Chamilo\CoreBundle\Controller\DropboxController::download()

Complexity

Conditions	14
Paths	11

Size

Total Lines	66
Code Lines	38

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
    #[Route('/files/{id<\d+>}/download', name: 'dropbox_file_download', methods: ['GET'])]
    public function download(int $id, Request $r): Response
    {
        [$cid] = $this->context($r);

        $file = $this->fileRepo->find($id);
        if (!$file || (int) $file->getCId() !== $cid) {
            throw $this->createNotFoundException('File not found');
        }

        // Resolve the resource file attached to this dropbox entry
        $resourceNode = $file->getResourceNode();
        $resourceFile = $resourceNode?->getFirstResourceFile();

        if (!$resourceFile) {
            throw $this->createNotFoundException('Resource file not found');
        }

        // Display name: prefer the dropbox visible title; fallback to original name
        $downloadName = trim($file->getTitle() ?: $resourceFile->getOriginalName() ?: 'file.bin');

        // Guess mime
        $mime = $resourceFile->getMimeType() ?: 'application/octet-stream';
        if ($mime === 'application/octet-stream' && class_exists(MimeTypes::class)) {
            $types = new MimeTypes();
            $guess = $types->guessMimeType($downloadName);
            if ($guess) {
                $mime = $guess;
            }
        }

        // Stream from ResourceNode FS (no tmp-path fallback)
        $stream = $this->resourceNodeRepository->getResourceNodeFileStream($resourceNode, $resourceFile);
        if (!\is_resource($stream)) {
            throw $this->createNotFoundException('Resource stream not available');
        }

        $size = (int) $resourceFile->getSize();

        $response = new StreamedResponse(function () use ($stream) {
            // Stream file in chunks
            while (!feof($stream)) {
                $buffer = fread($stream, 8192);
                if ($buffer === false) {
                    break;
                }
                echo $buffer;
                @ob_flush();

It seems like you do not handle an error condition for ob_flush(). This can introduce security issues, and is generally not recommended.

                flush();
            }
            fclose($stream);
        });

        $disposition = $response->headers->makeDisposition(
            ResponseHeaderBag::DISPOSITION_ATTACHMENT,
            $downloadName
        );

        $response->headers->set('Content-Type', $mime);
        if ($size > 0) {
            $response->headers->set('Content-Length', (string) $size);
            $response->headers->set('Accept-Ranges', 'none'); // simple download (no Range)
        }
        $response->headers->set('Content-Disposition', $disposition);

        return $response;
    }