mirror of
https://github.com/nextcloud/server.git
synced 2026-10-29 16:15:46 +01:00
313 lines
11 KiB
PHP
313 lines
11 KiB
PHP
<?php
|
|
|
|
/**
|
|
* SPDX-FileCopyrightText: 2016-2024 Nextcloud GmbH and Nextcloud contributors
|
|
* SPDX-FileCopyrightText: 2016 ownCloud, Inc.
|
|
* SPDX-License-Identifier: AGPL-3.0-only
|
|
*/
|
|
|
|
namespace OC\Core\Controller;
|
|
|
|
use OC\AppFramework\Utility\TimeFactory;
|
|
use OC\Avatar\AvatarManager;
|
|
use OCP\AppFramework\Controller;
|
|
use OCP\AppFramework\Http;
|
|
use OCP\AppFramework\Http\Attribute\FrontpageRoute;
|
|
use OCP\AppFramework\Http\Attribute\NoAdminRequired;
|
|
use OCP\AppFramework\Http\Attribute\NoCSRFRequired;
|
|
use OCP\AppFramework\Http\Attribute\NoSameSiteCookieRequired;
|
|
use OCP\AppFramework\Http\Attribute\OpenAPI;
|
|
use OCP\AppFramework\Http\Attribute\PublicPage;
|
|
use OCP\AppFramework\Http\FileDisplayResponse;
|
|
use OCP\AppFramework\Http\JSONResponse;
|
|
use OCP\AppFramework\Http\Response;
|
|
use OCP\Files\File;
|
|
use OCP\Files\IUserFolder;
|
|
use OCP\Files\NotPermittedException;
|
|
use OCP\IL10N;
|
|
use OCP\Image;
|
|
use OCP\IRequest;
|
|
use OCP\IUserManager;
|
|
use Psr\Log\LoggerInterface;
|
|
|
|
/**
|
|
* Class AvatarController
|
|
*
|
|
* @package OC\Core\Controller
|
|
*/
|
|
class AvatarController extends Controller {
|
|
private const CACHE_DEFAULT = 60 * 60 * 24;
|
|
|
|
/**
|
|
* Long enough to span the gap between infrequent large calls, which is where
|
|
* the cost of refetching everyone's avatar lands. Not longer, because this
|
|
* is also how long a missed version bump stays wrong.
|
|
*/
|
|
private const CACHE_VERSIONED = 60 * 60 * 24 * 60;
|
|
|
|
/**
|
|
* In some situations everyone fetches everyone else's avatar at once, so a fixed
|
|
* window expires the whole set together and the next call pays for all of
|
|
* it. Offsetting per user spreads those refetches over later calls.
|
|
*/
|
|
private const CACHE_SPREAD = 60 * 60 * 24 * 30;
|
|
|
|
public function __construct(
|
|
string $appName,
|
|
IRequest $request,
|
|
protected AvatarManager $avatarManager,
|
|
protected IL10N $l10n,
|
|
protected IUserManager $userManager,
|
|
protected ?IUserFolder $userFolder,
|
|
protected LoggerInterface $logger,
|
|
protected ?string $userId,
|
|
protected TimeFactory $timeFactory,
|
|
protected GuestAvatarController $guestAvatarController,
|
|
) {
|
|
parent::__construct($appName, $request);
|
|
}
|
|
|
|
/**
|
|
* Get the dark avatar
|
|
*
|
|
* @param non-empty-string $userId ID of the user
|
|
* @param 64|512 $size Size of the avatar
|
|
* @param bool $guestFallback Fallback to guest avatar if not found
|
|
* @param string $v Avatar version, which lets the response be cached for longer. A stale version still returns the current avatar
|
|
* @return FileDisplayResponse<Http::STATUS_OK|Http::STATUS_CREATED, array{Content-Type: string, X-NC-IsCustomAvatar: int}>|JSONResponse<Http::STATUS_NOT_FOUND, list<empty>, array{}>|Response<Http::STATUS_INTERNAL_SERVER_ERROR, array{}>
|
|
*
|
|
* 200: Avatar returned
|
|
* 201: Avatar returned
|
|
* 404: Avatar not found
|
|
*/
|
|
#[NoCSRFRequired]
|
|
#[PublicPage]
|
|
