($data)
| 105 | } |
| 106 | |
| 107 | public function put($data): ?string |
| 108 | { |
| 109 | [$folderKey, $fileName] = $this->split(); |
| 110 | $fileName = basename(trim($fileName)); |
| 111 | |
| 112 | if (FolderCrypto::isEncryptedOrAncestor($folderKey)) { |
| 113 | throw new Forbidden('WebDAV is disabled inside encrypted folders'); |
| 114 | } |
| 115 | if (!self::isAllowedWebDavFileName($fileName)) { |
| 116 | throw new Forbidden('Invalid file name.'); |
| 117 | } |
| 118 | |
| 119 | $exists = is_file($this->path); |
| 120 | |
| 121 | if (!$this->isAdmin) { |
| 122 | // uploads disabled blocks both create & overwrite |
| 123 | if (!empty($this->perms['disableUpload'])) { |
| 124 | throw new Forbidden('Uploads are disabled for your account'); |
| 125 | } |
| 126 | // granular gates |
| 127 | if ($exists) { |
| 128 | if (!ACL::canEdit($this->user, $this->perms, $folderKey)) { |
| 129 | throw new Forbidden('No edit permission in this folder'); |
| 130 | } |
| 131 | } else { |
| 132 | if (!ACL::canUpload($this->user, $this->perms, $folderKey)) { |
| 133 | throw new Forbidden('No upload permission in this folder'); |
| 134 | } |
| 135 | } |
| 136 | } |
| 137 | |
| 138 | // Ownership on overwrite (unless admin/bypass) |
| 139 | $bypass = !empty($this->perms['bypassOwnership']) || $this->isAdmin; |
| 140 | if ($exists && !$bypass && !$this->isOwner($folderKey, $fileName)) { |
| 141 | throw new Forbidden('You do not own the target file'); |
| 142 | } |
| 143 | |
| 144 | // write + metadata (unchanged) |
| 145 | $maxBytes = defined('FR_WEBDAV_MAX_UPLOAD_BYTES') ? (int)FR_WEBDAV_MAX_UPLOAD_BYTES : 0; |
| 146 | if ($maxBytes < 0) { |
| 147 | $maxBytes = 0; |
| 148 | } |
| 149 | |
| 150 | if (is_resource($data)) { |
| 151 | $dir = dirname($this->path); |
| 152 | $tmp = $dir . DIRECTORY_SEPARATOR . '.' . basename($this->path) . '.tmp-' . bin2hex(random_bytes(8)); |
| 153 | $out = @fopen($tmp, 'wb'); |
| 154 | if ($out === false) { |
| 155 | throw new Forbidden('Unable to write file'); |
| 156 | } |
| 157 | $written = 0; |
| 158 | while (!feof($data)) { |
| 159 | $chunk = fread($data, 1024 * 1024); |
| 160 | if ($chunk === false) { |
| 161 | fclose($out); |
| 162 | @unlink($tmp); |
| 163 | throw new Forbidden('Unable to write file'); |
| 164 | } |
no test coverage detected