m3 Security Fixes
This commit is contained in:
Mark Gregory
@@ -5,157 +5,146 @@ namespace Modules\M3\Http\Controllers\API;
|
||||
use Cache;
|
||||
use Config;
|
||||
use File;
|
||||
use Illuminate\Http\JsonResponse;
|
||||
use Illuminate\Http\Request;
|
||||
use Log;
|
||||
use Modules\M3\Helpers\Helper;
|
||||
use Modules\M3\Http\Controllers\Controller;
|
||||
use Smalot\PdfParser\Parser;
|
||||
use Str;
|
||||
|
||||
class PdfStorage extends Controller
|
||||
{
|
||||
private const ZERO_PAD = '000000';
|
||||
|
||||
// PdfStorageAPI : PDF file read and save to Cache
|
||||
public function PdfStorageAPI(Request $request)
|
||||
public function PdfStorageAPI(Request $request): JsonResponse
|
||||
{
|
||||
ini_set('max_execution_time', Config::get('arrays.PHPTimeOut'));
|
||||
ini_set('max_input_time', Config::get('arrays.PHPTimeOut'));
|
||||
ini_set('default_socket_timeout', Config::get('arrays.PHPTimeOut'));
|
||||
// dd($request->all());
|
||||
// Get the Calling User
|
||||
$SHUSER = m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser';
|
||||
$SHSOURCE = 'PdfStorageAPI';
|
||||
// PDF File PATH
|
||||
$pdfFilePath = Config::get('arrays.PdfPath');
|
||||
$this->configureTimeouts();
|
||||
|
||||
$context = $this->requestContext($request);
|
||||
if ($context === null) {
|
||||
return $this->errorResponse('No URL Parameters Sent', self::ZERO_PAD, '', '', '');
|
||||
}
|
||||
|
||||
try {
|
||||
// Get URL PARAMS
|
||||
$urlParams = count($request->all()) > 0 ? $request->all() : '';
|
||||
// dd($urlParams);
|
||||
$this->logRequest($context);
|
||||
|
||||
$COMPANY = isset($urlParams['COMPANY']) ? trim($urlParams['COMPANY']) : ''; // Company
|
||||
$WHS = isset($urlParams['WHS']) ? trim($urlParams['WHS']) : ''; // WareHouse
|
||||
$DOCTYPE = isset($urlParams['DOCTYPE']) ? trim($urlParams['DOCTYPE']) : ''; // document type (PackingList, CarrierLabel, ContentLabel)
|
||||
$FILENAME = isset($urlParams['FILENAME']) ? trim($urlParams['FILENAME']) : ''; // PDF File name
|
||||
$DOCNUM = isset($urlParams['DOCNUM']) ? trim($urlParams['DOCNUM']) : ''; // document number (ie the internal box number, the pick list number)
|
||||
$A4MACPKR = isset($urlParams['A4MACPKR']) ? trim($urlParams['A4MACPKR']) : ''; // Delivery note number
|
||||
$cacheKey = $this->buildCacheKey($context);
|
||||
$pdfFileName = (string) Config::get('arrays.PdfPath') . $context['FILENAME'] . '.pdf';
|
||||
$error = $this->validateStorageRequest($pdfFileName, $cacheKey);
|
||||
|
||||
if ($urlParams != '') {
|
||||
// Key Combination : COMPANY WHS A4MACPKR DOCTYPE DOCNUM
|
||||
// Document type (PackingList, CarrierLabel, ContentLabel)
|
||||
$DELIVERYNO = isset($A4MACPKR) ? $A4MACPKR : self::ZERO_PAD;
|
||||
$DELIVERYNO = $DELIVERYNO != '' && $DELIVERYNO != null ? $DELIVERYNO : self::ZERO_PAD;
|
||||
// Write to Logs : Params In
|
||||
$IncomingParams = ['COMPANY' => $COMPANY, 'WHS' => $WHS, 'DOCTYPE' => $DOCTYPE, 'FILENAME' => $FILENAME, 'A4MACPKR' => $A4MACPKR, 'DOCNUM' => $DOCNUM];
