diff --git a/composer.json b/composer.json
index 227f24ea1..aa442ea96 100755
--- a/composer.json
+++ b/composer.json
@@ -25,6 +25,7 @@
"barryvdh/laravel-debugbar": "^3.1",
"barryvdh/laravel-dompdf": "0.8.6",
"doctrine/dbal": "2.9.2",
+ "enshrined/svg-sanitize": "^0.14.0",
"fideloper/proxy": "^4.2",
"flynsarmy/db-blade-compiler": "^5.5",
"fzaninotto/faker": "^1.4",
diff --git a/composer.lock b/composer.lock
index 219fabd75..e014fb6c4 100644
--- a/composer.lock
+++ b/composer.lock
@@ -4,7 +4,7 @@
"Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
"This file is @generated automatically"
],
- "content-hash": "a3b2fd5de3b2c9728194478b97a6b6e1",
+ "content-hash": "62aa6739c921ce53f0029598eb1ada41",
"packages": [
{
"name": "algolia/algoliasearch-client-php",
@@ -1506,6 +1506,51 @@
},
"time": "2021-02-11T11:04:51+00:00"
},
+ {
+ "name": "enshrined/svg-sanitize",
+ "version": "0.14.0",
+ "source": {
+ "type": "git",
+ "url": "https://github.com/darylldoyle/svg-sanitizer.git",
+ "reference": "beff89576a72540ee99476aeb9cfe98222e76fb8"
+ },
+ "dist": {
+ "type": "zip",
+ "url": "https://api.github.com/repos/darylldoyle/svg-sanitizer/zipball/beff89576a72540ee99476aeb9cfe98222e76fb8",
+ "reference": "beff89576a72540ee99476aeb9cfe98222e76fb8",
+ "shasum": ""
+ },
+ "require": {
+ "ext-dom": "*",
+ "ext-libxml": "*"
+ },
+ "require-dev": {
+ "codeclimate/php-test-reporter": "^0.1.2",
+ "phpunit/phpunit": "^6"
+ },
+ "type": "library",
+ "autoload": {
+ "psr-4": {
+ "enshrined\\svgSanitize\\": "src"
+ }
+ },
+ "notification-url": "https://packagist.org/downloads/",
+ "license": [
+ "GPL-2.0-or-later"
+ ],
+ "authors": [
+ {
+ "name": "Daryll Doyle",
+ "email": "daryll@enshrined.co.uk"
+ }
+ ],
+ "description": "An SVG sanitizer for PHP",
+ "support": {
+ "issues": "https://github.com/darylldoyle/svg-sanitizer/issues",
+ "source": "https://github.com/darylldoyle/svg-sanitizer/tree/0.14.0"
+ },
+ "time": "2021-01-21T10:13:20+00:00"
+ },
{
"name": "ezimuel/guzzlestreams",
"version": "3.0.1",
diff --git a/packages/Webkul/Core/src/Traits/Sanitizer.php b/packages/Webkul/Core/src/Traits/Sanitizer.php
new file mode 100644
index 000000000..8a3fa41af
--- /dev/null
+++ b/packages/Webkul/Core/src/Traits/Sanitizer.php
@@ -0,0 +1,27 @@
+sanitize($dirtySVG));
+ }
+}
\ No newline at end of file
diff --git a/packages/Webkul/Product/src/Repositories/SearchRepository.php b/packages/Webkul/Product/src/Repositories/SearchRepository.php
index 255d5db9b..b0954a7f3 100755
--- a/packages/Webkul/Product/src/Repositories/SearchRepository.php
+++ b/packages/Webkul/Product/src/Repositories/SearchRepository.php
@@ -2,13 +2,16 @@
namespace Webkul\Product\Repositories;
-use Illuminate\Container\Container as App;
-use Illuminate\Support\Facades\Storage;
+use Webkul\Core\Traits\Sanitizer;
use Webkul\Core\Eloquent\Repository;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Container\Container as App;
use Webkul\Product\Repositories\ProductRepository;
class SearchRepository extends Repository
{
+ use Sanitizer;
+
/**
* ProductRepository object
*
@@ -51,6 +54,10 @@ class SearchRepository extends Repository
{
$path = request()->file('image')->store('product-search');
+ if ($data['image']->getMimeType() === 'image/svg') {
+ $this->sanitizeSVG($path);
+ }
+
return Storage::url($path);
}
}
\ No newline at end of file
diff --git a/packages/Webkul/Velocity/src/Http/Controllers/Admin/ConfigurationController.php b/packages/Webkul/Velocity/src/Http/Controllers/Admin/ConfigurationController.php
index 1c1f66bcc..f050ca73d 100644
--- a/packages/Webkul/Velocity/src/Http/Controllers/Admin/ConfigurationController.php
+++ b/packages/Webkul/Velocity/src/Http/Controllers/Admin/ConfigurationController.php
@@ -2,18 +2,14 @@
namespace Webkul\Velocity\Http\Controllers\Admin;
-use Illuminate\Support\Facades\Storage;
use Illuminate\Support\Str;
+use Webkul\Core\Traits\Sanitizer;
+use Illuminate\Support\Facades\Storage;
use Webkul\Velocity\Repositories\VelocityMetadataRepository;
class ConfigurationController extends Controller
{
- /**
- * VelocityMetadataRepository object
- *
- * @var \Webkul\Velocity\Repositories\VelocityMetadataRepository
- */
- protected $velocityMetaDataRepository;
+ use Sanitizer;
/**
* Locale
@@ -25,6 +21,13 @@ class ConfigurationController extends Controller
*/
protected $channel;
+ /**
+ * VelocityMetadataRepository $velocityMetaDataRepository
+ *
+ * @var \Webkul\Velocity\Repositories\VelocityMetadataRepository
+ */
+ protected $velocityMetaDataRepository;
+
/**
* Create a new controller instance.
