TheCloneArmy/crater
1
0
Fork 1
mirror of https://github.com/crater-invoice/crater.git synced 2025-10-28 12:11:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

Unrestricted php file upload fix (#681)

Browse Source 
https://huntr.dev/bounties/d7453360-baca-4e56-985f-481275fa38db/
This commit is contained in:
theWorstComrade
2021-12-29 13:33:20 +01:00
committed by GitHub
parent c9d0a63854
commit cdc913d16c
7 changed files with 176 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
app/Http/Controllers/V1/Admin/Settings/CompanyController.php
View File

@ -9,6 +9,8 @@ use Crater\Http\Resources\CompanyResource;
use Crater\Http\Resources\UserResource;
use Crater\Models\Company;
use Illuminate\Http\Request;
use Crater\Http\Requests\AvatarRequest;
use Crater\Http\Requests\CompanyLogoRequest;
class CompanyController extends Controller
{
@ -58,10 +60,10 @@ class CompanyController extends Controller
/**
* Upload the company logo to storage.
*
* @param \Illuminate\Http\Request $request
* @param \Crater\Http\Requests\CompanyLogoRequest $request
* @return \Illuminate\Http\JsonResponse
*/
public function uploadCompanyLogo(Request $request)
public function uploadCompanyLogo(CompanyLogoRequest $request)
{
$company = Company::find($request->header('company'));
@ -89,10 +91,10 @@ class CompanyController extends Controller
/**
* Upload the Admin Avatar to public storage.
*
* @param \Illuminate\Http\Request $request
* @param \Crater\Http\Requests\AvatarRequest $request
* @return \Illuminate\Http\JsonResponse
*/
public function uploadAvatar(Request $request)
public function uploadAvatar(AvatarRequest $request)
{
$user = auth()->user();