Deploy Ladill Merchant / deploy (push) Successful in 24s
SVG can embed JavaScript and would run as stored XSS when served inline on a public storefront page, and we have no SVG sanitizer. Allow only raster formats: - item_images validation: image rule (permits SVG) -> mimes:jpeg,jpg,png,gif,webp - QrCodeManagerService: reject image/svg+xml / .svg(z) in brand-image and item-image storage (defense in depth, since those only checked the image/* prefix) - file pickers: accept raster mimes only Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
198 lines
7.0 KiB
PHP
198 lines
7.0 KiB
PHP
<?php
|
|
|
|
namespace App\Http\Controllers\Merchant;
|
|
|
|
use App\Http\Controllers\Controller;
|
|
use App\Models\QrCode;
|
|
use App\Services\Qr\QrCodeManagerService;
|
|
use App\Services\Qr\QrImageGeneratorService;
|
|
use App\Services\Qr\QrPdfExporter;
|
|
use App\Support\Qr\QrTypeCatalog;
|
|
use Illuminate\Http\RedirectResponse;
|
|
use Illuminate\Http\Request;
|
|
use Illuminate\Support\Facades\Storage;
|
|
use Illuminate\Support\Str;
|
|
use Illuminate\View\View;
|
|
use RuntimeException;
|
|
use Symfony\Component\HttpFoundation\Response;
|
|
use Symfony\Component\HttpFoundation\StreamedResponse;
|
|
|
|
class StorefrontController extends Controller
|
|
{
|
|
public function __construct(
|
|
private QrCodeManagerService $manager,
|
|
private QrImageGeneratorService $imageGenerator,
|
|
private QrPdfExporter $pdfExporter,
|
|
) {}
|
|
|
|
public function index(Request $request): View
|
|
{
|
|
$account = ladill_account();
|
|
$qrCodes = $account->qrCodes()
|
|
->whereIn('type', \App\Support\Qr\QrTypeCatalog::storefrontTypes())
|
|
->latest()
|
|
->get();
|
|
|
|
$previewDataUris = $qrCodes->mapWithKeys(function (QrCode $qr) {
|
|
return [$qr->id => $this->imageGenerator->previewDataUri($qr)];
|
|
});
|
|
|
|
return view('merchant.storefronts.index', [
|
|
'qrCodes' => $qrCodes,
|
|
'previewDataUris' => $previewDataUris,
|
|
]);
|
|
}
|
|
|
|
public function create(Request $request): View
|
|
{
|
|
$requestedType = (string) $request->query('type', QrCode::TYPE_SHOP);
|
|
if (! QrTypeCatalog::isValid($requestedType)) {
|
|
$requestedType = QrCode::TYPE_SHOP;
|
|
}
|
|
|
|
return view('merchant.storefronts.create', ['requestedType' => $requestedType]);
|
|
}
|
|
|
|
public function store(Request $request): RedirectResponse
|
|
{
|
|
$account = ladill_account();
|
|
|
|
$request->validate([
|
|
'label' => ['required', 'string', 'max:120'],
|
|
'type' => ['required', 'in:'.implode(',', QrTypeCatalog::storefrontTypes())],
|
|
'menu_logo' => ['nullable', 'image', 'mimes:jpeg,jpg,png,gif,webp', 'max:4096'],
|
|
'menu_cover' => ['nullable', 'image', 'mimes:jpeg,jpg,png,gif,webp', 'max:8192'],
|
|
'item_images' => ['nullable', 'array'],
|
|
'item_images.*' => ['array'],
|
|
'item_images.*.*' => ['mimes:jpeg,jpg,png,gif,webp', 'max:4096'],
|
|
]);
|
|
|
|
$data = array_merge($request->all(), [
|
|
'menu_logo' => $request->file('menu_logo'),
|
|
'menu_cover' => $request->file('menu_cover'),
|
|
]);
|
|
|
|
try {
|
|
$qrCode = $this->manager->create($account, $data);
|
|
} catch (RuntimeException $e) {
|
|
return back()->withInput()->with('error', $e->getMessage());
|
|
}
|
|
|
|
return redirect()->route('merchant.storefronts.show', $qrCode)
|
|
->with('success', QrTypeCatalog::label($qrCode->type).' storefront created.');
|
|
}
|
|
|
|
public function show(QrCode $storefront): View
|
|
{
|
|
$this->authorizeStorefront($storefront);
|
|
|
|
return view('merchant.storefronts.show', [
|
|
'qrCode' => $storefront->fresh(),
|
|
'previewDataUri' => $this->imageGenerator->previewDataUri($storefront),
