Add support for short download URLs #1875 #1922

- Originally committed on April 3, 2022
- Thanks to @misol @conory
- getDownloadUrl()에서 기존 메소드 형태 최대한 그대로 유지하는 방향으로 작업
  (단, source_filename 파라미터를 전달하지 않으면 긴주소로 강제됨)
- getDirectFileUrl()의 불필요하게 복잡한 코드 정리
- getFileList()에서 이미지가 아닌 파일도 절대경로를 반환하도록 수정
- procFileDownload, procFileOutput에서 URL에 포함된 파일명을 검증하도록 하여
  동일한 첨부파일에서 파일명 부분만 변형한 링크를 무한 생성할 수 없도록 함
- 짧은주소 미사용시 불필요한 module_srl 파라미터 제거
This commit is contained in:
Kijin Sung 2022-12-26 16:23:19 +09:00
parent 0029d1a1ec
commit 17279c264b
6 changed files with 49 additions and 25 deletions

View file

@ -86,11 +86,14 @@ class fileModel extends file
$obj->original_type = $file_info->original_type;
$obj->direct_download = $file_info->direct_download;
$obj->cover_image = ($file_info->cover_image === 'Y') ? true : false;
$obj->download_url = $file_info->download_url;
if($obj->direct_download === 'Y' && self::isDownloadable($file_info))
{
$obj->download_url = self::getDirectFileUrl($file_info->uploaded_filename);
}
else
{
$obj->download_url = self::getDirectFileUrl($file_info->download_url);
}
$file_list[] = $obj;
$attached_size += $file_info->file_size;
@ -248,12 +251,20 @@ class fileModel extends file
*
* @param int $file_srl The sequence of file to get url
* @param string $sid
* @param int $module_srl
* @param int $module_srl (unused)
* @param string $source_filename
* @return string Returns a url
*/
public static function getDownloadUrl($file_srl, $sid, $module_srl = 0)
public static function getDownloadUrl($file_srl, $sid, $module_srl = 0, $source_filename = null)
{
return sprintf('?module=%s&act=%s&file_srl=%s&sid=%s&module_srl=%d', 'file', 'procFileDownload', $file_srl, $sid, $module_srl);
if ($source_filename && config('use_rewrite') && self::getFileConfig()->download_short_url === 'Y')
{
return sprintf('files/download/link/%d/%s/%s', $file_srl, $sid, rawurlencode(preg_replace('/\.\.+/', '.', $source_filename)));
}
else
{
return sprintf('index.php?module=%s&act=%s&file_srl=%s&sid=%s', 'file', 'procFileDownload', $file_srl, $sid);
}
}
/**
@ -264,12 +275,7 @@ class fileModel extends file
*/
public static function getDirectFileUrl($path)
{
if(dirname($_SERVER['SCRIPT_NAME']) == '/' || dirname($_SERVER['SCRIPT_NAME']) == '\\')
{
return '/' . substr($path, 2);
}
return dirname($_SERVER['SCRIPT_NAME']) . '/' . substr($path, 2);
return \RX_BASEURL . ltrim($path, './');
}
/**
@ -342,7 +348,7 @@ class fileModel extends file
if(count($output->data) == 1)
{
$file = $output->data[0];
$file->download_url = self::getDownloadUrl($file->file_srl, $file->sid, $file->module_srl);
$file->download_url = self::getDownloadUrl($file->file_srl, $file->sid, $file->module_srl, $file->source_filename);
return $file;
}
@ -355,7 +361,7 @@ class fileModel extends file
foreach($output->data as $key=>$value)
{
$file = $value;
$file->download_url = self::getDownloadUrl($file->file_srl, $file->sid, $file->module_srl);
$file->download_url = self::getDownloadUrl($file->file_srl, $file->sid, $file->module_srl, $file->source_filename);
$fileList[] = $file;
}
}
@ -387,7 +393,7 @@ class fileModel extends file
foreach ($output->data as $file)
{
$file->source_filename = escape($file->source_filename, false);
$file->download_url = self::getDownloadUrl($file->file_srl, $file->sid, $file->module_srl);
$file->download_url = self::getDownloadUrl($file->file_srl, $file->sid, $file->module_srl, $file->source_filename);
$fileList[] = $file;
}
return $fileList;