diff options
Diffstat (limited to 'src/controller/FileUploadController.php')
| -rw-r--r-- | src/controller/FileUploadController.php | 65 |
1 files changed, 0 insertions, 65 deletions
diff --git a/src/controller/FileUploadController.php b/src/controller/FileUploadController.php deleted file mode 100644 index 3cd5e6b..0000000 --- a/src/controller/FileUploadController.php +++ /dev/null | |||
| @@ -1,65 +0,0 @@ | |||
| 1 | <?php | ||
| 2 | // src/controller/FileUploadController.php | ||
| 3 | |||
| 4 | declare(strict_types=1); | ||
| 5 | |||
| 6 | use Symfony\Component\HttpFoundation\JsonResponse; | ||
| 7 | |||
| 8 | class FileUploadController | ||
| 9 | { | ||
| 10 | static private function checkFileDownload(array $file): bool | ||
| 11 | { | ||
| 12 | $extensions_white_list = ['pdf', 'rtf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods', 'odp']; // = extensions_white_list côté javascript | ||
| 13 | $mime_type_white_list = ['application/pdf', 'application/rtf', 'text/rtf', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentationml.presentation', 'application/vnd.oasis.opendocument.text', 'application/vnd.oasis.opendocument.spreadsheet', 'application/vnd.oasis.opendocument.presentation']; | ||
| 14 | |||
| 15 | // 1/ extension | ||
| 16 | $extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION)); | ||
| 17 | if(!in_array($extension, $extensions_white_list, true)){ | ||
| 18 | return false; | ||
| 19 | } | ||
| 20 | |||
| 21 | // 2/ fichier obtenu par HTTP POST (théoriquement inutile si le routeur est solide, mais ça ne mange pas de pain) | ||
| 22 | if(!is_uploaded_file($file['tmp_name'])){ | ||
| 23 | return false; | ||
| 24 | } | ||
| 25 | |||
| 26 | // 3/ objet $finfo valide (dépend du paramètre FILEINFO_MIME_TYPE) | ||
| 27 | $finfo = new finfo(FILEINFO_MIME_TYPE); | ||
| 28 | if($finfo === false){ | ||
| 29 | return false; | ||
| 30 | } | ||
| 31 | |||
| 32 | // 4/ contrôle du "vrai" type mime (finfo_file lit les 1ers octets des fichiers pour y trouver des "signatures", très fiable sauf avec les conteneurs: doc, zip...) | ||
| 33 | $real_type = finfo_file($finfo, $file['tmp_name']); | ||
| 34 | return in_array($real_type, $mime_type_white_list, true); | ||
| 35 | } | ||
| 36 | |||
| 37 | static public function fileUploadTinyMce(): JsonResponse | ||
| 38 | { | ||
| 39 | if(isset($_FILES['file'])){ | ||
| 40 | $dest = 'user_data/media/'; | ||
| 41 | if(!is_dir($dest)){ // Vérifier si le répertoire existe, sinon le créer | ||
| 42 | mkdir($dest, 0755, true); | ||
| 43 | } | ||
| 44 | |||
| 45 | $name = Security::secureFileName(pathinfo($_FILES['file']['name'], PATHINFO_FILENAME)); // retirer caractères spéciaux et changer espaces en underscores | ||
| 46 | $extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION)); | ||
| 47 | $file_path = $dest . $name . '_' . uniqid() . '.' . $extension; // nom unique | ||
| 48 | |||
| 49 | if(self::checkFileDownload($_FILES['file'])){ | ||
| 50 | if(move_uploaded_file($_FILES['file']['tmp_name'], $file_path)){ | ||
| 51 | return new JsonResponse(['location' => $file_path]); | ||
| 52 | } | ||
| 53 | else{ | ||
| 54 | return new JsonResponse(['message' => 'Erreur enregistrement du fichier.'], JsonResponse::HTTP_INTERNAL_SERVER_ERROR); // code 500 | ||
| 55 | } | ||
| 56 | } | ||
| 57 | else{ | ||
| 58 | return new JsonResponse(['message' => 'Erreur 400: fichier non valide.'], JsonResponse::HTTP_BAD_REQUEST); // code 400 | ||
| 59 | } | ||
| 60 | } | ||
| 61 | else{ | ||
| 62 | return new JsonResponse(['message' => 'Erreur 400: Bad Request'], JsonResponse::HTTP_BAD_REQUEST); // code 400 | ||
| 63 | } | ||
| 64 | } | ||
| 65 | } \ No newline at end of file | ||