İlk temizlik tamamlandı bir önceki projeden

app/Http/Middleware/AdvancedAuth.php

@@ -0,0 +1,77 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+use Illuminate\Support\Facades\Auth;
+
+class AdvancedAuth
+{
+    /**
+     * Handle an incoming request.
+     * Bu middleware route parametrelerinden "table" ve "action" bilgisini okur
+     * ve isAuth() helper'ını kullanarak yetki kontrolü yapar.
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        // Kullanıcı giriş yapmış mı?
+        if (!auth()->check() && !$request->user()) {
+            return response()->json(['message' => 'Unauthenticated.'], 401);
+        }
+
+        // Route parametrelerini al
+        // Route tanımı: /{table}/{action}
+        $table = $request->route('table') ?? $request->input('table');
+        $action = $request->route('action') ?? $request->input('action');
+
+        // table-column-values endpoint'i için action varsayılan olarak 'read' yap.
+        if (!$action && $request->is('api/table-column-values')) {
+            $action = 'read';
+        }
+
+        // CRUD action'larını permission type'larına eşle
+        $permissionType = 'read'; // Varsayılan
+
+        switch ($action) {
+            case 'create':
+            case 'store':
+            case 'insert':
+                $permissionType = 'write'; // veya 'create'
+                break;
+            case 'update':
+            case 'edit':
+            case 'save':
+                $permissionType = 'write'; // Genelde write güncelleme ve eklemeyi kapsar
+                break;
+            case 'delete':
+            case 'remove':
+            case 'destroy':
+                $permissionType = 'full'; // Silme genelde en yüksek yetki ister
+                break;
+            case 'read':
+            case 'get':
+            case 'list':
+            case 'view':
+                $permissionType = 'read';
+                break;
+        }
+
+        // Admin her zaman geçer (isAuth içinde kontrol ediliyor ama burada erken çıkış yapabiliriz)
+        // isAuth($moduleType, $permissionType)
+        // Not: $table parametresi genellikle slug veya tablo adıdır. isAuth slug bekler.
+        
+        $moduleSlug = resolveModuleFromTable($table);
+        
+        if (!isAuth($moduleSlug, $permissionType)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => 'Unauthorized action.',
+                'required_permission' => "$moduleSlug:$permissionType"
+            ], 403);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/Authenticate.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Auth\Middleware\Authenticate as Middleware;
+
+class Authenticate extends Middleware
+{
+    /**
+     * Get the path the user should be redirected to when they are not authenticated.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @return string|null
+     */
+    protected function redirectTo($request)
+    {
+        if (! $request->expectsJson()) {
+            return route('login');
+        }
+    }
+}

app/Http/Middleware/CheckStaticHash.php

@@ -0,0 +1,41 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class CheckStaticHash
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure  $next
+     * @return mixed
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $hash = config('services.api.static_hash');
+        
+        // Eğer hash config'de tanımlı değilse güvenli başarısızlık (fail-safe)
+        if (empty($hash)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => 'Server configuration error: API Static Hash is not configured.'
+            ], 500);
+        }
+
+        $requestHash = $request->header('X-Api-Hash');
+
+        if ($requestHash !== $hash) {
+            return response()->json([
+                'status' => 'error',
+                'message' => 'Unauthorized access. Invalid or missing X-Api-Hash header.'
+            ], 401);
+        }
+
+        return $next($request);
+    }
+}
+

app/Http/Middleware/ElFinderProtectMainFolder.php

@@ -0,0 +1,42 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class ElFinderProtectMainFolder
+{
+    public function handle(Request $request, Closure $next)
+    {
+        $cmd = $request->input('cmd');
+        $target = $request->input('target');
+        
+        // Mevcut tüm ilk seviye klasörleri al
+        $documentsPath = storage_path('documents');
+        $firstLevelDirs = array_map(
+            fn($path) => basename($path),
+            glob($documentsPath . '/*', GLOB_ONLYDIR)
+        );
+        
+        $firstLevelDirs[] = "/";
+        
+        // Hedef klasörün gerçek yolunu al
+        if ($target && strpos($target, 'l1_') === 0) {
+            $decodedTarget = base64_decode(substr($target, 3));
+            
+            if (in_array($decodedTarget, $firstLevelDirs)) {
+
+                $restrictedCommands = ['rm', 'rename', 'move'];
+                
+                if (in_array($cmd, $restrictedCommands)) {
+                    return response()->json([
+                        'error' => 'You cannot perform this operation on directories in the main folder!'
+                    ]);
+                }
+            }
+        }
+
+        return $next($request);
+    }
+} 

app/Http/Middleware/EncryptCookies.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Cookie\Middleware\EncryptCookies as Middleware;
+
+class EncryptCookies extends Middleware
+{
+    /**
+     * The names of the cookies that should not be encrypted.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/IpFirewall.php

