Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[CI-1267]: Security fix CVE-2023-46865 #20

Merged
merged 2 commits into from
Feb 4, 2024
Merged

[CI-1267]: Security fix CVE-2023-46865 #20

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
090fb2a
Add extension whitelist to company logo file name
asylumdx Oct 24, 2023
1dbae89
Update CompanyController.php
asylumdx Oct 25, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
60 changes: 39 additions & 21 deletions app/Http/Controllers/V1/Admin/Settings/CompanyController.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,41 +56,59 @@ public function updateCompany(CompanyRequest $request)

return new CompanyResource($company);
}
/**
* Upload the company logo to storage.
*
* @param \Crater\Http\Requests\CompanyLogoRequest $request
* @return \Illuminate\Http\JsonResponse
*/
public function uploadCompanyLogo(CompanyLogoRequest $request)
{
$company = Company::find($request->header('company'));
$this->authorize('manage company', $company);

/**
* Upload the company logo to storage.
*
* @param \Crater\Http\Requests\CompanyLogoRequest $request
* @return \Illuminate\Http\JsonResponse
*/
public function uploadCompanyLogo(CompanyLogoRequest $request)
{
$company = Company::find($request->header('company'));
$data = json_decode($request->company_logo);

$this->authorize('manage company', $company);
if (isset($request->is_company_logo_removed) && (bool) $request->is_company_logo_removed) {
$company->clearMediaCollection('logo');
}

$data = json_decode($request->company_logo);
if ($data) {
$company = Company::find($request->header('company'));

if (isset($request->is_company_logo_removed) && (bool) $request->is_company_logo_removed) {
$company->clearMediaCollection('logo');
}
if ($data) {
$company = Company::find($request->header('company'));
if ($company) {
// Extract the file extension from the filename
$fileExtension = pathinfo($data->name, PATHINFO_EXTENSION);

if ($company) {
// Define an array of allowed extensions
$allowedExtensions = ['gif', 'png', 'jpeg'];

// Check if the file extension is allowed
if (in_array($fileExtension, $allowedExtensions)) {
$company->clearMediaCollection('logo');

$company->addMediaFromBase64($data->data)
->usingFileName($data->name)
->toMediaCollection('logo');

return response()->json([
'success' => true,
]);
} else {
// File extension is not allowed
return response()->json([
'error' => 'Only .gif, .png, and .jpeg file extensions are allowed.',
], 400);
}
}

return response()->json([
'success' => true,
]);
}

return response()->json([
'success' => true,
]);
}


/**
* Upload the Admin Avatar to public storage.
*
Expand Down