47 lines
2.4 KiB
PHP
47 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Services;
|
|
|
|
use Illuminate\Contracts\Encryption\DecryptException;
|
|
use Illuminate\Http\Response;
|
|
use Illuminate\Support\Facades\Crypt;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Symfony\Component\HttpFoundation\BinaryFileResponse;
|
|
use Symfony\Component\HttpFoundation\HeaderUtils;
|
|
|
|
/** Authorization/publication stays with the consumer; originals share integrity and cipher handling. */
|
|
class VerifiedDocumentBinary
|
|
{
|
|
public function respond(object $document, bool $inline = false): Response|BinaryFileResponse
|
|
{
|
|
abort_unless($document->status === 'active' && $document->malware_scan_status === 'clean'
|
|
&& ($document->deleted_at ?? null) === null && hash_equals(trim($document->sha256), trim((string) $document->malware_scanned_sha256)), 404);
|
|
$disk = Storage::disk('local');
|
|
$root = realpath($disk->path(''));
|
|
$path = realpath($disk->path($document->storage_key));
|
|
abort_unless($root && $path && str_starts_with(strtolower($path), strtolower($root.DIRECTORY_SEPARATOR)) && is_file($path), 404);
|
|
$headers = ['X-Content-Type-Options' => 'nosniff', 'Cache-Control' => 'private, no-store'];
|
|
if ($inline) {
|
|
$headers['Content-Type'] = $document->media_type;
|
|
$headers['Content-Security-Policy'] = "sandbox; default-src 'none'; style-src 'unsafe-inline'";
|
|
}
|
|
if (($document->storage_encryption ?? null) === 'laravel') {
|
|
try {
|
|
$bytes = Crypt::decryptString($disk->get($document->storage_key));
|
|
} catch (DecryptException) {
|
|
abort(404);
|
|
}
|
|
abort_unless(hash_equals(trim($document->sha256), hash('sha256', $bytes)), 404);
|
|
$headers['Content-Type'] = $document->media_type;
|
|
$headers['Content-Disposition'] = HeaderUtils::makeDisposition($inline ? 'inline' : 'attachment', basename($document->file_name), 'document');
|
|
|
|
return response($bytes, 200, $headers);
|
|
}
|
|
abort_unless(($document->storage_encryption ?? null) === null, 404);
|
|
$checksum = hash_file('sha256', $path);
|
|
abort_unless(is_string($checksum) && hash_equals(trim($document->sha256), $checksum), 404);
|
|
|
|
return $inline ? response()->file($path, $headers)->setContentDisposition('inline', basename($document->file_name)) : response()->download($path, basename($document->file_name), $headers);
|
|
}
|
|
}
|