* Handles uploading a file to a shared folder. */
(string $token, array $fileUpload, string $subPath = '', ?string $providedPass = null)
| 3003 | * Handles uploading a file to a shared folder. |
| 3004 | */ |
| 3005 | public static function uploadToSharedFolder(string $token, array $fileUpload, string $subPath = '', ?string $providedPass = null): array |
| 3006 | { |
| 3007 | // Max size & allowed extensions (mirror FileModel’s common types) |
| 3008 | $maxSize = 50 * 1024 * 1024; // 50 MB |
| 3009 | $allowedExtensions = [ |
| 3010 | 'jpg', |
| 3011 | 'jpeg', |
| 3012 | 'png', |
| 3013 | 'gif', |
| 3014 | 'pdf', |
| 3015 | 'doc', |
| 3016 | 'docx', |
| 3017 | 'txt', |
| 3018 | 'xls', |
| 3019 | 'xlsx', |
| 3020 | 'ppt', |
| 3021 | 'pptx', |
| 3022 | 'mp4', |
| 3023 | 'webm', |
| 3024 | 'mp3', |
| 3025 | 'mkv', |
| 3026 | 'csv', |
| 3027 | 'json', |
| 3028 | 'xml', |
| 3029 | 'md' |
| 3030 | ]; |
| 3031 | |
| 3032 | $record = self::findShareFolderRecord($token); |
| 3033 | if (!$record) { |
| 3034 | return ["error" => "Invalid share token."]; |
| 3035 | } |
| 3036 | |
| 3037 | if (class_exists('SourceContext') && SourceContext::isReadOnly()) { |
| 3038 | return ["error" => "Source is read-only."]; |
| 3039 | } |
| 3040 | |
| 3041 | if (time() > ($record['expires'] ?? 0)) { |
| 3042 | return ["error" => "This share link has expired."]; |
| 3043 | } |
| 3044 | if (!empty($record['password']) && ($providedPass === null || $providedPass === '')) { |
| 3045 | return ["error" => "Password required."]; |
| 3046 | } |
| 3047 | if (!empty($record['password']) && !password_verify((string)$providedPass, $record['password'])) { |
| 3048 | return ["error" => "Invalid password."]; |
| 3049 | } |
| 3050 | if (empty($record['allowUpload']) || (int)$record['allowUpload'] !== 1) { |
| 3051 | return ["error" => "File uploads are not allowed for this share."]; |
| 3052 | } |
| 3053 | |
| 3054 | // Encrypted folders/descendants: shared access is blocked (v1). |
| 3055 | $folderKey = trim((string)($record['folder'] ?? ''), "/\\ "); |
| 3056 | $folderKey = ($folderKey === '' ? 'root' : $folderKey); |
| 3057 | try { |
| 3058 | if (FolderCrypto::isEncryptedOrAncestor($folderKey)) { |
| 3059 | @unlink($fileUpload['tmp_name'] ?? ''); |
| 3060 | return ["error" => "Uploads are disabled for encrypted folders."]; |
| 3061 | } |
| 3062 | } catch (\Throwable $e) { |
no test coverage detected