fix api security issues and update pages issue

2026-06-04 16:41:19 -04:00
parent feb6be0610
commit 5e5fe3794a
32 changed files with 1628 additions and 37 deletions
@@ -17,6 +17,14 @@ class BroadcastEmailImageService

    public function store(UploadedFile $file): array
    {
+        if (! $file->isValid()) {
+            return [
+                'ok' => false,
+                'status' => 400,
+                'error' => 'Invalid upload',
+            ];
+        }
+
        $mime = strtolower((string) $file->getMimeType());
        if (!isset($this->allowedTypes[$mime])) {
            return [
@@ -40,7 +48,7 @@ class BroadcastEmailImageService
        }

        $ext = $this->allowedTypes[$mime];
-        $newName = uniqid('em_', true) . '.' . $ext;
+        $newName = 'em_' . bin2hex(random_bytes(16)) . '.' . $ext;
        $file->move($targetDir, $newName);

        return [