File hashing uploads made through TinyMCE

This was tricky, so i tried to stay minimal and try to snatch the very first procedure after file upload and inject rehashing there. The file is tinymce.pages.inc under the function tinymce_image_upload. 

To my surprise, the upload and rehashing works without any complications right now. 

Example file for public uploads (uploaded image address):

/files/uploads/b22e3dfbdb3e413688e17f6aa69729ab.jpg

This is a very alternative version (although File Hash < - > Tinymce support would be more handy), but the drag & dropped and inline images seem to get hashed with MD5 now, which is fair enough.

This is the new full tinymce.pages.inc (see triple star "***" comments):

------

<?php
/**
* @file
* Menu callbacks for TinyMCE module.
*/

/**
* Menu callback; Saves images uploaded via copy/paste into the editor.
*
* @param stdClass $format
*   Filter format.
*
* @return array|void
*/
function tinymce_image_upload($format) {
 $upload_settings = $format->editor_settings['image_upload'];
 if (!$upload_settings['status']) {
   backdrop_add_http_header('Status', '403 Forbidden');
   return;
 }

 // Odd structure needed for file_save_upload().
 if (isset($_FILES['file'])) {
   $_FILES['files'] = array();
   foreach ($_FILES['file'] as $key => $value) {
     $_FILES['files'][$key]['upload'] = $value;
   }
 }

 $destination = $upload_settings['scheme'] . '://' .  $upload_settings['directory'];
 $extensions = image_get_supported_extensions();
 $validators = array(
   'file_validate_extensions' => array(implode(' ', $extensions)),
   'tinymce_validate_is_image' => array(),
 );
 if ($upload_settings['max_size']) {
   $validators['file_validate_size'] = array(parse_size($upload_settings['max_size']));
 }
 if ($upload_settings['max_dimensions']['width']) {
   $validators['file_validate_image_resolution'] = array(
     $upload_settings['max_dimensions']['width'] . 'x' . $upload_settings['max_dimensions']['height'],
   );
 }

 file_prepare_directory($destination, FILE_CREATE_DIRECTORY);
 $file = file_save_upload('upload', $validators, $destination);
 if ($file) {
   // *** Generate MD5 hash of the file content ***
   $md5_hash = md5_file($file->uri);
   
   // Get original file extension
   $path_info = pathinfo($file->filename);
   $extension = isset($path_info['extension']) ? '.' . $path_info['extension'] : '';
   
   // *** Create new filename with MD5 hash *** 
   $new_filename = $md5_hash . $extension;
   
   // Get the full destination path for the new file
   $new_destination = $destination . '/' . $new_filename;
   
   // *** Rename the file to use MD5 hash ***
   if (file_move($file, $new_destination)) {
     // Update file object with new filename
     $file->filename = $new_filename;
     $file->uri = $new_destination;
     
     // Try to make a local path if possible for better portability.
     $absolute_path = parse_url($GLOBALS['base_url'], PHP_URL_PATH) . '/';
     $url = file_create_url($file->uri);
     $url = str_replace($GLOBALS['base_url'] . '/', $absolute_path, $url);
     $image_info = image_get_info($file->uri);
     $response = array(
       'uploaded' => 1,
       'location' => $url,
       'fileId' => $file->fid,
       'width' => !empty($image_info['width']) ? $image_info['width'] : '',
       'height' => !empty($image_info['height']) ? $image_info['height'] : '',
     );
   }
   else {
     // If we can't rename, use the original file
     $absolute_path = parse_url($GLOBALS['base_url'], PHP_URL_PATH) . '/';
     $url = file_create_url($file->uri);
     $url = str_replace($GLOBALS['base_url'] . '/', $absolute_path, $url);
     $image_info = image_get_info($file->uri);
     $response = array(
       'uploaded' => 1,
       'location' => $url,
       'fileId' => $file->fid,
       'width' => !empty($image_info['width']) ? $image_info['width'] : '',
       'height' => !empty($image_info['height']) ? $image_info['height'] : '',
     );
   }
 }
 else {
   $response = array('uploaded' => 0);
 }

 // file_save_upload() sets messages via backdrop_set_message(). Pull the
 // responses out and display via TinyMCE's notification system.
 $messages = backdrop_get_messages();
 $message_string = '';
 foreach ($messages as $type) {
   $message_string .= $type[0] . ' ';
 }
 if ($message_string) {
   $response['errors'] = strip_tags($message_string);
 }

 return $response;
}

/**
* Custom validation callback for image upload.
*
* Currently file_validate_is_image() fails for newly uploaded files, as the uri
* is something like "/tmp/phpAbCde" - without file extension.
* @see https://github.com/backdrop-backdrop-issues/issues/6497
*/
function tinymce_validate_is_image(File $file) {
 $errors = array();

 // SVG have their own validator on upload (file_validate_svg).
 // If SVG aren't supported, yet, TinyMCE would refuse to upload in the first
 // place and even if upload was attempted, the server-side extension based
 // validation would fail.
 if ($file->filemime == 'image/svg+xml') {
   return $errors;
 }
 // Validate that the image toolkit can handle this raster image.
 if (!$info = image_get_info($file->uri)) {
   $errors[] = t('The image appears to be broken.');
 }

 return $errors;
}

------

(In Text editors and formats,  i had to turn off "Inline Image Styles" for the inline button to match drag & drop file insertion). Images are now full size in the editor however.

This implementation is somewhat MacGyver and will hash literally all files going through TinyMCE,  but it's essentially doing its thing. 

You can try the above file somewhere, what do you think? I could safely replace this file on my running site.