fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-04-02 01:52:10 +09:00
Code Issues Projects Releases Packages Wiki Activity

Add support for short download URLs #1875 #1922

Browse source 
- Originally committed on April 3, 2022
- Thanks to @misol @conory
- getDownloadUrl()에서 기존 메소드 형태 최대한 그대로 유지하는 방향으로 작업
  (단, source_filename 파라미터를 전달하지 않으면 긴주소로 강제됨)
- getDirectFileUrl()의 불필요하게 복잡한 코드 정리
- getFileList()에서 이미지가 아닌 파일도 절대경로를 반환하도록 수정
- procFileDownload, procFileOutput에서 URL에 포함된 파일명을 검증하도록 하여
  동일한 첨부파일에서 파일명 부분만 변형한 링크를 무한 생성할 수 없도록 함
- 짧은주소 미사용시 불필요한 module_srl 파라미터 제거
This commit is contained in:
Kijin Sung 2022-12-26 16:23:19 +09:00
parent 0029d1a1ec
commit 17279c264b
6 changed files with 49 additions and 25 deletions
Download patch file Download diff file Expand all files Collapse all files

24
modules/file/file.controller.php
View file

@ -158,7 +158,7 @@ class fileController extends file
}
else
{
$this->add('download_url', FileModel::getDownloadUrl($output->get('file_srl'), $output->get('sid'), $module_srl));
$this->add('download_url', FileModel::getDownloadUrl($output->get('file_srl'), $output->get('sid'), $module_srl, $output->get('source_filename')));
}
}
@ -288,18 +288,24 @@ class fileController extends file
$file_srl = Context::get('file_srl');
$sid = Context::get('sid');
$logged_info = Context::get('logged_info');
$filename_arg = Context::get('filename');
// Get file information from the DB
$file_obj = FileModel::getFile($file_srl);
$filename = preg_replace('/\.\.+/', '.', $file_obj->source_filename);
// If the requested file information is incorrect, an error that file cannot be found appears
if($file_obj->file_srl != $file_srl || $file_obj->sid !== $sid)
{
throw new Rhymix\Framework\Exceptions\TargetNotFound('msg_file_not_found');
}
// File name
$filename = $file_obj->source_filename;
$file_module_config = FileModel::getFileModuleConfig($file_obj->module_srl);
if ($filename_arg !== null && $filename_arg !== $filename)
{
throw new Rhymix\Framework\Exceptions\TargetNotFound('msg_file_not_found');
}
// Not allow the file outlink
$file_module_config = FileModel::getFileModuleConfig($file_obj->module_srl);
if($file_module_config->allow_outlink == 'N' && $_SERVER["HTTP_REFERER"])
{
// Handles extension to allow outlink
@ -430,6 +436,12 @@ class fileController extends file
throw new Rhymix\Framework\Exceptions\InvalidRequest;
}
// Check filename if given
if ($filename_arg !== null && $filename_arg !== $filename)
{
throw new Rhymix\Framework\Exceptions\TargetNotFound('msg_file_not_found');
}
// Check if file exists
$uploaded_filename = $file_obj->uploaded_filename;
if(!file_exists($uploaded_filename))
@ -452,7 +464,7 @@ class fileController extends file
}
// Encode the filename.
if ($filename_arg && $filename_arg === $filename)
if ($filename_arg !== null && $filename_arg === $filename)
{
$filename_param = '';
}