Joseph.Rawlings/Virtnet.bond
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

feat: enhance storage file serving with direct access and route handling

Browse Source
This commit is contained in:
Joseph.Rawlings
2025-11-30 08:34:35 -05:00
parent 6d2779dc4b
commit c5e5b08cbd
2 changed files with 36 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
routes/web.php
View File

@@ -61,6 +61,36 @@ Route::group(['middleware' => ['web', 'auth']], function () {
Route::get('cart', Cart::class)->name('cart');
// Serve storage files if symlink doesn't work or web server doesn't serve them directly
// This route only handles requests that reach Laravel (if .htaccess doesn't serve them)
Route::get('/storage/{path}', function ($path) {
// Sanitize the path to prevent directory traversal
$path = str_replace('..', '', $path);
$path = ltrim($path, '/');
$filePath = storage_path('app/public/' . $path);
// Ensure the file exists and is within the public storage directory
if (!file_exists($filePath) || !is_file($filePath)) {
abort(404, 'File not found');
}
// Verify the file is actually within the storage/app/public directory
$realPath = realpath($filePath);
$publicPath = realpath(storage_path('app/public'));
if (!$realPath || strpos($realPath, $publicPath) !== 0) {
abort(403, 'Access denied');
}
$mimeType = mime_content_type($filePath) ?: 'application/octet-stream';
return response()->file($filePath, [
'Content-Type' => $mimeType,
'Cache-Control' => 'public, max-age=31536000',
]);
})->where('path', '.*')->name('storage.serve');
Route::group(['prefix' => 'products'], function () {
Route::get('/{category:slug}', Products\Index::class)->name('category.show')/* ->where('category', '[A-Za-z0-9_/-]+') */;
Route::get('/{category:slug}/{product:slug}', Products\Show::class)->name('products.show')/* ->where('category', '[A-Za-z0-9_/-]+') */;