webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-30 04:23:11 +03:00
Code Activity

Added test and handling for local_secure_restricted in exports

Browse Source
This commit is contained in:
Dan Brown
2022-09-02 14:21:43 +01:00
parent f88330202b
commit 092b6d6378
3 changed files with 46 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/Entities/Tools/ExportFormatter.php
View File

@ -235,7 +235,7 @@ class ExportFormatter
$linksOutput = [];
preg_match_all("/\<a.*href\=(\'|\")(.*?)(\'|\").*?\>/i", $htmlContent, $linksOutput);
// Replace image src with base64 encoded image strings
// Update relative links to be absolute, with instance url
if (isset($linksOutput[0]) && count($linksOutput[0]) > 0) {
foreach ($linksOutput[0] as $index => $linkMatch) {
$oldLinkString = $linkMatch;
@ -248,7 +248,6 @@ class ExportFormatter
}
}
// Replace any relative links with system domain
return $htmlContent;
}

12
app/Uploads/ImageService.php
View File

@ -501,6 +501,14 @@ class ImageService
}
$storagePath = $this->adjustPathForStorageDisk($storagePath);
// Apply access control when local_secure_restricted images are active
if ($this->usingSecureRestrictedImages()) {
if (!$this->checkUserHasAccessToRelationOfImageAtPath($storagePath)) {
return null;
}
}
$storage = $this->getStorageDisk();
$imageData = null;
if ($storage->exists($storagePath)) {
@ -548,6 +556,10 @@ class ImageService
*/
protected function checkUserHasAccessToRelationOfImageAtPath(string $path): bool
{
if (strpos($path, '/uploads/images/') === 0) {
$path = substr($path, 15);
}
// Strip thumbnail element from path if existing
$originalPathSplit = array_filter(explode('/', $path), function(string $part) {
$resizedDir = (strpos($part, 'thumbs-') === 0 || strpos($part, 'scaled-') === 0);