security of request upload item

src/Domain/Files/Controllers/FileAccess/GetThumbnailController.php

@@ -20,10 +20,8 @@ class GetThumbnailController extends Controller
         Request $request,
         string $filename,
     ): FileNotFoundException | StreamedResponse {
-        $originalFileName = substr($filename, 3);
-
         $file = File::withTrashed()
-            ->where('basename', $originalFileName)
+            ->where('basename', substr($filename, 3))
             ->firstOrFail();
 
         if (! Gate::any(['can-edit', 'can-view'], [$file, null])) {

src/Domain/Files/Controllers/FileAccess/VisitorGetThumbnailController.php

@@ -30,11 +30,9 @@ class VisitorGetThumbnailController extends Controller
         // Check ability to access protected share files
         ($this->protectShareRecord)($shared);
 
-        $originalFileName = substr($filename, 3);
-
         // Get file record
         $file = UserFile::where('user_id', $shared->user_id)
-            ->where('basename', $originalFileName)
+            ->where('basename', substr($filename, 3))
             ->firstOrFail();
 
         // Check file access

src/Domain/Files/Models/File.php

@@ -115,7 +115,6 @@ class File extends Model
 
         // Generate thumbnail link for local storage
         if ($this->type === 'image') {
-
             foreach ($thumbnail_sizes as $item) {
                 $route = route('thumbnail', ['name' => $item['name'] . '-' . $this->basename]);
 

src/Domain/UploadRequest/Controllers/CreateUploadRequestController.php

@@ -1,13 +1,12 @@
 <?php
-
 namespace Domain\UploadRequest\Controllers;
 
-use App\Http\Controllers\Controller;
 use Auth;
-use Domain\UploadRequest\Notifications\UploadRequestNotification;
+use Notification;
+use App\Http\Controllers\Controller;
 use Domain\UploadRequest\Requests\StoreUploadRequest;
 use Domain\UploadRequest\Resources\UploadRequestResource;
-use Notification;
+use Domain\UploadRequest\Notifications\UploadRequestNotification;
 
 class CreateUploadRequestController extends Controller
 {
@@ -27,4 +26,4 @@ class CreateUploadRequestController extends Controller
 
         return response(new UploadRequestResource($uploadRequest), 201);
     }
-}
+}

src/Domain/UploadRequest/Controllers/FileAccess/GetFileFromUploadRequestController.php

@@ -1,16 +1,13 @@
 <?php
 namespace Domain\UploadRequest\Controllers\FileAccess;
 
-use Domain\Files\Actions\DownloadFileAction;
-use Domain\Sharing\Actions\ProtectShareRecordAction;
-use Domain\Sharing\Actions\VerifyAccessToItemWithinAction;
-use Domain\Traffic\Actions\RecordDownloadAction;
-use Domain\UploadRequest\Models\UploadRequest;
-use Gate;
 use Domain\Files\Models\File;
 use Illuminate\Http\Response;
-use Domain\Sharing\Models\Share;
-use Domain\Files\Resources\FileResource;
+use Domain\Files\Actions\DownloadFileAction;
+use Domain\UploadRequest\Models\UploadRequest;
+use Domain\Traffic\Actions\RecordDownloadAction;
+use Illuminate\Contracts\Foundation\Application;
+use Illuminate\Contracts\Routing\ResponseFactory;
 use Symfony\Component\HttpFoundation\BinaryFileResponse;
 
 /**
@@ -27,10 +24,16 @@ class GetFileFromUploadRequestController
     public function __invoke(
         string $filename,
         UploadRequest $uploadRequest
-    ): BinaryFileResponse {
+    ): Application|ResponseFactory|Response|BinaryFileResponse {
+        // Check if upload request is active
+        if ($uploadRequest->status !== 'active') {
+            return response('Gone', 410);
+        }
+
         // Get file
         $file = File::where('user_id', $uploadRequest->user_id)
             ->where('basename', $filename)
+            ->where('parent_id', $uploadRequest->id)
             ->firstOrFail();
 
         // Store user download size

src/Domain/UploadRequest/Controllers/FileAccess/GetThumbnailFromUploadRequestController.php

@@ -1,11 +1,14 @@
 <?php
 namespace Domain\UploadRequest\Controllers\FileAccess;
 
-use App\Http\Controllers\Controller;
-use Domain\Files\Actions\DownloadThumbnailAction;
-use Domain\Traffic\Actions\RecordDownloadAction;
-use Domain\UploadRequest\Models\UploadRequest;
 use Domain\Files\Models\File;
+use Illuminate\Http\Response;
+use App\Http\Controllers\Controller;
+use Domain\UploadRequest\Models\UploadRequest;
+use Domain\Traffic\Actions\RecordDownloadAction;
+use Illuminate\Contracts\Foundation\Application;
+use Domain\Files\Actions\DownloadThumbnailAction;
+use Illuminate\Contracts\Routing\ResponseFactory;
 use Symfony\Component\HttpFoundation\StreamedResponse;
 
