'; /** * @var string */ protected $title = 'Image'; /** * @var string */ protected $content = << ###BODY### ###IMAGE### EOF; public function __construct( protected readonly Features $features, private readonly FileNameValidator $fileNameValidator, private readonly ResourceFactory $resourceFactory, ) {} /** * Init function, setting the input vars in the global space. * * @throws \InvalidArgumentException * @throws \TYPO3\CMS\Core\Resource\Exception\FileDoesNotExistException */ public function initialize() { $fileUid = $this->request->getQueryParams()['file'] ?? null; $parametersArray = $this->request->getQueryParams()['parameters'] ?? null; // If no file-param or parameters are given, we must exit if (!$fileUid || !isset($parametersArray) || !is_array($parametersArray)) { throw new \InvalidArgumentException('No valid fileUid given', 1476048455); } // rebuild the parameter array and check if the HMAC is correct $parametersEncoded = implode('', $parametersArray); /* For backwards compatibility the HMAC is transported within the md5 param */ $hmacParameter = $this->request->getQueryParams()['md5'] ?? null; $hashService = GeneralUtility::makeInstance(HashService::class); $hmac = $hashService->hmac(implode('|', [$fileUid, $parametersEncoded]), 'tx_cms_showpic', HashAlgo::SHA3_256); if (!is_string($hmacParameter) || !hash_equals($hmac, $hmacParameter)) { throw new \InvalidArgumentException('hash does not match', 1476048456); } // decode the parameters Array - `bodyTag` contains HTML if set and would lead // to a false-positive XSS-detection, that's why parameters are base64-encoded $parameters = json_decode(base64_decode($parametersEncoded), true) ?? []; foreach ($parameters as $parameterName => $parameterValue) { if (in_array($parameterName, static::ALLOWED_PARAMETER_NAMES, true)) { $this->{$parameterName} = $parameterValue; } } if (MathUtility::canBeInterpretedAsInteger($fileUid)) { $this->file = $this->resourceFactory->getFileObject((int)$fileUid); } else { $this->file = $this->resourceFactory->retrieveFileOrFolderObject($fileUid); } if (!($this->file instanceof FileInterface && $this->isFileValid($this->file))) { throw new Exception('File processing for local storage is denied', 1594043425); } if ($this->features->isFeatureEnabled('security.frontend.allowInsecureFrameOptionInShowImageController')) { $frameValue = $this->request->getQueryParams()['frame'] ?? null; if ($frameValue !== null && MathUtility::canBeInterpretedAsInteger($frameValue)) { $this->frame = (int)$frameValue; } } } /** * Main function which creates the image if needed and outputs the HTML code for the page displaying the image. * Accumulates the content in $this->content */ public function main() { $processedImage = $this->processImage(); $imageAttributes = [ 'src' => $processedImage->getPublicUrl() ?? '', 'alt' => $this->file->getProperty('alternative') ?: $this->title, 'title' => $this->file->getProperty('title') ?: $this->title, 'width' => (string)$processedImage->getProperty('width'), 'height' => (string)$processedImage->getProperty('height'), ]; $markerArray = [ '###TITLE###' => htmlspecialchars($this->file->getProperty('title') ?: $this->title), '###IMAGE###' => sprintf('', GeneralUtility::implodeAttributes($imageAttributes, true)), '###BODY###' => $this->bodyTag, ]; $this->content = str_replace(array_keys($markerArray), array_values($markerArray), $this->content); } /** * Does the actual image processing * * @return \TYPO3\CMS\Core\Resource\ProcessedFile */ protected function processImage() { $max = str_contains($this->width . $this->height, 'm') ? 'm' : ''; $this->height = MathUtility::forceIntegerInRange($this->height, 0); $this->width = MathUtility::forceIntegerInRange((int)$this->width, 0) . $max; $processingConfiguration = [ 'width' => $this->width, 'height' => $this->height, 'frame' => $this->frame, 'crop' => $this->crop, ]; return $this->file->process(ProcessedFile::CONTEXT_IMAGECROPSCALEMASK, $processingConfiguration); } /** * Fetches the content and builds a content file out of it * * @param ServerRequestInterface $request the current request object * @return ResponseInterface the modified response */ public function processRequest(ServerRequestInterface $request): ResponseInterface { $this->request = $request; try { $this->initialize(); $this->main(); $response = new Response(); $response->getBody()->write($this->content); return $response; } catch (\InvalidArgumentException $e) { // add a 410 "gone" if invalid parameters given return (new Response())->withStatus(410); } catch (Exception $e) { return (new Response())->withStatus(404); } } protected function isFileValid(FileInterface $file): bool { return $file->getStorage()->getDriverType() !== 'Local' || $this->fileNameValidator->isValid(basename($file->getIdentifier())); } }