generated from boboko/starter
29 lines
1002 B
PHP
29 lines
1002 B
PHP
|
<?php
|
||
|
|
|
||
|
|
namespace App\Http\Controllers\Checkout;
|
||
|
|
|
||
|
|
use App\Http\Controllers\Controller;
|
||
|
|
use Illuminate\Http\Request;
|
||
|
|
use Illuminate\Support\Facades\Storage;
|
||
|
|
use Symfony\Component\HttpFoundation\StreamedResponse;
|
||
|
|
|
||
|
|
/**
|
||
|
|
* Serves a file answer to a product custom field (a cart/order line's
|
||
|
|
* meta.custom_fields, see CartController::customFieldsMeta()) from its private
|
||
|
|
* disk. Only reachable through a temporary signed URL — generated per render
|
||
|
|
* by checkout::partials.line-custom-fields — so disk and path in the query
|
||
|
|
* can't be tampered with, and a link stops working once it expires.
|
||
|
|
*/
|
||
|
|
class CustomFieldFileController extends Controller
|
||
|
|
{
|
||
|
|
public function __invoke(string $locale, Request $request): StreamedResponse
|
||
|
|
{
|
||
|
|
$disk = Storage::disk((string) $request->query('disk'));
|
||
|
|
$path = (string) $request->query('path');
|
||
|
|
|
||
|
|
abort_unless($disk->exists($path), 404);
|
||
|
|
|
||
|
|
return $disk->response($path, null, ['Cache-Control' => 'private, max-age=3600']);
|
||
|
|
}
|
||
|
|
}
|