Merge pull request #58 from Laravel-Backpack/fix-json-decode-request-value

fix mime types

Author: pxpm

src/BackpackElfinderController.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace Backpack\FileManager;
+
+use Illuminate\Support\Facades\Crypt;
+use Illuminate\Support\Facades\Log;
+
+class BackpackElfinderController extends \Barryvdh\Elfinder\ElfinderController
+{
+    public function showPopup($input_id)
+    {
+        $mimes = request('mimes');
+
+        try {
+            $mimes = Crypt::decrypt(urldecode(request('mimes')));
+        } catch (\Illuminate\Contracts\Encryption\DecryptException $e) {
+            Log::error('Someone attempted to tamper with mime types in elfinder popup. The attempt was blocked.');
+            abort(403, 'Unauthorized action.');
+        }
+
+        request()->merge(['mimes' => urlencode(serialize($mimes))]);
+
+        return $this->app['view']
+            ->make($this->package.'::standalonepopup')
+            ->with($this->getViewVars())
+            ->with(compact('input_id'));
+    }
+}

src/FileManagerServiceProvider.php

@@ -3,13 +3,14 @@
 namespace Backpack\FileManager;
 
 use Backpack\Basset\Facades\Basset;
+use Barryvdh\Elfinder\ElfinderController;
 use Illuminate\Support\Facades\Config;
 use Illuminate\Support\ServiceProvider;
 
 class FileManagerServiceProvider extends ServiceProvider
 {
     protected $commands = [
-        \Backpack\FileManager\Console\Commands\Install::class,
+        Console\Commands\Install::class,
     ];
 
     /**
@@ -25,6 +26,11 @@ public function boot()
         }
     }
 
+    public function register()
+    {
+        $this->app->bind(ElfinderController::class, BackpackElfinderController::class);
+    }
+
     /**
      * Console-specific booting.
      *