Documentation

file_functions.php

Table of Contents

Enums

ProcessFileUploadErrorCondition

Functions

safe_file_name()  : string
Ensures the filename cannot leave the directory set.
generateUserFilenameUID()  : string
Generate a UID for filnames that can be different from user to user (e.g. contact sheets)
isPathWhitelisted()  : bool
Checks if a path is part of a whitelisted list of paths. This applies to both folders and files.
get_checksum()  : string|false
Return a checksum for the given file path.
temp_local_download_remote_file()  : string|bool
Download remote file to the temp filestore location.
check_valid_file_extension()  : bool
Basic check of uploaded file against list of allowed extensions
is_banned_extension()  : bool
Is the given extension in the list of blocked extensions? Also ensures extension is no longer than 10 characters due to resource.file_extension database column limit
remove_empty_temp_directory()  : void
Remove empty folder from path to file. Helpful to remove a temp directory once the file it was created to hold no longer exists.
is_valid_upload_path()  : bool
Confirm upload path is one of valid paths.
validate_resource_files()  : array<string|int, mixed>
Validate the files on disk that are associated with the given resources
is_valid_rs_path()  : bool
Check if a given file path is from a valid RS accessible location
is_safe_basename()  : bool
Validation helper function to determine if a path base name is unsafe (e.g OS command injection).
process_file_upload()  : ProcessFileUploadErrorCondition}
High level function which can handle processing file uploads.
parse_filename_extension()  : string
Parse file name (can include path, although it's unnecessary) to prevent known security bypasses associated with extensions, such as: - Double extensions, e.g. .jpg.php - Null bytes, e.g. .php%00.jpg, where .jpg gets truncated and .php becomes the new extension - Using Windows (DOS) 8.3 short path feature where it's possible to replace existing files by using their shortname (e.g. ".htaccess" can be replaced by "HTACCE~1")
delete_temp_files()  : void
Delete old files and folders from tempo directory based on the configured $purge_temp_folder_age value Affects filestore/tmp, $storagedir/tmp or the configured $tempdir directory
purge_query_cache()  : void
permitted_archiver_arguments()  : bool
Are the arguments set in $archiver_settings["arguments"] permitted? Allows word characters, '@', and '-' only
check_symlink()  : bool
Check if a given path is absolute or contains a symlink or junction is_link() does not accurately detect junction links on Windows systems instead we check if the output from stat() and lstat() differ.

Functions

safe_file_name()

Ensures the filename cannot leave the directory set.

safe_file_name(string $name) : string

Only to be used for internal ResourceSpace paths as only a limited character set is supported

Parameters
$name : string
Return values
string

generateUserFilenameUID()

Generate a UID for filnames that can be different from user to user (e.g. contact sheets)

generateUserFilenameUID(int $user_id) : string
Parameters
$user_id : int
Return values
string

isPathWhitelisted()

Checks if a path is part of a whitelisted list of paths. This applies to both folders and files.

isPathWhitelisted(string $path, array<string|int, mixed> $whitelisted_paths) : bool

Note: the function is not supposed to check/ validate the syntax of the path (ie. UNIX/ Windows)

Parameters
$path : string

Path which is going to be checked against whitelisted paths

$whitelisted_paths : array<string|int, mixed>

List of whitelisted paths

Return values
bool

get_checksum()

Return a checksum for the given file path.

get_checksum(string $path[, bool $forcefull = false ]) : string|false
Parameters
$path : string

Path to file

$forcefull : bool = false

Force use of whole file and ignore $file_checksums_50k setting

Return values
string|false —

Return the checksum value, false otherwise.

temp_local_download_remote_file()

Download remote file to the temp filestore location.

temp_local_download_remote_file(string $url[, string $key = "" ]) : string|bool
Parameters
$url : string

Source URL

$key : string = ""

Optional key to use - to prevent conflicts when simultaneous calls use same file name

Return values
string|bool —

Returns the new temp filestore location or false otherwise.

check_valid_file_extension()

Basic check of uploaded file against list of allowed extensions

check_valid_file_extension(array{name: string} $uploadedfile, array<string|int, mixed> $validextensions) : bool
Parameters
$uploadedfile : array{name: string}

An element from the $_FILES PHP reserved variable

$validextensions : array<string|int, mixed>

Array of valid extension strings

Return values
bool

is_banned_extension()

Is the given extension in the list of blocked extensions? Also ensures extension is no longer than 10 characters due to resource.file_extension database column limit

is_banned_extension(string $extension) : bool
Parameters
$extension : string
  • file extension to check
Return values
bool

remove_empty_temp_directory()

Remove empty folder from path to file. Helpful to remove a temp directory once the file it was created to hold no longer exists.

remove_empty_temp_directory([string $path_to_file = "" ]) : void

This function should be called only once the directory to be removed is empty.

