netgen / netgenenhancedbinaryfilebundle Goto Github PK

Symfony allows for specifying the error message that will be shown when the user selects a file of a mime type that is disallowed (https://symfony.com/doc/current/reference/constraints/File.html#mimetypesmessage)

It would be nice to be able to define that error message on content type level in the admin interface.

When usingenhancedezbinaryfile in the current ezplatform admin user interface it is unfuncitonal. No file can currently be uploaded.

When trying to download a file though the custom admin interface, so the corresponding method in the DownloadController a php error is triggered if the OriginalFilename of the file contains umlauts.

Possible solution could be to wrap the original filename in CDATA tag?

Hello,

after following the installation process (require your legacy extension package, activate it from legacy.yml, then require the bundle and activate it from appkernel), I can add enhanced file attributes to classes.

Problem is I keep getting an error in both backend and frontend when accessing the classes with that attribute. Unfortunately only the frontend gives me a stacktrace:

FatalThrowableError in BinaryBaseStorage.php line 49: Type error: Argument 1 passed to eZ\Publish\Core\FieldType\BinaryBase\BinaryBaseStorage::__construct() must be of the type array, object given, called in /cache/dev/appDevDebugProjectContainer.php on line 4865

in BinaryBaseStorage.php line 49 at BinaryBaseStorage->__construct(object(LegacyStorage), object(eZPublishCoreIOTolerantIOService_000000002ecbbdaf00000000021dbc3c38025f693236dc1642e709d041e3c4b3), object(LegacyPathGenerator), object(FileInfo)) in appDevDebugProjectContainer.php line 4865 at appDevDebugProjectContainer->getEzpublish_Enhancedezbinaryfile_ExternalStorageHandlerService() in Container.php line 304 at Container->get('ezpublish.enhancedezbinaryfile.external_storage_handler') in ExternalStorageRegistryFactory.php line 36 at ExternalStorageRegistryFactory->eZ\Publish\Core\Base\Container\ApiLoader\Storage\{closure}() at call_user_func(object(Closure)) in StorageRegistry.php line 75 at StorageRegistry->getStorage('enhancedezbinaryfile') in StorageHandler.php line 83 at StorageHandler->getFieldData(object(VersionInfo), object(Field)) in FieldHandler.php line 307 at FieldHandler->loadExternalFieldData(object(Content)) in appDevDebugProjectContainer.php line 80492 at eZPublishCorePersistenceLegacyContentFieldHandler_000000002ecb8a8600000000021dbc3c38025f693236dc1642e709d041e3c4b3->loadExternalFieldData(object(Content)) in Handler.php line 325 at Handler->load('372', '3', array('ita-IT')) in appDevDebugProjectContainer.php line 80798 at eZPublishCorePersistenceLegacyContentHandler_000000002ecb8ad300000000021dbc3c38025f693236dc1642e709d041e3c4b3->load('372', '3', array('ita-IT')) in ContentHandler.php line 68 at ContentHandler->load('372', '3', array('ita-IT')) in ContentService.php line 408 at ContentService->internalLoadContent('372', array('ita-IT'), '3', false, true) in ContentService.php line 342 at ContentService->loadContent('372', array('ita-IT'), null, true) in appDevDebugProjectContainer.php line 75078 at eZPublishCoreRepositoryContentService_000000002ecb951a00000000021dbc3c38025f693236dc1642e709d041e3c4b3->loadContent('372', array('ita-IT'), null, true) in ContentService.php line 192 at ContentService->loadContent('372', array('ita-IT'), null) in LoadService.php line 71 at LoadService->loadContent('372') in ContentViewBuilder.php line 153 at ContentViewBuilder->loadContent('372') in ContentViewBuilder.php line 121 at ContentViewBuilder->buildView(array('is_rest_request' => false, 'siteaccess' => object(SiteAccess), 'semanticPathinfo' => '/Path', 'viewParameters' => array(), 'viewParametersString' => '', '_route' => 'ez_urlalias', '_controller' => 'ng_content:viewAction', 'contentId' => '372', 'locationId' => '353', 'viewType' => 'full', 'layout' => true, '_route_params' => array('contentId' => '372', 'locationId' => '353', 'viewType' => 'full', 'layout' => true), '_locale' => 'it_IT', 'csrf_enabled' => true)) in ViewControllerListener.php line 70 at ViewControllerListener->getController(object(FilterControllerEvent), 'kernel.controller', object(TraceableEventDispatcher)) at call_user_func(array(object(ViewControllerListener), 'getController'), object(FilterControllerEvent), 'kernel.controller', object(TraceableEventDispatcher)) in WrappedListener.php line 61 at WrappedListener->__invoke(object(FilterControllerEvent), 'kernel.controller', object(ContainerAwareEventDispatcher)) at call_user_func(object(WrappedListener), object(FilterControllerEvent), 'kernel.controller', object(ContainerAwareEventDispatcher)) in EventDispatcher.php line 184 at EventDispatcher->doDispatch(array(object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener), object(WrappedListener)), 'kernel.controller', object(FilterControllerEvent)) in EventDispatcher.php line 46 at EventDispatcher->dispatch('kernel.controller', object(FilterControllerEvent)) in TraceableEventDispatcher.php line 140 at TraceableEventDispatcher->dispatch('kernel.controller', object(FilterControllerEvent)) in HttpKernel.php line 137 at HttpKernel->handleRaw(object(Request), '1') in HttpKernel.php line 64 at HttpKernel->handle(object(Request), '1', true) in ContainerAwareHttpKernel.php line 69 at ContainerAwareHttpKernel->handle(object(Request), '1', true) in Kernel.php line 185 at Kernel->handle(object(Request)) in app.php line 70

I'm also using:
"netgen/ezpublish-legacy": ">=2017.04",
"netgen/enhanced-binary-file-bundle": "^2.0",
"netgen/enhancedezbinaryfile": "^5.0"
"ezsystems/ezpublish-kernel": "~6.9.1",

Since files that are uploaded as part of a information collection (using https://github.com/netgen/NetgenInformationCollectionBundle) are placed on a fixed location on the disk (<storage_dir>/original/collected/<filename>) filename collisions are likely to happen, resulting in files getting overwritten on the disk.

Additionally this is a security/privacy risk because filenames could relatively easily be guessed allowing access to those files via above mentioned url scheme.

The filenames should be replaced by hash values on upload, storing these hash values in the collection attributes. Additionally, a controller to download the files (using the original filename) should be implemented, allowing for permission checks, too.

php-cs-fixer configuration removes trailing whitespace at the end of a file, we should update configuration to most recent one.