scratch – Blame information for rev 53

Subversion Repositories:
Rev:
Rev Author Line No. Line
28 office 1 <?php
2  
3 ###########################################################################
4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
5 ###########################################################################
6  
7 require_once('inc/pseudocrypt.php');
8 require_once('inc/functions.php');
9 require_once('config.php');
10  
37 office 11 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or
12 !isset($_POST['action']) or empty($_POST['action']))
13 return;
14  
15 #### Check fingerprint consistency.
16 $fingerprint = strtoupper($_POST['fingerprint']);
17 if(strlen($fingerprint) !== 32)
18 return;
19  
20 $action = strtoupper($_POST['action']);
21  
22 #### Data must be sent in order to save a file.
40 office 23 if($action === 'SAVE' and !isset($_POST['data']))
37 office 24 return;
25  
26 #### Hash fingerprint.
27 $file = strtolower(
28 PseudoCrypt::hash(
29 preg_replace(
30 '/\D/',
31 '',
32 hash(
33 'sha512',
50 office 34 $fingerprint
37 office 35 )
48 office 36 ),
37 $ASSET_HASH_SIZE
49 office 38 )
37 office 39 );
40  
28 office 41 #### Build the user path.
42 $userPath = join(
43 DIRECTORY_SEPARATOR,
44 array(
45 $STORE_FOLDER,
37 office 46 $file
28 office 47 )
48 );
49  
50 #### Check for path traversals
49 office 51 $pathPart = pathinfo($userPath.'.html');
28 office 52 if (strcasecmp(
53 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0)
54 return;
55  
37 office 56 switch($action) {
57 case 'SAVE':
28 office 58 #### Store the file.
49 office 59 atomized_put_contents($userPath.'.html', $_POST['data']);
28 office 60 break;
37 office 61 case 'LOAD':
50 office 62 if(!file_exists($userPath.'.html'))
29 office 63 return;
53 office 64 ### Set no-cache
65 header('Content-Type: text/html; charset=utf-8');
66 header('Cache-Control: no-cache, no-store, must-revalidate');
67 header('Pragma: no-cache');
68 header('Expires: 0');
69 ### Open MIME info database and send the content type.
70 header('Content-type: text/html');
71 ### Send the file along with the inline content disposition.
72 header('Content-length: '.(int)get_file_size($userPath.'.html'));
73 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"');
74 header('X-Sendfile: '.$userPath.'.html');
28 office 75 break;
76 }
77