mirror of
https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git
synced 2026-05-05 04:54:53 +00:00
9b81f6cd92
- Add 60 req/min throttle to the public API group and a stricter 10 req/min throttle to POST /highscores. - Replace mass-assigned $guarded=[] with explicit $fillable on User, Meetup, Course, Lecturer, and SelfHostedService. created_by stays out of the whitelist; the existing creating() hooks continue to populate it. - Require authenticated user on Api/MeetupController::index instead of trusting the user_id query parameter (IDOR). - Constrain the /img and /img-public route paths to a safe character set and reject any path containing ".." in ImageController. - Add rel="noopener noreferrer" to every target="_blank" link on the meetup and course landing pages.
93 lines
2.4 KiB
PHP
93 lines
2.4 KiB
PHP
<?php
|
|
|
|
namespace App\Models;
|
|
|
|
use Illuminate\Database\Eloquent\Factories\HasFactory;
|
|
use Illuminate\Database\Eloquent\Model;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsTo;
|
|
use Illuminate\Database\Eloquent\Relations\BelongsToMany;
|
|
use Illuminate\Database\Eloquent\Relations\HasMany;
|
|
use Spatie\Image\Enums\Fit;
|
|
use Spatie\MediaLibrary\HasMedia;
|
|
use Spatie\MediaLibrary\InteractsWithMedia;
|
|
use Spatie\MediaLibrary\MediaCollections\Models\Media;
|
|
use Spatie\Tags\HasTags;
|
|
|
|
class Course extends Model implements HasMedia
|
|
{
|
|
use HasFactory;
|
|
use HasTags;
|
|
use InteractsWithMedia;
|
|
|
|
/**
|
|
* @var array<int, string>
|
|
*/
|
|
protected $fillable = [
|
|
'name',
|
|
'lecturer_id',
|
|
'description',
|
|
];
|
|
|
|
/**
|
|
* The attributes that should be cast to native types.
|
|
*
|
|
* @var array
|
|
*/
|
|
protected $casts = [
|
|
'id' => 'integer',
|
|
'lecturer_id' => 'integer',
|
|
];
|
|
|
|
protected static function booted()
|
|
{
|
|
static::creating(function ($model) {
|
|
if (! $model->created_by) {
|
|
$model->created_by = auth()->id();
|
|
}
|
|
});
|
|
}
|
|
|
|
public function registerMediaConversions(?Media $media = null): void
|
|
{
|
|
$this
|
|
->addMediaConversion('preview')
|
|
->fit(Fit::Crop, 300, 300)
|
|
->nonQueued();
|
|
$this->addMediaConversion('thumb')
|
|
->fit(Fit::Crop, 130, 130)
|
|
->width(130)
|
|
->height(130);
|
|
}
|
|
|
|
public function registerMediaCollections(): void
|
|
{
|
|
$this->addMediaCollection('logo')
|
|
->acceptsMimeTypes(['image/jpeg', 'image/png', 'image/gif', 'image/webp'])
|
|
->singleFile()
|
|
->useFallbackUrl(asset('img/einundzwanzig.png'));
|
|
$this->addMediaCollection('images')
|
|
->acceptsMimeTypes(['image/jpeg', 'image/png', 'image/gif', 'image/webp'])
|
|
->useFallbackUrl(asset('img/einundzwanzig.png'));
|
|
}
|
|
|
|
public function createdBy(): BelongsTo
|
|
{
|
|
return $this->belongsTo(User::class, 'created_by');
|
|
}
|
|
|
|
public function categories(): BelongsToMany
|
|
{
|
|
return $this->belongsToMany(Category::class);
|
|
}
|
|
|
|
public function lecturer(): BelongsTo
|
|
{
|
|
return $this->belongsTo(Lecturer::class);
|
|
}
|
|
|
|
public function courseEvents(): HasMany
|
|
{
|
|
return $this->hasMany(CourseEvent::class);
|
|
}
|
|
}
|