@@ -12,17 +12,16 @@ class LinkTypeViewController extends Controller
1212 public function getParamForm ($ typename , $ linkId = 0 )
1313 {
1414 $ data = [
15- 'link_title ' => '' ,
16- 'link_url ' => '' ,
15+ 'title ' => '' ,
16+ 'link ' => '' ,
1717 'button_id ' => 0 ,
1818 'buttons ' => [],
1919 ];
2020
2121 if ($ linkId ) {
2222 $ link = Link::find ($ linkId );
23- $ typename = $ link ->type ?? 'predefined ' ;
24- $ data ['link_title ' ] = $ link ->title ;
25- $ data ['link_url ' ] = $ link ->link ;
23+ $ data ['title ' ] = $ link ->title ;
24+ $ data ['link ' ] = $ link ->link ;
2625 if (Route::currentRouteName () != 'showButtons ' ) {
2726 $ data ['button_id ' ] = $ link ->button_id ;
2827 }
@@ -52,4 +51,32 @@ public function getParamForm($typename, $linkId = 0)
5251
5352 return view ($ typename . '.form ' , $ data );
5453 }
54+
55+ public function blockAsset (Request $ request , $ type )
56+ {
57+ $ asset = $ request ->query ('asset ' );
58+
59+ // Prevent directory traversal in $type
60+ if (preg_match ('/\.\.|\/| \\\\/ ' , $ type )) {
61+ abort (403 , 'Unauthorized action. ' );
62+ }
63+
64+ // Define allowed file extensions
65+ $ allowedExtensions = ['js ' , 'css ' , 'img ' , 'svg ' , 'gif ' , 'jpg ' , 'jpeg ' , 'png ' , 'mp4 ' , 'mp3 ' ];
66+
67+ $ extension = strtolower (pathinfo ($ asset , PATHINFO_EXTENSION ));
68+ if (!in_array ($ extension , $ allowedExtensions )) {
69+ return response ('File type not allowed ' , Response::HTTP_FORBIDDEN );
70+ }
71+
72+ $ basePath = realpath (base_path ("blocks/ $ type " ));
73+
74+ $ fullPath = realpath (base_path ("blocks/ $ type/ $ asset " ));
75+
76+ if (!$ fullPath || !file_exists ($ fullPath ) || strpos ($ fullPath , $ basePath ) !== 0 ) {
77+ return response ('File not found ' , Response::HTTP_NOT_FOUND );
78+ }
79+
80+ return response ()->file ($ fullPath );
81+ }
5582}
0 commit comments