kenmirrors/grocy
1
0
Fork 0
mirror of https://github.com/grocy/grocy.git synced 2025-08-15 10:14:39 +00:00
Code Issues Projects Releases Wiki Activity

Enforce file groups

Browse Source
This commit is contained in:
Bernd Bestel
2021-07-02 20:29:53 +02:00
parent 74d745cfc4
commit 34ffb96ae3
2 changed files with 34 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
controllers/FilesApiController.php
View File

@@ -11,6 +11,11 @@ class FilesApiController extends BaseApiController
{
try
{
if(!in_array($args['group'], $this->getOpenApiSpec()->components->internalSchemas->FileGroups->enum))
{
throw new \Exception('Invalid file group');
}
if (IsValidFileName(base64_decode($args['fileName'])))
{
$fileName = base64_decode($args['fileName']);
@@ -39,8 +44,12 @@ class FilesApiController extends BaseApiController
{
try
{
$fileName = $this->checkFileName($args['fileName']);
if(!in_array($args['group'], $this->getOpenApiSpec()->components->internalSchemas->FileGroups->enum))
{
throw new \Exception('Invalid file group');
}
$fileName = $this->checkFileName($args['fileName']);
$filePath = $this->getFilePath($args['group'], $fileName, $request->getQueryParams());
if (file_exists($filePath))
@@ -65,9 +74,13 @@ class FilesApiController extends BaseApiController
{
try
{
if(!in_array($args['group'], $this->getOpenApiSpec()->components->internalSchemas->FileGroups->enum))
{
throw new \Exception('Invalid file group');
}
$fileInfo = explode('_', $args['fileName']);
$fileName = $this->checkFileName($fileInfo[1]);
$filePath = $this->getFilePath($args['group'], base64_decode($fileInfo[0]), $request->getQueryParams());
if (file_exists($filePath))
@@ -92,9 +105,14 @@ class FilesApiController extends BaseApiController
{
try
{
$fileName = $this->checkFileName($args['fileName']);
if(!in_array($args['group'], $this->getOpenApiSpec()->components->internalSchemas->FileGroups->enum))
{
throw new \Exception('Invalid file group');
}
$fileName = $this->checkFileName($args['fileName']);
$data = $request->getBody()->getContents();
file_put_contents($this->getFilesService()->GetFilePath($args['group'], $fileName), $data);
return $this->EmptyApiResponse($response);