I followed the documentation to upload files to my public folder, and now I wish I could delete a file from that folder.
if I use the query provided by api platform: api/image/{id} I can only delete the row in my table. I would already have to retrieve the path of the image to save it in the table. And maybe then I can use it to delete the image?
I need a Deserializer ?
Laurent.
You need to create an EventListener and listen to the postRemove event so that after deleting an entry from the Image entity, you physically remove the file from the directory.
An example of listening for events on an Image entity:
class ImageEventSubscriber
{
public function postRemove(Image $image, LifecycleEventArgs $event){
$image_path = $image->getPath(); // You may have to specify the full path to the file if it is not listed in the database.
if (file_exists($image_path))
{
unlink($image_path);
}
}
}
Now you need to declare your event listener in the services.yaml file
App\EventListener\ImageEventSubscriber:
tags: [ { name: doctrine.orm.entity_listener, entity: App\Entity\Image, event: postRemove } ]
Now, when requesting DELETE: api/image/{id}, the record and file will be deleted. You can get more information about EventSubscriber by reading the documentation.
Related
I'm trying to save a folder to the storage folder, but it isn't creating the folder.
What happens is that, I save the folder name in a form and what I want to happen is that if that folder doesn't exist then create it.
Here is my code
public function createFolder()
{
$base = storage_path("app/folder/".request('folder'));
if(!file_exists($base))
{
Storage::makeDirectory($base);
}
}
You can do some think like this
$path="folder/".request()->folder;
$folderExist= Storage::exists($path);
if(!$folderExist){
Storage::makeDirectory($path);
}
I'm using Strapi with local upload provider.
Whenever I upload a file, it is stored under the "public/uploads" folder locally, which is public.
Meaning that anyone with the file id, could download it eg. http://strapi-admin:1337/uploads/image1_9a9bd50a5b.png
However, I would like to only allow:
downloads to autenticated users which have the role "consumer" to be able to download files through the strapi API.
What is the best way for doing this?
Should I modify the upload extension directly? or is it any workaround I can use to implement this?
I would still like to store files locally (not using AWS3 and other cloud providers)
Thanks
The best way you can solve this is to create a collection e.g FileShare. The Collection table could be like this: uuid (UID), filename (TEXT), fileid (NUMBER), role(related to Roles table), user(relate to user-permission table), status (BOOLEAN).
Using this logic, you will have to create a new route for file upload, the code upload from respective controller, The code below will help:
const validateUploadBody = require('strapi-plugin-upload/controllers/validation/upload');
async create(ctx){
let userData=ctx.state?.user; let requestData=ctx.request.body;
const {
request: { body, files: { files } = {} },
} = ctx;
let uploadedFiles = await strapi.plugins.upload.services.upload.upload({
data: await validateUploadBody(body),
files,
});
let datat={
filename:uploadedFiles[0].name,
fileid:uploadedFiles[0].id,
status:true,
uuid:"3456345678", // Generate random perhaps use moment().format("x")
role:2 //it can be any role of your choice
}
let updateLibrary= await strapi.query('file-shares').create(datat);
}
Ensure to use the uuid as the download enpoint from your frontend e.g https://example.com/file/2343567. Don't expose your media library url.
Then create a controller that will look for the file from FileShare table, check necessary permission for the user then download the file.
i want to store my image to a specific folder and the folder will named by page id. For example if Page id=1, the folder location should be public/pages/page_id/image_here.
If the folder are not existed yet the system will generate and named with their page id.
$id=1;
$directoryPath=public_path('pages/' . $id);
if(File::isDirectory($directoryPath)){
//Perform storing
} else {
Storage::makeDirectory($directoryPath);
//Perform storing
}
But i having error that "mkdir(): Invalid argument".
Can i know why it happen?
And after my research some people say the folder name should based with id+token so intruder cannot search image based on id, is there possible to achieve?
I had the same problem, but when I use File instead of Storage it works!
$id=1;
$directoryPath=public_path('pages/'.$id);
//check if the directory exists
if(!File::isDirectory($directoryPath)){
//make the directory because it doesn't exists
File::makeDirectory($directoryPath);
}
//Perform store of the file
Hope this works!
When you use Storage facade, it uses local disk as default which is configured to work with storage_path().