*
@@ -43,12 +46,14 @@ class ConfigurationController extends Controller
}
/**
+ * Render meta data.
+ *
* @return \Illuminate\View\View
*/
public function renderMetaData()
- {
+ {
$this->locale = request()->get('locale') ? request()->get('locale') : app()->getLocale();
-
+
$velocityMetaData = $this->velocityHelper->getVelocityMetaData($this->locale, $this->channel, false);
if (! $velocityMetaData) {
@@ -65,6 +70,8 @@ class ConfigurationController extends Controller
}
/**
+ * Store meta data.
+ *
* @param int $id
* @return \Illuminate\Http\Response
*/
@@ -105,16 +112,6 @@ class ConfigurationController extends Controller
}
}
- if (isset($params['product_view_images'])) {
- foreach ($params['product_view_images'] as $index => $productViewImage) {
- if ($productViewImage !== "") {
- $params['product_view_images'][$index] = $this->uploadImage($productViewImage, $index);
- }
- }
-
- $params['product_view_images'] = json_encode($params['product_view_images']);
- }
-
$params['advertisement'] = json_encode($params['advertisement']);
$params['home_page_content'] = str_replace('=>', '=>', $params['home_page_content']);
@@ -132,10 +129,11 @@ class ConfigurationController extends Controller
}
/**
+ * Upload advertisement images.
+ *
* @param array $data
* @param int $index
* @param array $advertisement
- *
* @return array
*/
public function uploadAdvertisementImages($data, $index, $advertisement)
@@ -152,16 +150,20 @@ class ConfigurationController extends Controller
if (Str::contains($imageId, 'image_')) {
if (request()->hasFile($file) && $image) {
$filter_index = substr($imageId, 6, 1);
- if ( isset($data[$filter_index]) ) {
+ if (isset($data[$filter_index])) {
$size = array_key_last($saveData[$index]);
- $saveImage[$size + 1] = request()->file($file)->store($dir);
+ $saveImage[$size + 1] = $path = request()->file($file)->store($dir);
} else {
- $saveImage[substr($imageId, 6, 1)] = request()->file($file)->store($dir);
+ $saveImage[substr($imageId, 6, 1)] = $path = request()->file($file)->store($dir);
+ }
+
+ if ($image->getMimeType() === 'image/svg') {
+ $this->sanitizeSVG($path);
}
}
} else {
- if ( isset($advertisement[$index][$imageId]) && $advertisement[$index][$imageId] && !request()->hasFile($file)) {
+ if (isset($advertisement[$index][$imageId]) && $advertisement[$index][$imageId] && !request()->hasFile($file)) {
$saveImage[$imageId] = $advertisement[$index][$imageId];
unset($advertisement[$index][$imageId]);
@@ -200,30 +202,8 @@ class ConfigurationController extends Controller
}
/**
- * @param array $data
- * @param int $index
+ * Manage add images.
*
- * @return mixed
- */
- public function uploadImage($data, $index)
- {
- $type = 'product_view_images';
- $request = request();
-
- $image = '';
- $file = $type . '.' . $index;
- $dir = "velocity/$type";
-
- if ($request->hasFile($file)) {
- Storage::delete($dir . $file);
-
- $image = $request->file($file)->store($dir);
- }
-
- return $image;
- }
-
- /**
* @param array $addImages
*
* @return array
@@ -250,21 +230,25 @@ class ConfigurationController extends Controller
return $imagePaths;
}
+ /**
+ * Create meta data.
+ *
+ * @param string $locale
+ * @param string $channel
+ *
+ * @return array
+ */
private function createMetaData($locale, $channel)
{
\DB::table('velocity_meta_data')->insert([
'locale' => $locale,
'channel' => $channel,
'header_content_count' => '5',
-
'home_page_content' => "@include('shop::home.advertisements.advertisement-four')@include('shop::home.featured-products') @include('shop::home.product-policy') @include('shop::home.advertisements.advertisement-three') @include('shop::home.new-products') @include('shop::home.advertisements.advertisement-two')
",
'footer_left_content' => __('velocity::app.admin.meta-data.footer-left-raw-content'),
-
'footer_middle_content' => '',
'slider' => 1,
-
'subscription_bar_content' => '',
-
'product_policy' => '
Free Shipping on Order $20 or More
Product Replace & Return Available
Product Exchange and EMI Available