vendor/sulu/form-bundle/Event/ProtectedMediaSubscriber.php line 73

  1. <?php
  3. /*
  4.  * This file is part of Sulu.
  5.  *
  6.  * (c) Sulu GmbH
  7.  *
  8.  * This source file is subject to the MIT license that is bundled
  9.  * with this source code in the file LICENSE.
  10.  */
  12. namespace Sulu\Bundle\FormBundle\Event;
  14. use Doctrine\ORM\EntityManagerInterface;
  15. use Doctrine\ORM\NoResultException;
  16. use Sulu\Bundle\MediaBundle\Entity\MediaInterface;
  17. use Sulu\Bundle\MediaBundle\Media\FormatCache\FormatCacheInterface;
  18. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  19. use Symfony\Component\HttpFoundation\RedirectResponse;
  20. use Symfony\Component\HttpKernel\Event\RequestEvent;
  21. use Symfony\Component\HttpKernel\Exception\AccessDeniedHttpException;
  22. use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
  24. /**
  25.  * @internal
  26.  */
  27. class ProtectedMediaSubscriber implements EventSubscriberInterface
  28. {
  29.     /**
  30.      * @var UrlGeneratorInterface
  31.      */
  32.     private $urlGenerator;
  34.     /**
  35.      * @var EntityManagerInterface
  36.      */
  37.     private $entityManager;
  39.     /**
  40.      * @var FormatCacheInterface
  41.      */
  42.     private $formatCache;
  44.     /**
  45.      * @var string[]
  46.      */
  47.     protected $protectedCollectionKeys = [];
  49.     /**
  50.      * @param string[] $protectedCollectionKeys
  51.      */
  52.     public function __construct(
  53.         UrlGeneratorInterface $urlGenerator,
  54.         EntityManagerInterface $entityManager,
  55.         FormatCacheInterface $formatCache,
  56.         array $protectedCollectionKeys = [
  57.             'sulu_form',
  58.         ]
  59.     ) {
  60.         $this->urlGenerator = $urlGenerator;
  61.         $this->entityManager = $entityManager;
  62.         $this->formatCache = $formatCache;
  63.         $this->protectedCollectionKeys = $protectedCollectionKeys;
  64.     }
  66.     public static function getSubscribedEvents()
  67.     {
  68.         return [
  69.             'kernel.request' => 'onRequest',
  70.         ];
  71.     }
  73.     public function onRequest(RequestEvent $event): void
  74.     {
  75.         if (\method_exists($event, 'isMainRequest') ? !$event->isMainRequest() : !$event->isMasterRequest()) {
  76.             return;
  77.         }
  79.         $request = $event->getRequest();
  81.         $routeName = $request->attributes->get('_route');
  83.         if ('sulu_media.website.image.proxy' !== $routeName
  84.             && 'sulu_media.website.media.download' !== $routeName
  85.         ) {
  86.             return;
  87.         }
  89.         $mediaId = null;
  91.         if ('sulu_media.website.image.proxy' === $routeName) {
  92.             $slug = $request->attributes->get('slug');
  94.             if (!$slug) {
  95.                 return;
  96.             }
  98.             $mediaProperties = $this->formatCache->analyzedMediaUrl($request->getPathInfo());
  99.             $mediaId = $mediaProperties['id'];
  100.         }
  102.         if (!$mediaId) {
  103.             /** @var string|null $mediaId */
  104.             $mediaId = $request->attributes->get('id');
  105.         }
  107.         if (!\is_numeric($mediaId) || !$this->isProtectedCollection((int) $mediaId)) {
  108.             return;
  109.         }
  111.         if ('sulu_media.website.image.proxy' === $routeName) {
  112.             throw new AccessDeniedHttpException();
  113.         }
  115.         $url = $this->urlGenerator->generate(
  116.             'sulu_media.website.media.download_admin',
  117.             \array_merge(
  118.                 $request->query->all(),
  119.                 $request->attributes->get('_route_params')
  120.             )
  121.         );
  123.         $event->setResponse(new RedirectResponse($url));
  124.     }
  126.     private function isProtectedCollection(int $mediaId): bool
  127.     {
  128.         $queryBuilder = $this->entityManager->createQueryBuilder()
  129.             ->from(MediaInterface::class, 'media')
  130.             ->innerJoin('media.collection', 'collection')
  131.             ->select('collection.key')
  132.             ->where('media.id = :id')
  133.             ->setParameter('id', $mediaId);
  135.         try {
  136.             $collectionKey = $queryBuilder->getQuery()->getSingleScalarResult();
  137.         } catch (NoResultException $e) {
  138.             return false;
  139.         }
  141.         foreach ($this->protectedCollectionKeys as $protectedCollectionKey) {
  142.             if (0 === \strpos($collectionKey, $protectedCollectionKey)) {
  143.                 return true;
  144.             }
  145.         }
  147.         return false;
  148.     }
  149. }