Merge pull request #4575 from okazy/hotfix/product_images

管理画面の商品画像登録処理の改善

src/Eccube/Form/Type/Admin/ProductType.php

@@ -27,6 +27,10 @@
 use Symfony\Component\Form\Extension\Core\Type\TextareaType;
 use Symfony\Component\Form\Extension\Core\Type\TextType;
 use Symfony\Component\Form\FormBuilderInterface;
+use Symfony\Component\Form\FormError;
+use Symfony\Component\Form\FormEvent;
+use Symfony\Component\Form\FormEvents;
+use Symfony\Component\Form\FormInterface;
 use Symfony\Component\OptionsResolver\OptionsResolver;
 use Symfony\Component\Validator\Constraints as Assert;
 
@@ -176,6 +180,35 @@ public function buildForm(FormBuilderInterface $builder, array $options)
                 'mapped' => false,
             ])
         ;
+
+        $builder->addEventListener(FormEvents::POST_SUBMIT, function (FormEvent $event) {
+            /** @var FormInterface $form */
+            $form = $event->getForm();
+            $saveImgDir = $this->eccubeConfig['eccube_save_image_dir'];
+            $tempImgDir = $this->eccubeConfig['eccube_temp_image_dir'];
+            $this->validateFilePath($form->get('delete_images'), [$saveImgDir, $tempImgDir]);
+            $this->validateFilePath($form->get('add_images'), [$tempImgDir]);
+        });
+    }
+
+    /**
+     * 指定された複数ディレクトリのうち、いずれかのディレクトリ以下にファイルが存在するかを確認。
+     *
+     * @param $form FormInterface
+     * @param $dirs array
+     */
+    private function validateFilePath($form, $dirs)
+    {
+        foreach ($form->getData() as $fileName) {
+            $fileInDir = array_filter($dirs, function ($dir) use ($fileName) {
+                $filePath = realpath($dir.'/'.$fileName);
+                $topDirPath = realpath($dir);
+                return strpos($filePath, $topDirPath) === 0 && $filePath !== $topDirPath;
+            });
+            if (!$fileInDir) {
+                $form->getRoot()['product_image']->addError(new FormError(trans('admin.product.image__invalid_path')));
+            }
+        }
     }
 
     /**

src/Eccube/Resource/locale/messages.en.yaml

@@ -608,6 +608,7 @@ admin.product.name: Product Name
 admin.product.image: Product Images
 admin.product.image__short: Images
 admin.product.image_size: 'More than 600px x 600px is recommended'
+admin.product.image__invalid_path: Invalid image path.
 admin.product.sale_type: Sales Type
 admin.product.description_detail: Product Descriptions
 admin.product.description_list: Product Descriptions (All)

src/Eccube/Resource/locale/messages.ja.yaml

@@ -608,6 +608,7 @@ admin.product.name: 商品名
 admin.product.image: 商品画像
 admin.product.image__short: 画像
 admin.product.image_size: '推奨サイズ : 600px x 600px以上'
+admin.product.image__invalid_path: 画像のパスが不正です。
 admin.product.sale_type: 販売種別
 admin.product.description_detail: 商品説明
 admin.product.description_list: 商品説明(一覧)