Add a secret to upload files

The placement of files depends on the file extension, allowing files to be efficiently served by the web server instead of blocking a PHP worker.

diff --git a/wcfsetup/install/files/lib/data/file/File.class.php b/wcfsetup/install/files/lib/data/file/File.class.php
index bd27d90bbe3dc1ae592ece756f4eef9d5a009dd9..2d837eadf1cbc80bb6a15a546da6f4138492acbf 100644 (file)
--- a/wcfsetup/install/files/lib/data/file/File.class.php
+++ b/wcfsetup/install/files/lib/data/file/File.class.php
@@ -21,6 +21,7 @@ use wcf\util\StringUtil;
  * @property-read int $fileSize
  * @property-read string $fileHash
  * @property-read string $fileExtension
+ * @property-read string $secret
  * @property-read string $typeName
  * @property-read string $mimeType
  * @property-read int|null $width
@@ -61,8 +62,9 @@ class File extends DatabaseObject
     public function getSourceFilename(): string
     {
         return \sprintf(
-            '%d-%s.%s',
+            '%d-%s-%s.%s',
             $this->fileID,
+            $this->secret,
             $this->fileHash,
             $this->fileExtension,
         );
@@ -74,7 +76,8 @@ class File extends DatabaseObject
         $folderB = \substr($this->fileHash, 2, 2);
 
         return \sprintf(
-            \WCF_DIR . '_data/private/fileUpload/%s/%s/',
+            \WCF_DIR . '_data/%s/files/%s/%s/',
+            $this->fileExtension === 'bin' ? 'private' : 'public',
             $folderA,
             $folderB,
         );

diff --git a/wcfsetup/install/files/lib/data/file/FileEditor.class.php b/wcfsetup/install/files/lib/data/file/FileEditor.class.php
index 8696efdc2e1d497c8660b3b99de66ac56283397d..50be36834e7d460ef6d728d947fbe84f09d3fd6d 100644 (file)
--- a/wcfsetup/install/files/lib/data/file/FileEditor.class.php
+++ b/wcfsetup/install/files/lib/data/file/FileEditor.class.php
@@ -45,6 +45,7 @@ class FileEditor extends DatabaseObjectEditor
             'fileSize' => $fileTemporary->fileSize,
             'fileHash' => $fileTemporary->fileHash,
             'fileExtension' => File::getSafeFileExtension($mimeType, $fileTemporary->filename),
+            'secret' => \bin2hex(\random_bytes(10)),
             'typeName' => $fileTemporary->typeName,
             'mimeType' => $mimeType,
             'width' => $width,

diff --git a/wcfsetup/setup/db/install.sql b/wcfsetup/setup/db/install.sql
index c76e56a9ba3bcb83e389b6eed2bc3196254fe7b3..dc63a88748e2faee18f284435acb648a4c5b0c28 100644 (file)
--- a/wcfsetup/setup/db/install.sql
+++ b/wcfsetup/setup/db/install.sql
@@ -605,6 +605,7 @@ CREATE TABLE wcf1_file (
        fileSize BIGINT NOT NULL,
        fileHash CHAR(64) NOT NULL,
        fileExtension VARCHAR(10) NOT NULL,
+       secret CHAR(20) NOT NULL,
        typeName VARCHAR(255) NOT NULL,
        mimeType VARCHAR(255) NOT NULL,
        width INT,