Fix: upload themes

.gitignore

@@ -30,7 +30,7 @@ public/error_log
 /.vscode
 
 # Themes
-# /themes/*
+/themes/*
 !/themes/opendk/default/
 /storage/komplain
 

app/Http/Controllers/BackEnd/ThemesController.php

@@ -65,6 +65,13 @@ public function upload()
                 ]);
             }
 
+            if (!$file->isValid()) {
+                return response()->json([
+                    'status' => 'error',
+                    'message' => 'Upload file gagal: ' . $file->getErrorMessage(),
+                ]);
+            }
+
             $result = $this->themeService->installFromZip($file);
 
             return response()->json($result);

app/Http/Middleware/SecurityHeaders.php

@@ -52,7 +52,7 @@ public function handle($request, Closure $next)
             $localDomain = env('APP_URL', 'http://localhost');
             $urlDatabaseGabungan = config('setting.api_server_database_gabungan');
             $response->headers->set('X-Content-Type-Options', 'nosniff');            
-            $response->headers->set('Content-Security-Policy', "default-src 'self';script-src 'self' https://pantau.opensid.my.id/ https://cdnjs.cloudflare.com/ajax/libs/tinymce/ https://cdn.jsdelivr.net/npm/ platform.twitter.com unpkg.com 'unsafe-inline' 'unsafe-eval';style-src 'self' https://www.tiny.cloud/ http://www.tinymce.com/css/codepen.min.css https://cdnjs.cloudflare.com/ajax/libs/tinymce/ https://cdn.jsdelivr.net/npm/ fonts.googleapis.com unpkg.com 'unsafe-inline';img-src 'self' * data:;font-src 'self' https://cdnjs.cloudflare.com/ajax/libs/tinymce/ https://cdn.jsdelivr.net/npm/ fonts.gstatic.com data:;connect-src 'self' ".$urlDatabaseGabungan." https://pantau.opensid.my.id/ ;media-src 'self';frame-src 'self' platform.twitter.com github.com *.youtube.com *.vimeo.com *.opensid.my.id;object-src 'none';base-uri 'self';report-uri");
+            $response->headers->set('Content-Security-Policy', "default-src 'self';script-src 'self' https://pantau.opensid.my.id/ https://cdnjs.cloudflare.com/ajax/libs/tinymce/ https://cdn.jsdelivr.net/npm/ http://cdnjs.cloudflare.com/ajax/libs/numeral.js/2.0.6/numeral.min.js https://website-widgets.pages.dev/dist/sienna.min.js platform.twitter.com unpkg.com 'unsafe-inline' 'unsafe-eval';style-src 'self' https://www.tiny.cloud/ http://www.tinymce.com/css/codepen.min.css https://cdnjs.cloudflare.com/ajax/libs/tinymce/ https://cdn.jsdelivr.net/npm/ fonts.googleapis.com unpkg.com 'unsafe-inline';img-src 'self' * data:;font-src 'self' https://cdnjs.cloudflare.com/ajax/libs/tinymce/ https://cdn.jsdelivr.net/npm/ fonts.gstatic.com data:;connect-src 'self' ".$urlDatabaseGabungan." https://pantau.opensid.my.id/ ;media-src 'self';frame-src 'self' platform.twitter.com github.com *.youtube.com *.vimeo.com *.opensid.my.id;object-src 'none';base-uri 'self';report-uri");
         }
 
         return $response;

app/Models/Themes.php

@@ -46,7 +46,8 @@ class Themes extends Model
         'path',
         'vendor',
         'active',
-        'system'        
+        'system',
+        'screenshot'        
     ];
 
     // append slug attribute

app/Services/ThemeHooksValidator.php

@@ -43,6 +43,12 @@ public function scanZipForPhp(\ZipArchive $zip): void
 
         for ($i = 0; $i < $zip->numFiles; $i++) {
             $filename = $zip->getNameIndex($i);
+
+            // Skip Blade template files — they are safe Laravel templates
+            if (str_ends_with($filename, '.blade.php')) {
+                continue;
+            }
+
             $ext = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
 
             if (in_array($ext, self::DANGEROUS_EXTENSIONS, true)) {

app/Services/ThemeService.php

@@ -6,6 +6,7 @@
 use Illuminate\Http\UploadedFile;
 use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Storage;
 
 class ThemeService
 {
@@ -67,7 +68,7 @@ public function installFromZip(UploadedFile $file): array
         $path = $this->fileUploadService->uploadSecure($file, 'framework/themes', $allowedMimes, 51200);
 
         $fileName = basename($path);
-        $filePath = storage_path('framework/themes');
+        $filePath = Storage::disk('public')->path('framework/themes');
 
         $zip = new \ZipArchive;
         $zipOpened = false;
@@ -84,40 +85,48 @@ public function installFromZip(UploadedFile $file): array
                 $zip->close();
                 $zipOpened = false;
 
-                $folderTheme = explode('.', $fileName)[0];
-                $composerPath = "$extractedPath/$folderTheme/composer.json";
+                $composerPath = $this->findComposerJson($extractedPath);
 
-                if (file_exists($composerPath)) {
-                    $composerData = json_decode(file_get_contents($composerPath), true);
+                if ($composerPath === null) {
+                    File::deleteDirectory($extractedPath);
+                    File::deleteDirectory($filePath);
 
-                    $this->validateThemeStructure($extractedPath, $folderTheme);
+                    return [
+                        'status' => 'error',
+                        'message' => 'Tema gagal diunggah: file composer.json tidak ditemukan dalam arsip',
+                    ];
+                }
+
+                $folderTheme = substr(dirname($composerPath), strlen($extractedPath) + 1);
+                $composerData = json_decode(file_get_contents($composerPath), true);
+
+                $this->validateThemeStructure($extractedPath, $folderTheme);
 
-                    $newFolder = base_path('themes/' . $composerData['name']);
+                $newFolder = base_path('themes/' . $composerData['name']);
 
-                    if (File::move("$extractedPath/$folderTheme", $newFolder)) {
-                        File::deleteDirectory($extractedPath);
-                        File::deleteDirectory($filePath);
+                if (File::move("$extractedPath/$folderTheme", $newFolder)) {
+                    File::deleteDirectory($extractedPath);
+                    File::deleteDirectory($filePath);
 
-                        scan_themes();
+                    scan_themes();
 
-                        $themeName = $composerData['name'];
-                        $userId = auth()->id();
-                        $userEmail = auth()->user()?->email ?? 'unknown';
-                        Log::warning("Theme uploaded (hooks NOT auto-loaded): theme={$themeName}, user_id={$userId}, email={$userEmail}", [
-                            'action' => 'theme_upload',
-                            'theme' => $themeName,
-                            'user_id' => $userId,
-                        ]);
+                    $themeName = $composerData['name'];
+                    $userId = auth()->id();
+                    $userEmail = auth()->user()?->email ?? 'unknown';
+                    Log::warning("Theme uploaded (hooks NOT auto-loaded): theme={$themeName}, user_id={$userId}, email={$userEmail}", [
+                        'action' => 'theme_upload',
+                        'theme' => $themeName,
+                        'user_id' => $userId,
+                    ]);
 
-                        return [
-                            'status' => 'success',
-                            'message' => 'Tema berhasil diunggah. Review hooks.php melalui menu aktivasi tema sebelum mengaktifkan.',
-                        ];
-                    } else {
-                        File::deleteDirectory($extractedPath);
-                        File::deleteDirectory($filePath);
-                    }
+                    return [
+                        'status' => 'success',
+                        'message' => 'Tema berhasil diunggah. Review hooks.php melalui menu aktivasi tema sebelum mengaktifkan.',
+                    ];
                 }
+
+                File::deleteDirectory($extractedPath);
+                File::deleteDirectory($filePath);
             }
         } finally {
             if ($zipOpened) {
@@ -131,6 +140,20 @@ public function installFromZip(UploadedFile $file): array
         ];
     }
 
+    private function findComposerJson(string $path): ?string
+    {
+        $directory = new \RecursiveDirectoryIterator($path, \RecursiveDirectoryIterator::SKIP_DOTS);
+        $iterator = new \RecursiveIteratorIterator($directory);
+
+        foreach ($iterator as $file) {
+            if ($file->getFilename() === 'composer.json') {
+                return $file->getPathname();
+            }
+        }
+
+        return null;
+    }
+
     private function validateThemeStructure(string $path, string $folder): bool
     {
         $requiredFiles = [