So, if you want to create directory in public directory, use File::makeDirectory which is just simple wrapper for mkdir() with additional options or use mkdir() directly:
File::makeDirectory($directoryPath);
mkdir($directoryPath);
For basic Laravel file system the syntax is :
At very top under namespace write:
use File;
Then in your method use:
$id=1;
$directoryPath=public_path('pages/' . $id);
if(File::isDirectory($directoryPath)){
//Perform storing
} else {
File::makeDirectory($directoryPath, 0777, true, true);
//Perform storing
}
I'm new with laravel and I'm working in fileststem on laravel
(I want to do usual fileststem process like -make dir - copy - put -delete -ect)
I'm using laravel "Storage" Facade
but when i type
i referenced the class above like this in my code
use Illuminate\Support\Facades\Storage;
for example below :
if (file_exists(public_path($oldImage))) {
Storage::delete($oldImage);
}
nothing happens ,and when i refer to the class code i found this :
namespace Illuminate\Support\Facades;
/**
* #see \Illuminate\Filesystem\FilesystemManager
*/
class Storage extends Facade
{
/**
* Get the registered name of the component.
*
* #return string
*/
protected static function getFacadeAccessor()
{
return 'filesystem';
}
}
so where is the implementation and if you have alternative way to deal with
filesystem process rather than "Storage" facade ??
Storage is a facade and accesses the class Filesystem located here: vendor/laravel/framework/src/Illuminate/Filesystem/Filesystem.php
As you can see in the official filesystem documentation the code snippets use Storage.
UPDATE:
You should add use Storage; to be able to use the Storage facade.
I recommend reading the Laravel 8.X docs to get an initial heads up: https://laravel.com/docs/8.x/filesystem
NOTE: Before you get too carried away, make sure you understand the difference between local and public.
For starters, you should make your first goal to upload a file and acquire the UploadedFile type.
You can access a single file via something like $request->file('name'), or an array of images via something like:
// $request->input('images')
foreach ($images as $image) {
\Log::debug($image->getClientOriginalName());
}
If your file upload can be single and/or multiple, I recommend going with the array approach because a single file wrapped in an array allows you to use the same syntax for single and multi uploads (ie: that foreach loop works fine with one image, no extra code).
Here's an example:
use Illuminate\Support\Facades\Storage;
$slug = 'davids-sandwich-photos';
foreach ($images as $image) {
Storage::putFileAs(
'images' .'/'. $slug,
$image,
$image->getClientOriginalName()
);
}
Storage::putFileAs() can take 3 parameters: directory, content, filename. You can see above in the code that I interpolated a mix of static and derived directory name. You could do something like 'images' .'/'. $slug .'/'. Auth::user()->id to save the file in /images/davids-sandwich-photos/11.
Then, check in your repo directory: /storage/app/ and look for the images directory.
You can manually delete the folders while testing to get your bearings straight.
That should be enough to get most people started.
To avoid using the Storage facade, you can use:
foreach ($images as $image) {
$image->storeAs(
'examples' .'/'. $slug,
$image->getClientOriginalName(),
'public'
);
}
--
Check out config/filesystems.php under the disks section if you want to start manipulating the drivers, but I'm not a DB admin expert here.
I also saved this along my journey: https://medium.com/#shafiya.ariff23/how-to-store-uploaded-images-in-public-folder-in-laravel-5-8-and-display-them-on-shared-hosting-e31c7f37a737. You might need that if you get stuck with something like symlinking.
<img
v-for="image in example.images"
:key="image.filename"
:src="`/storage/examples/${example.slug}/${image.filename}`"
>
NOTE: The important part with Vue JS is to use <img src="/storage/examples/slug/filename.jpg"> if your file is located in your repository as /storage/app/public/examples/slug/filename.jpg Pay close attention to every character.
The public_path function returns the fully qualified path to the public directory ie public directory inside the laravel application. When using Storage, the path is set to the storage/app directory.
if (file_exists(public_path($oldImage))) {
//public_path($oldImage) will check for file in public directory
Storage::delete($oldImage); //Will delete file in storage/app directory
}
The modified code should be
if(Storage::has($oldImage)){
Storage::delete($oldImage);
}
I have installed Laravel 5.0 and have made Authentication. Everything is working just fine.
My web site is only open for Authenticated members. The content inside is protected to Authenticated members only, but the images inside the site is not protected for public view.
Any one writes the image URL directly can see the image, even if the person is not logged in to the system.
http://www.somedomainname.net/images/users/userImage.jpg
My Question: is it possible to protect images (the above URL example) from public view, in other Word if a URL of the image send to any person, the individual must be member and login to be able to see the image.
Is that possible and how?
It is possible to protect images from public view in Laravel 5.x folder.
Create images folder under storage folder (I have chosen storage folder because it has write permission already that I can use when I upload images to it) in Laravel like storage/app/images.
Move the images you want to protect from public folder to the new created images folder. You could also chose other location to create images folder but not inside the public folder, but with in Laravel folder structure but still a logical location example not inside controller folder. Next you need to create a route and image controller.
