Merge remote-tracking branch 'origin/main'

Author: aguingand

src/Http/Controllers/Api/ApiController.php

@@ -6,18 +6,9 @@
 use Code16\Sharp\EntityList\SharpEntityList;
 use Code16\Sharp\Http\Controllers\SharpProtectedController;
 use Code16\Sharp\Show\SharpShow;
-use Code16\Sharp\Utils\Entities\SharpEntityManager;
 
 abstract class ApiController extends SharpProtectedController
 {
-    protected SharpEntityManager $entityManager;
-
-    public function __construct()
-    {
-        parent::__construct();
-        $this->entityManager = app(SharpEntityManager::class);
-    }
-
     protected function getListInstance(string $entityKey): SharpEntityList
     {
         return $this->entityManager->entityFor($entityKey)->getListOrFail();

src/Http/Controllers/Api/ApiFormEditorUploadFormController.php

@@ -3,9 +3,8 @@
 namespace Code16\Sharp\Http\Controllers\Api;
 
 use Code16\Sharp\Http\Controllers\Api\Requests\EditorUploadFormRequest;
-use Illuminate\Routing\Controller;
 
-class ApiFormEditorUploadFormController extends Controller
+class ApiFormEditorUploadFormController extends ApiController
 {
     public function update(string $globalFilter, EditorUploadFormRequest $request, string $entityKey, ?string $instanceId = null)
     {

src/Http/Controllers/Api/ApiFormUploadController.php

@@ -4,9 +4,8 @@
 
 use Code16\Sharp\Utils\FileUtil;
 use Illuminate\Foundation\Validation\ValidatesRequests;
-use Illuminate\Routing\Controller;
 
-class ApiFormUploadController extends Controller
+class ApiFormUploadController extends ApiController
 {
     use ValidatesRequests;
 

src/Http/Controllers/Api/ApiFormUploadThumbnailController.php

@@ -2,16 +2,12 @@
 
 namespace Code16\Sharp\Http\Controllers\Api;
 
-use Code16\Sharp\Auth\SharpAuthorizationManager;
 use Code16\Sharp\Form\Eloquent\Uploads\Traits\UsesSharpUploadModel;
-use Illuminate\Routing\Controller;
 
-class ApiFormUploadThumbnailController extends Controller
+class ApiFormUploadThumbnailController extends ApiController
 {
     use UsesSharpUploadModel;
 
-    public function __construct(private readonly SharpAuthorizationManager $authorizationManager) {}
-
     // Used to generate large thumbnail for upload crop modal
     public function show(string $globalFilter, string $entityKey, ?string $instanceId = null)
     {

tests/Http/Api/ApiFormUploadControllerTest.php

@@ -4,6 +4,7 @@
 use Illuminate\Support\Facades\Storage;
 
 beforeEach(function () {
+    login();
     Storage::fake('local');
 });
 
@@ -102,3 +103,13 @@
         ->assertStatus(422)
         ->assertJsonValidationErrorFor('validation_rule.1');
 });
+
+it('does not allow to use a path traversal exploit', function () {
+    $this
+        ->postJson(route('code16.sharp.api.form.upload'), [
+            'file' => UploadedFile::fake()->create('../../../etc/passwd.txt'),
+        ])
+        ->assertOk();
+
+    $this->assertTrue(Storage::disk('local')->exists('tmp/passwd.txt'));
+});

tests/Http/Form/FormUploadsTest.php

@@ -5,6 +5,7 @@
 use Illuminate\Support\Facades\Storage;
 
 beforeEach(function () {
+    login();
     Storage::fake('local');
 });
 

tests/Unit/Console/GeneratorTest.php

@@ -7,7 +7,10 @@
 
 beforeEach(function () {
     login();
+    File::deleteDirectory(base_path('app/Sharp'));
+});
 
+afterEach(function () {
     File::deleteDirectory(base_path('app/Sharp'));
 });