webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-07-28 17:02:04 +03:00
Code Activity

Added test and handling for local_secure_restricted in exports

Browse Source
This commit is contained in:
Dan Brown
2022-09-02 14:21:43 +01:00
parent f88330202b
commit 092b6d6378
3 changed files with 46 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
app/Uploads/ImageService.php
View File

@ -501,6 +501,14 @@ class ImageService
}
$storagePath = $this->adjustPathForStorageDisk($storagePath);
// Apply access control when local_secure_restricted images are active
if ($this->usingSecureRestrictedImages()) {
if (!$this->checkUserHasAccessToRelationOfImageAtPath($storagePath)) {
return null;
}
}
$storage = $this->getStorageDisk();
$imageData = null;
if ($storage->exists($storagePath)) {
@ -548,6 +556,10 @@ class ImageService
*/
protected function checkUserHasAccessToRelationOfImageAtPath(string $path): bool
{
if (strpos($path, '/uploads/images/') === 0) {
$path = substr($path, 15);
}
// Strip thumbnail element from path if existing
$originalPathSplit = array_filter(explode('/', $path), function(string $part) {
$resizedDir = (strpos($part, 'thumbs-') === 0 || strpos($part, 'scaled-') === 0);