Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

(umbraCollab) Check media Parent for permissions when setting correct MediaType #11858

Merged
merged 14 commits into from
Feb 28, 2022
Merged

(umbraCollab) Check media Parent for permissions when setting correct MediaType #11858

Changes from 5 commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
5737f8f
Check for allowed types before uploading item
cornehoskam Jan 13, 2022
1f8b6b8
Don't automatically set if multiple mediatypes allowed
cornehoskam Jan 13, 2022
21c1545
Check for allowed default folder creation
cornehoskam Jan 13, 2022
6792fae
Merge branch 'v9/contrib' into pr/11858
mikecp Jan 19, 2022
0566b53
Small updates
mikecp Jan 20, 2022
aeb4b2e
Merge branch 'v9/contrib' into pr/11858
nul800sebastiaan Feb 4, 2022
6622a31
Merge branch 'v9/contrib' into temp-7735
cornehoskam Feb 14, 2022
9453931
Merge branch 'v9/contrib' into pr/11858
nul800sebastiaan Feb 21, 2022
2c3d1fe
Make sure we show an error when a media type is being uploaded that i…
nul800sebastiaan Feb 22, 2022
866e5e5
IsFolderCreationAllowedHere shouldn't get a nullable int as input
nul800sebastiaan Feb 22, 2022
ceea354
Update src/Umbraco.Web.BackOffice/Controllers/ContentControllerBase.cs
nul800sebastiaan Feb 22, 2022
2a9a0cf
Merge branch 'v9/contrib' into pr/11858
nul800sebastiaan Feb 28, 2022
64830f3
Optimizations from @nzdev feedback on the PR
nul800sebastiaan Feb 28, 2022
a8cbb87
Reduce nesting
nul800sebastiaan Feb 28, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
116 changes: 88 additions & 28 deletions src/Umbraco.Web.BackOffice/Controllers/MediaController.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -682,6 +682,32 @@ public async Task<ActionResult<MediaItemDisplay>> PostAddFolder(PostedFolder fol
return NotFound("The passed id doesn't exist");
}

//Check parent permissions if we aren't creating a folder in the root directory
if (parentId != Constants.System.Root)
{
var mediaTypes = _mediaTypeService.GetAll().ToList();
var mediaFolderItem = _mediaService.GetById(parentId.Value);
var mediaFolderType =
mediaTypes.FirstOrDefault(x => x.Alias == mediaFolderItem.ContentType.Alias);

var allowDefaultFolder = false;
if (mediaFolderType != null)
{
allowDefaultFolder = mediaFolderType.AllowedContentTypes.Any(x => x.Alias == Constants.Conventions.MediaTypes.Folder);
}

if (!allowDefaultFolder)
{
var tempFiles = new PostedFiles();

tempFiles.Notifications.Add(new BackOfficeNotification(
_localizedTextService.Localize("speechBubbles", "operationFailedHeader"),
_localizedTextService.Localize("media", "disallowedFileType"),
NotificationStyle.Warning));
return Ok(tempFiles);
}
}

var f = _mediaService.CreateMedia(folder.Name, parentId.Value, Constants.Conventions.MediaTypes.Folder);
_mediaService.Save(f, _backofficeSecurityAccessor.BackOfficeSecurity.CurrentUser.Id);

Expand Down Expand Up @@ -735,7 +761,7 @@ public async Task<IActionResult> PostAddFile([FromForm] string path, [FromForm]
IMedia folderMediaItem;

//if uploading directly to media root and not a subfolder
if (parentId == -1)
if (parentId == Constants.System.Root)
{
//look for matching folder
folderMediaItem =
Expand Down Expand Up @@ -773,6 +799,40 @@ public async Task<IActionResult> PostAddFile([FromForm] string path, [FromForm]
}
}

var mediaType = string.Empty;
var mediaTypes = _mediaTypeService.GetAll().ToList();

