From 1b559f91a27c8069da315f449dd92004a5e564c1 Mon Sep 17 00:00:00 2001
From: Dillon <dillonngoweijoon@gmail.com>
Date: Sun, 8 Oct 2023 03:50:19 +0800
Subject: [PATCH] Security Patch - Exporting feedback data to excel file

---
 .../Standards/Rules/CanExportFeedback.php     | 14 +++--
 .../general/elements/AnchorLinkComponent.vue  | 51 +++++++++++++++++++
 resources/views/pages/feedback.blade.php      |  4 +-
 routes/web.php                                |  2 +-
 4 files changed, 63 insertions(+), 8 deletions(-)
 create mode 100644 resources/assets/vue/components/general/elements/AnchorLinkComponent.vue

diff --git a/app/Classes/Modules/Exports/Standards/Rules/CanExportFeedback.php b/app/Classes/Modules/Exports/Standards/Rules/CanExportFeedback.php
index 5d8b2ec0..349a37b6 100644
--- a/app/Classes/Modules/Exports/Standards/Rules/CanExportFeedback.php
+++ b/app/Classes/Modules/Exports/Standards/Rules/CanExportFeedback.php
@@ -14,12 +14,16 @@ class CanExportFeedback extends AbstractRule
      */
     protected function authorized(): bool
     {
-        $roleToCheck = Auth()->user()->type;
-        if (in_array($roleToCheck, RoleTypes::ADMIN_ROLES)) {
-            return true;
-        } else {
-            return false;
+        if(Auth()->user()){
+            $roleToCheck = Auth()->user()->type;
+            if (in_array($roleToCheck, RoleTypes::ADMIN_ROLES)) {
+                return true;
+            }
+            else {
+                return false;
+            }
         }
+        return false;
     }
 
     /**
diff --git a/resources/assets/vue/components/general/elements/AnchorLinkComponent.vue b/resources/assets/vue/components/general/elements/AnchorLinkComponent.vue
new file mode 100644
index 00000000..53365dcd
--- /dev/null
+++ b/resources/assets/vue/components/general/elements/AnchorLinkComponent.vue
@@ -0,0 +1,51 @@
+<template>
+    <a :href="href" @click="downloadFile" target="_blank">
+        <slot></slot>
+    </a>
+  </template>
+<script>
+    export default {
+        props: {
+            href: {
+                type: String,
+                required: true,
+            },
+        },
+        methods: {
+            downloadFile(event) {
+                event.preventDefault();
+
+                fetch(this.href, {
+                    method: 'GET',
+                    headers: {
+                        'Authorization': 'Bearer ' + this.$store.getters.getAccessToken,
+                    },
+                })
+                .then((response) => {
+                    if (response.status === 200) {
+                        const contentDisposition = response.headers.get('Content-Disposition');
+                        const filename = contentDisposition ? contentDisposition.split('filename=')[1] : 'downloaded_file';
+
+                        return response.blob()
+                        .then((blob) => {
+                            const blobUrl = window.URL.createObjectURL(blob);
+                            const a = document.createElement('a');
+                            a.href = blobUrl;
+                            a.download = filename;
+                            a.style.display = 'none';
+                            document.body.appendChild(a);
+                            a.click();
+                            document.body.removeChild(a);
+                            window.URL.revokeObjectURL(blobUrl);
+                        });
+                    } else {
+                        console.error('Request failed with status:', response.status);
+                    }
+                })
+                .catch((error) => {
+                    console.error('Network error:', error);
+                });
+            }
+        }
+    }
+</script>
diff --git a/resources/views/pages/feedback.blade.php b/resources/views/pages/feedback.blade.php
index d4754d65..06a3ca21 100644
--- a/resources/views/pages/feedback.blade.php
+++ b/resources/views/pages/feedback.blade.php
@@ -14,7 +14,7 @@
                         <div class="col">
                             <div class="row">
                                 <div class="col">
-                                    <a href="{{route('feedback.export')}}" target="_blank">
+                                    <anchor-link-component href="{{route('feedback.export')}}">
                                         <button type="button" class="btn btn-sm p-t-10 p-b-10 p-r-35 p-l-35 btn-primary b-rad-none">
                                             <div class="row align-items-center">
                                                 <div class="col-auto p-r-0 p-l-0">
@@ -23,7 +23,7 @@
                                                 <div class="col p-r-5">Export To Excel</div>
                                             </div>
                                         </button>
-                                    </a>
+                                    </anchor-link-component>
                                     <div class="row align-items-center m-t-10 p-t-10 p-b-10 b-t b-grey muted all-caps fs-10">
                                         <div class="col-1">Question Set</div>
                                         <div class="col-2">Question Text</div>
diff --git a/routes/web.php b/routes/web.php
index 5ef2081c..b92e0d62 100644
--- a/routes/web.php
+++ b/routes/web.php
@@ -1198,7 +1198,7 @@ Route::get('/feedback', function () {
     return view('pages.feedback');
 })->name('admin.feedback');
 
-Route::get('/export/feedback', 'Exports\ExportFeedbackDataController@export')->name('feedback.export');
+Route::get('/export/feedback', 'Exports\ExportFeedbackDataController@export')->middleware(['api'])->middleware(['valid.token'])->name('feedback.export');
 
 Route::get('/404', function () {
     abort(404);