在上一個項目中，我通過執(zhí)行以下操作來保護(hù)上傳：
創(chuàng)建的存儲磁盤：
config/filesystems.php
'myDisk' => [
'driver' => 'local',
'root' => storage_path('app/uploads'),
'url' => env('APP_URL') . '/storage',
'visibility' => 'private',
],
這會將\storage\app\uploads\無法上載的文件上傳到公眾。
要將文件保存在控制器上：
Storage::disk('myDisk')->put('/ANY FOLDER NAME/' . $file, $data);
為了使用戶查看文件并保護(hù)上傳內(nèi)容免受未經(jīng)授權(quán)的訪問。首先檢查磁盤上是否存在文件：
public function returnFile($file)
{
//This method will look for the file and get it from drive
$path = storage_path('app/uploads/ANY FOLDER NAME/' . $file);
try {
$file = File::get($path);
$type = File::mimeType($path);
$response = Response::make($file, 200);
$response->header("Content-Type", $type);
return $response;
} catch (FileNotFoundException $exception) {
abort(404);
}
}
服務(wù)的文件，如果用戶有權(quán)訪問：
public function licenceFileShow($file)
{
/**
*Make sure the @param $file has a dot
* Then check if the user has Admin Role. If true serve else
*/
if (strpos($file, '.') !== false) {
if (Auth::user()->hasAnyRole(['Admin'])) {
/** Serve the file for the Admin*/
return $this->returnFile($file);
} else {
/**Logic to check if the request is from file owner**/
return $this->returnFile($file);
}
} else {
//Invalid file name given
return redirect()->route('home');
}
}
最后在Web.php路由上：
Route::get('uploads/user-files/{filename}', 'MiscController@licenceFileShow');