|
|
]);
|
|
}
|
|
|
|
public function update(Request $request, QrCode $storefront): RedirectResponse
|
|
{
|
|
$this->authorizeStorefront($storefront);
|
|
|
|
$request->validate([
|
|
'label' => ['sometimes', 'string', 'max:120'],
|
|
'is_active' => ['sometimes', 'boolean'],
|
|
'menu_logo' => ['nullable', 'image', 'mimes:jpeg,jpg,png,gif,webp', 'max:4096'],
|
|
'menu_cover' => ['nullable', 'image', 'mimes:jpeg,jpg,png,gif,webp', 'max:8192'],
|
|
'item_images' => ['nullable', 'array'],
|
|
'item_images.*' => ['array'],
|
|
'item_images.*.*' => ['mimes:jpeg,jpg,png,gif,webp', 'max:4096'],
|
|
]);
|
|
|
|
$data = array_merge($request->all(), [
|
|
'is_active' => $request->boolean('is_active', $storefront->is_active),
|
|
'menu_logo' => $request->file('menu_logo'),
|
|
'menu_cover' => $request->file('menu_cover'),
|
|
]);
|
|
|
|
try {
|
|
$this->manager->update($storefront, $data);
|
|
} catch (RuntimeException $e) {
|
|
return back()->withInput()->with('error', $e->getMessage());
|
|
}
|
|
|
|
return back()->with('success', 'Storefront updated.');
|
|
}
|
|
|
|
public function destroy(QrCode $storefront): RedirectResponse
|
|
{
|
|
$this->authorizeStorefront($storefront);
|
|
|
|
$this->manager->delete($storefront);
|
|
|
|
return redirect()
|
|
->route('merchant.storefronts.index')
|
|
->with('success', 'Storefront deleted.');
|
|
}
|
|
|
|
public function preview(QrCode $storefront): Response
|
|
{
|
|
$this->authorizeStorefront($storefront);
|
|
|
|
$qrCode = $this->imageGenerator->ensureValidImages($storefront);
|
|
$bytes = $this->imageGenerator->normalizeStoredPng($qrCode->png_path);
|
|
|
|
if ($bytes === null) {
|
|
$bytes = $this->imageGenerator->renderPng($qrCode->encodedPayload(), $qrCode->style());
|
|
$this->imageGenerator->generateAndStore($qrCode);
|
|
}
|
|
|
|
return response($bytes, 200, [
|
|
'Content-Type' => 'image/png',
|
|
'Cache-Control' => 'private, max-age=3600',
|
|
]);
|
|
}
|
|
|
|
public function download(QrCode $storefront, string $format): StreamedResponse
|
|
{
|
|
$this->authorizeStorefront($storefront);
|
|
|
|
$qrCode = $this->imageGenerator->ensureValidImages($storefront);
|
|
$path = $format === 'svg' ? $qrCode->svg_path : $qrCode->png_path;
|
|
$filename = Str::slug($qrCode->label).'-qr.'.($format === 'svg' ? 'svg' : 'png');
|
|
|
|
if ($format === 'png') {
|
|
$bytes = $this->imageGenerator->normalizeStoredPng($path);
|
|
if ($bytes === null) {
|
|
$bytes = $this->imageGenerator->renderPng($qrCode->encodedPayload(), $qrCode->style());
|
|
$this->imageGenerator->generateAndStore($qrCode);
|
|
}
|
|
|
|
return response()->streamDownload(fn () => print($bytes), $filename, [
|
|
'Content-Type' => 'image/png',
|
|
]);
|
|
}
|
|
|
|
if ($format === 'pdf') {
|
|
$bytes = $this->imageGenerator->normalizeStoredPng($qrCode->png_path);
|
|
if ($bytes === null) {
|
|
$bytes = $this->imageGenerator->renderPng($qrCode->encodedPayload(), $qrCode->style());
|
|
$this->imageGenerator->generateAndStore($qrCode);
|
|
}
|
|
|
|
$pdf = $this->pdfExporter->fromPng($bytes, $qrCode->label);
|
|
|
|
return response()->streamDownload(fn () => print($pdf), Str::slug($qrCode->label).'-qr.pdf', [
|
|
'Content-Type' => 'application/pdf',
|
|
]);
|
|
}
|
|
|
|
abort_unless($path && Storage::disk('qr')->exists($path), 404);
|
|
|
|
return Storage::disk('qr')->download($path, $filename);
|
|
}
|
|
|
|
private function authorizeStorefront(QrCode $storefront): void
|
|
{
|
|
abort_unless(in_array($storefront->type, \App\Support\Qr\QrTypeCatalog::storefrontTypes(), true), 404);
|
|
abort_unless($storefront->user_id === ladill_account()->id, 403);
|
|
}
|
|
}
|