From f27cca08ff786ceff1870147f6d6bad14d71117f Mon Sep 17 00:00:00 2001
From: polo <ordipolo@gmx.fr>
Date: Fri, 23 Oct 2026 00:47:32 +0200
Subject: =?UTF-8?q?dossiers=20avec=20majuscule,=20namespace=20pour=20toute?=
 =?UTF-8?q?s=20les=20classes,=20autoload=20psr-4,=20UserDataService::creat?=
 =?UTF-8?q?eZip=20d=C3=A9plac=C3=A9=20dans=20Backup?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/Controller/FileUploadController.php | 68 +++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)
 create mode 100644 src/Controller/FileUploadController.php

(limited to 'src/Controller/FileUploadController.php')

diff --git a/src/Controller/FileUploadController.php b/src/Controller/FileUploadController.php
new file mode 100644
index 0000000..4627017
--- /dev/null
+++ b/src/Controller/FileUploadController.php
@@ -0,0 +1,68 @@
+<?php
+// src/Controller/FileUploadController.php
+
+declare(strict_types=1);
+
+namespace App\Controller;
+
+use Symfony\Component\HttpFoundation\JsonResponse;
+use App\Service\Security;
+
+class FileUploadController
+{
+	static private function checkFileDownload(array $file): bool
+	{
+		$extensions_white_list = ['pdf', 'rtf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'odt', 'ods', 'odp']; // = extensions_white_list côté javascript
+		$mime_type_white_list = ['application/pdf', 'application/rtf', 'text/rtf', 'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 'application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentationml.presentation', 'application/vnd.oasis.opendocument.text', 'application/vnd.oasis.opendocument.spreadsheet', 'application/vnd.oasis.opendocument.presentation'];
+		
+		// 1/ extension
+		$extension = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
+		if(!in_array($extension, $extensions_white_list, true)){
+			return false;
+	    }
+		
+		// 2/ fichier obtenu par HTTP POST (théoriquement inutile si le routeur est solide, mais ça ne mange pas de pain)
+		if(!is_uploaded_file($file['tmp_name'])){
+			return false;
+		}
+
+		// 3/ objet $finfo valide (dépend du paramètre FILEINFO_MIME_TYPE)
+	    $finfo = new \finfo(FILEINFO_MIME_TYPE);
+		if($finfo === false){
+	        return false;
+	    }
+		
+		// 4/ contrôle du "vrai" type mime (finfo_file lit les 1ers octets des fichiers pour y trouver des "signatures", très fiable sauf avec les conteneurs: doc, zip...)
+	    $real_type = finfo_file($finfo, $file['tmp_name']);
+	    return in_array($real_type, $mime_type_white_list, true);
+	}
+
+	static public function fileUploadTinyMce(): JsonResponse
+	{
+		if(isset($_FILES['file'])){
+	        $dest = 'user_data/media/';
+	        if(!is_dir($dest)){ // Vérifier si le répertoire existe, sinon le créer
+	            mkdir($dest, 0755, true);
+	        }
+	        
+	        $name = Security::secureFileName(pathinfo($_FILES['file']['name'], PATHINFO_FILENAME)); // retirer caractères spéciaux et changer espaces en underscores
+	        $extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION)); 
+	        $file_path = $dest . $name . '_' . uniqid() . '.' . $extension; // nom unique
+	        
+	        if(self::checkFileDownload($_FILES['file'])){
+	        	if(move_uploaded_file($_FILES['file']['tmp_name'], $file_path)){
+					return new JsonResponse(['location' => $file_path]);
+				}
+				else{
+					return new JsonResponse(['message' => 'Erreur enregistrement du fichier.'], JsonResponse::HTTP_INTERNAL_SERVER_ERROR); // code 500
+				}
+	        }
+	        else{
+				return new JsonResponse(['message' => 'Erreur 400: fichier non valide.'], JsonResponse::HTTP_BAD_REQUEST); // code 400
+			}
+	    }
+	    else{
+	        return new JsonResponse(['message' => 'Erreur 400: Bad Request'], JsonResponse::HTTP_BAD_REQUEST); // code 400
+	    }
+	}
+}
\ No newline at end of file
-- 
cgit v1.2.3