forked from phpbb/phpbb
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathavatar.php
More file actions
115 lines (96 loc) · 2.6 KB
/
avatar.php
File metadata and controls
115 lines (96 loc) · 2.6 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
<?php
/**
*
* This file is part of the phpBB Forum Software package.
*
* @copyright (c) phpBB Limited <https://www.phpbb.com>
* @license GNU General Public License, version 2 (GPL-2.0)
*
* For full copyright and license information, please see
* the docs/CREDITS.txt file.
*
*/
namespace phpbb\storage\controller;
use phpbb\cache\service;
use phpbb\config\config;
use phpbb\db\driver\driver_interface;
use phpbb\storage\storage;
use Symfony\Component\HttpFoundation\Request as symfony_request;
use Symfony\Component\HttpFoundation\Response;
use Symfony\Component\HttpFoundation\ResponseHeaderBag;
use Symfony\Component\HttpFoundation\StreamedResponse;
/**
* Controller for /download/avatar/{file} routes
*/
class avatar extends controller
{
/** @var config */
protected $config;
/** @var array */
protected $allowed_extensions = ['png', 'gif', 'jpg', 'jpeg'];
/**
* Constructor
*
* @param service $cache
* @param config $config
* @param driver_interface $db
* @param storage $storage
* @param symfony_request $symfony_request
*/
public function __construct(service $cache, config $config, driver_interface $db, storage $storage, symfony_request $symfony_request)
{
parent::__construct($cache, $db, $storage, $symfony_request);
$this->config = $config;
}
/**
* {@inheritdoc}
*/
public function handle(string $file): Response
{
$file = $this->decode_filename($file);
return parent::handle($file);
}
/**
* {@inheritdoc}
*/
protected function is_allowed(string $file): bool
{
$ext = substr(strrchr($file, '.'), 1);
// If filename have point and have an allowed extension
return strpos($file, '.') && in_array($ext, $this->allowed_extensions, true);
}
/**
* Decode avatar filename
*
* @param string $file Filename
*
* @return string Filename in filesystem
*/
protected function decode_filename(string $file): string
{
$avatar_group = false;
if (isset($file[0]) && $file[0] === 'g')
{
$avatar_group = true;
$file = substr($file, 1);
}
$ext = substr(strrchr($file, '.'), 1);
$file = (int) $file;
return $this->config['avatar_salt'] . '_' . ($avatar_group ? 'g' : '') . $file . '.' . $ext;
}
/**
* {@inheritdoc}
*/
protected function prepare(StreamedResponse $response, string $file): void
{
$response->setPublic();
$disposition = $response->headers->makeDisposition(
ResponseHeaderBag::DISPOSITION_INLINE,
rawurlencode($file)
);
$response->headers->set('Content-Disposition', $disposition);
$time = new \DateTime();
$response->setExpires($time->modify('+1 year'));
parent::prepare($response, $file);
}
}