From ba99b2a093c83ed5fa4ce4cc2c921754fb978573 Mon Sep 17 00:00:00 2001
From: F4ilji <F4ilj@yandex.ru>
Date: Sat, 4 Jul 2026 13:21:54 +0500
Subject: [PATCH] fix(vikon): switch validateFileTypes from blacklist to
 whitelist
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Based on actual file analysis of sveden/abitur/vsoko modules:
- html, css, js, map (content + assets)
- png, jpg, gif, svg, ico, bmp (images)
- ttf, woff, woff2, eot (fonts)
- pdf, doc, docx (documents)
- vikon (module-specific)

No PHP/ASP/executables in allowed list — any non-whitelisted file is blocked.
---
 .../VikonIntegration/Tasks/FilesystemTask.php   | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/app/Containers/VikonIntegration/Tasks/FilesystemTask.php b/app/Containers/VikonIntegration/Tasks/FilesystemTask.php
index 317f3d0..96d0a64 100644
--- a/app/Containers/VikonIntegration/Tasks/FilesystemTask.php
+++ b/app/Containers/VikonIntegration/Tasks/FilesystemTask.php
@@ -66,17 +66,22 @@ class FilesystemTask
 
     public function validateFileTypes(string $directory): array
     {
-        $blocked = [
-            'php', 'php3', 'php4', 'php5', 'php7', 'php8', 'phtml', 'phps',
-            'asp', 'aspx', 'jsp', 'jspx', 'cfm',
-            'pl', 'py', 'rb', 'cgi', 'sh', 'bash', 'bat', 'cmd', 'exe',
-            'ps1', 'htaccess', 'htpasswd',
+        $allowed = [
+            'html', 'htm',
+            'css', 'js', 'map',
+            'json', 'xml', 'txt',
+            'png', 'jpg', 'jpeg', 'gif', 'svg', 'svgz', 'webp', 'ico', 'bmp',
+            'ttf', 'woff', 'woff2', 'eot', 'otf',
+            'pdf', 'doc', 'docx', 'xls', 'xlsx',
+            'zip',
+            'vikon',
         ];
+
         $found = [];
 
         foreach (File::allFiles($directory) as $file) {
             $ext = strtolower($file->getExtension());
-            if (in_array($ext, $blocked, true)) {
+            if (!in_array($ext, $allowed, true)) {
                 $found[] = str_replace(base_path() . '/', '', $file->getPathname());
             }
         }