h0rseduck /
yii2-upload-behavior
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | |||
| 3 | namespace h0rseduck\file; |
||
| 4 | |||
| 5 | use Imagine\Image\Box; |
||
| 6 | use Imagine\Image\ImageInterface; |
||
| 7 | use Imagine\Image\ManipulatorInterface; |
||
| 8 | use Yii; |
||
| 9 | use yii\base\InvalidArgumentException; |
||
| 10 | use yii\base\InvalidConfigException; |
||
| 11 | use yii\base\NotSupportedException; |
||
| 12 | use yii\db\BaseActiveRecord; |
||
| 13 | use yii\helpers\ArrayHelper; |
||
| 14 | use yii\helpers\FileHelper; |
||
| 15 | use yii\imagine\Image; |
||
| 16 | |||
| 17 | /** |
||
| 18 | * UploadImageBehavior automatically uploads image, creates thumbnails and fills |
||
| 19 | * the specified attribute with a value of the name of the uploaded image. |
||
| 20 | * |
||
| 21 | * To use UploadImageBehavior, insert the following code to your ActiveRecord class: |
||
| 22 | * |
||
| 23 | * ```php |
||
| 24 | * use h0rseduck\file\UploadImageBehavior; |
||
| 25 | * |
||
| 26 | * function behaviors() |
||
| 27 | * { |
||
| 28 | * return [ |
||
| 29 | * [ |
||
| 30 | * 'class' => UploadImageBehavior::class, |
||
| 31 | * 'attribute' => 'file', |
||
| 32 | * 'scenarios' => ['insert', 'update'], |
||
| 33 | * 'placeholder' => '@app/modules/user/assets/images/userpic.jpg', |
||
| 34 | * 'path' => '@webroot/upload/{id}/images', |
||
| 35 | * 'url' => '@web/upload/{id}/images', |
||
| 36 | * 'thumbPath' => '@webroot/upload/{id}/images/thumb', |
||
| 37 | * 'thumbUrl' => '@web/upload/{id}/images/thumb', |
||
| 38 | * 'autorotate' => true, |
||
| 39 | * 'thumbs' => [ |
||
| 40 | * 'thumb' => ['width' => 400, 'quality' => 90], |
||
| 41 | * 'preview' => ['width' => 200, 'height' => 200], |
||
| 42 | * ], |
||
| 43 | * ], |
||
| 44 | * ]; |
||
| 45 | * } |
||
| 46 | * ``` |
||
| 47 | * |
||
| 48 | * @author Alexander Mohorev <[email protected]> |
||
| 49 | * @author Alexey Samoylov <[email protected]> |
||
| 50 | * @author H0rse Duck <[email protected]> |
||
| 51 | */ |
||
| 52 | class UploadImageBehavior extends UploadBehavior |
||
| 53 | { |
||
| 54 | /** |
||
| 55 | * @var string |
||
| 56 | */ |
||
| 57 | public $placeholder; |
||
| 58 | |||
| 59 | /** |
||
| 60 | * @var boolean |
||
| 61 | */ |
||
| 62 | public $createThumbsOnSave = true; |
||
| 63 | |||
| 64 | /** |
||
| 65 | * @var boolean |
||
| 66 | */ |
||
| 67 | public $createThumbsOnRequest = false; |
||
| 68 | |||
| 69 | /** |
||
| 70 | * Rotates an image automatically based on EXIF information. |
||
| 71 | * @var boolean |
||
| 72 | */ |
||
| 73 | public $autorotate = false; |
||
| 74 | |||
| 75 | /** |
||
| 76 | * Whether delete original uploaded image after thumbs generating. |
||
| 77 | * Defaults to FALSE |
||
| 78 | * @var boolean |
||
| 79 | */ |
||
| 80 | public $deleteOriginalFile = false; |
||
| 81 | |||
| 82 | /** |
||
| 83 | * @var array the thumbnail profiles |
||
| 84 | * - `width` |
||
| 85 | * - `height` |
||
| 86 | * - `quality` |
||
| 87 | */ |
||
| 88 | public $thumbs = [ |
||
| 89 | 'thumb' => ['width' => 200, 'height' => 200, 'quality' => 90], |
||
| 90 | ]; |
||
| 91 | |||
| 92 | /** |
||
| 93 | * @var string|null |
||
| 94 | */ |
||
| 95 | public $thumbPath; |
||
| 96 | |||
| 97 | /** |
||
| 98 | * @var string|null |
||
| 99 | */ |
||
| 100 | public $thumbUrl; |