//Check if we have a parent folder before checking it's permissions.
if (parentId.HasValue && parentId != Constants.System.Root)
{
var mediaFolderItem = _mediaService.GetById(parentId.Value);
var mediaFolderType =
mediaTypes.FirstOrDefault(x => x.Alias == mediaFolderItem.ContentType.Alias);

if (mediaFolderType != null)
{
var allowedContentTypesCount = 0;
IMediaType mediaTypeItem = null;
foreach (var allowedContentType in mediaFolderType.AllowedContentTypes)
{
var checkMediaTypeItem = _mediaTypeService.Get(allowedContentType.Id.Value);
var fileProperty = checkMediaTypeItem.CompositionPropertyTypes.FirstOrDefault(x => x.Alias == Constants.Conventions.Media.File);

if (fileProperty != null)
{
allowedContentTypesCount++;
mediaTypeItem = checkMediaTypeItem;
}
}

//Only set the permission-based mediaType if we only allow 1 specific file under this parent.
if (allowedContentTypesCount == 1 && mediaTypeItem != null)
{
mediaType = mediaTypeItem.Alias;
}
}
}

//get the files
foreach (var formFile in file)
{
Expand All @@ -782,57 +842,57 @@ public async Task<IActionResult> PostAddFile([FromForm] string path, [FromForm]

if (_contentSettings.IsFileAllowedForUpload(ext))
nul800sebastiaan marked this conversation as resolved.
Show resolved Hide resolved
{
var mediaType = Constants.Conventions.MediaTypes.File;

if (contentTypeAlias == Constants.Conventions.MediaTypes.AutoSelect)
if (string.IsNullOrEmpty(mediaType))
{
var mediaTypes = _mediaTypeService.GetAll();
// Look up MediaTypes
foreach (var mediaTypeItem in mediaTypes)
mediaType = Constants.Conventions.MediaTypes.File;

if (contentTypeAlias == Constants.Conventions.MediaTypes.AutoSelect)
{
var fileProperty = mediaTypeItem.CompositionPropertyTypes.FirstOrDefault(x => x.Alias == "umbracoFile");
if (fileProperty != null)
// Look up MediaTypes
foreach (var mediaTypeItem in mediaTypes)
{
var dataTypeKey = fileProperty.DataTypeKey;
var dataType = _dataTypeService.GetDataType(dataTypeKey);

if (dataType != null && dataType.Configuration is IFileExtensionsConfig fileExtensionsConfig)
var fileProperty = mediaTypeItem.CompositionPropertyTypes.FirstOrDefault(x => x.Alias == Constants.Conventions.Media.File);
if (fileProperty != null)
{
var fileExtensions = fileExtensionsConfig.FileExtensions;
if (fileExtensions != null)
var dataTypeKey = fileProperty.DataTypeKey;
var dataType = _dataTypeService.GetDataType(dataTypeKey);

if (dataType != null && dataType.Configuration is IFileExtensionsConfig fileExtensionsConfig)
{
if (fileExtensions.Where(x => x.Value == ext).Count() != 0)
var fileExtensions = fileExtensionsConfig.FileExtensions;
if (fileExtensions != null)
{
mediaType = mediaTypeItem.Alias;
break;
if (fileExtensions.Where(x => x.Value == ext).Count() != 0)
{
mediaType = mediaTypeItem.Alias;
break;
}
}
}
}
}
}

// If media type is still File then let's check if it's an image.
if (mediaType == Constants.Conventions.MediaTypes.File && _imageUrlGenerator.SupportedImageFileTypes.Contains(ext))
// If media type is still File then let's check if it's an image.
if (mediaType == Constants.Conventions.MediaTypes.File && _imageUrlGenerator.SupportedImageFileTypes.Contains(ext))
{
mediaType = Constants.Conventions.MediaTypes.Image;
}
}
else
{
mediaType = Constants.Conventions.MediaTypes.Image;
mediaType = contentTypeAlias;
}
}
else
{
mediaType = contentTypeAlias;
}

var mediaItemName = fileName.ToFriendlyName();

var f = _mediaService.CreateMedia(mediaItemName, parentId.Value, mediaType, _backofficeSecurityAccessor.BackOfficeSecurity.CurrentUser.Id);


await using (var stream = formFile.OpenReadStream())
{
f.SetValue(_mediaFileManager, _mediaUrlGenerators, _shortStringHelper, _contentTypeBaseServiceProvider, Constants.Conventions.Media.File, fileName, stream);
}


var saveResult = _mediaService.Save(f, _backofficeSecurityAccessor.BackOfficeSecurity.CurrentUser.Id);
if (saveResult == false)
{
Expand Down