Next

README.md

@@ -1,6 +1,6 @@
 # CakePHP Glide
 
-[![Build Status](https://img.shields.io/github/actions/workflow/status/ADmad/cakephp-glide/ci.yml?style=flat-square&branch=master)](https://github.com/ADmad/cakephp-glide/actions?query=workflow%3ACI+branch%3Amaster)
+[![Build Status](https://img.shields.io/github/actions/workflow/status/ADmad/cakephp-glide/ci.yml?branch=master&style=flat-square)](https://github.com/ADmad/cakephp-glide/actions/workflows/ci.yml?query=branch%3Amaster)
 [![Coverage Status](https://img.shields.io/codecov/c/github/ADmad/cakephp-glide.svg?style=flat-square)](https://codecov.io/github/ADmad/cakephp-glide)
 [![Total Downloads](https://img.shields.io/packagist/dt/ADmad/cakephp-glide.svg?style=flat-square)](https://packagist.org/packages/ADmad/cakephp-glide)
 [![License](https://img.shields.io/badge/license-MIT-blue.svg?style=flat-square)](LICENSE.txt)
@@ -82,7 +82,15 @@ $routes->scope('/images', function ($routes) {
         // Allowed query string params. If for e.g. you are only using glide presets
         // then you can set allowed params as `['p']` to prevent users from using
         // any other image manipulation params.
-        'allowedParams' => null
+        'allowedParams' => null,
+
+        // If the image URL is requested without any transformation params then
+        // directly return the original image. Default `false`.
+        'originalPassThrough' => false,
+
+        // Allowed content types in response when "originalPassThrough" is `true`.
+        // By default only the image type supported by Glide are allowed.
+        'passThroughAllowedContentTypes' => [],
     ]));
 
     $routes->applyMiddleware('glide');

composer.json

@@ -30,10 +30,10 @@
     "require": {
         "php": ">=8.1",
         "cakephp/cakephp": "^5.0",
-        "league/glide": "^3.0"
+        "league/glide": "^3.0 || ^4.0"
     },
     "require-dev": {
-        "phpunit/phpunit": "^10.1"
+        "phpunit/phpunit": "^10.1 || ^11.5.3 || ^12.1.3 || ^13.0"
     },
     "autoload": {
         "psr-4": {

phpcs.xml

@@ -0,0 +1,8 @@
+<?xml version="1.0"?>
+<ruleset name="Glide">
+    <file>src/</file>
+    <file>tests/</file>
+
+    <rule ref="CakePHP"/>
+    <arg value="ps"/>
+</ruleset>

psalm.xml

@@ -17,5 +17,6 @@
 
     <issueHandlers>
         <ClassMustBeFinal errorLevel="suppress"/>
+        <PropertyNotSetInConstructor errorLevel="suppress"/>
     </issueHandlers>
 </psalm>

src/Middleware/GlideMiddleware.php

@@ -15,6 +15,7 @@
 use Cake\Utility\Security;
 use Exception;
 use Laminas\Diactoros\Stream;
+use League\Glide\Api\Encoder;
 use League\Glide\Server;
 use League\Glide\ServerFactory;
 use League\Glide\Signatures\SignatureFactory;
@@ -23,14 +24,8 @@
 use Psr\Http\Server\MiddlewareInterface;
 use Psr\Http\Server\RequestHandlerInterface;
 
-/**
- * @implements \Cake\Event\EventDispatcherInterface<\ADmad\Glide\Middleware\GlideMiddleware>
- */
 class GlideMiddleware implements MiddlewareInterface, EventDispatcherInterface
 {
-    /**
-     * @use \Cake\Event\EventDispatcherTrait<\ADmad\Glide\Middleware\GlideMiddleware>
-     */
     use EventDispatcherTrait;
 
     use InstanceConfigTrait;
@@ -56,6 +51,7 @@ class GlideMiddleware implements MiddlewareInterface, EventDispatcherInterface
         'headers' => null,
         'allowedParams' => null,
         'originalPassThrough' => false,
+        'passThroughAllowedContentTypes' => [],
     ];
 
     /**
@@ -263,6 +259,15 @@ protected function _passThrough(ServerRequestInterface $request, Server $server)
         $stream = new Stream($resource);
 
         $contentType = $source->mimeType($path);
+        $allowedContentTypes = $this->getConfig('passThroughAllowedContentTypes', []);
+        if ($allowedContentTypes === []) {
+            $allowedContentTypes = Encoder::supportedFormats();
+        }
+
+        if (!in_array($contentType, $allowedContentTypes, true)) {
+            throw new ResponseException('Content type not supported.');
+        }
+
         $contentLength = $source->fileSize($path);
 
         /** @psalm-suppress PossiblyFalseArgument */
@@ -307,9 +312,9 @@ protected function _withCacheHeaders(
 
         return $response
             ->withHeader('Cache-Control', 'public,max-age=' . $maxAge)
-            ->withHeader('Date', gmdate(DATE_RFC7231, time()))
-            ->withHeader('Last-Modified', gmdate(DATE_RFC7231, (int)$modifiedTime))
-            ->withHeader('Expires', gmdate(DATE_RFC7231, $expire));
+            ->withHeader('Date', gmdate('D, d M Y H:i:s \G\M\T', time()))
+            ->withHeader('Last-Modified', gmdate('D, d M Y H:i:s \G\M\T', (int)$modifiedTime))
+            ->withHeader('Expires', gmdate('D, d M Y H:i:s \G\M\T', $expire));
     }
 
     /**

src/View/Helper/GlideHelper.php

@@ -12,13 +12,14 @@
  * GlideHelper
  *
  * @property \Cake\View\Helper\HtmlHelper $Html
+ * @extends \Cake\View\Helper<\Cake\View\View>
  */
 class GlideHelper extends Helper
 {
     /**
      * Helpers used by this helper.
      *
-     * @var array
+     * @var array<int|string, string|array<string, mixed>>
      */
     protected array $helpers = ['Html'];
 

tests/TestCase/Middleware/GlideMiddlewareTest.php

@@ -123,6 +123,37 @@ public function testOriginalPassThrough()
         $this->assertSame($fileSize, (int)$headers['Content-Length'][0]);
     }
 
+    /**
+     * Test that original pass through fails for unsupported (non-image) content types.
+     *
+     * @return void
+     */
+    public function testOriginalPassThroughFail()
+    {
+        $this->expectException(ResponseException::class);
+
+        $request = ServerRequestFactory::fromGlobals([
+            'REQUEST_URI' => '/images/nope.txt',
+        ]);
+
+        (new GlideMiddleware($this->config + ['originalPassThrough' => true]))
+            ->process($request, $this->handler);
+    }
+
+    public function testOriginalPassThroughCustomType()
+    {
+        $request = ServerRequestFactory::fromGlobals([
+            'REQUEST_URI' => '/images/nope.txt',
+        ]);
+
+        $config = [
+            'originalPassThrough' => true,
+            'passThroughAllowedContentTypes' => ['text/plain'],
+        ] + $this->config;
+        $response = (new GlideMiddleware($config))->process($request, $this->handler);
+        $this->assertSame('text/plain', $response->getHeaderLine('Content-Type'));
+    }
+
     public function testPathConfig()
     {
         $middleware = new GlideMiddleware(['path' => '/img'] + $this->config);

tests/test_app/webroot/upload/nope.txt

@@ -0,0 +1 @@
+nope