Task #205 feat : File download functionality from backend

techjoomla · Nov 28, 2019 · f634525 · f634525
1 parent 3ee31f1
commit f634525
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 1 deletion.
diff --git a/administrator/controller.php b/administrator/controller.php
@@ -70,6 +70,7 @@ public function display($cachable = false, $urlparams = false)
 	 */
 	public function getMediaFile()
 	{
+		(JSession::checkToken() or JSession::checkToken('get')) or jexit(JText::_('JINVALID_TOKEN'));
 		JLoader::import("/techjoomla/media/storage/local", JPATH_LIBRARIES);
 		$app = Factory::getApplication();
 		$jinput = $app->input;

diff --git a/site/controller.php b/site/controller.php
@@ -53,6 +53,7 @@ public function __construct()
 	 */
 	public function getMediaFile()
 	{
+		(JSession::checkToken() or JSession::checkToken('get')) or jexit(JText::_('JINVALID_TOKEN'));
 		JLoader::import("/techjoomla/media/storage/local", JPATH_LIBRARIES);
 		$app = Factory::getApplication();
 		$jinput = $app->input;

diff --git a/site/helpers/tjfields.php b/site/helpers/tjfields.php
@@ -1927,7 +1927,10 @@ public function getMediaUrl($fileName, $extraUrlParamsArray = '')
 			// Here, fpht means file encoded path
 			$encodedFileName = base64_encode($fileName);
 			$basePathLink = 'index.php?option=com_tjfields&task=getMediaFile&fpht=';
-			$mediaURLlink = Uri::base() . substr(Route::_($basePathLink . $encodedFileName . $extraUrlParams), strlen(Uri::base(true)) + 1);
+			$mediaURL = Uri::base() . substr(Route::_($basePathLink . $encodedFileName . $extraUrlParams), strlen(Uri::base(true)) + 1);
+
+			$csrf = JSession::getFormToken() . '=1';
+			$mediaURLlink = $mediaURL . '&' . $csrf;
 
 			return $mediaURLlink;
 		}