||
| 101 | |||
| 102 | /** |
||
| 103 | * @var ImageInterface |
||
| 104 | */ |
||
| 105 | private $originalImage; |
||
| 106 | |||
| 107 | /** |
||
| 108 | * @inheritdoc |
||
| 109 | * @throws NotSupportedException |
||
| 110 | * @throws InvalidConfigException |
||
| 111 | */ |
||
| 112 | public function init() |
||
| 113 | { |
||
| 114 | if (!class_exists(Image::class)) { |
||
| 115 | throw new NotSupportedException("Yii2-imagine extension is required to use the UploadImageBehavior"); |
||
| 116 | } |
||
| 117 | |||
| 118 | parent::init(); |
||
| 119 | |||
| 120 | if ($this->createThumbsOnSave || $this->createThumbsOnRequest) { |
||
| 121 | if ($this->thumbPath === null) { |
||
| 122 | $this->thumbPath = $this->path; |
||
| 123 | } |
||
| 124 | if ($this->thumbUrl === null) { |
||
| 125 | $this->thumbUrl = $this->url; |
||
| 126 | } |
||
| 127 | } |
||
| 128 | } |
||
| 129 | |||
| 130 | /** |
||
| 131 | * @inheritdoc |
||
| 132 | * @throws InvalidConfigException |
||
| 133 | * @throws \yii\base\Exception |
||
| 134 | */ |
||
| 135 | protected function afterUpload() |
||
| 136 | { |
||
| 137 | parent::afterUpload(); |
||
| 138 | $path = $this->getPathOriginalImage(); |
||
| 139 | if ($path) { |
||
| 140 | $this->originalImage = Image::getImagine()->open($path); |
||
| 141 | if ($this->autorotate) { |
||
| 142 | Image::autorotate($this->originalImage)->save($path); |
||
|
0 ignored issues
–
show
|
|||
| 143 | } |
||
| 144 | if ($this->createThumbsOnSave) { |
||
| 145 | $this->createThumbs($path); |
||
| 146 | } |
||
| 147 | } |
||
| 148 | } |
||
| 149 | |||
| 150 | /** |
||
| 151 | * @param $path |
||
| 152 | * @throws InvalidConfigException |
||
| 153 | * @throws \yii\base\Exception |
||
| 154 | */ |
||
| 155 | protected function createThumbs($path) |
||
| 156 | { |
||
| 157 | foreach ($this->thumbs as $profile => $config) { |
||
| 158 | $thumbPath = $this->getThumbUploadPath($this->attribute, $profile); |
||
| 159 | if ($thumbPath !== null) { |
||
| 160 | if (!FileHelper::createDirectory(dirname($thumbPath))) { |
||
| 161 | throw new InvalidArgumentException( |
||
| 162 | "Directory specified in 'thumbPath' attribute doesn't exist or cannot be created." |
||
| 163 | ); |
||
| 164 | } |
||
| 165 | if (!is_file($thumbPath)) { |
||
| 166 | $this->generateImageThumb($config, $path, $thumbPath); |
||
|
0 ignored issues
–
show
It seems like
$thumbPath defined by $this->getThumbUploadPat...s->attribute, $profile) on line 158 can also be of type boolean; however, h0rseduck\file\UploadIma...r::generateImageThumb() does only seem to accept string, maybe add an additional type check?
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check: /**
* @return array|string
*/
function returnsDifferentValues($x) {
if ($x) {
return 'foo';
}
return array();
}
$x = returnsDifferentValues($y);
if (is_array($x)) {
// $x is an array.
}
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue. Loading history...
|
|||
| 167 | } |
||
| 168 | } |
||
| 169 | } |
||
| 170 | |||
| 171 | if ($this->deleteOriginalFile) { |
||
| 172 | parent::delete($this->attribute); |
||
|
0 ignored issues
–
show
It seems like you call parent on a different method (
delete() instead of createThumbs()). Are you sure this is correct? If so, you might want to change this to $this->delete().
