-
Notifications
You must be signed in to change notification settings - Fork 245
Expand file tree
/
Copy pathfiles.php
More file actions
149 lines (136 loc) · 5.36 KB
/
Copy pathfiles.php
File metadata and controls
149 lines (136 loc) · 5.36 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
<?php
return [
/*
|--------------------------------------------------------------------------
| File Upload Configuration
|--------------------------------------------------------------------------
|
| This file contains configuration options for file uploads including
| allowed file extensions and MIME types for security validation.
|
*/
/*
|--------------------------------------------------------------------------
| Allowed File Extensions
|--------------------------------------------------------------------------
|
| List of file extensions that are allowed to be uploaded.
| Only files with these extensions will be accepted.
| Archive formats (.zip, .rar, .tar, .7z) are explicitly NOT allowed for security.
|
*/
'allowed_extensions' => [
// Documents
'pdf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx',
'txt', 'csv',
// Images
'jpg', 'jpeg', 'png', 'gif', 'svg',
// Audio
'mp3',
// Video
'mp4', 'webm',
],
/*
|--------------------------------------------------------------------------
| Extension to MIME Type Mapping
|--------------------------------------------------------------------------
|
| An associative array that maps each allowed file extension to one or more
| corresponding MIME types. This provides a strong validation to ensure that
| a file's content type (MIME type) matches its declared extension,
| preventing malicious files (like a script disguised as an image) from being uploaded.
|
*/
'extension_mime_map' => [
// Documents
'pdf' => ['application/pdf'],
'doc' => ['application/msword'],
'docx' => ['application/vnd.openxmlformats-officedocument.wordprocessingml.document'],
'xls' => ['application/vnd.ms-excel'],
'xlsx' => ['application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
'ppt' => ['application/vnd.ms-powerpoint'],
'pptx' => ['application/vnd.openxmlformats-officedocument.presentationml.presentation'],
'txt' => ['text/plain'],
'csv' => ['text/csv', 'application/csv', 'text/plain'],
// Images
'jpg' => ['image/jpeg'],
'jpeg' => ['image/jpeg'],
'png' => ['image/png'],
'gif' => ['image/gif'],
'svg' => ['image/svg+xml'],
// Audio
'mp3' => ['audio/mpeg'],
// Video
'mp4' => ['video/mp4'],
'webm' => ['video/webm'],
],
/*
|--------------------------------------------------------------------------
| Enable DANGEROUS Validation
|--------------------------------------------------------------------------
|
| Whether to enable dangerous file validation that checks against
|
*/
'enable_dangerous_validation' => env('ENABLE_DANGEROUS_VALIDATION', true),
/*
|--------------------------------------------------------------------------
| Enable MIME Type Validation
|--------------------------------------------------------------------------
|
| Whether to enable MIME type validation against allowed_mime_types list
| AND validate that MIME type corresponds to file extension using extension_mime_map.
| This provides comprehensive validation to prevent malicious files.
| Recommended to keep this enabled for security.
|
*/
'enable_mime_validation' => env('ENABLE_MIME_VALIDATION', true),
/*
|--------------------------------------------------------------------------
| Enable Extension Validation
|--------------------------------------------------------------------------
|
| Whether to enable basic file extension validation against allowed_extensions list.
| This validates that the file extension is in the allowed list.
| Recommended to keep this enabled for security.
|
*/
'enable_extension_validation' => env('ENABLE_EXTENSION_VALIDATION', true),
/*
|--------------------------------------------------------------------------
| Security Dangerous File Extensions
|--------------------------------------------------------------------------
|
| Archive formats (.zip, .rar, .tar, .7z, .gz, etc.) are explicitly
| NOT allowed for security reasons. These file types can contain
| malicious content and are blocked by default.
|
*/
'dangerous_extensions' => [
'zip', 'rar', '7z', 'tar', 'gz', 'bz2', 'xz', 'lzma',
'cab', 'ar', 'iso', 'dmg', 'pkg', 'deb', 'rpm',
],
/*
|--------------------------------------------------------------------------
| Security Dangerous MIME Types
|--------------------------------------------------------------------------
|
| A list of MIME types associated with archives and executables.
| This provides an additional layer of security to prevent the upload of
| compressed files or other potentially dangerous content, even if their
| file extension has been tampered with.
|
*/
'dangerous_mime_types' => [
'application/zip',
'application/x-rar-compressed',
'application/x-7z-compressed',
'application/x-tar',
'application/gzip',
'application/x-bzip2',
'application/x-xz',
'application/x-lzma',
'application/vnd.ms-cab-compressed',
'application/x-iso9660-image',
],
];