fix(file-uploads): validate chapters json content + remove permit_empty rule to uploaded files (6289c42b) · Commits · Ad Aures / Castopod

app/Config/App.php

+16 −15

Original line number	Diff line number	Diff line
		@@ -16,7 +16,7 @@ class App extends BaseConfig
		* URL to your CodeIgniter root. Typically, this will be your base URL,
		* WITH a trailing slash:
		*
		* http://example.com/
		* E.g., http://example.com/
		*/
		public string $baseURL = 'http://localhost:8080/';

		@@ -24,9 +24,9 @@ class App extends BaseConfig
		* Allowed Hostnames in the Site URL other than the hostname in the baseURL.
		* If you want to accept multiple Hostnames, set this.
		*
		* E.g. When your site URL ($baseURL) is 'http://example.com/', and your site
		* also accepts 'http://media.example.com/' and
		* 'http://accounts.example.com/':
		* E.g.,
		* When your site URL ($baseURL) is 'http://example.com/', and your site
		* also accepts 'http://media.example.com/' and 'http://accounts.example.com/':
		* ['media.example.com', 'accounts.example.com']
		*
		* @var list<string>
		@@ -38,9 +38,9 @@ class App extends BaseConfig
		* Index File
		* --------------------------------------------------------------------------
		*
		* Typically this will be your index.php file, unless you've renamed it to
		* something else. If you are using mod_rewrite to remove the page set this
		* variable so that it is blank.
		* Typically, this will be your `index.php` file, unless you've renamed it to
		* something else. If you have configured your web server to remove this file
		* from your site URIs, set this variable to an empty string.
		*/
		public string $indexPage = '';

		@@ -53,9 +53,9 @@ class App extends BaseConfig
		* URI string. The default setting of 'REQUEST_URI' works for most servers.
		* If your links do not seem to work, try one of the other delicious flavors:
		*
		* 'REQUEST_URI' Uses $_SERVER['REQUEST_URI']
		* 'QUERY_STRING' Uses $_SERVER['QUERY_STRING']
		* 'PATH_INFO' Uses $_SERVER['PATH_INFO']
		* 'REQUEST_URI': Uses $_SERVER['REQUEST_URI']
		* 'QUERY_STRING': Uses $_SERVER['QUERY_STRING']
		* 'PATH_INFO': Uses $_SERVER['PATH_INFO']
		*
		* WARNING: If you set this to 'PATH_INFO', URIs will always be URL-decoded!
		*/
		@@ -96,7 +96,7 @@ class App extends BaseConfig
		*
		* IncomingRequest::setLocale() also uses this list.
		*
		* @var string[]
		* @var list<string>
		*/
		public array $supportedLocales = ['en', 'fr', 'pl', 'de', 'pt-BR', 'nn-NO', 'es', 'zh-Hans', 'ca'];

		@@ -108,7 +108,8 @@ class App extends BaseConfig
		* The default timezone that will be used in your application to display
		* dates with the date helper, and can be retrieved through app_timezone()
		*
		* @see https://www.php.net/manual/en/timezones.php for list of timezones supported by PHP.
		* @see https://www.php.net/manual/en/timezones.php for list of timezones
		* supported by PHP.
		*/
		public string $appTimezone = 'UTC';

		@@ -132,7 +133,7 @@ class App extends BaseConfig
		* If true, this will force every request made to this application to be
		* made via a secure connection (HTTPS). If the incoming request is not
		* secure, the user will be redirected to a secure version of the page
		* and the HTTP Strict Transport Security header will be set.
		* and the HTTP Strict Transport Security (HSTS) header will be set.
		*/
		public bool $forceGlobalSecureRequests = true;

app/Config/Routing.php

+2 −3

Original line number	Diff line number	Diff line
		@@ -66,13 +66,12 @@ class Routing extends BaseRouting

		/**
		* Sets the class/method that should be called if routing doesn't
		* find a match. It can be either a closure or the controller/method
		* name exactly like a route is defined: Users::index
		* find a match. It can be the controller/method name like: Users::index
		*
		* This setting is passed to the Router class and handled there.
		*
		* If you want to use a closure, you will have to set it in the
		* class constructor or the routes file by calling:
		* routes file by calling:
		*
		* $routes->set404Override(function() {
		* // Do something here

app/Models/EpisodeModel.php

+0 −1

Original line number	Diff line number	Diff line
		@@ -218,7 +218,6 @@ class EpisodeModel extends UuidModel
		/** @var LazyUuidFromString $uuid */
		$uuid = $this->uuid->{$this->uuidVersion}();

		// @phpstan-ignore-next-line
		if (! $this->update($episodeId, [
		'preview_id' => $uuid,
		])) {

app/Validation/FileRules.php

+39 −0

Original line number	Diff line number	Diff line
		@@ -95,4 +95,43 @@ class FileRules extends ValidationFileRules
		}

		//--------------------------------------------------------------------

		/**
		* Checks that an uploaded json file's content is valid
		*/
		public function is_json(string $blank = null, string $params = ''): bool
		{
		// Grab the file name off the top of the $params
		// after we split it.
		$params = explode(',', $params);
		$name = array_shift($params);

		if (! ($files = $this->request->getFileMultiple($name))) {
		$files = [$this->request->getFile($name)];
		}

		foreach ($files as $file) {
		if ($file === null) {
		return false;
		}

		if ($file->getError() === UPLOAD_ERR_NO_FILE) {
		return true;
		}

		$content = file_get_contents($file->getTempName());

		if ($content === false) {
		return false;
		}

		json_decode($content);

		if (json_last_error() !== JSON_ERROR_NONE) {
		return false;
		}
		}

		return true;
		}
		}

captainhook.json

+1 −1

Original line number	Diff line number	Diff line
		@@ -18,7 +18,7 @@
		"enabled": true,
		"actions": [
		{
		"action": "composer test -- --no-coverage",
		"action": "composer test",
		"options": [],
		"conditions": []
		},