#[FrontpageRoute(verb: 'GET', url: '/avatar/{userId}/{size}/dark')]
|
|
#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
|
|
#[NoSameSiteCookieRequired]
|
|
public function getAvatarDark(string $userId, int $size, bool $guestFallback = false, string $v = '') {
|
|
if ($size <= 64) {
|
|
if ($size !== 64) {
|
|
$this->logger->debug('Avatar requested in deprecated size ' . $size);
|
|
}
|
|
$size = 64;
|
|
} else {
|
|
if ($size !== 512) {
|
|
$this->logger->debug('Avatar requested in deprecated size ' . $size);
|
|
}
|
|
$size = 512;
|
|
}
|
|
|
|
try {
|
|
$avatar = $this->avatarManager->getAvatar($userId);
|
|
$avatarFile = $avatar->getFile($size, true);
|
|
$response = new FileDisplayResponse(
|
|
$avatarFile,
|
|
Http::STATUS_OK,
|
|
['Content-Type' => $avatarFile->getMimeType(), 'X-NC-IsCustomAvatar' => (int)$avatar->isCustomAvatar()]
|
|
);
|
|
} catch (\Exception $e) {
|
|
if ($guestFallback) {
|
|
return $this->guestAvatarController->getAvatarDark($userId, $size);
|
|
}
|
|
return new JSONResponse([], Http::STATUS_NOT_FOUND);
|
|
}
|
|
|
|
$response->cacheFor($this->cacheSecondsFor($userId, $v), false, true);
|
|
return $response;
|
|
}
|
|
|
|
/**
|
|
* Get the avatar
|
|
*
|
|
* @param non-empty-string $userId ID of the user
|
|
* @param 64|512 $size Size of the avatar
|
|
* @param bool $guestFallback Fallback to guest avatar if not found
|
|
* @param string $v Avatar version, which lets the response be cached for longer. A stale version still returns the current avatar
|
|
* @return FileDisplayResponse<Http::STATUS_OK|Http::STATUS_CREATED, array{Content-Type: string, X-NC-IsCustomAvatar: int}>|JSONResponse<Http::STATUS_NOT_FOUND, list<empty>, array{}>|Response<Http::STATUS_INTERNAL_SERVER_ERROR, array{}>
|
|
*
|
|
* 200: Avatar returned
|
|
* 201: Avatar returned
|
|
* 404: Avatar not found
|
|
*/
|
|
#[NoCSRFRequired]
|
|
#[PublicPage]
|
|
#[FrontpageRoute(verb: 'GET', url: '/avatar/{userId}/{size}')]
|
|
#[OpenAPI(scope: OpenAPI::SCOPE_DEFAULT)]
|
|
#[NoSameSiteCookieRequired]
|
|
public function getAvatar(string $userId, int $size, bool $guestFallback = false, string $v = '') {
|
|
if ($size <= 64) {
|
|
if ($size !== 64) {
|
|
$this->logger->debug('Avatar requested in deprecated size ' . $size);
|
|
}
|
|
$size = 64;
|
|
} else {
|
|
if ($size !== 512) {
|
|
$this->logger->debug('Avatar requested in deprecated size ' . $size);
|
|
}
|
|
$size = 512;
|
|
}
|
|
|
|
try {
|
|
$avatar = $this->avatarManager->getAvatar($userId);
|
|
$avatarFile = $avatar->getFile($size);
|
|
$response = new FileDisplayResponse(
|
|
$avatarFile,
|
|
Http::STATUS_OK,
|
|
['Content-Type' => $avatarFile->getMimeType(), 'X-NC-IsCustomAvatar' => (int)$avatar->isCustomAvatar()]
|
|
);
|
|
} catch (\Exception $e) {
|
|
if ($guestFallback) {
|
|
return $this->guestAvatarController->getAvatar($userId, $size);
|
|
}
|
|
return new JSONResponse([], Http::STATUS_NOT_FOUND);
|
|
}
|
|
|
|
$response->cacheFor($this->cacheSecondsFor($userId, $v), false, true);
|
|
return $response;
|
|
}
|
|
|
|
/**
|
|
* Decided here rather than by the caller: attaching a version to an avatar
|
|
* whose visibility depends on the viewer must not buy a month of caching.
