1) { $this->outputDir = $this->findOutputDir(); } $path = $this->outputDir; foreach ($files as $key => $f) { if ($path === '') { $path = File::dirpath($f['tmp_name']); } $result[$key] = []; $result[$key]['status'] = UploadStatus::OK; if (!isset($f['error'])) { $result[$key]['status'] = UploadStatus::WRONG_PARAMETERS; return $result; } elseif ($f['error'] !== \UPLOAD_ERR_OK) { $result[$key]['status'] = $this->getUploadError($f['error']); return $result; } $result[$key]['size'] = $f['size']; if ($f['size'] > $this->maxSize) { $result[$key]['status'] = UploadStatus::CONFIG_SIZE; return $result; } if (!empty($this->allowedTypes) && ($ext = \array_search($f['type'], $this->allowedTypes, true)) === false) { $result[$key]['status'] = UploadStatus::WRONG_EXTENSION; return $result; } $split = \explode('.', $f['name']); $result[$key]['filename'] = \count($files) === 1 && !empty($name) ? $name : $f['name']; $extension = \count($split) > 1 ? $split[\count($split) - 1] : ''; $result[$key]['extension'] = $extension; if ($this->preserveFileName) { $name = $f['name']; $result[$key]['filename'] = $name; } if (!$this->preserveFileName || $fileCount !== 1 || empty($name) || \is_file($path . '/' . $name)) { try { $name = $this->createFileName($path, $f['tmp_name'], $extension); $result[$key]['filename'] = $name; } catch (\Exception $e) { $result[$key]['filename'] = $f['name']; $result[$key]['status'] = UploadStatus::FAILED_HASHING; return $result; } } $result[$key]['name'] = empty($name) ? $result[$key]['filename'] : $name; if (!\is_dir($path)) { $created = Directory::create($path, 0755, true); if (!$created) { FileLogger::getInstance()->error('Couldn\t upload media file. There maybe is a problem with your permission or uploaded file.'); } } if (!\rename($f['tmp_name'], $dest = $path . '/' . $name)) { $result[$key]['status'] = UploadStatus::NOT_MOVABLE; return $result; } if ($encryptionKey !== '') { $nonce = \sodium_randombytes_buf(24); $fpSource = \fopen($dest, 'r+'); $fpEncoded = \fopen($dest . '.tmp', 'w'); if ($fpSource === false || $fpEncoded === false) { $result[$key]['status'] = UploadStatus::NOT_ENCRYPTABLE; return $result; } while (($buffer = \fgets($fpSource, 4096)) !== false) { $encrypted = \sodium_crypto_secretbox($buffer, $nonce, $encryptionKey); \fwrite($fpEncoded, $encrypted); } \fclose($fpSource); \fclose($fpEncoded); \unlink($dest); \rename($dest . '.tmp', $dest); $result[$key]['nonce'] = $nonce; } /* if ($this->isInterlaced && \in_array($extension, FileUtils::IMAGE_EXTENSION)) { //$this->interlace($extension, $dest); } */ /* if ($encoding !== '') { // changing encoding bugs out image files //FileUtils::changeFileEncoding($dest, $encoding); }*/ $result[$key]['path'] = $path; } return $result; } /** * Create file name if file already exists or if file name should be random. * * @param string $path Path where file should be saved * @param string $tempName Temp. file name generated during upload * @param string $extension Extension name * * @return string * * @throws \Exception This exception is thrown if the file couldn't be created * * @since 1.0.0 */ private function createFileName(string $path, string $tempName, string $extension) : string { $rnd = ''; $limit = 0; do { $sha = \sha1($tempName . $rnd); if ($sha === false) { throw new \Exception('No file path could be found. Potential attack!'); } $sha .= '.' . $extension; $fileName = $sha; $rnd = \mt_rand(); ++$limit; } while (\is_file($path . '/' . $fileName) && $limit < self::PATH_GENERATION_LIMIT); if ($limit >= self::PATH_GENERATION_LIMIT) { throw new \Exception('No file path could be found. Potential attack!'); } return $fileName; } /** * Make image interlace * * @param string $extension Image extension * @param string $path File path * * @return void * * @since 1.0.0 */ private function interlace(string $extension, string $path) : void { if ($extension === 'png') { $img = \imagecreatefrompng($path); } elseif ($extension === 'jpg' || $extension === 'jpeg') { $img = \imagecreatefromjpeg($path); } else { $img = \imagecreatefromgif($path); } if ($img === false) { return; } \imageinterlace($img, $this->isInterlaced); if ($extension === 'png') { \imagepng($img, $path); } elseif ($extension === 'jpg' || $extension === 'jpeg') { \imagejpeg($img, $path); } else { \imagegif($img, $path); } \imagedestroy($img); } /** * Find unique output path for batch of files * * @return string * * @since 1.0.0 */ private function findOutputDir() : string { do { $rndPath = \str_pad(\dechex(\mt_rand(0, 65535)), 4, '0', \STR_PAD_LEFT); } while (\is_dir($this->outputDir . '/_' . $rndPath)); return $this->outputDir . '/_' . $rndPath; } /** * Get upload error * * @param mixed $error Error type * * @return int * * @since 1.0.0 */ private function getUploadError($error) : int { switch ($error) { case \UPLOAD_ERR_NO_FILE: return UploadStatus::NOTHING_UPLOADED; case \UPLOAD_ERR_INI_SIZE: case \UPLOAD_ERR_FORM_SIZE: return UploadStatus::UPLOAD_SIZE; default: return UploadStatus::UNKNOWN_ERROR; } } /** * @return string[] * * @since 1.0.0 */ public function getAllowedTypes() : array { return $this->allowedTypes; } /** * @param string[] $allowedTypes Allowed file types * * @return void * * @since 1.0.0 */ public function setAllowedTypes(array $allowedTypes) : void { $this->allowedTypes = $allowedTypes; } /** * @param string $allowedTypes Allowed file types * * @return void * * @since 1.0.0 */ public function addAllowedTypes(string $allowedTypes) : void { $this->allowedTypes[] = $allowedTypes; } }