Fixed download attack

mafftor · Jun 5, 2020 · ca56205 · ca56205
1 parent fe3d51d
commit ca56205
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/src/Controllers/DownloadController.php b/src/Controllers/DownloadController.php
@@ -2,10 +2,24 @@
 
 namespace Mafftor\LaravelFileManager\Controllers;
 
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Log;
+
 class DownloadController extends LfmController
 {
     public function getDownload()
     {
-        return response()->download($this->lfm->setName(request('file'))->path('absolute'));
+        $filepath = $this->helper->getCategoryName() . request('working_dir') . '/' . request('file');
+
+        try {
+            if (Storage::disk($this->helper->config('disk'))->exists($filepath)) {
+                return response()->download($this->lfm->setName(request('file'))->path('absolute'));
+            }
+        } catch (\Exception $e) {
+            // Do not need to throw the exception
+        }
+
+        Log::error('[laravel-file-manager] File not found - ' . $filepath);
+        abort(404);
     }
 }