|
|
*/
|
|
private function cacheSecondsFor(string $userId, string $version): int {
|
|
if ($version !== '' && $this->avatarManager->canCacheAvatarLongTerm($userId)) {
|
|
return self::CACHE_VERSIONED + (crc32($userId) % self::CACHE_SPREAD);
|
|
}
|
|
|
|
return self::CACHE_DEFAULT;
|
|
}
|
|
|
|
/**
|
|
* @param ?non-empty-string $path
|
|
*/
|
|
#[NoAdminRequired]
|
|
#[FrontpageRoute(verb: 'POST', url: '/avatar/')]
|
|
public function postAvatar(?string $path = null): JSONResponse {
|
|
$files = $this->request->getUploadedFile('files');
|
|
|
|
if (isset($path)) {
|
|
$path = stripslashes($path);
|
|
/** @var File $node */
|
|
$node = $this->userFolder->get($path);
|
|
if (!($node instanceof File)) {
|
|
return new JSONResponse(['data' => ['message' => $this->l10n->t('Please select a file.')]]);
|
|
}
|
|
if ($node->getSize() > 20 * 1024 * 1024) {
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('File is too big')]],
|
|
Http::STATUS_BAD_REQUEST
|
|
);
|
|
}
|
|
|
|
if ($node->getMimeType() !== 'image/jpeg' && $node->getMimeType() !== 'image/png') {
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('The selected file is not an image.')]],
|
|
Http::STATUS_BAD_REQUEST
|
|
);
|
|
}
|
|
|
|
try {
|
|
$content = $node->getContent();
|
|
} catch (NotPermittedException $e) {
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('The selected file cannot be read.')]],
|
|
Http::STATUS_BAD_REQUEST
|
|
);
|
|
}
|
|
} elseif (!is_null($files)) {
|
|
if (
|
|
$files['error'][0] === 0
|
|
&& is_uploaded_file($files['tmp_name'][0])
|
|
) {
|
|
if ($files['size'][0] > 20 * 1024 * 1024) {
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('File is too big')]],
|
|
Http::STATUS_BAD_REQUEST
|
|
);
|
|
}
|
|
$content = file_get_contents($files['tmp_name'][0]);
|
|
unlink($files['tmp_name'][0]);
|
|
} else {
|
|
$phpFileUploadErrors = [
|
|
UPLOAD_ERR_OK => $this->l10n->t('The file was uploaded'),
|
|
UPLOAD_ERR_INI_SIZE => $this->l10n->t('The uploaded file exceeds the upload_max_filesize directive in php.ini'),
|
|
UPLOAD_ERR_FORM_SIZE => $this->l10n->t('The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form'),
|
|
UPLOAD_ERR_PARTIAL => $this->l10n->t('The file was only partially uploaded'),
|
|
UPLOAD_ERR_NO_FILE => $this->l10n->t('No file was uploaded'),
|
|
UPLOAD_ERR_NO_TMP_DIR => $this->l10n->t('Missing a temporary folder'),
|
|
UPLOAD_ERR_CANT_WRITE => $this->l10n->t('Could not write file to disk'),
|
|
UPLOAD_ERR_EXTENSION => $this->l10n->t('A PHP extension stopped the file upload'),
|
|
];
|
|
$message = $phpFileUploadErrors[$files['error'][0]] ?? $this->l10n->t('Invalid file provided');
|
|
$this->logger->warning($message, ['app' => 'core']);
|
|
return new JSONResponse(
|
|
['data' => ['message' => $message]],
|
|
Http::STATUS_BAD_REQUEST
|
|
);
|
|
}
|
|
} else {
|
|
//Add imgfile
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('No image or file provided')]],
|
|
Http::STATUS_BAD_REQUEST
|
|
);
|
|
}
|
|
|
|
try {
|
|
$image = new Image();
|
|
$image->loadFromData($content);
|
|
$image->readExif($content);
|
|
$image->fixOrientation();
|
|
|
|
if ($image->valid()) {
|
|
$mimeType = $image->mimeType();
|
|
if ($mimeType !== 'image/jpeg' && $mimeType !== 'image/png') {
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('Unknown filetype')]],
|
|
Http::STATUS_OK
|
|
);
|
|
}
|
|
|
|
if ($image->width() === $image->height()) {
|
|
try {
|
|
$avatar = $this->avatarManager->getAvatar($this->userId);
|
|
$avatar->set($image);
|
|
return new JSONResponse(['status' => 'success']);
|
|
} catch (\Throwable $e) {
|
|
$this->logger->error($e->getMessage(), ['exception' => $e, 'app' => 'core']);
|
|
return new JSONResponse(['data' => ['message' => $this->l10n->t('An error occurred. Please contact your admin.')]], Http::STATUS_BAD_REQUEST);
|
|
}
|
|
}
|
|
|
|
return new JSONResponse(
|
|
['data' => 'notsquare', 'image' => 'data:' . $mimeType . ';base64,' . base64_encode($image->data())],
|
|
Http::STATUS_OK
|
|
);
|
|
} else {
|
|
return new JSONResponse(
|
|
['data' => ['message' => $this->l10n->t('Invalid image')]],
|
|
Http::STATUS_OK
|
|
);
|
|
}
|
|
} catch (\Exception $e) {
|
|
$this->logger->error($e->getMessage(), ['exception' => $e, 'app' => 'core']);
|
|
return new JSONResponse(['data' => ['message' => $this->l10n->t('An error occurred. Please contact your admin.')]], Http::STATUS_OK);
|
|
}
|
|
}
|
|
|
|
#[NoAdminRequired]
|
|
#[FrontpageRoute(verb: 'DELETE', url: '/avatar/')]
|
|
public function deleteAvatar(): JSONResponse {
|
|
try {
|
|
$avatar = $this->avatarManager->getAvatar($this->userId);
|
|
$avatar->remove();
|
|
return new JSONResponse();
|
|
} catch (\Exception $e) {
|
|
$this->logger->error($e->getMessage(), ['exception' => $e, 'app' => 'core']);
|
|
return new JSONResponse(['data' => ['message' => $this->l10n->t('An error occurred. Please contact your admin.')]], Http::STATUS_BAD_REQUEST);
|
|
}
|
|
}
|
|
}
|