|
||||
$data = ['SHMACPKR' => $DELIVERYNO, 'SHDT' => date('Y-m-d'), 'SHTIME' => date('H:i:s'), 'SHERROR' => '', 'SHINTBOX' => $DOCNUM, 'SHTYPE' => 'M3-Req-out',
|
||||
'SHDATA' => json_encode($IncomingParams), 'SHUSER' => $SHUSER, 'SHSOURCE' => $SHSOURCE, 'SHCO' => $COMPANY, 'SHWHS' => $WHS];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// Make Key and Test Validity
|
||||
if ($A4MACPKR != '' && $DOCTYPE != '' && $DOCNUM != '' && $COMPANY != '' && $WHS != '') {
|
||||
$cacheKey = $A4MACPKR . $DOCTYPE . $DOCNUM . $COMPANY . $WHS;
|
||||
} else {
|
||||
$cacheKey = '';
|
||||
}
|
||||
|
||||
// Read PDF File and Encode to Base64
|
||||
$pdfFileName = $pdfFilePath . $FILENAME . '.pdf';
|
||||
// dd($pdfFileName);
|
||||
// dd(File::exists($pdfFileName));
|
||||
if (File::exists($pdfFileName) && $cacheKey != '') {
|
||||
// dd(File::exists($pdfFileName));
|
||||
|
||||
// Parse PDF file and build necessary objects.
|
||||
$parser = new Parser;
|
||||
|
||||
// $pdf = $parser->parseFile('/www/sentm3test/htdocs/labels/E1232824-10826596.pdf');
|
||||
// dump($pdf);
|
||||
// $text = $pdf->getText();
|
||||
// dump("Text Only");
|
||||
// dump($text);
|
||||
|
||||
$pdfFile = File::get($pdfFileName);
|
||||
|
||||
// Transform content to base64
|
||||
$base64PDF = base64_encode($pdfFile);
|
||||
// Output base64 string
|
||||
// dump($base64PDF);
|
||||
|
||||
// Save Cache
|
||||
Cache::forever($cacheKey, $base64PDF);
|
||||
// Cache::put($cacheKey, $base64PDF, now()->addMinutes(60));
|
||||
|
||||
// Retrieve Cache
|
||||
// $cachedPdfFile = Cache::get($cacheKey);
|
||||
// dump("Retrieve Base64 Encoded PDF saved in Cache:");
|
||||
// dump($cachedPdfFile);
|
||||
// $pdfData = substr($cachedPdfFile,0,50);
|
||||
// remove File from Cache
|
||||
// Cache::put(pdfFileName, 'value', -5);
|
||||
// Cache::forget($pdfFileName);
|
||||
|
||||
// Base64 Decode and Display
|
||||
// $pdf = $parser->parseContent(base64_decode($base64PDF));
|
||||
// $text = $pdf->getText();
|
||||
// dump($text);
|
||||
|
||||
// Write to Logs Out : Success
|
||||
$data = ['SHMACPKR' => $DELIVERYNO, 'SHDT' => date('Y-m-d'), 'SHTIME' => date('H:i:s'), 'SHERROR' => '', 'SHINTBOX' => $DOCNUM, 'SHTYPE' => 'M3-Res-out',
|
||||
'SHDATA' => 'PDF File converted to Base64 and Saved to Cache.Key: ' . $cacheKey, 'SHUSER' => $SHUSER, 'SHSOURCE' => $SHSOURCE, 'SHCO' => $COMPANY, 'SHWHS' => $WHS];
|
||||
// dd($data);
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
return response()->json([
|
||||
'code' => '200',
|
||||
'status' => 'Success',
|
||||
'cacheKey' => $cacheKey,
|
||||
// 'PDFData' => $pdfData
|
||||
]);
|
||||
} else {
|
||||
$SHDATA = File::exists($pdfFileName) ? '' : 'PDF File Not Found-';
|
||||
$SHDATA = $cacheKey != '' ? $SHDATA . '' : $SHDATA . 'Cache Key is missing Params';
|
||||
|
||||
// Write to Logs Out : Error
|
||||
$data = ['SHMACPKR' => $DELIVERYNO, 'SHDT' => date('Y-m-d'), 'SHTIME' => date('H:i:s'), 'SHERROR' => 'X', 'SHINTBOX' => $DOCNUM, 'SHTYPE' => 'M3-Res-out',
