A warehouse thumbnail resize fully rasterizes the SOURCE image (~4 bytes/pixel
in GD/ImageMagick, via healCorruptPng() and Spatie Image::load()) before it can
downscale. A very large source (e.g. a ~74-megapixel upload) blows the PHP
memory_limit during that decode. Memory exhaustion is an UNCATCHABLE fatal, so
it bypasses resizedPath()'s try/catch "serve original" fallback and 500s the
whole request instead (GlitchTip #5617: "Allowed memory size exhausted",
tried to allocate 295995336 bytes).
Add a decompression-bomb guard at the top of the try: read the source
dimensions cheaply with getimagesize() (header-only, no decode) and, when the
pixel count exceeds files.optimization.max_source_megapixels (default 40, 0
disables), log a warning and return the original path — the same graceful
fallback the catch performs, but reached BEFORE any allocation.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an opt-in FileAccessControl middleware that resolves the warehouse file
and enforces File::canBeAccessedBy() (default public, so existing consumers
are unaffected) when files.access_control.enabled is set. Resolution is
delegated to a configurable files.warehouse.resolver (ResolvesWarehouseFiles)
and the resolved file is stashed on the request so the controller reuses it.
Exposed as the `files.access` route-middleware alias and auto-attached to the
package warehouse route. Adds the FileAccessControl unit suite.
Fabian @ Blax Software