@@ -0,0 +1,37 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class IpFirewall
+{
+    /**
+     * Handle an incoming request.
+     */
+    public function handle(Request $request, Closure $next): Response
+    {
+        // İzin verilen IP listesi (Env veya Config'den alınabilir)
+        // Boş bırakılırsa herkese açık olur.
+        $allowedIpsString = config('app.allowed_api_ips', ''); 
+        
+        if (empty($allowedIpsString)) {
+            return $next($request);
+        }
+
+        $allowedIps = explode(',', $allowedIpsString);
+        $clientIp = $request->ip();
+
+        if (!in_array($clientIp, $allowedIps)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => 'Access denied. IP not allowed.',
+                'ip' => $clientIp
+            ], 403);
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/LogFeedbackMiddleware.php

@@ -0,0 +1,61 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Throwable;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Log;
+use App\Models\FeedbackReport;
+
+class LogFeedbackMiddleware
+{
+    public function handle($request, Closure $next)
+    {
+        try {
+            // İstek devam ediyor
+            $response = $next($request);
+            return $response;
+        } catch (Throwable $exception) {
+            try {
+                $status = method_exists($exception, 'getStatusCode') ? $exception->getStatusCode() : 500;
+
+                if ($status >= 500 && $status < 600) {
+                    $user = Auth::user();
+                    $userName = $user ? $user->name : 'Unknown';
+
+                    $errorMessage = $exception->getMessage() ?: 'System Error';
+                    $errorFile = $exception->getFile() ?? 'unknown';
+                    $errorLine = $exception->getLine() ?? 0;
+                    $url = $request->fullUrl();
+                    $timestamp = now()->format('Y-m-d H:i:s');
+
+                    if ($user) {
+                        FeedbackReport::create([
+                            'user_id' => $user->id,
+                            'username' => $userName,
+                            'title' => "System Error: " . $errorMessage,
+                            'description' => "URL: {$url}\nFile: {$errorFile}\nLine: {$errorLine}\nMessage: {$errorMessage}",
+                            'status' => 'submitted',
+                        ]);
+                    }
+
+                }
+
+                if ($request->expectsJson()) {
+                    return response()->json([
+                        'status' => 'error',
+                        'message' => 'An unexpected system error occurred and has been reported.'
+                    ], 500);
+                }
+
+                return response()->view('errors.500', [], 500);
+
+            } catch (Throwable $logError) {
+                Log::error('Error while saving FeedbackReport: ' . $logError->getMessage());
+            }
+
+            throw $exception; 
+        }
+    }
+}

app/Http/Middleware/PermissionControl.php

@@ -0,0 +1,130 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Closure;
+use Illuminate\Http\Request;
+
+class PermissionControl
+{
+    public function pathToTypeInfo($path) {
+
+        $typePrefix = "/admin/types/";
+
+        if(strpos($path, $typePrefix) !== false) {
+            $type = str_replace($typePrefix, "", $path);
+            $typeInfo = db("types")->where("slug", $type)->first();
+        } else {
+            $typeInfo = null;
+        }
+
+        return $typeInfo;
+    }
+
+
+
+    public function permissionHave($typeInfo, $levelIndex) {
+       
+        $fullControl = explode(",", $typeInfo->full_control);
+        $write = explode(",", $typeInfo->write);
+        $read = explode(",", $typeInfo->read);
+        $modify = explode(",", $typeInfo->modify);
+
+        $permissions = [];
+        
+
+        if(in_array($levelIndex, $fullControl)) {
+            $permissions[] = "full_control";
+        }
+        if(in_array($levelIndex, $write)) {
+            $permissions[] = "write";
+        }
+        if(in_array($levelIndex, $read)) {
+            $permissions[] = "read";
+        }
+        if(in_array($levelIndex, $modify)) {
+            $permissions[] = "modify";
+        }
+
+        return $permissions;
+    }
+    
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next)
+    {
+        $exceptPaths = [
+            '/admin/login',
+            '/login',
+            '/logout',
+            '/',
+            '/cron',
+            '/cron-documents',
+            '/cron-report-builder-queue',
+            '/clear-cache',
+            '/mail-link',
+
+        ];
+        $thisPath = $request->getPathInfo();
+        
+        $onlyAdminPath = [
+            '/admin/users',
+            '/admin/new/artisan',
+            '/admin/new/types',
+        ];
+        
+        if(in_array($thisPath, $onlyAdminPath)) {
+            if(!isAdmin()) {
+                echo "Only admin can access this area.";
+                exit();
+            }
+        }
+        
+        
+        if(!in_array($thisPath, $exceptPaths)) {
+
+            $thisTypeInfo = $this->pathToTypeInfo($thisPath);
+
+            $userInfo = u();
+            $levels = levels();
+
+            $fullControl = 0;
+            $write = 1;
+            $read = 2;
+            $modify = 3;
+
+            //$thisLevel = $levels[$userInfo->level];
+            try {
+                if(is_null($userInfo->level)) {
+                    echo "Level is null. Please update this user level";
+                    exit();
+                } else {
+                    $thisLevelIndex = getLevelIndex($userInfo->level);
+                    if(!is_null($thisTypeInfo)) {
+                        $permissionHave = $this->permissionHave($thisTypeInfo, $thisLevelIndex);
+                        if(in_array("read", $permissionHave) || in_array("full_control", $permissionHave) || in_array("write", $permissionHave)) {
+                            return $next($request);
+                        } else {
+                            echo "You are not authorized to view this area.";
+                            exit();
+                        }
+                    }
+                }
+            } catch (\Throwable $th) {
+                echo "Level is null. Please update this user level";
+                exit();
+            }
+            
+            
+            //dd($thisLevel);
+           // dd($request);
+        }
+        
+        return $next($request);
+    }
+}

