41 lines
1023 B
PHP
41 lines
1023 B
PHP
<?php
|
|
|
|
namespace App\Services;
|
|
|
|
use Illuminate\Http\UploadedFile;
|
|
use Illuminate\Support\Str;
|
|
|
|
/**
|
|
* Scaffolded ahead of any actual upload feature (e.g. avatars) so hardening
|
|
* isn't an afterthought bolted on later. Not wired to a route yet.
|
|
*/
|
|
class FileUploadValidator
|
|
{
|
|
private const ALLOWED_MIME_TYPES = [
|
|
'image/jpeg',
|
|
'image/png',
|
|
'image/webp',
|
|
];
|
|
|
|
private const MAX_BYTES = 5 * 1024 * 1024; // 5MB
|
|
|
|
public function validate(UploadedFile $file): bool
|
|
{
|
|
if ($file->getSize() > self::MAX_BYTES) {
|
|
return false;
|
|
}
|
|
|
|
// Sniff actual content type rather than trusting the client-supplied
|
|
// extension or Content-Type header.
|
|
return in_array($file->getMimeType(), self::ALLOWED_MIME_TYPES, true);
|
|
}
|
|
|
|
/**
|
|
* A randomized filename that never trusts the client-supplied name.
|
|
*/
|
|
public function randomizedFilename(UploadedFile $file): string
|
|
{
|
|
return Str::uuid().'.'.$file->extension();
|
|
}
|
|
}
|