Fix download to authorize absolute paths

dvlpp · Oct 28, 2015 · d3b42cc · d3b42cc
1 parent 627a888
commit d3b42cc
Showing 1 changed file with 5 additions and 3 deletions.
diff --git a/src/Dvlpp/Sharp/Http/UploadController.php b/src/Dvlpp/Sharp/Http/UploadController.php
@@ -40,11 +40,13 @@ public function download($fileShortPath)
             $path = $fileShortPath;
         }
 
-        $fullpath = config("sharp.upload_storage_base_path") . "/" . $path;
+        if(!starts_with($path, "/")) {
+            $path = config("sharp.upload_storage_base_path") . "/" . $path;
+        }
 
         return (new Response(
-            Storage::disk($disk)->get($fullpath), 200
-        ))->header('Content-Type', Storage::disk($disk)->mimeType($fullpath))
+            Storage::disk($disk)->get($path), 200
+        ))->header('Content-Type', Storage::disk($disk)->mimeType($path))
             ->header("Content-Disposition", "attachment");
     }