/**
* Detect HTML in the first KB to prevent against potential security issue with
* IE/Safari/Opera file type auto detection bug.
* Returns true if file contain insecure HTML code at the beginning.
*
* @return boolean true if uploaded file contains html in first 1024 bytes
*/
public function containsHtml()
{
$fp = fopen($this->tempFilePath, 'rb');
$chunk = fread($fp, 1024);
fclose($fp);
return Utils::containsHtml($chunk);
}
/**
* Validates the file
*
* @return bool true if file passed the validation
*
* @throws AlreadyExistsException
* @throws FileNotFoundException
* @throws InvalidExtensionException
* @throws InvalidNameException
* @throws InvalidRequestException
* @throws InvalidUploadException
*/
public function isValid()
{
if ($this->newFileName) {
if (!File::isValidName($this->newFileName, $this->config->get('disallowUnsafeCharacters'))) {
throw new InvalidNameException('Invalid file name');
}
if ($this->resourceType->getBackend()->isHiddenFile($this->newFileName)) {
throw new InvalidRequestException('New provided file name is hidden');
}
if (!$this->resourceType->isAllowedExtension($this->getNewExtension())) {
throw new InvalidExtensionException();
}
if ($this->config->get('checkDoubleExtension') && !$this->areValidDoubleExtensions($this->newFileName)) {
throw new InvalidExtensionException();
}
if ($this->workingFolder->containsFile($this->newFileName)) {
throw new AlreadyExistsException('File already exists');
}
}
if (!$this->hasValidFilename() || !$this->hasValidPath()) {
throw new InvalidRequestException('Invalid filename or path');
}
if ($this->isHidden() || $this->hasHiddenPath()) {
throw new InvalidRequestException('Edited file is hidden');
}
if ($this->config->get('checkDoubleExtension') && !$this->areValidDoubleExtensions()) {
throw new InvalidExtensionException();
}
if (!$this->resourceType->isAllowedExtension($this->getExtension())) {
throw new InvalidExtensionException();
}
if (!$this->saveAsNew && !$this->exists()) {
throw new FileNotFoundException();
}
if ($this->newContents) {
if (Utils::containsHtml(substr($this->newContents, 0, 1024)) && !in_array(strtolower($this->newFileName ? $this->getNewExtension() : $this->getExtension()), $this->config->get('htmlExtensions'))) {
throw new InvalidUploadException('HTML detected in disallowed file type', Error::UPLOADED_WRONG_HTML_FILE);
}
$maxFileSize = $this->resourceType->getMaxSize();
if ($maxFileSize && strlen($this->newContents) > $maxFileSize) {
throw new InvalidUploadException('Uploaded file is too big', Error::UPLOADED_TOO_BIG);
}
}
return true;
}
