✏ EDIT: Upload.php

<?php
class Upload
{
    private array $allowedExtensions;
    private array $allowedMimes;
    private int $maxBytes;

public function __construct(array $allowedExtensions = ['pdf','jpg','jpeg','png','docx'], int $maxMb = 5)
    {
        $this->allowedExtensions = $allowedExtensions;
        $this->allowedMimes = [
            'application/pdf',
            'image/jpeg',
            'image/png',
            'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
            'application/octet-stream'
        ];
        $this->maxBytes = $maxMb * 1024 * 1024;
    }

public function save(array $file, string $targetDir): array
    {
        if (!isset($file['error']) || $file['error'] === UPLOAD_ERR_NO_FILE) {
            return ['ok' => false, 'message' => 'No file uploaded.'];
        }
        if ($file['error'] !== UPLOAD_ERR_OK) {
            return ['ok' => false, 'message' => 'Upload failed.'];
        }
        if (($file['size'] ?? 0) > $this->maxBytes) {
            return ['ok' => false, 'message' => 'File is too large. Maximum size is ' . round($this->maxBytes / 1024 / 1024) . ' MB.'];
        }
        $original = $file['name'] ?? 'file';
        $ext = strtolower(pathinfo($original, PATHINFO_EXTENSION));
        if (!in_array($ext, $this->allowedExtensions, true)) {
            return ['ok' => false, 'message' => 'File type not allowed.'];
        }
        $finfo = new finfo(FILEINFO_MIME_TYPE);
        $mime = $finfo->file($file['tmp_name']);
        if (!in_array($mime, $this->allowedMimes, true)) {
            return ['ok' => false, 'message' => 'Invalid file MIME type.'];
        }
        $target = dirname(__DIR__, 2) . '/' . trim($targetDir, '/');
        if (!is_dir($target)) {
            mkdir($target, 0755, true);
        }
        $name = bin2hex(random_bytes(16)) . '.' . $ext;
        $path = $target . '/' . $name;
        if (!move_uploaded_file($file['tmp_name'], $path)) {
            return ['ok' => false, 'message' => 'Could not save uploaded file.'];
        }
        return [
            'ok' => true,
            'path' => trim($targetDir, '/') . '/' . $name,
            'original' => $original,
            'mime' => $mime,
            'size' => $file['size'] ?? 0,
        ];
    }
}

[✗] CANCEL