Parameters
$path_to_file : string = ""

Full path to file in filestore.

is_valid_upload_path()

Confirm upload path is one of valid paths.

is_valid_upload_path(string $file_path, array<string|int, mixed> $valid_upload_paths) : bool
Parameters
$file_path : string

Upload path.

$valid_upload_paths : array<string|int, mixed>

Array of valid upload paths to test against.

Return values
bool —

true when path is valid else false

validate_resource_files()

Validate the files on disk that are associated with the given resources

validate_resource_files(array<string|int, mixed> $resources[, array<string|int, mixed> $criteria = [] ]) : array<string|int, mixed>
Parameters
$resources : array<string|int, mixed>

Array of resource IDs or array of resource data e.g, from search results

$criteria : array<string|int, mixed> = []

Array with an array of callables for each resource with the required return values in order to pass the check e.g. 'file_exists" =>true for a file presence only check

Return values
array<string|int, mixed> —

$results An array with resource ID as the index and the results of the check as the value (boolean) e.g. ["1234" => true, "1235" => false]

is_valid_rs_path()

Check if a given file path is from a valid RS accessible location

is_valid_rs_path(string $path[, array<string|int, mixed> $override_paths = [] ]) : bool
Parameters
$path : string
$override_paths : array<string|int, mixed> = []

Override checking of the default RS paths to check a specific location only.

Return values
bool

is_safe_basename()

Validation helper function to determine if a path base name is unsafe (e.g OS command injection).

is_safe_basename(string $val) : bool

Very strict, limited to specific characters only. Should only be used for filenames originating in ResourceSpace.

Parameters
$val : string
Return values
bool

process_file_upload()

High level function which can handle processing file uploads.

process_file_upload(SplFileInfo|array{name: string, full_path: string, type: string, tmp_name: string, error: int, size: int} $source, SplFileInfo $destination, array{allow_extensions?: list, file_move?: "move_uploaded_file"|"rename"|"copy"|"dry_run", mime_file_based_detection?: bool} $processor) : ProcessFileUploadErrorCondition}
Parameters
$source : SplFileInfo|array{name: string, full_path: string, type: string, tmp_name: string, error: int, size: int}
$destination : SplFileInfo
$processor : array{allow_extensions?: list, file_move?: "move_uploaded_file"|"rename"|"copy"|"dry_run", mime_file_based_detection?: bool}

Processors which can override different parts of the main logic (e.g. allow specific extensions)

Return values
ProcessFileUploadErrorCondition}

parse_filename_extension()

Parse file name (can include path, although it's unnecessary) to prevent known security bypasses associated with extensions, such as: - Double extensions, e.g. .jpg.php - Null bytes, e.g. .php%00.jpg, where .jpg gets truncated and .php becomes the new extension - Using Windows (DOS) 8.3 short path feature where it's possible to replace existing files by using their shortname (e.g. ".htaccess" can be replaced by "HTACCE~1")

parse_filename_extension(string $filename) : string
Parameters
$filename : string
Return values
string

delete_temp_files()

Delete old files and folders from tempo directory based on the configured $purge_temp_folder_age value Affects filestore/tmp, $storagedir/tmp or the configured $tempdir directory

delete_temp_files() : void

permitted_archiver_arguments()

Are the arguments set in $archiver_settings["arguments"] permitted? Allows word characters, '@', and '-' only

permitted_archiver_arguments(mixed $string) : bool
Parameters
$string : mixed
Return values
bool

check_symlink()

Check if a given path is absolute or contains a symlink or junction is_link() does not accurately detect junction links on Windows systems instead we check if the output from stat() and lstat() differ.

check_symlink(string $checkpath) : bool
Parameters
$checkpath : string
Return values
bool
On this page

Search results