StreamDelivery.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
namespace ILIAS\FileDelivery\Delivery;
 
use ILIAS\FileDelivery\Delivery\ResponseBuilder\ResponseBuilder;
use ILIAS\Filesystem\Stream\FileStream;
use ILIAS\FileDelivery\Token\Signer\Payload\FilePayload;
use ILIAS\Filesystem\Stream\Streams;
use ILIAS\FileDelivery\Token\Signer\Payload\ShortFilePayload;
use ILIAS\Filesystem\Stream\ZIPStream;
use ILIAS\FileDelivery\Isolation\IsolationConfig;
use ILIAS\HTTP\GlobalHttpState;
use ILIAS\FileDelivery\Token\DataSigning;
 
final class StreamDelivery extends BaseDelivery
{
    public const SUBREQUEST_SEPARATOR = '/-/';
 
    public function __construct(
        private DataSigning $data_signer,
        GlobalHttpState $http,
        ResponseBuilder $response_builder,
        ResponseBuilder $fallback_response_builder,
        IsolationConfig $isolation = new IsolationConfig(false, null, null),
    ) {
        parent::__construct($http, $response_builder, $fallback_response_builder, $isolation);
    }
 
    public function attached(
        FileStream $stream,
        string $download_file_name,
        ?string $mime_type = null
    ): never {
        $this->deliver(
            $stream,
            $download_file_name,
            $mime_type,
            Disposition::ATTACHMENT
        );
    }
 
    public function inline(
        FileStream $stream,
        string $download_file_name,
        ?string $mime_type = null
    ): never {
        $this->deliver(
            $stream,
            $download_file_name,
            $mime_type,
            Disposition::INLINE
        );
    }
 
    public function deliver(
        FileStream $stream,
        string $download_file_name,
        ?string $mime_type = null,
        Disposition $disposition = Disposition::INLINE
    ): never {
        $r = $this->http->response();
        $uri = $stream->getMetadata()['uri'];
 
        // Temporary files (e.g. ZIPs built by ILIAS\Filesystem\Util\Archive\Zip) are removed by a
        // shutdown function as soon as this request exits. Header based delivery (X-Sendfile,
        // X-Accel-Redirect) opens the file only after PHP has finished, so it would no longer exist.
        // Such files must be streamed by PHP itself, see https://mantis.ilias.de/view.php?id=48367
        if (
            $stream instanceof ZIPStream
            || $uri === 'php://memory'
            || $this->isTemporaryFile((string) $uri)
        ) {
            $this->response_builder = $this->fallback_response_builder;
        }
 
        $r = $this->setGeneralHeaders(
            $r,
            $uri,
            $mime_type ?? mime_content_type($uri),
            $download_file_name,
            $disposition
        );
 
        $r = $this->response_builder->buildForStream(
            $this->http->request(),
            $r,
            $stream
        );
        $this->saveAndClose($r);
    }
 
    private function isTemporaryFile(string $uri): bool
    {
        $real_path = realpath($uri);
        if ($real_path === false) {
            return false;
        }
        $temp_dirs = array_filter([
            defined('CLIENT_DATA_DIR') ? realpath(\CLIENT_DATA_DIR . '/temp') : false,
            realpath(sys_get_temp_dir()),
        ]);
        foreach ($temp_dirs as $temp_dir) {
            if (str_starts_with($real_path, rtrim($temp_dir, '/') . '/')) {
                return true;
            }
        }
        return false;
    }
 
    public function deliverFromToken(string $token): never
    {
        $r = $this->http->response();
 
        // check if $token has a sub-request, such as .../index.html
        $parts = explode(self::SUBREQUEST_SEPARATOR, $token);
        $sub_request = null;
        if (count($parts) > 1) {
            $token = $parts[0];
            $sub_request = implode('/', array_slice($parts, 1));
        }
 
        $payload = $this->data_signer->verifyStreamToken($token);
 
        // a token signed for the ILIAS domain is served there only, all others only on the content domain
        $isolated = !$payload instanceof ShortFilePayload || $payload->isIsolated();
        $host_allowed = $isolated ? $this->isRequestHostAllowed() : !$this->isRequestOnContentHost();
        if (!$host_allowed) {
            $this->notFound($r);
        }
 
        switch (true) {
            case $payload instanceof FilePayload:
                $uri = $payload->getUri();
                $mime_type = $payload->getMimeType();
                $file_name = $payload->getFilename();
                $disposition = Disposition::tryFrom($payload->getDisposition()) ?? Disposition::INLINE;
                break;
            case $payload instanceof ShortFilePayload:
                $uri = $payload->getUri();
                $mime_type = $this->determineMimeType($uri);
                $file_name = $payload->getFilename();
                $disposition = Disposition::INLINE;
                break;
            default:
                $this->notFound($r);
        }
        unset($payload);
 
        // handle direct access to file
 
        if ($sub_request === null) {
            $r = $this->setGeneralHeaders(
                $r,
                $uri,
                $mime_type,
                $file_name,
                $disposition,
                $isolated
            );
 
            $this->http->saveResponse(
                $this->response_builder->buildForStream(
                    $this->http->request(),
                    $r,
                    Streams::ofResource(fopen($uri, 'rb'))
                )
            );
        } else { // handle subrequest, aka file in a ZIP
            $requested_zip = $uri;
            $sub_request = urldecode($sub_request);
            // remove query
            $sub_request = explode('?', $sub_request)[0];
 
            try {
                $file_inside_ZIP = Streams::ofFileInsideZIP($requested_zip, $sub_request);
            } catch (\Throwable) {
                $this->notFound($r);
            }
            $file_inside_zip_uri = $file_inside_ZIP->getMetadata()['uri'];
            $file_inside_zip_stream = fopen($file_inside_zip_uri, 'rb');
 
            if ($file_inside_zip_stream === false) {
                $this->notFound($r);
            }
 
            // we must use PHPResponseBuilder here, because the streams inside zips cant be delivered using XSendFile or others
            $this->response_builder = $this->fallback_response_builder;
 
            $mime_type = $this->determineMimeType($file_inside_zip_uri);
            $r = $this->setGeneralHeaders(
                $r,
                $file_inside_zip_uri,
                $mime_type,
                basename($sub_request),
                Disposition::INLINE, // subrequests are always inline per default, browsers may change this to download
                $isolated
            );
 
 
            $this->http->saveResponse(
                $this->response_builder->buildForStream(
                    $this->http->request(),
                    $r,
                    $file_inside_ZIP
                )
            );
        }
        $this->http->sendResponse();
        $this->http->close();
    }
 
    private function determineMimeType(string $filename): string
    {
        $suffix = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
        if (isset($this->mime_type_map[$suffix])) {
            if (is_array($this->mime_type_map[$suffix]) && isset($this->mime_type_map[$suffix][0])) {
                return $this->mime_type_map[$suffix][0];
            }
 
            return $this->mime_type_map[$suffix];
        }
 
        $mime_type = mime_content_type($filename);
        if ($mime_type === 'application/octet-stream') {
            $mime_type = mime_content_type(substr($filename, 64));
        }
        return $mime_type ?: 'application/octet-stream';
    }
}