parent::__construct();
     }
 
+    /**
+     * Provide an image file from storage.
+     * @param string $path
+     * @return mixed
+     */
+    public function showImage(string $path)
+    {
+        $path = storage_path('uploads/images/' . $path);
+        if (!file_exists($path)) {
+            abort(404);
+        }
+
+        return response()->file($path);
+    }
+
     /**
      * Get all images for a specific type, Paginated
      * @param string $type
@@ -107,7 +123,7 @@ class ImageController extends Controller
         $imageUpload = $request->file('file');
 
         try {
-            $uploadedTo = $request->has('uploaded_to') ? $request->get('uploaded_to') : 0;
+            $uploadedTo = $request->filled('uploaded_to') ? $request->get('uploaded_to') : 0;
             $image = $this->imageRepo->saveNew($imageUpload, $type, $uploadedTo);
         } catch (ImageUploadException $e) {
             return response($e->getMessage(), 500);
@@ -162,7 +178,7 @@ class ImageController extends Controller
         $this->checkOwnablePermission('image-delete', $image);
 
         // Check if this image is used on any pages
-        $isForced = ($request->has('force') && ($request->get('force') === 'true') || $request->get('force') === true);
+        $isForced = in_array($request->get('force', ''), [true, 'true']);
         if (!$isForced) {
             $pageSearch = $entityRepo->searchForImage($image->url);
             if ($pageSearch !== false) {