|
||||
'SHDATA' => 'An Error Occured -' . $SHDATA, 'SHUSER' => $SHUSER, 'SHSOURCE' => $SHSOURCE, 'SHCO' => $COMPANY, 'SHWHS' => $WHS];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// Return Error
|
||||
return response()->json([
|
||||
'code' => '405',
|
||||
'status' => 'Error',
|
||||
'message' => $SHDATA,
|
||||
]);
|
||||
}
|
||||
} else {
|
||||
// Write to Logs Out : Error
|
||||
$DELIVERYNO = isset($DELIVERYNO) ? $DELIVERYNO : self::ZERO_PAD;
|
||||
$data = ['SHMACPKR' => $DELIVERYNO, 'SHDT' => date('Y-m-d'), 'SHTIME' => date('H:i:s'), 'SHERROR' => 'X', 'SHINTBOX' => '', 'SHTYPE' => 'M3-Res-out',
|
||||
'SHDATA' => 'No URL Parameters Sent.', 'SHUSER' => $SHUSER, 'SHSOURCE' => $SHSOURCE, 'SHCO' => $COMPANY, 'SHWHS' => $WHS];
|
||||
Helper::logToICM699M($data);
|
||||
|
||||
// Return Error
|
||||
return response()->json([
|
||||
'code' => '405',
|
||||
'status' => 'Error',
|
||||
'message' => 'No URL Parameters Sent',
|
||||
]);
|
||||
if ($error !== null) {
|
||||
return $this->errorResponse($error, $context['DELIVERYNO'], $context['DOCNUM'], $context['COMPANY'], $context['WHS']);
|
||||
}
|
||||
} catch (\Throwable $th) {
|
||||
// Log::error($th);
|
||||
|
||||
// Write to Logs Out : Error
|
||||
$DELIVERYNO = isset($DELIVERYNO) ? $DELIVERYNO : self::ZERO_PAD;
|
||||
$data = ['SHMACPKR' => $DELIVERYNO, 'SHDT' => date('Y-m-d'), 'SHTIME' => date('H:i:s'), 'SHERROR' => 'X', 'SHINTBOX' => '', 'SHTYPE' => 'M3-Res-out',
|
||||
'SHDATA' => 'An Error Occured - ' . substr($th, 0, 300), 'SHUSER' => $SHUSER, 'SHSOURCE' => $SHSOURCE, 'SHCO' => $COMPANY, 'SHWHS' => $WHS];
|
||||
Helper::logToICM699M($data);
|
||||
Cache::forever($cacheKey, base64_encode(File::get($pdfFileName)));
|
||||
$this->logResult($context, 'PDF File converted to Base64 and Saved to Cache.Key: ' . $cacheKey);
|
||||
|
||||
return response()->json(['code' => '200', 'status' => 'Success', 'cacheKey' => $cacheKey]);
|
||||
} catch (\Throwable $exception) {
|
||||
$message = 'An Error Occured - ' . substr($exception->getMessage(), 0, 300);
|
||||
$this->safeLog($context, $message, true);
|
||||
|
||||
return response()->json([
|
||||
'code' => '405',
|
||||
'status' => 'error',
|
||||
'message' => 'Catched Error: ' . $th,
|
||||
'message' => 'Catched Error: ' . $exception->getMessage(),
|
||||
]);
|
||||
}
|
||||
}
|
||||
// End PdfStorageAPI
|
||||
|
||||
private function configureTimeouts(): void
|
||||
{
|
||||
$timeout = (string) Config::get('arrays.PHPTimeOut');
|
||||
ini_set('max_execution_time', $timeout);
|
||||
ini_set('max_input_time', $timeout);
|
||||
ini_set('default_socket_timeout', $timeout);
|
||||
}
|
||||
|
||||
private function requestContext(Request $request): ?array
|
||||
{
|
||||
if ($request->all() === []) {
|
||||
return null;
|
||||
}
|
||||
|
||||
$context = [];
|
||||
foreach (['COMPANY', 'WHS', 'DOCTYPE', 'FILENAME', 'DOCNUM', 'A4MACPKR'] as $key) {
|
||||
$context[$key] = trim((string) $request->input($key, ''));
