MAGETWO-92165: Redundancy in Custom Option Filenames

Author: Oleksandr Gorkun

app/code/Magento/Catalog/Model/Product/Option/Type/File/ExistingValidate.php

@@ -0,0 +1,50 @@
+<?php
+/**
+ * Copyright © Magento, Inc. All rights reserved.
+ * See COPYING.txt for license details.
+ */
+
+namespace Magento\Catalog\Model\Product\Option\Type\File;
+
+/**
+ * Validator for existing (already saved) files.
+ */
+class ExistingValidate extends \Zend_Validate
+{
+    /**
+     * @inheritDoc
+     *
+     * @param string $value File's full path.
+     * @param string|null $originalName Original file's name (when uploaded).
+     *
+     * @throws \InvalidArgumentException
+     */
+    public function isValid($value, string $originalName = null)
+    {
+        if (!is_string($value)) {
+            throw new \InvalidArgumentException('File\'s full path is expected');
+        }
+
+        $this->_messages = [];
+        $this->_errors = [];
+        $result = true;
+        $fileInfo = null;
+        if ($originalName) {
+            $fileInfo = ['name' => $originalName];
+        }
+        foreach ($this->_validators as $element) {
+            $validator = $element['instance'];
+            if ($validator->isValid($value, $fileInfo)) {
+                continue;
+            }
+            $result = false;
+            $messages = $validator->getMessages();
+            $this->_messages = array_merge($this->_messages, $messages);
+            $this->_errors = array_merge($this->_errors,   array_keys($messages));
+            if ($element['breakChainOnFailure']) {
+                break;
+            }
+        }
+        return $result;
+    }
+}

app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidateFactory.php

@@ -13,6 +13,6 @@ class ValidateFactory
      */
     public function create()
     {
-        return new \Zend_Validate();
+        return new ExistingValidate();
     }
 }

app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorFile.php

@@ -10,6 +10,8 @@
 use Magento\Framework\App\Filesystem\DirectoryList;
 use Magento\Catalog\Model\Product\Exception as ProductException;
 use Magento\Framework\Exception\LocalizedException;
+use Magento\Framework\Math\Random;
+use Magento\Framework\App\ObjectManager;
 
 /**
  * @SuppressWarnings(PHPMD.CouplingBetweenObjects)
@@ -62,25 +64,34 @@ class ValidatorFile extends Validator
      */
     protected $isImageValidator;
 
+    /**
+     * @var Random
+     */
+    private $random;
+
     /**
      * @param \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig
      * @param \Magento\Framework\Filesystem $filesystem
      * @param \Magento\Framework\File\Size $fileSize
      * @param \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory
      * @param \Magento\Framework\Validator\File\IsImage $isImageValidator
+     * @param Random|null $random
      * @throws \Magento\Framework\Exception\FileSystemException
      */
     public function __construct(
         \Magento\Framework\App\Config\ScopeConfigInterface $scopeConfig,
         \Magento\Framework\Filesystem $filesystem,
         \Magento\Framework\File\Size $fileSize,
         \Magento\Framework\HTTP\Adapter\FileTransferFactory $httpFactory,
-        \Magento\Framework\Validator\File\IsImage $isImageValidator
+        \Magento\Framework\Validator\File\IsImage $isImageValidator,
+        Random $random = null
     ) {
         $this->mediaDirectory = $filesystem->getDirectoryWrite(DirectoryList::MEDIA);
         $this->filesystem = $filesystem;
         $this->httpFactory = $httpFactory;
         $this->isImageValidator = $isImageValidator;
+        $this->random = $random
+            ?? ObjectManager::getInstance()->get(Random::class);
         parent::__construct($scopeConfig, $filesystem, $fileSize);
     }
 
@@ -147,16 +158,15 @@ public function validate($processingParams, $option)
         $userValue = [];
 
         if ($upload->isUploaded($file) && $upload->isValid($file)) {
-            $extension = pathinfo(strtolower($fileInfo['name']), PATHINFO_EXTENSION);
-
             $fileName = \Magento\MediaStorage\Model\File\Uploader::getCorrectFileName($fileInfo['name']);
             $dispersion = \Magento\MediaStorage\Model\File\Uploader::getDispersionPath($fileName);
 
             $filePath = $dispersion;
 
             $tmpDirectory = $this->filesystem->getDirectoryRead(DirectoryList::SYS_TMP);
             $fileHash = md5($tmpDirectory->readFile($tmpDirectory->getRelativePath($fileInfo['tmp_name'])));
-            $filePath .= '/' . $fileHash . '.' . $extension;
+            $fileRandomName = $this->random->getRandomString(32);
+            $filePath .= '/' .$fileRandomName;
             $fileFullPath = $this->mediaDirectory->getAbsolutePath($this->quotePath . $filePath);
 
             $upload->addFilter(new \Zend_Filter_File_Rename(['target' => $fileFullPath, 'overwrite' => true]));

app/code/Magento/Catalog/Model/Product/Option/Type/File/ValidatorInfo.php

@@ -6,6 +6,9 @@
 
 namespace Magento\Catalog\Model\Product\Option\Type\File;
 
+/**
+ * Validator for existing files.
+ */
 class ValidatorInfo extends Validator
 {
     /**
@@ -90,7 +93,7 @@ public function validate($optionValue, $option)
         }
 
         $result = false;
-        if ($validatorChain->isValid($this->fileFullPath)) {
+        if ($validatorChain->isValid($this->fileFullPath, $optionValue['title'])) {
             $result = $this->rootDirectory->isReadable($this->fileRelativePath)
                 && isset($optionValue['secret_key'])
                 && $this->buildSecretKey($this->fileRelativePath) == $optionValue['secret_key'];

app/code/Magento/Sales/Model/Download.php

@@ -78,7 +78,8 @@ public function downloadFile($info)
         $this->_fileFactory->create(
             $info['title'],
             ['value' => $this->_rootDir->getRelativePath($relativePath), 'type' => 'filename'],
-            $this->rootDirBasePath
+            $this->rootDirBasePath,
+            $info['type']
         );
     }