floor12\files\actions\GetFileAction

Complexity

Total Complexity

5

Size/Duplication

Total Lines	28
Duplicated Lines	0 %

Importance

Changes	1
Bugs	0	Features	1

1 Method

Rating	Name	Duplication	Size	Complexity
A	run()	0	26	5

<?php

namespace floor12\files\actions;

use floor12\files\components\SimpleImage;
use floor12\files\models\File;
use floor12\files\models\FileType;
use Yii;
use yii\base\Action;
use yii\web\NotFoundHttpException;

class GetFileAction extends Action
{
    public function run($hash)
    {
        $model = File::findOne(['hash' => $hash]);

        if (!$model)

$model is of type yii\db\ActiveRecord, thus it always evaluated to true.

            throw new NotFoundHttpException("Запрашиваемый файл не найден");

        if (!file_exists($model->rootPath))

It seems like $model->rootPath can also be of type null; however, parameter $filename of file_exists() does only seem to accept string, maybe add an additional type check?

            throw new NotFoundHttpException('Запрашиваемый файл не найден на диске.');

        Yii::$app->response->headers->set('Last-Modified', date("c", $model->created));
        Yii::$app->response->headers->set('Cache-Control', 'public, max-age=' . (60 * 60 * 24 * 15));

        if ($model->type == FileType::IMAGE && $model->watermark) {
            $image = new SimpleImage();
            $image->load($model->rootPath);
            $image->watermark(Yii::getAlias("@frontend/web/design/logo-big.png"));
            $tmpName = Yii::getAlias("@runtime/" . md5(time() . $model->id));
            $image->save($tmpName, IMAGETYPE_JPEG);
            $stream = fopen($tmpName, 'rb');

It seems like $tmpName can also be of type false; however, parameter $filename of fopen() does only seem to accept string, maybe add an additional type check?

            Yii::$app->response->sendStreamAsFile($stream, $model->title, ['inline' => true, 'mimeType' => "image/jpeg", 'filesize' => $model->size]);
            @unlink($tmpName);

It seems like you do not handle an error condition for unlink(). This can introduce security issues, and is generally not recommended.

It seems like $tmpName can also be of type false; however, parameter $filename of unlink() does only seem to accept string, maybe add an additional type check?

        } else {
            $stream = fopen($model->rootPath, 'rb');

It seems like $model->rootPath can also be of type null; however, parameter $filename of fopen() does only seem to accept string, maybe add an additional type check?

            Yii::$app->response->sendStreamAsFile($stream, $model->title, ['inline' => true, 'mimeType' => $model->content_type, 'filesize' => $model->size]);
        }
    }
}