Create Route
Route::get('images/users/{user_id}/{slug}', [
'as' => 'images.show',
'uses' => 'ImagesController#show',
'middleware' => 'auth',
]);
The route will forward all image request access to Authentication page if person is not logged in.
Create ImagesController
class ImagesController extends Controller {
public function show($user_id, $slug)
{
$storagePath = storage_path('app/images/users/' . $user_id . '/' . $slug);
return Image::make($storagePath)->response();
}
}
EDIT (NOTE)
For those who use Laravel 5.2 and newer. Laravel introduces new and better way to serve files that has less overhead (This way does not regenerate the file as mentioned in the answer):
File Responses
The file method can be used to display a file, such as an image or
PDF, directly in the user's browser instead of initiating a download.
This method accepts the path to the file as its first argument and an
array of headers as its second argument:
return response()->file($pathToFile);
return response()->file($pathToFile, $headers);
You can modify your storage path and file/folder structure as you wish to fit your requirement, this is just to demonstrate how I did it and how it works.
You can also added condition to show the images only for specific members in the controller.
It is also possible to hash the file name with file name, time stamp and other variables in addition.
Addition: some asked if this method can be used as alternative to public folder upload, YES it is possible but it is not recommended practice as explained in this answer. So the same method can be also used to upload images in storage path even if you do not intend to protect them, just follow the same process but remove 'middleware' => 'auth',. That way you won't give 777 permission in your public folder and still have a safe uploading environment. The same mentioned answer also explain how to use this method with out authentication in case some one would use it or giving alternative solution as well.
In a previous project I protected the uploads by doing the following:
Created Storage Disk:
config/filesystems.php
'myDisk' => [
'driver' => 'local',
'root' => storage_path('app/uploads'),
'url' => env('APP_URL') . '/storage',
'visibility' => 'private',
],
This will upload the files to \storage\app\uploads\ which is not available to public viewing.
To save files on your controller:
Storage::disk('myDisk')->put('/ANY FOLDER NAME/' . $file, $data);
In order for users to view the files and to protect the uploads from unauthorized access. First check if the file exist on the disk:
public function returnFile($file)
{
//This method will look for the file and get it from drive
$path = storage_path('app/uploads/ANY FOLDER NAME/' . $file);
try {
$file = File::get($path);
$type = File::mimeType($path);
$response = Response::make($file, 200);
$response->header("Content-Type", $type);
return $response;
} catch (FileNotFoundException $exception) {
abort(404);
}
}
Serve the file if the user have the right access:
public function licenceFileShow($file)
{
/**
*Make sure the #param $file has a dot
* Then check if the user has Admin Role. If true serve else
*/
if (strpos($file, '.') !== false) {
if (Auth::user()->hasAnyRole(['Admin'])) {
/** Serve the file for the Admin*/
return $this->returnFile($file);
} else {
/**Logic to check if the request is from file owner**/
return $this->returnFile($file);
}
} else {
//Invalid file name given
return redirect()->route('home');
}
}
Finally on Web.php routes:
Route::get('uploads/user-files/{filename}', 'MiscController#licenceFileShow');
I haven't actually tried this but I found Nginx auth_request module that allows you to check the authentication from Laravel, but still send the file using Nginx.
It sends an internal request to given url and checks the http code for success (2xx) or failure (4xx) and on success, lets the user download the file.
Edit: Another option is something I've tried and it seemed to work fine. You can use X-Accel-Redirect -header to serve the file from Nginx. The request goes through PHP, but instead of sending the whole file through, it just sends the file location to Nginx which then serves it to the client.
if I am understanding you it's like !
Route::post('/download/{id}', function(Request $request , $id){
{
if(\Auth::user()->id == $id) {
return \Storage::download($request->f);
}
else {
\Session::flash('error' , 'Access deny');
return back();
}
}
})->name('download')->middleware('auth:owner,admin,web');
Every file inside the public folder is accessible in the browser. Anyone easily gets that file if they find out the file name and storage path.
So better option is to store the file outside the public folder eg: /storage/app/private
Now do following steps:
create a route (eg: private/{file_name})
Route::get('/private/{file_name}', [App\Http\Controllers\FileController::class, 'view'])->middleware(['auth'])->name('view.file');
create a function in a controller that returns a file path. to create a controller run the command php artisan make:controller FileController
and paste the view function in FileController
public function view($file)
{
$filePath = "notes/{$file}";
if(Storage::exists($filePath)){
return Storage::response($filePath);
}
abort(404);
}
then, paste use Illuminate\Support\Facades\Storage; in FileController for Storage
And don't forget to assign middleware (in route or controller) as your requirement(eg: auth)
And now, only those who have access to that middleware can access that file through a route name called view.file