src/storage/BaseFileSystemStorage.php
public function ensureFileUpload($fileSource, $fileName)
    {
        // throw exception if source or name is empty
        if (empty($fileSource) || empty($fileName)) {
            throw new Exception("Filename and source can not be empty.");
        }
        // if filename is blob, its a paste event from the browser, therefore generate the filename from the file source.
        // @TODO: move out of ensureFileUpload
        if ($fileName == 'blob') {
            $ext = FileHelper::getExtensionsByMimeType(FileHelper::getMimeType($fileSource));
            $fileName = 'paste-'.date("Y-m-d-H-i").'.'.$ext[0];
        }
        // get file informations from the name
        $fileInfo = FileHelper::getFileInfo($fileName);
        // get the mimeType from the fileSource, if $secureFileUpload is disabled, the mime type will be extracted from the file extensions
        // instead of using the fileinfo extension, therefore this is not recommend.
        $mimeType = FileHelper::getMimeType($fileSource, null, !$this->secureFileUpload);
        // empty mime type indicates a wrong file upload.
        if (empty($mimeType)) {
            throw new Exception("Unable to find mimeType for the given file, make sure the php extension 'fileinfo' is installed.");
        }

        $extensionsFromMimeType = FileHelper::getExtensionsByMimeType($mimeType);
        
        if (empty($extensionsFromMimeType) && empty($this->whitelistExtensions)) {
            throw new Exception("Unable to find extension for given mimeType \"{$mimeType}\" or it contains insecure data.");
        }
        
        if (!empty($this->whitelistExtensions)) {
            $extensionsFromMimeType = array_merge($extensionsFromMimeType, $this->whitelistExtensions);
        }

        // check if the file extension is matching the entries from FileHelper::getExtensionsByMimeType array.
        if (!in_array($fileInfo->extension, $extensionsFromMimeType) && !in_array($mimeType, $this->whitelistMimeTypes)) {
            throw new Exception("The given file extension \"{$fileInfo->extension}\" for file with mimeType \"{$mimeType}\" is not matching any valid extension: ".VarDumper::dumpAsString($extensionsFromMimeType).".");
        }
         
        foreach ($extensionsFromMimeType as $extension) {
            if (in_array($extension, $this->dangerousExtensions)) {
                throw new Exception("The file extension '{$extension}' seems to be dangerous and can not be stored.");
            }
        }

        // check whether a mimetype is in the dangerousMimeTypes list and not whitelisted in whitelistMimeTypes.
        if (in_array($mimeType, $this->dangerousMimeTypes) && !in_array($mimeType, $this->whitelistMimeTypes)) {
            throw new Exception("The file mimeType '{$mimeType}' seems to be dangerous and can not be stored.");
        }

        return [
            'fileInfo' => $fileInfo,
            'mimeType' => $mimeType,
            'fileName' => $fileName,
            'secureFileName' => Inflector::slug(str_replace('_', '-', $fileInfo->name), '-'),
            'fileSource' => $fileSource,
            'fileSize' => filesize($fileSource),
            'extension' => $fileInfo->extension,
            'hashName' => FileHelper::hashName($fileName),
        ];
    }
public function ensureFileUpload($fileSource, $fileName)
    {
        // throw exception if source or name is empty
        if (empty($fileSource) || empty($fileName)) {
            throw new Exception("Filename and source can not be empty.");
        }
        // if filename is blob, its a paste event from the browser, therefore generate the filename from the file source.
        // @TODO: move out of ensureFileUpload
        if ($fileName == 'blob') {
            $ext = FileHelper::getExtensionsByMimeType(FileHelper::getMimeType($fileSource));
            $fileName = 'paste-'.date("Y-m-d-H-i").'.'.$ext[0];
        }
        // get file informations from the name
        $fileInfo = FileHelper::getFileInfo($fileName);
        // get the mimeType from the fileSource, if $secureFileUpload is disabled, the mime type will be extracted from the file extensions
        // instead of using the fileinfo extension, therefore this is not recommend.
        $mimeType = FileHelper::getMimeType($fileSource, null, !$this->secureFileUpload);
        // empty mime type indicates a wrong file upload.
        if (empty($mimeType)) {
            throw new Exception("Unable to find mimeType for the given file, make sure the php extension 'fileinfo' is installed.");
        }

        $extensionsFromMimeType = FileHelper::getExtensionsByMimeType($mimeType);
        
        if (empty($extensionsFromMimeType) && empty($this->whitelistExtensions)) {
            throw new Exception("Unable to find extension for given mimeType \"{$mimeType}\" or it contains insecure data.");
        }
        
        if (!empty($this->whitelistExtensions)) {
            $extensionsFromMimeType = array_merge($extensionsFromMimeType, $this->whitelistExtensions);
        }

