From 87644166adc9468c7bae9b0b61d3cb4d02ab2b2f Mon Sep 17 00:00:00 2001
From: Samuel Georges <sam@daftspunk.com>
Date: Sat, 25 Apr 2015 12:53:54 +1000
Subject: [PATCH] Adds internal download link for protected files

---
 CHANGELOG.md                                  |  3 +
 modules/backend/controllers/Files.php         | 67 +++++++++++++++++++
 modules/backend/formwidgets/FileUpload.php    | 36 +++++++---
 .../fileupload/partials/_file_single.htm      |  2 +-
 4 files changed, 99 insertions(+), 9 deletions(-)
 create mode 100644 modules/backend/controllers/Files.php

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8510c878..380adad48 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,6 @@
+* **Build 24x** (2015-04-xx)
+  - Protected files can now be downloaded by administrators using the `fileupload` form widget.
+
 * **Build 247** (2015-04-23)
   - Added Media Manager feature.
 
diff --git a/modules/backend/controllers/Files.php b/modules/backend/controllers/Files.php
new file mode 100644
index 000000000..dea2d5493
--- /dev/null
+++ b/modules/backend/controllers/Files.php
@@ -0,0 +1,67 @@
+<?php namespace Backend\Controllers;
+
+use App;
+use Backend;
+use System\Models\File as FileModel;
+use Backend\Classes\Controller;
+use ApplicationException;
+use Exception;
+
+/**
+ * Backend files controller
+ *
+ * @package october\backend
+ * @author Alexey Bobkov, Samuel Georges
+ *
+ */
+class Files extends Controller
+{
+    public function get($code = null)
+    {
+        try {
+            if (!$code) {
+                throw new ApplicationException('Missing code');
+            }
+
+            $parts = explode('!', base64_decode($code));
+            if (count($parts) < 2) {
+                throw new ApplicationException('Invalid code');
+            }
+
+            list($id, $hash) = $parts;
+
+            if (!$file = FileModel::find((int) $id)) {
+                throw new ApplicationException('Unable to find file');
+            }
+
+            $verifyCode = self::getUniqueCode($file);
+            if ($code != $verifyCode) {
+                throw new ApplicationException('Invalid hash');
+            }
+
+            echo $file->output();
+            exit;
+        }
+        catch (Exception $ex) {}
+
+        /*
+         * Fall back on Cms controller
+         */
+        return App::make('Cms\Classes\Controller')->setStatusCode(404)->run('/404');
+    }
+
+    public static function getDownloadUrl($file)
+    {
+        return Backend::url('backend/files/get/' . self::getUniqueCode($file));
+    }
+
+    public static function getUniqueCode($file)
+    {
+        if (!$file) {
+            return null;
+        }
+
+        $hash = md5($file->file_name . '!' . $file->disk_name);
+        return base64_encode($file->id . '!' . $hash);
+    }
+}
\ No newline at end of file
diff --git a/modules/backend/formwidgets/FileUpload.php b/modules/backend/formwidgets/FileUpload.php
index 1b52d5f06..2cf35280b 100644
--- a/modules/backend/formwidgets/FileUpload.php
+++ b/modules/backend/formwidgets/FileUpload.php
@@ -94,7 +94,7 @@ class FileUpload extends FormWidgetBase
     /**
      * Prepares the view data
      */
-    public function prepareVars()
+    protected function prepareVars()
     {
         $this->vars['fileList'] = $this->getFileList();
         $this->vars['singleFile'] = array_get($this->vars['fileList'], 0, null);
@@ -107,14 +107,19 @@ class FileUpload extends FormWidgetBase
 
     protected function getFileList()
     {
-        $list = $this->getRelationObject()->withDeferred($this->sessionKey)->orderBy('sort_order')->get();
+        $list = $this
+            ->getRelationObject()
+            ->withDeferred($this->sessionKey)
+            ->orderBy('sort_order')
+            ->get()
+        ;
 
         /*
-         * Set the thumb for each file
+         * Decorate each file with thumb and custom download path
          */
-        foreach ($list as $file) {
-            $file->thumb = $file->getThumb($this->imageWidth, $this->imageHeight, $this->thumbOptions);
-        }
+        $list->each(function($file){
+            $this->decorateFileAttributes($file);
+        });
 
         return $list;
     }
@@ -325,8 +330,7 @@ class FileUpload extends FormWidgetBase
 
             $fileRelation->add($file, $this->sessionKey);
 
-            $file->thumb = $file->getThumb($this->imageWidth, $this->imageHeight, $this->thumbOptions);
-            $result = $file;
+            $result = $this->decorateFileAttributes($file);
 
         }
         catch (Exception $ex) {
@@ -336,4 +340,20 @@ class FileUpload extends FormWidgetBase
         header('Content-Type: application/json');
         die($result);
     }
+
+    /**
+     * Adds the bespoke thumb and path property used by this widget.
+     * @return System\Models\File
+     */
+    protected function decorateFileAttributes($file)
+    {
+        $file->thumb = $file->getThumb($this->imageWidth, $this->imageHeight, $this->thumbOptions);
+
+        // Internal download link
+        if (!$file->isImage() || !$file->isPublic()) {
+            $file->path = \Backend\Controllers\Files::getDownloadUrl($file);
+        }
+
+        return $file;
+    }
 }
diff --git a/modules/backend/formwidgets/fileupload/partials/_file_single.htm b/modules/backend/formwidgets/fileupload/partials/_file_single.htm
index 9548af1b7..4dc7c7c64 100644
--- a/modules/backend/formwidgets/fileupload/partials/_file_single.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_file_single.htm
@@ -61,7 +61,7 @@
 
                 <a
                     href="{{path}}"
-                    class="uploader-file-link oc-icon-paper-clip"
+                    class="uploader-file-link oc-icon-paperclip"
                     target="_blank"></a>
             </div>
         </div>