有条件地在Xataface中的PHPWord文档中插入图像

Question

My xataface website has an action that uses PHPWord to create a letter. I'm trying to sign the letter with an image of a signature, but I don't want to just keep the image file on the server. I want it to be created from PHP so I can do some permission checks and only display the signature to "people or pages who are allowed to see it".

My first idea was to create a PHP file that has the image inline as data, and in theory can display the signature if the request comes through xataface, or a blank image of the same size if it does not, but this PHP file isn't in the Xataface context so it can't tell who is logged in :-( It does work - the image is correctly in the document, just that I can't control who can see it.

Next I tried wrapping the functionality of the above PHP into an action handler, and then using $section->addMemoryImage("http://localhost/site/index.php?-action=sigfile"); in my script that generates PHPWord doc, but that gets an "unsupported image type" in the PHP log (without getting into the handler).

I've also tried putting just the "working image code" into templates/sigfile.html, but that gets an "unsupported image type" too (If I go straight to the PHP file it works. If I wrap it in any xataface stuff it doesn't)

About the only thing I've got working is using some "hidden key" e.g. PHPWord doc does $section->addMemoryImage("http://localhost/site/sig.php?a=1&b=2&c=3"); and the script is just looking for b=2 - the rest is just noise, but that is hardly secure...

The other idea would be have the php write the image to disk (server side), use it and then delete. Not sure how secure that is.

Am I missing some simple way of doing this?

Answer 1

If I were you I would write the image to temporary storage just before you call addMemoryImage(). Then just reference the local path. Then delete the image when it is safe to do so... depending on how PHPWord works, that might be immediately after the addMemoryImage() call, or it might be after some later render step.

Your goal of using an http:// url would work if you pass the session ID as part of the URL. see here for details on that

That way it will use the same session. HOWEVER, you need to beware of deadlocks if you do this because PHP sessions are locking... only one request can be accessing a given session at a time. So you would need to first close the session in the first action before making the background request.

Much easier to just write the image to temp storage, and delete when done.