Some security fixes

Author: uacode

README.md

@@ -30,9 +30,10 @@ Add a disk config in `config/admin.php`:
     'extensions' => [
 
         'media-manager' => [
-        
+
             // Select a local disk that you configured in `config/filesystem.php`
-            'disk' => 'public'
+            'disk' => 'public',
+            'allowed_ext' => 'jpg,jpeg,png,pdf,doc,docx,zip'
         ],
     ],
 

src/MediaController.php

@@ -1,5 +1,4 @@
 <?php
-
 namespace Encore\Admin\Media;
 
 use Encore\Admin\Facades\Admin;
@@ -12,19 +11,19 @@ class MediaController extends Controller
     public function index(Request $request)
     {
         return Admin::content(function (Content $content) use ($request) {
-            $content->header('Media manager');
+                $content->header('Media manager');
 
-            $path = $request->get('path', '/');
-            $view = $request->get('view', 'table');
+                $path = $request->get('path', '/');
+                $view = $request->get('view', 'table');
 
-            $manager = new MediaManager($path);
+                $manager = new MediaManager($path);
 
-            $content->body(view("laravel-admin-media::$view", [
+                $content->body(view("laravel-admin-media::$view", [
                 'list'   => $manager->ls(),
                 'nav'    => $manager->navigation(),
                 'url'    => $manager->urls(),
-            ]));
-        });
+                ]));
+            });
     }
 
     public function download(Request $request)
@@ -33,7 +32,14 @@ public function download(Request $request)
 
         $manager = new MediaManager($file);
 
-        return $manager->download();
+        try {
+            return $manager->download();
+        } catch (\Exception $e) {
+            return response()->json([
+                'status' => false,
+                'message' => $e->getMessage(),
+            ]);
+        }
     }
 
     public function upload(Request $request)
@@ -63,14 +69,14 @@ public function delete(Request $request)
         try {
             if ($manager->delete($files)) {
                 return response()->json([
-                    'status'  => true,
-                    'message' => trans('admin.delete_succeeded'),
+                        'status'  => true,
+                        'message' => trans('admin.delete_succeeded'),
                 ]);
             }
         } catch (\Exception $e) {
             return response()->json([
-                'status'  => true,
-                'message' => $e->getMessage(),
+                    'status'  => false,
+                    'message' => $e->getMessage(),
             ]);
         }
     }
@@ -85,14 +91,14 @@ public function move(Request $request)
         try {
             if ($manager->move($new)) {
                 return response()->json([
-                    'status'  => true,
-                    'message' => trans('admin.move_succeeded'),
+                        'status'  => true,
+                        'message' => trans('admin.move_succeeded'),
                 ]);
             }
         } catch (\Exception $e) {
             return response()->json([
-                'status'  => true,
-                'message' => $e->getMessage(),
+                    'status'  => false,
+                    'message' => $e->getMessage(),
             ]);
         }
     }
@@ -113,7 +119,7 @@ public function newFolder(Request $request)
             }
         } catch (\Exception $e) {
             return response()->json([
-                'status'  => true,
+                'status'  => false,
                 'message' => $e->getMessage(),
             ]);
         }

src/MediaManager.php

@@ -26,6 +26,12 @@ class MediaManager extends Extension
      */
     protected $storage;
 
+    /**
+     * List of allowed extensions.
+     * @var string
+     */
+    protected $allowed = [];
+
     /**
      * @var array
      */
@@ -50,6 +56,10 @@ public function __construct($path = '/')
     {
         $this->path = $path;
 
+        if (!empty(config('admin.extensions.media-manager.allowed_ext'))) {
+            $this->allowed = explode(',', config('admin.extensions.media-manager.allowed_ext'));
+        }
+
         $this->initStorage();
     }
 
@@ -77,10 +87,10 @@ public function ls()
         $directories = $this->storage->directories($this->path);
 
         return $this->formatDirectories($directories)
-            ->merge($this->formatFiles($files))
-            ->sort(function ($item) {
-                return $item['name'];
-            })->all();
+                ->merge($this->formatFiles($files))
+                ->sort(function ($item) {
+                    return $item['name'];
+                })->all();
     }
 
     /**
@@ -92,7 +102,11 @@ public function ls()
      */
     protected function getFullPath($path)
     {
-        return $this->storage->getDriver()->getAdapter()->applyPathPrefix($path);
+        $path = $this->storage->getDriver()->getAdapter()->applyPathPrefix($path);
+        if (strstr($fullPath, '..')) {
+            throw new \Exception('Incorrect path');
+        }
+        return $path;
     }
 
     public function download()
@@ -125,6 +139,11 @@ public function delete($path)
 
     public function move($new)
     {
+        $ext = pathinfo($new, PATHINFO_EXTENSION);
+        if ($this->allowed && !in_array($ext, $this->allowed)) {
+            throw new \Exception('File extension ' . $ext . ' is not allowed');
+        }
+
         return $this->storage->move($this->path, $new);
     }
 
@@ -137,6 +156,10 @@ public function move($new)
     public function upload($files = [])
     {
         foreach ($files as $file) {
+            if ($this->allowed && !in_array($file->getClientOriginalExtension(), $this->allowed)) {
+                throw new \Exception('File extension ' . $file->getClientOriginalExtension() . ' is not allowed');
+            }
+
             $this->storage->putFileAs($this->path, $file, $file->getClientOriginalName());
         }