floor12\files\actions\GetFileAction::run()

Complexity

Conditions	5
Paths	4

Size

Total Lines	26
Code Lines	19

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	1

<?php
    public function run($hash)
    {
        $model = File::findOne(['hash' => $hash]);

        if (!$model)

$model is of type yii\db\ActiveRecord, thus it always evaluated to true.

            throw new NotFoundHttpException("Запрашиваемый файл не найден");

        if (!file_exists($model->rootPath))
            throw new NotFoundHttpException('Запрашиваемый файл не найден на диске.');

        Yii::$app->response->headers->set('Last-Modified', date("c", $model->created));
        Yii::$app->response->headers->set('Cache-Control', 'public, max-age=' . (60 * 60 * 24 * 15));

        if ($model->type == FileType::IMAGE && $model->watermark) {
            $image = new SimpleImage();
            $image->load($model->rootPath);
            $image->watermark(Yii::getAlias("@frontend/web/design/logo-big.png"));
            $tmpName = Yii::getAlias("@runtime/" . md5(time() . $model->id));
            $image->save($tmpName, IMAGETYPE_JPEG);
            $stream = fopen($tmpName, 'rb');
            Yii::$app->response->sendStreamAsFile($stream, $model->title, ['inline' => true, 'mimeType' => "image/jpeg", 'filesize' => $model->size]);

It seems like $stream can also be of type false; however, parameter $handle of yii\web\Response::sendStreamAsFile() does only seem to accept resource, maybe add an additional type check?

            @unlink($tmpName);

It seems like you do not handle an error condition for unlink(). This can introduce security issues, and is generally not recommended.

        } else {
            $stream = fopen($model->rootPath, 'rb');
            Yii::$app->response->sendStreamAsFile($stream, $model->title, ['inline' => true, 'mimeType' => $model->content_type, 'filesize' => $model->size]);
        }