WuYongJie
9595267ee7
Some checks failed
Tests / PHP 8.1 (push) Has been cancelled
Tests / PHP 8.2 (push) Has been cancelled
Tests / PHP 8.3 (push) Has been cancelled
48 lines
1.4 KiB
PHP
48 lines
1.4 KiB
PHP
<?php
|
|
|
|
namespace App\Jobs\Common;
|
|
|
|
use App\Abstracts\Job;
|
|
use App\Events\Common\ItemCreated;
|
|
use App\Events\Common\ItemCreating;
|
|
use App\Interfaces\Job\HasOwner;
|
|
use App\Interfaces\Job\HasSource;
|
|
use App\Interfaces\Job\ShouldCreate;
|
|
use App\Jobs\Common\CreateItemTaxes;
|
|
use App\Models\Common\Item;
|
|
|
|
class CreateItem extends Job implements HasOwner, HasSource, ShouldCreate
|
|
{
|
|
public function handle(): Item
|
|
{
|
|
// Security: strip HTML tags from name to prevent stored XSS in delete
|
|
// confirmation modal (CVE-2026-11942). The delete modal renders model
|
|
// name via v-html; e() in getMessage() provides output encoding, but
|
|
// this strips HTML at the source as defense-in-depth.
|
|
if ($this->request->has('name')) {
|
|
$this->request->merge([
|
|
'name' => strip_tags($this->request->get('name')),
|
|
]);
|
|
}
|
|
|
|
event(new ItemCreating($this->request));
|
|
|
|
\DB::transaction(function () {
|
|
$this->model = Item::create($this->request->all());
|
|
|
|
// Upload picture
|
|
if ($this->request->file('picture')) {
|
|
$media = $this->getMedia($this->request->file('picture'), 'items');
|
|
|
|
$this->model->attachMedia($media, 'picture');
|
|
}
|
|
|
|
$this->dispatch(new CreateItemTaxes($this->model, $this->request));
|
|
});
|
|
|
|
event(new ItemCreated($this->model, $this->request));
|
|
|
|
return $this->model;
|
|
}
|
|
}
|