diff --git a/app/Http/Controllers/Apis/Protected/Summit/OAuth2PresentationApiController.php b/app/Http/Controllers/Apis/Protected/Summit/OAuth2PresentationApiController.php index 3009bf2f..07c51c97 100644 --- a/app/Http/Controllers/Apis/Protected/Summit/OAuth2PresentationApiController.php +++ b/app/Http/Controllers/Apis/Protected/Summit/OAuth2PresentationApiController.php @@ -11,6 +11,8 @@ * See the License for the specific language governing permissions and * limitations under the License. **/ + +use App\Http\Utils\FileTypes; use libs\utils\HTMLCleaner; use models\exceptions\EntityNotFoundException; use models\exceptions\ValidationException; @@ -640,7 +642,13 @@ final class OAuth2PresentationApiController extends OAuth2ProtectedController 'description', ]; - $slide = $this->presentation_service->addSlideTo($request, $presentation_id, HTMLCleaner::cleanData($data, $fields)); + $slide = $this->presentation_service->addSlideTo + ( + $request, + $presentation_id, + HTMLCleaner::cleanData($data, $fields), + array_merge(FileTypes::ImagesExntesions, FileTypes::SlidesExtensions) + ); return $this->created(SerializerRegistry::getInstance()->getSerializer($slide)->serialize()); } @@ -675,25 +683,7 @@ final class OAuth2PresentationApiController extends OAuth2ProtectedController if (is_null($summit)) return $this->error404(); - $content_type = $request->headers->has('Content-Type') ? strtolower( $request->headers->get('Content-Type')) : null; - - if (false !== $pos = strpos($content_type, ';')) { - $content_type = substr($content_type, 0, $pos); - } - $file = null; $data = $request->all(); - Log::debug("updatePresentationSlide: data ".var_dump($data)); - if(strstr($content_type, 'multipart/form-data')) { - Log::debug("updatePresentationSlide: has multipart/form-data"); - $parser = new ParseMultiPartFormDataInputStream(file_get_contents('php://input')); - $input = $parser->getInput(); - Log::debug("updatePresentationSlide: input ".var_dump($input)); - $data = $input['parameters']; - $files = $input['files']; - $file = null; - if (isset($files['file'])) - $file = $files['file']; - } $rules = [ 'link' => 'nullable|url', @@ -720,7 +710,11 @@ final class OAuth2PresentationApiController extends OAuth2ProtectedController $slide = $this->presentation_service->updateSlide ( - $request, $presentation_id, $slide_id, HTMLCleaner::cleanData($data, $fields), $file + $request, + $presentation_id, + $slide_id, + HTMLCleaner::cleanData($data, $fields), + array_merge(FileTypes::ImagesExntesions, FileTypes::SlidesExtensions) ); return $this->updated(SerializerRegistry::getInstance()->getSerializer($slide)->serialize()); diff --git a/app/Http/Controllers/Apis/Protected/Summit/OAuth2SummitLocationsApiController.php b/app/Http/Controllers/Apis/Protected/Summit/OAuth2SummitLocationsApiController.php index 16e2e650..160fa752 100644 --- a/app/Http/Controllers/Apis/Protected/Summit/OAuth2SummitLocationsApiController.php +++ b/app/Http/Controllers/Apis/Protected/Summit/OAuth2SummitLocationsApiController.php @@ -1932,28 +1932,10 @@ final class OAuth2SummitLocationsApiController extends OAuth2ProtectedController $summit = SummitFinderStrategyFactory::build($this->repository, $this->resource_server_context)->find($summit_id); if (is_null($summit)) return $this->error404(); - - $content_type = $request->headers->has('Content-Type') ? strtolower( $request->headers->get('Content-Type')) : null; - - if (false !== $pos = strpos($content_type, ';')) { - $content_type = substr($content_type, 0, $pos); - } - - if(!strstr($content_type, 'multipart/form-data')) - return $this->error400(); - - $parser = new ParseMultiPartFormDataInputStream(file_get_contents('php://input')); - $input = $parser->getInput(); - $metadata = $input['parameters']; - $files = $input['files']; - $file = null; - - if(isset($files['file'])) - $file = $files['file']; - - $rules = SummitLocationImageValidationRulesFactory::build(true); + $data = $request->all(); + $rules = SummitLocationImageValidationRulesFactory::build(true); // Creates a Validator instance and validates the data. - $validation = Validator::make($metadata, $rules); + $validation = Validator::make($data, $rules); if ($validation->fails()) { $messages = $validation->messages()->toArray(); @@ -1971,9 +1953,9 @@ final class OAuth2SummitLocationsApiController extends OAuth2ProtectedController $map_id, HTMLCleaner::cleanData ( - $metadata, ['description'] + $data, ['description'] ), - $file + $request->hasFile('file') ? $request->file('file'):null ); return $this->updated(SerializerRegistry::getInstance()->getSerializer($map)->serialize()); @@ -2148,28 +2130,10 @@ final class OAuth2SummitLocationsApiController extends OAuth2ProtectedController try { $summit = SummitFinderStrategyFactory::build($this->repository, $this->resource_server_context)->find($summit_id); if (is_null($summit)) return $this->error404(); - - $content_type = $request->headers->has('Content-Type') ? strtolower( $request->headers->get('Content-Type')) : null; - - if (false !