        // check if the file extension is matching the entries from FileHelper::getExtensionsByMimeType array.
        if (!in_array($fileInfo->extension, $extensionsFromMimeType) && !in_array($mimeType, $this->whitelistMimeTypes)) {
            throw new Exception("The given file extension \"{$fileInfo->extension}\" for file with mimeType \"{$mimeType}\" is not matching any valid extension: ".VarDumper::dumpAsString($extensionsFromMimeType).".");
        }
         
        foreach ($extensionsFromMimeType as $extension) {
            if (in_array($extension, $this->dangerousExtensions)) {
                throw new Exception("The file extension '{$extension}' seems to be dangerous and can not be stored.");
            }
        }

        // check whether a mimetype is in the dangerousMimeTypes list and not whitelisted in whitelistMimeTypes.
        if (in_array($mimeType, $this->dangerousMimeTypes) && !in_array($mimeType, $this->whitelistMimeTypes)) {
            throw new Exception("The file mimeType '{$mimeType}' seems to be dangerous and can not be stored.");
        }

        return [
            'fileInfo' => $fileInfo,
            'mimeType' => $mimeType,
            'fileName' => $fileName,
            'secureFileName' => Inflector::slug(str_replace('_', '-', $fileInfo->name), '-'),
            'fileSource' => $fileSource,
            'fileSize' => filesize($fileSource),
            'extension' => $fileInfo->extension,
            'hashName' => FileHelper::hashName($fileName),
        ];
    }
public function ensureFileUpload ( $ fileSource , $ fileName ) { // throw exception if source or name is empty if ( empty ( $ fileSource ) || empty ( $ fileName ) ) { throw new Exception ( "Filename and source can not be empty." ) ; } // if filename is blob, its a paste event from the browser, therefore generate the filename from the file source. // @TODO: move out of ensureFileUpload if ( $ fileName == 'blob' ) { $ ext = FileHelper :: getExtensionsByMimeType ( FileHelper :: getMimeType ( $ fileSource ) ) ; $ fileName = 'paste-' . date ( "Y-m-d-H-i" ) . '.' . $ ext [ 0 ] ; } // get file informations from the name $ fileInfo = FileHelper :: getFileInfo ( $ fileName ) ; // get the mimeType from the fileSource, if $secureFileUpload is disabled, the mime type will be extracted from the file extensions // instead of using the fileinfo extension, therefore this is not recommend. $ mimeType = FileHelper :: getMimeType ( $ fileSource , null , ! $ this -> secureFileUpload ) ; // empty mime type indicates a wrong file upload. if ( empty ( $ mimeType ) ) { throw new Exception ( "Unable to find mimeType for the given file, make sure the php extension 'fileinfo' is installed." ) ; } $ extensionsFromMimeType = FileHelper :: getExtensionsByMimeType ( $ mimeType ) ; if ( empty ( $ extensionsFromMimeType ) && empty ( $ this -> whitelistExtensions ) ) { throw new Exception ( "Unable to find extension for given mimeType \"{$mimeType}\" or it contains insecure data." ) ; } if ( ! empty ( $ this -> whitelistExtensions ) ) { $ extensionsFromMimeType = array_merge ( $ extensionsFromMimeType , $ this -> whitelistExtensions ) ; } // check if the file extension is matching the entries from FileHelper::getExtensionsByMimeType array. if ( ! in_array ( $ fileInfo -> extension , $ extensionsFromMimeType ) && ! in_array ( $ mimeType , $ this -> whitelistMimeTypes ) ) { throw new Exception ( "The given file extension \"{$fileInfo->extension}\" for file with mimeType \"{$mimeType}\" is not matching any valid extension: " . VarDumper :: dumpAsString ( $ extensionsFromMimeType ) . "." ) ; } foreach ( $ extensionsFromMimeType as $ extension ) { if ( in_array ( $ extension , $ this -> dangerousExtensions ) ) { throw new Exception ( "The file extension '{$extension}' seems to be dangerous and can not be stored." ) ; } } // check whether a mimetype is in the dangerousMimeTypes list and not whitelisted in whitelistMimeTypes. if ( in_array ( $ mimeType , $ this -> dangerousMimeTypes ) && ! in_array ( $ mimeType , $ this -> whitelistMimeTypes ) ) { throw new Exception ( "The file mimeType '{$mimeType}' seems to be dangerous and can not be stored." ) ; } return [ 'fileInfo' => $ fileInfo , 'mimeType' => $ mimeType , 'fileName' => $ fileName , 'secureFileName' => Inflector :: slug ( str_replace ( '_' , '-' , $ fileInfo -> name ) , '-' ) , 'fileSource' => $ fileSource , 'fileSize' => filesize ( $ fileSource ) , 'extension' => $ fileInfo -> extension , 'hashName' => FileHelper :: hashName ( $ fileName ) , ] ; }
Ensure a file uploads and return relevant file infos.

@param string $fileSource The file on the server ($_FILES['tmp'])
@param string $fileName Original upload name of the file ($_FILES['name'])
@throws Exception
@return array Returns an array with the following KeywordPatch
+ fileInfo:
+ mimeType:
+ fileName:
+ secureFileName: The file name with all insecure chars removed
+ fileSource:
+ extension: jpg, png, etc.
+ hashName: a short hash name for the given file, not the md5 sum.
Ensure a file uploads and return relevant file infos .