This check looks for a call to a parent method whose name is different than the method from which it is called. Consider the following code: class Daddy
{
protected function getFirstName()
{
return "Eidur";
}
protected function getSurName()
{
return "Gudjohnsen";
}
}
class Son
{
public function getFirstName()
{
return parent::getSurname();
}
}
The Loading history...
|
|||
| 173 | } |
||
| 174 | } |
||
| 175 | |||
| 176 | /** |
||
| 177 | * @param string $attribute |
||
| 178 | * @param string $profile |
||
| 179 | * @param boolean $old |
||
| 180 | * @return string |
||
| 181 | */ |
||
| 182 | public function getThumbUploadPath($attribute, $profile = 'thumb', $old = false) |
||
| 183 | { |
||
| 184 | /** @var BaseActiveRecord $model */ |
||
| 185 | $model = $this->owner; |
||
| 186 | $path = $this->resolvePath($this->thumbPath); |
||
| 187 | $attribute = ($old === true) ? $model->getOldAttribute($attribute) : $model->$attribute; |
||
| 188 | $filename = $this->getThumbFileName($attribute, $profile); |
||
| 189 | |||
| 190 | return $filename ? Yii::getAlias($path . '/' . $filename) : null; |
||
| 191 | } |
||
| 192 | |||
| 193 | /** |
||
| 194 | * @param string $attribute |
||
| 195 | * @param string $profile |
||
| 196 | * @return string|null |
||
| 197 | * @throws InvalidConfigException |
||
| 198 | * @throws \yii\base\Exception |
||
| 199 | */ |
||
| 200 | public function getThumbUploadUrl($attribute, $profile = 'thumb') |
||
| 201 | { |
||
| 202 | /** @var BaseActiveRecord $model */ |
||
| 203 | $model = $this->owner; |
||
| 204 | $path = $this->getPathOriginalImage(); |
||
| 205 | if ($path && $this->createThumbsOnRequest) { |
||
| 206 | $this->createThumbs($path); |
||
| 207 | } |
||
| 208 | |||
| 209 | if (is_file($this->getThumbUploadPath($attribute, $profile))) { |
||
| 210 | $url = $this->resolvePath($this->thumbUrl); |
||
| 211 | $fileName = $model->getOldAttribute($attribute); |
||
| 212 | $thumbName = $this->getThumbFileName($fileName, $profile); |
||
| 213 | |||
| 214 | return Yii::getAlias($url . '/' . $thumbName); |
||
| 215 | } elseif ($this->placeholder) { |
||
| 216 | return $this->getPlaceholderUrl($profile); |
||
| 217 | } else { |
||
| 218 | return null; |
||
| 219 | } |
||
| 220 | } |
||
| 221 | |||
| 222 | /** |
||
| 223 | * @param $profile |
||
| 224 | * @return string |
||
| 225 | * @throws InvalidConfigException |
||
| 226 | */ |
||
| 227 | protected function getPlaceholderUrl($profile) |
||
| 228 | { |
||
| 229 | list ($path, $url) = Yii::$app->assetManager->publish($this->placeholder); |
||
| 230 | $filename = basename($path); |
||
| 231 | $thumb = $this->getThumbFileName($filename, $profile); |
||
| 232 | $thumbPath = dirname($path) . DIRECTORY_SEPARATOR . $thumb; |
||
| 233 | $thumbUrl = dirname($url) . '/' . $thumb; |
||
| 234 | |||
| 235 | if (!is_file($thumbPath)) { |
||
| 236 | $this->generateImageThumb($this->thumbs[$profile], $path, $thumbPath); |
||
| 237 | } |
||
| 238 | |||
| 239 | return $thumbUrl; |
||
| 240 | } |
||
| 241 | |||
| 242 | /** |
||
| 243 | * @inheritdoc |
||
| 244 | */ |
||
| 245 | protected function delete($attribute, $old = false) |
||
| 246 | { |
||
| 247 | parent::delete($attribute, $old); |
||
| 248 | |||
| 249 | $profiles = array_keys($this->thumbs); |
||
| 250 | foreach ($profiles as $profile) { |
||
| 251 | $path = $this->getThumbUploadPath($attribute, $profile, $old); |
||
| 252 | if (is_file($path)) { |
||
| 253 | unlink($path); |
||
| 254 | } |
||
| 255 | } |
||
| 256 | } |
||