app/Http/Middleware/PreventRequestsDuringMaintenance.php

@@ -0,0 +1,17 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\PreventRequestsDuringMaintenance as Middleware;
+
+class PreventRequestsDuringMaintenance extends Middleware
+{
+    /**
+     * The URIs that should be reachable while maintenance mode is enabled.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+    ];
+}

app/Http/Middleware/RedirectIfAuthenticated.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use App\Providers\RouteServiceProvider;
+use Closure;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+
+class RedirectIfAuthenticated
+{
+    /**
+     * Handle an incoming request.
+     *
+     * @param  \Illuminate\Http\Request  $request
+     * @param  \Closure(\Illuminate\Http\Request): (\Illuminate\Http\Response|\Illuminate\Http\RedirectResponse)  $next
+     * @param  string|null  ...$guards
+     * @return \Illuminate\Http\Response|\Illuminate\Http\RedirectResponse
+     */
+    public function handle(Request $request, Closure $next, ...$guards)
+    {
+        $guards = empty($guards) ? [null] : $guards;
+
+        foreach ($guards as $guard) {
+            if (Auth::guard($guard)->check()) {
+                return redirect(RouteServiceProvider::HOME);
+            }
+        }
+
+        return $next($request);
+    }
+}

app/Http/Middleware/TrimStrings.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\TrimStrings as Middleware;
+
+class TrimStrings extends Middleware
+{
+    /**
+     * The names of the attributes that should not be trimmed.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        'current_password',
+        'password',
+        'password_confirmation',
+    ];
+}

app/Http/Middleware/TrustHosts.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustHosts as Middleware;
+
+class TrustHosts extends Middleware
+{
+    /**
+     * Get the host patterns that should be trusted.
+     *
+     * @return array<int, string|null>
+     */
+    public function hosts()
+    {
+        return [
+            $this->allSubdomainsOfApplicationUrl(),
+        ];
+    }
+}

app/Http/Middleware/TrustProxies.php

@@ -0,0 +1,28 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Http\Middleware\TrustProxies as Middleware;
+use Illuminate\Http\Request;
+
+class TrustProxies extends Middleware
+{
+    /**
+     * The trusted proxies for this application.
+     *
+     * @var array<int, string>|string|null
+     */
+    protected $proxies;
+
+    /**
+     * The headers that should be used to detect proxies.
+     *
+     * @var int
+     */
+    protected $headers =
+        Request::HEADER_X_FORWARDED_FOR |
+        Request::HEADER_X_FORWARDED_HOST |
+        Request::HEADER_X_FORWARDED_PORT |
+        Request::HEADER_X_FORWARDED_PROTO |
+        Request::HEADER_X_FORWARDED_AWS_ELB;
+}

app/Http/Middleware/VerifyCsrfToken.php

@@ -0,0 +1,19 @@
+<?php
+
+namespace App\Http\Middleware;
+
+use Illuminate\Foundation\Http\Middleware\VerifyCsrfToken as Middleware;
+
+class VerifyCsrfToken extends Middleware
+{
+    /**
+     * The URIs that should be excluded from CSRF verification.
+     *
+     * @var array<int, string>
+     */
+    protected $except = [
+        //
+        'tester',
+        '/admin-ajax/report-builder-pdf-generator',
+    ];
+}