Josep Piguillem
a49816eb46
POST /api/v1/media stores an image where the panel keeps a page's and answers with the path to send as `featured_image`. Without it the MCP server could create a page but never give it a picture. The file goes through Media::for(), so it is processed, served and pruned like one uploaded in the panel. Two ways in, one per request: a multipart `file`, or JSON with a `url` the API downloads itself. JPEG, PNG, WebP, GIF or AVIF only, decided from the bytes; no SVG, which is a document that can carry script. The URL is fetched from inside the stack's network, so RemoteImage guards it: HTTPS only, every resolved address must be public, the connection is pinned to the checked address with CURLOPT_RESOLVE so a changing DNS answer cannot swap in a private one, redirects are not followed, and the body is read to a ceiling whatever its headers say. Uploading needs permission to write pages. MediaPolicy::create stays false, so the panel gains no free-standing "new file" button. In the MCP server a multipart binary field becomes `<field>_path` over stdio: the server reads the file from the caller's disk and sends it as multipart, instead of the model pushing base64 through its context. Over HTTP the server's disk is not the caller's, so only `body.url` is offered. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
106 lines
3.6 KiB
PHP
106 lines
3.6 KiB
PHP
<?php
|
|
|
|
declare(strict_types=1);
|
|
|
|
return [
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Where uploads live
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| It has to be a disk with public URLs: the frontend is a separate
|
|
| application on another host, so a path only this app can resolve is no
|
|
| use to it. `public` needs `php artisan storage:link` once.
|
|
|
|
|
*/
|
|
|
|
'disk' => env('MEDIA_DISK', 'public'),
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Derived versions
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Widths generated for each image, in pixels. An image is never scaled up:
|
|
| a 900px original produces the 400 and 800 versions and stops there, so a
|
|
| small upload cannot be blown up into a blurry "large" one.
|
|
|
|
|
*/
|
|
|
|
'widths' => [400, 800, 1200, 1600],
|
|
|
|
/*
|
|
| Formats to generate besides the original. AVIF is listed because it is
|
|
| worth having where it exists, but it is only produced when the running
|
|
| PHP can encode it — the generator checks rather than assumes.
|
|
*/
|
|
'formats' => ['avif', 'webp'],
|
|
|
|
'quality' => [
|
|
'webp' => 82,
|
|
'avif' => 55,
|
|
'jpeg' => 82,
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Placeholder
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| A tiny blurred version inlined as a data URI, so the frontend can paint
|
|
| something in the right colours while the real image loads. Kept small on
|
|
| purpose: it travels inside every JSON response that mentions the image.
|
|
|
|
|
*/
|
|
|
|
'placeholder' => [
|
|
'enabled' => true,
|
|
'width' => 20,
|
|
],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Limits
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| Pixel ceiling for processing. Above it the image is recorded with its
|
|
| dimensions but no derived versions: resizing a 100-megapixel file costs
|
|
| more memory than a small panel is worth, and it is nearly always a
|
|
| mistake rather than an intention.
|
|
|
|
|
*/
|
|
|
|
'max_pixels' => (int) env('MEDIA_MAX_PIXELS', 50_000_000),
|
|
|
|
// Formats that are copied through untouched. Resampling a vector loses the
|
|
// point of it.
|
|
'passthrough_mimes' => ['image/svg+xml', 'image/gif'],
|
|
|
|
/*
|
|
|--------------------------------------------------------------------------
|
|
| Uploads through the API
|
|
|--------------------------------------------------------------------------
|
|
|
|
|
| POST /api/v1/media, which the MCP server uses to put an image on a page.
|
|
|
|
|
| Raster formats only. The panel's own upload accepts SVG from the people
|
|
| who run it; this endpoint also fetches from arbitrary URLs, and an SVG is
|
|
| a document that can carry script, served from this application's domain.
|
|
|
|
|
| The size ceiling sits under php.ini's `upload_max_filesize` (24M) so the
|
|
| answer is a readable 422 rather than PHP silently dropping the file.
|
|
|
|
|
*/
|
|
|
|
'upload' => [
|
|
'mimes' => ['image/jpeg', 'image/png', 'image/webp', 'image/gif', 'image/avif'],
|
|
'max_kb' => (int) env('MEDIA_UPLOAD_MAX_KB', 20 * 1024),
|
|
'directory' => 'pages',
|
|
|
|
// Fetching from a URL: how long to wait, in seconds. The request that
|
|
// triggered it is waiting too.
|
|
'remote_timeout' => (int) env('MEDIA_REMOTE_TIMEOUT', 15),
|
|
],
|
|
];
|