ControllerCommonFileManager::upload()

Complexity

Conditions	18
Paths	48

Size

Total Lines	94
Code Lines	50

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function upload()
    {
        $this->load->language('common/filemanager');

        $json = array();

        // Check user has permission
        if (!$this->user->hasPermission('modify', 'common/filemanager')) {
            $json['error'] = $this->language->get('error_permission');
        }

        // Make sure we have the correct directory
        if (isset($this->request->get['directory'])) {
            $directory = rtrim($_SERVER['DOCUMENT_ROOT'] . '/images/application/' . $this->request->get['directory'], '/');
        } else {
            $directory = $_SERVER['DOCUMENT_ROOT'] . '/images/application';
        }

        // Check its a directory
        if (!is_dir($directory) || substr(str_replace('\\', '/', realpath($directory)), 0, strlen($_SERVER['DOCUMENT_ROOT'] . '/public_html/assets/images/' . 'catalog')) != $_SERVER['DOCUMENT_ROOT'] . '/images/application') {
            $json['error'] = $this->language->get('error_directory');
        }

        if (!$json) {
            // Check if multiple files are uploaded or just one
            $files = array();

            if (!empty($this->request->files['file']['name']) && is_array($this->request->files['file']['name'])) {
                foreach (array_keys($this->request->files['file']['name']) as $key) {
                    $files[] = array(
                        'name'     => $this->request->files['file']['name'][$key],
                        'type'     => $this->request->files['file']['type'][$key],
                        'tmp_name' => $this->request->files['file']['tmp_name'][$key],
                        'error'    => $this->request->files['file']['error'][$key],
                        'size'     => $this->request->files['file']['size'][$key]
                    );
                }
            }

            foreach ($files as $file) {
                if (is_file($file['tmp_name'])) {
                    // Sanitize the filename
                    $filename = basename(html_entity_decode($file['name'], ENT_QUOTES, 'UTF-8'));

                    // Validate the filename length
                    if ((\voku\helper\UTF8::strlen($filename) < 3) || (\voku\helper\UTF8::strlen($filename) > 255)) {
                        $json['error'] = $this->language->get('error_filename');
                    }

                    // Allowed file extension types
                    $allowed = array(
                        'jpg',
                        'jpeg',
                        'gif',
                        'png'
                    );

                    if (!in_array(\voku\helper\UTF8::strtolower(\voku\helper\UTF8::substr(strrchr($filename, '.'), 1)), $allowed)) {

It seems like voku\helper\UTF8::substr(strrchr($filename, '.'), 1) can also be of type false; however, parameter $str of voku\helper\UTF8::strtolower() does only seem to accept string, maybe add an additional type check?

                        $json['error'] = $this->language->get('error_filetype');
                    }

                    // Allowed file mime types
                    $allowed = array(
                        'image/jpeg',
                        'image/pjpeg',
                        'image/png',
                        'image/x-png',
                        'image/gif'
                    );

                    if (!in_array($file['type'], $allowed)) {
                        $json['error'] = $this->language->get('error_filetype');
                    }

                    // Return any upload error
                    if ($file['error'] != UPLOAD_ERR_OK) {
                        $json['error'] = $this->language->get('error_upload_' . $file['error']);
                    }
                } else {
                    $json['error'] = $this->language->get('error_upload');
                }

                if (!$json) {

The expression $json of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using empty($expr) instead to make it clear that you intend to check for an array without elements.

                    move_uploaded_file($file['tmp_name'], $directory . '/' . $filename);

The variable $filename does not seem to be defined for all execution paths leading up to this point.

                }
            }
        }

        if (!$json) {
            $json['success'] = $this->language->get('text_uploaded');
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }