Implemented saveBase64Images() to convert base64 <img> tags into real files stored under /uploads/<module>/<id>/ with secure filenames. Added wrapper functions and updated document creation to use processed image paths.

agent/post/document.php

@@ -16,10 +16,23 @@ if (isset($_POST['add_document'])) {
     $asset_id = intval($_POST['asset'] ?? 0);
 
     // Document add query
-    mysqli_query($mysqli,"INSERT INTO documents SET document_name = '$name', document_description = '$description', document_content = '$content', document_content_raw = '$content_raw', document_folder_id = $folder, document_created_by = $session_user_id, document_client_id = $client_id");
+    mysqli_query($mysqli,"INSERT INTO documents SET document_name = '$name', document_description = '$description', document_content = '', document_content_raw = '$content_raw', document_folder_id = $folder, document_created_by = $session_user_id, document_client_id = $client_id");
     
     $document_id = mysqli_insert_id($mysqli);
 
+    $processed_content = mysqli_escape_string(
+        $mysqli,
+        saveBase64Images(
+            $_POST['content'],
+            $_SERVER['DOCUMENT_ROOT'] . "/uploads/documents/",
+            "uploads/documents/",
+            $document_id
+        )
+    );
+
+    // Document update content
+    mysqli_query($mysqli,"UPDATE documents SET document_content = '$processed_content' WHERE document_id = $document_id");
+
     if ($contact_id) {
         mysqli_query($mysqli,"INSERT INTO contact_documents SET contact_id = $contact_id, document_id = $document_id");
     }

functions.php

@@ -1642,4 +1642,87 @@ function sanitize_filename($filename, $strict = false) {
     }
 
     return $filename;
-}
+}
+
+function saveBase64Images(string $html, string $baseFsPath, string $baseWebPath, int $ownerId): string {
+    // Normalize paths
+    $baseFsPath  = rtrim($baseFsPath, '/\\') . '/';
+    $baseWebPath = rtrim($baseWebPath, '/\\') . '/';
+
+    $targetDir = $baseFsPath . $ownerId . "/";
+
+    $folderCreated = false;   // <-- NEW FLAG
+    $savedAny      = false;   // <-- Track if ANY images processed
+
+    libxml_use_internal_errors(true);
+    $dom = new DOMDocument();
+    $dom->loadHTML('<?xml encoding="utf-8" ?>' . $html);
+    libxml_clear_errors();
+
+    $imgs = $dom->getElementsByTagName('img');
+
+    foreach ($imgs as $img) {
+        $src = $img->getAttribute('src');
+
+        // Match base64 images
+        if (preg_match('/^data:image\/([a-zA-Z0-9+]+);base64,(.*)$/s', $src, $matches)) {
+
+            $savedAny = true;  // <-- We are actually saving at least 1 image
+
+            // Create folder ONLY when needed
+            if (!$folderCreated) {
+                if (!is_dir($targetDir)) {
+                    mkdir($targetDir, 0775, true);
+                }
+                $folderCreated = true;
+            }
+
+            $mimeType = strtolower($matches[1]);
+            $base64   = $matches[2];
+
+            $binary = base64_decode($base64);
+            if ($binary === false) {
+                continue;
+            }
+
+            // Extension mapping
+            switch ($mimeType) {
+                case 'jpeg':
+                case 'jpg': $ext = 'jpg'; break;
+                case 'png': $ext = 'png'; break;
+                case 'gif': $ext = 'gif'; break;
+                case 'webp': $ext = 'webp'; break;
+                default: $ext = 'png';
+            }
+
+            // Secure random filename
+            $uid = bin2hex(random_bytes(16));
+            $filename = "img_{$uid}.{$ext}";
+
+            $filePath = $targetDir . $filename;
+
+            if (file_put_contents($filePath, $binary) !== false) {
+                $webPath = "/" . $baseWebPath . $ownerId . "/" . $filename;
+                $img->setAttribute('src', $webPath);
+            }
+        }
+    }
+
+    // If no images were processed, return original HTML immediately
+    if (!$savedAny) {
+        return $html;
+    }
+
+    // Extract body content only
+    $body = $dom->getElementsByTagName('body')->item(0);
+
+    if ($body) {
+        $innerHTML = '';
+        foreach ($body->childNodes as $child) {
+            $innerHTML .= $dom->saveHTML($child);
+        }
+        return $innerHTML;
+    }
+
+    return $html;
+}

uploads/documents/index.php

@@ -0,0 +1 @@
+