| 257 | |||
| 258 | /** |
||
| 259 | * @param $filename |
||
| 260 | * @param string $profile |
||
| 261 | * @return string |
||
| 262 | */ |
||
| 263 | protected function getThumbFileName($filename, $profile = 'thumb') |
||
| 264 | { |
||
| 265 | return $profile . '-' . $filename; |
||
| 266 | } |
||
| 267 | |||
| 268 | /** |
||
| 269 | * @param array $config |
||
| 270 | * @param string $path |
||
| 271 | * @param string $thumbPath |
||
| 272 | * @throws InvalidConfigException |
||
| 273 | */ |
||
| 274 | protected function generateImageThumb($config, $path, $thumbPath) |
||
|
0 ignored issues
–
show
|
|||
| 275 | { |
||
| 276 | $width = $this->getConfigValue($config, 'width'); |
||
| 277 | $height = $this->getConfigValue($config, 'height'); |
||
| 278 | |||
| 279 | if ($height < 1 && $width < 1) { |
||
| 280 | throw new InvalidConfigException(sprintf( |
||
| 281 | 'Length of either side of thumb cannot be 0 or negative, current size ' . |
||
| 282 | 'is %sx%s', $width, $height |
||
| 283 | )); |
||
| 284 | } |
||
| 285 | |||
| 286 | $quality = $this->getConfigValue($config, 'quality', 100); |
||
| 287 | $mode = $this->getConfigValue($config, 'mode', ManipulatorInterface::THUMBNAIL_INSET); |
||
| 288 | $bg_color = $this->getConfigValue($config, 'bg_color', 'FFF'); |
||
| 289 | |||
| 290 | if (!$width || !$height) { |
||
| 291 | $ratio = $this->originalImage->getSize()->getWidth() / $this->originalImage->getSize()->getHeight(); |
||
| 292 | if ($width) { |
||
| 293 | $height = ceil($width / $ratio); |
||
| 294 | } else { |
||
| 295 | $width = ceil($height * $ratio); |
||
| 296 | } |
||
| 297 | } |
||
| 298 | |||
| 299 | $processor = ArrayHelper::getValue($config, 'processor'); |
||
| 300 | if (!$processor || !is_callable($processor)) { |
||
| 301 | $processor = function (ImageInterface $thumb) use ($width, $height, $mode) { |
||
| 302 | $thumb->thumbnail(new Box($width, $height), $mode); |
||
| 303 | }; |
||
| 304 | } |
||
| 305 | |||
| 306 | // Fix error "PHP GD Allowed memory size exhausted". |
||
| 307 | ini_set('memory_limit', '512M'); |
||
| 308 | Image::$thumbnailBackgroundColor = $bg_color; |
||
| 309 | |||
| 310 | $thumb = clone $this->originalImage; |
||
| 311 | call_user_func($processor, $thumb); |
||
| 312 | $thumb->save($thumbPath, ['quality' => $quality]); |
||
| 313 | } |
||
| 314 | |||
| 315 | /** |
||
| 316 | * @param array $config |
||
| 317 | * @param string $attribute |
||
| 318 | * @param mixed|null $default |
||
| 319 | * @return mixed |
||
| 320 | */ |
||
| 321 | private function getConfigValue($config, $attribute, $default = null) |
||
| 322 | { |
||
| 323 | $value = ArrayHelper::getValue($config, $attribute, $default); |
||
| 324 | if ($value instanceof \Closure) { |
||
| 325 | $value = call_user_func($value, $this->owner); |
||
| 326 | } |
||
| 327 | return $value; |
||
| 328 | } |
||
| 329 | |||
| 330 | /** |
||
| 331 | * @return bool|string |
||
| 332 | */ |
||
| 333 | private function getPathOriginalImage() |
||
| 334 | { |
||
| 335 | $path = $this->getUploadPath($this->attribute); |
||
| 336 | if (!$path || !is_file($path)) { |
||
| 337 | return false; |
||
| 338 | } |
||
| 339 | return $path; |
||
| 340 | } |
||
| 341 | } |
||
| 342 |
If a method or function can return multiple different values and unless you are sure that you only can receive a single value in this context, we recommend to add an additional type check:
If this a common case that PHP Analyzer should handle natively, please let us know by opening an issue.