|
||||
}
|
||||
|
||||
$context['DELIVERYNO'] = $context['A4MACPKR'] !== '' ? $context['A4MACPKR'] : self::ZERO_PAD;
|
||||
$context['SHUSER'] = m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser';
|
||||
$context['SHSOURCE'] = 'PdfStorageAPI';
|
||||
|
||||
return $context;
|
||||
}
|
||||
|
||||
private function buildCacheKey(array $context): string
|
||||
{
|
||||
foreach (['A4MACPKR', 'DOCTYPE', 'DOCNUM', 'COMPANY', 'WHS'] as $required) {
|
||||
if ($context[$required] === '') {
|
||||
return '';
|
||||
}
|
||||
}
|
||||
|
||||
return $context['A4MACPKR'] . $context['DOCTYPE'] . $context['DOCNUM'] . $context['COMPANY'] . $context['WHS'];
|
||||
}
|
||||
|
||||
private function validateStorageRequest(string $pdfFileName, string $cacheKey): ?string
|
||||
{
|
||||
$messages = [];
|
||||
if (! File::exists($pdfFileName)) {
|
||||
$messages[] = 'PDF File Not Found-';
|
||||
}
|
||||
if ($cacheKey === '') {
|
||||
$messages[] = 'Cache Key is missing Params';
|
||||
}
|
||||
|
||||
return $messages === [] ? null : implode('', $messages);
|
||||
}
|
||||
|
||||
private function logRequest(array $context): void
|
||||
{
|
||||
$params = array_intersect_key($context, array_flip(['COMPANY', 'WHS', 'DOCTYPE', 'FILENAME', 'A4MACPKR', 'DOCNUM']));
|
||||
$this->safeLog($context, json_encode($params, JSON_THROW_ON_ERROR), false, 'M3-Req-out');
|
||||
}
|
||||
|
||||
private function logResult(array $context, string $message): void
|
||||
{
|
||||
$this->safeLog($context, $message);
|
||||
}
|
||||
|
||||
private function safeLog(array $context, string $message, bool $error = false, string $type = 'M3-Res-out'): void
|
||||
{
|
||||
try {
|
||||
Helper::logToICM699M([
|
||||
'SHMACPKR' => $context['DELIVERYNO'] ?? self::ZERO_PAD,
|
||||
'SHDT' => date('Y-m-d'),
|
||||
'SHTIME' => date('H:i:s'),
|
||||
'SHERROR' => $error ? 'X' : '',
|
||||
'SHINTBOX' => $context['DOCNUM'] ?? '',
|
||||
'SHTYPE' => $type,
|
||||
'SHDATA' => $message,
|
||||
'SHUSER' => $context['SHUSER'] ?? (m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser'),
|
||||
'SHSOURCE' => $context['SHSOURCE'] ?? 'PdfStorageAPI',
|
||||
'SHCO' => $context['COMPANY'] ?? '',
|
||||
'SHWHS' => $context['WHS'] ?? '',
|
||||
]);
|
||||
} catch (\Throwable) {
|
||||
// Logging must never turn an API response into a 500 error.
|
||||
}
|
||||
}
|
||||
|
||||
private function errorResponse(string $message, string $deliveryNo, string $docNum, string $company, string $warehouse): JsonResponse
|
||||
{
|
||||
$context = [
|
||||
'DELIVERYNO' => $deliveryNo,
|
||||
'DOCNUM' => $docNum,
|
||||
'COMPANY' => $company,
|
||||
'WHS' => $warehouse,
|
||||
'SHUSER' => m3_user() !== '' ? Str::upper(m3_user()) : 'WebUser',
|
||||
'SHSOURCE' => 'PdfStorageAPI',
|
||||
];
|
||||
$this->safeLog($context, 'An Error Occured -' . $message, true);
|
||||
|
||||
return response()->json(['code' => '405', 'status' => 'Error', 'message' => $message]);
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user