 /**
@@ -22,12 +25,16 @@ class GetThumbnailFromUploadRequestController extends Controller
     public function __invoke(
         string $filename,
         UploadRequest $uploadRequest
-    ): StreamedResponse {
-        $originalFileName = substr($filename, 3);
+    ): Application|ResponseFactory|Response|StreamedResponse {
+        // Check if upload request is active
+        if ($uploadRequest->status !== 'active') {
+            return response('Gone', 410);
+        }
 
         // Get file
         $file = File::where('user_id', $uploadRequest->user_id)
-            ->where('basename', $originalFileName)
+            ->where('basename', substr($filename, 3))
+            ->where('parent_id', $uploadRequest->id)
             ->firstOrFail();
 
         // Store user download size

src/Domain/UploadRequest/Controllers/UploadFilesForUploadRequestController.php

@@ -1,20 +1,20 @@
 <?php
-
 namespace Domain\UploadRequest\Controllers;
 
-use App\Users\Exceptions\InvalidUserActionException;
-use Domain\Files\Resources\FileResource;
-use Domain\UploadRequest\Models\UploadRequest;
-use Domain\Files\Actions\UploadFileAction;
-use Domain\Folders\Models\Folder;
-use Illuminate\Contracts\Filesystem\FileNotFoundException;
 use DB;
+use Domain\Folders\Models\Folder;
+use Domain\Files\Resources\FileResource;
+use Domain\Files\Actions\UploadFileAction;
+use Domain\UploadRequest\Models\UploadRequest;
+use App\Users\Exceptions\InvalidUserActionException;
+use Illuminate\Contracts\Filesystem\FileNotFoundException;
 
 class UploadFilesForUploadRequestController
 {
     public function __construct(
         private UploadFileAction $uploadFile,
-    ) {}
+    ) {
+    }
 
     /**
      * @throws FileNotFoundException
@@ -48,7 +48,6 @@ class UploadFilesForUploadRequestController
 
             // Return new uploaded file
             return response(new FileResource($file), 201);
-
         } catch (InvalidUserActionException $e) {
             return response([
                 'type'    => 'error',
@@ -71,4 +70,4 @@ class UploadFilesForUploadRequestController
             'name'      => "Upload Request from $timestampName",
         ]);
     }
-}
+}

src/Domain/UploadRequest/Models/UploadRequest.php

@@ -2,10 +2,10 @@
 namespace Domain\UploadRequest\Models;
 
 use App\Users\Models\User;
-use Database\Factories\UploadRequestFactory;
-use Domain\Folders\Models\Folder;
 use Illuminate\Support\Str;
+use Domain\Folders\Models\Folder;
 use Illuminate\Database\Eloquent\Model;
+use Database\Factories\UploadRequestFactory;
 use Illuminate\Database\Eloquent\Relations\HasOne;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 

src/Domain/UploadRequest/Notifications/UploadRequestNotification.php

@@ -1,12 +1,11 @@
 <?php
-
 namespace Domain\UploadRequest\Notifications;
 
-use Domain\UploadRequest\Models\UploadRequest;
 use Illuminate\Bus\Queueable;
-use Illuminate\Contracts\Queue\ShouldQueue;
-use Illuminate\Notifications\Messages\MailMessage;
 use Illuminate\Notifications\Notification;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Domain\UploadRequest\Models\UploadRequest;
+use Illuminate\Notifications\Messages\MailMessage;
 
 class UploadRequestNotification extends Notification implements ShouldQueue
 {
@@ -19,7 +18,8 @@ class UploadRequestNotification extends Notification implements ShouldQueue
      */
     public function __construct(
         public UploadRequest $uploadRequest
-    ) {}
+    ) {
+    }
 
     /**
      * Get the notification's delivery channels.
@@ -58,7 +58,6 @@ class UploadRequestNotification extends Notification implements ShouldQueue
     public function toArray($notifiable)
     {
         return [
-            //
         ];
     }
 }

src/Domain/UploadRequest/Requests/StoreUploadRequest.php

@@ -1,5 +1,4 @@
 <?php
-
 namespace Domain\UploadRequest\Requests;
 
 use Illuminate\Foundation\Http\FormRequest;

src/Domain/UploadRequest/Resources/UploadRequestResource.php

@@ -1,5 +1,4 @@
 <?php
-
 namespace Domain\UploadRequest\Resources;
 
 use Domain\Folders\Resources\FolderResource;