How to conciliate TinyMCE FileUpload and CakePHP - cakephp

Question

I am using TinyMCE for my views add() and edit() of my PagesController.
Following TinyMCE documentation, I am calling TinyMCE in my js file as below :
tinymce.init({
selector: '.tinymce',
menubar: false,
plugins: 'lists link image',
toolbar: 'insertfile undo redo | styleselect | bold italic underline | alignleft aligncenter alignright | bullist numlist | link image',
branding: false,
image_caption: true,
image_class_list: [
{title: 'img-responsive', value: 'img-responsive'},
],
image_title: true,
automatic_uploads: true,
mobile: {
menubar: false,
toolbar: [ 'undo', 'bold', 'italic', 'styleselect' ]
},
images_upload_handler: function (blobInfo, success, failure) {
var xhr, formData;
xhr = new XMLHttpRequest();
xhr.withCredentials = false;
xhr.open('POST', '/app/webroot/postAcceptor.php');
xhr.onload = function() {
var json;
if (xhr.status != 200) {
failure('HTTP Error: ' + xhr.status);
return;
}
json = JSON.parse(xhr.responseText);
if (!json || typeof json.location != 'string') {
failure('Invalid JSON: ' + xhr.responseText);
return;
}
success(json.location);
};
formData = new FormData();
formData.append('file', blobInfo.blob(), blobInfo.filename());
xhr.send(formData);
}
});
As you can see I am calling manually the file PostAcceptor.php.
This is working but I am conscious that this is not the optimal way to proceed.
Do I have to include the image_upload_handler directly in my views add() and edit() and create a new controller fileupload() instead of the postAcceptor.php file ?
I don't really know how to proceed properly. Also do you know if I can use getClientFilename() and moveTo() instead of postAcceptor content ?
postAcceptor.php
/***************************************************
* Only these origins are allowed to upload images *
***************************************************/
$accepted_origins = [
"http://localhost",
"http://192.168.1.1",
];
/*********************************************
* Change this line to set the upload folder *
*********************************************/
$imageFolder = "img/";
if (isset($_SERVER["HTTP_ORIGIN"])) {
// same-origin requests won't set an origin. If the origin is set, it must be valid.
if (in_array($_SERVER["HTTP_ORIGIN"], $accepted_origins)) {
header("Access-Control-Allow-Origin: " . $_SERVER["HTTP_ORIGIN"]);
} else {
header("HTTP/1.1 403 Origin Denied");
return;
}
}
// Don't attempt to process the upload on an OPTIONS request
if ($_SERVER["REQUEST_METHOD"] == "OPTIONS") {
header("Access-Control-Allow-Methods: POST, OPTIONS");
return;
}
reset($_FILES);
$temp = current($_FILES);
if (is_uploaded_file($temp["tmp_name"])) {
/*
If your script needs to receive cookies, set images_upload_credentials : true in
the configuration and enable the following two headers.
*/
// header('Access-Control-Allow-Credentials: true');
// header('P3P: CP="There is no P3P policy."');
// Sanitize input
if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $temp["name"])) {
header("HTTP/1.1 400 Invalid file name.");
return;
}
// Verify extension
if (
!in_array(strtolower(pathinfo($temp["name"], PATHINFO_EXTENSION)), [
"gif",
"jpg",
"png",
])
) {
header("HTTP/1.1 400 Invalid extension.");
return;
}
// Accept upload if there was no origin, or if it is an accepted origin
$filetowrite = $imageFolder . $temp["name"];
move_uploaded_file($temp["tmp_name"], $filetowrite);
// Determine the base URL
$protocol =
isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == "on"
? "https://"
: "http://";
$baseurl =
$protocol .
$_SERVER["HTTP_HOST"] .
rtrim(dirname($_SERVER["REQUEST_URI"]), "/") .
"/";
// Respond to the successful upload with JSON.
// Use a location key to specify the path to the saved image resource.
// { location : '/your/uploaded/image/file'}
echo json_encode(["location" => $baseurl . $filetowrite]);
} else {
// Notify editor that the upload failed
header("HTTP/1.1 500 Server Error");
}
Thank you !