mirror of
https://github.com/BookStackApp/BookStack.git
synced 2026-10-12 02:01:37 +00:00
Dan Brown
e210cc32e4
- Updates ZIP imports to validate that actual mime type of book cover images to ensure they are a supported image file. - Updates lower level ImageStorage to validate extensions of images when cleaning their name pre-storage. - Updates ZIP import Image and Book handling so book cover and image files have their extension forced from file mime types in the same way. Added testing to cover. Thanks to the submersion.ai security research team for reporting.
57 lines
1.5 KiB
PHP
57 lines
1.5 KiB
PHP
<?php
|
|
|
|
namespace BookStack\Exports\ZipExports\Models;
|
|
|
|
use BookStack\Exports\ZipExports\ZipExportFiles;
|
|
use BookStack\Exports\ZipExports\ZipValidationHelper;
|
|
use BookStack\Uploads\Image;
|
|
use Illuminate\Validation\Rule;
|
|
|
|
final class ZipExportImage extends ZipExportModel
|
|
{
|
|
public ?int $id = null;
|
|
public string $name;
|
|
public string $file;
|
|
public string $type;
|
|
|
|
public static function fromModel(Image $model, ZipExportFiles $files): self
|
|
{
|
|
$instance = new self();
|
|
$instance->id = $model->id;
|
|
$instance->name = $model->name;
|
|
$instance->type = $model->type;
|
|
$instance->file = $files->referenceForImage($model);
|
|
|
|
return $instance;
|
|
}
|
|
|
|
public function metadataOnly(): void
|
|
{
|
|
//
|
|
}
|
|
|
|
public static function validate(ZipValidationHelper $context, array $data): array
|
|
{
|
|
$rules = [
|
|
'id' => ['nullable', 'int', $context->uniqueIdRule('image')],
|
|
'name' => ['required', 'string', 'min:1'],
|
|
'file' => ['required', 'string', $context->imageFileReferenceRule()],
|
|
'type' => ['required', 'string', Rule::in(['gallery', 'drawio'])],
|
|
];
|
|
|
|
return $context->validateData($data, $rules);
|
|
}
|
|
|
|
public static function fromArray(array $data): static
|
|
{
|
|
$model = new static();
|
|
|
|
$model->id = $data['id'] ?? null;
|
|
$model->name = $data['name'];
|
|
$model->file = $data['file'];
|
|
$model->type = $data['type'];
|
|
|
|
return $model;
|
|
}
|
|
}
|