== $pos = strpos($content_type, ';')) { - $content_type = substr($content_type, 0, $pos); - } - - if(!strstr($content_type, 'multipart/form-data')) - return $this->error400(); - - $parser = new ParseMultiPartFormDataInputStream(file_get_contents('php://input')); - $input = $parser->getInput(); - $metadata = $input['parameters']; - $files = $input['files']; - $file = null; - - if(isset($files['file'])) - $file = $files['file']; - - $rules = SummitLocationImageValidationRulesFactory::build(true); + $data = $request->all(); + $rules = SummitLocationImageValidationRulesFactory::build(true); // Creates a Validator instance and validates the data. - $validation = Validator::make($metadata, $rules); + $validation = Validator::make($data, $rules); if ($validation->fails()) { $messages = $validation->messages()->toArray(); @@ -2187,9 +2151,9 @@ final class OAuth2SummitLocationsApiController extends OAuth2ProtectedController $image_id, HTMLCleaner::cleanData ( - $metadata, ['description'] + $data, ['description'] ), - $file + $request->hasFile('file') ? $request->file('file'):null ); return $this->updated(SerializerRegistry::getInstance()->getSerializer($image)->serialize()); diff --git a/app/Http/Kernel.php b/app/Http/Kernel.php index 57a9c3a6..dbaefe4e 100644 --- a/app/Http/Kernel.php +++ b/app/Http/Kernel.php @@ -21,6 +21,7 @@ class Kernel extends HttpKernel \Illuminate\View\Middleware\ShareErrorsFromSession::class, \App\Http\Middleware\CORSMiddleware::class, \App\Http\Middleware\SecurityHTTPHeadersWriterMiddleware::class, + \App\Http\Middleware\ParseMultipartFormDataInputForNonPostRequests::class, ]; /** diff --git a/app/Http/Middleware/ParseMultipartFormDataInputForNonPostRequests.php b/app/Http/Middleware/ParseMultipartFormDataInputForNonPostRequests.php new file mode 100644 index 00000000..6d28847b --- /dev/null +++ b/app/Http/Middleware/ParseMultipartFormDataInputForNonPostRequests.php @@ -0,0 +1,59 @@ +method() == 'POST' OR $request->method() == 'GET') { + return $next($request); + } + + if (preg_match('/multipart\/form-data/', $request->headers->get('Content-Type')) or + preg_match('/multipart\/form-data/', $request->headers->get('content-type')) + ) { + $parser = new ParseMultiPartFormDataInputStream(file_get_contents('php://input')); + $params = $parser->getInput(); + $files = []; + $parameters = []; + foreach ($params as $key => $param) { + if ($param instanceof \Symfony\Component\HttpFoundation\File\UploadedFile) { + $files[$key] = $param; + } else { + $parameters[$key] = $param; + } + } + if (count($files) > 0) { + $request->files->add($files); + } + if (count($parameters) > 0) { + $request->request->add($parameters); + } + } + return $next($request); + } +} \ No newline at end of file diff --git a/app/Http/Utils/FileTypes.php b/app/Http/Utils/FileTypes.php new file mode 100644 index 00000000..a80afcd6 --- /dev/null +++ b/app/Http/Utils/FileTypes.php @@ -0,0 +1,24 @@ +hasFile('file')){ + if($hasFile){ $file = $request->file('file'); if (!in_array($file->extension(), $allowed_extensions)) { throw new ValidationException( @@ -684,7 +684,6 @@ final class PresentationService * @param int $presentation_id * @param int $slide_id * @param array $slide_data - * @param UploadedFile $file * @param array $allowed_extensions * @param int $max_file_size * @return mixed|PresentationSlide @@ -696,8 +695,7 @@ final class PresentationService $presentation_id, $slide_id, array $slide_data, - UploadedFile $file = null, - array $allowed_extensions = ['ppt', 'pptx', 'xps', 'key', 'pdf', 'jpg', 'jpeg', 'png', 'svg', 'bmp', 'tga', 'tiff', 'gif'], + array $allowed_extensions = [], $max_file_size = 10485760 ){ @@ -708,8 +706,7 @@ final class PresentationService $slide_data, $max_file_size, $allowed_extensions, - $slide_id, - $file + $slide_id ) { $presentation = $this->presentation_repository->getById($presentation_id); @@ -730,7 +727,7 @@ final class PresentationService $hasLink = isset($slide_data['link']) && !empty($slide_data['link']); - $hasFile = !is_null($file); + $hasFile = $request->hasFile('file'); if($hasFile && $hasLink){ throw new ValidationException("you must provide a file or a link, not both."); @@ -751,6 +748,7 @@ final class PresentationService // check if there is any file sent if($hasFile){ + $file = $request->file('file'); if (!in_array($file->extension(), $allowed_extensions)) { throw new ValidationException( sprintf("file does not has a valid extension '(%s)'.", implode("','", $allowed_extensions)));