26127bf736
Estado original vindo do servidor de origem via tar.gz, antes da rodada de conformidade com a knowledge-base e fixes de GLPI 11. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
66 lines
1.8 KiB
PHP
66 lines
1.8 KiB
PHP
<?php
|
|
/**
|
|
* Lightweight public endpoint to serve plugin pictures.
|
|
* Works without authentication and is compatible with GLPI 11 routing.
|
|
*/
|
|
|
|
$_GET['donotcheckversion'] = true;
|
|
$dont_check_maintenance_mode = true;
|
|
|
|
require_once '../../../inc/includes.php';
|
|
|
|
$rawPath = $_GET['path'] ?? '';
|
|
if ($rawPath === '') {
|
|
http_response_code(400);
|
|
die('Missing path parameter');
|
|
}
|
|
|
|
$theme = $_GET['theme'] ?? '';
|
|
|
|
// Basic sanitization while keeping subdirectories (needed for storage layout)
|
|
$path = preg_replace('/[^a-zA-Z0-9._\\-\\/]/', '', $rawPath);
|
|
$path = str_replace(['../', '..\\'], '', $path);
|
|
$theme = preg_replace('/[^a-zA-Z0-9_\\-]/', '', $theme);
|
|
|
|
if ($path === '') {
|
|
http_response_code(400);
|
|
die('Invalid path');
|
|
}
|
|
|
|
if ($theme !== '') {
|
|
$baseDir = PluginButterflyTheme::getThemeFolder() . '/' . $theme;
|
|
} else {
|
|
$baseDir = PluginButterflyToolbox::getStorageBasePath();
|
|
}
|
|
|
|
$fullPath = $baseDir . '/' . ltrim($path, '/');
|
|
$realBase = is_dir($baseDir) ? realpath($baseDir) : false;
|
|
$realPath = realpath($fullPath);
|
|
|
|
if ($realBase === false || $realPath === false) {
|
|
http_response_code(404);
|
|
die('File not found');
|
|
}
|
|
|
|
$realBase = rtrim($realBase, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
|
|
if (strpos($realPath, $realBase) !== 0) {
|
|
http_response_code(403);
|
|
die('Access denied');
|
|
}
|
|
|
|
if (!is_file($realPath) || !is_readable($realPath)) {
|
|
http_response_code(404);
|
|
die('File not found');
|
|
}
|
|
|
|
$mimeType = mime_content_type($realPath) ?: 'application/octet-stream';
|
|
$fileSize = filesize($realPath);
|
|
$fileName = basename($realPath);
|
|
|
|
header('Content-Type: ' . $mimeType);
|
|
header('Content-Length: ' . $fileSize);
|
|
header('Content-Disposition: inline; filename="' . $fileName . '"');
|
|
header('Cache-Control: public, max-age=3600');
|
|
header('Last-Modified: ' . gmdate('D, d M Y H:i:s', filemtime($realPath)) . ' GMT');
|
|
|
|
readfile($realPath);
|