Anons79 Mini Shell

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use Illuminate\Support\Facades\Storage;

class StorageController extends Controller
{
    public function images()
    {

        $path = request()->path;
        if(str_contains(strtolower($path),"..") || str_contains(strtolower($path),"./") || str_contains(strtolower($path),"//") || str_contains(strtolower($path),'\\')){
            return abort(404);
        }

        if($path == "" || str_contains($path,"..")){
           return abort(404);
        }
        $cek = Storage::exists($path);
        if (!$cek) {
            return abort(404);
        }

        $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp'];

        // Get file extension
        $extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));

        // Check if extension is allowed
        if (!in_array($extension, $allowedExtensions)) {
            return abort(404);
        }


       
        return Storage::response($path);
    }

    public function file()
    {

        $path = request()->path;
        if($path == "" || str_contains($path,"..")){
            return abort(404);
        }
        $cek = Storage::exists($path);
        if (!$cek) {
           return abort(404);
        }

        $allowedExtensions = ['jpg', 'jpeg', 'png', 'gif', 'webp', 'bmp','zip','pdf','doc','docx','ppt','pptx','xls','xlsx'];

        // Get file extension
        $extension = strtolower(pathinfo($path, PATHINFO_EXTENSION));

        // Check if extension is allowed
        if (!in_array($extension, $allowedExtensions)) {
            return abort(404);
        }


       
        return Storage::download($path);
    }
}