scratch – Blame information for rev 94

Subversion Repositories:
Rev:
Rev Author Line No. Line
28 office 1 <?php
2  
3 ###########################################################################
4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
5 ###########################################################################
6  
66 office 7 require_once('php/pseudocrypt.php');
8 require_once('php/functions.php');
87 office 9 require_once('vendor/autoload.php');
28 office 10  
67 office 11 ### Load configuration.
12 $config = spyc_load_file('config.yaml');
13  
93 office 14 #### Script restrictions.
15 if(
16 (
94 office 17 !isset($_SERVER['HTTP_X_REQUESTED_WITH']) or
18 empty($_SERVER['HTTP_X_REQUESTED_WITH']) or
93 office 19 strtoupper($_SERVER['HTTP_X_REQUESTED_WITH']) != 'XMLHTTPREQUEST'
20 )
94 office 21 or
93 office 22 (
23 (
94 office 24 !isset($_SERVER['HTTP_REFERER']) or
93 office 25 empty($_SERVER['HTTP_REFERER'])
26 )
94 office 27 and
93 office 28 (
94 office 29 #strtoupper($_SERVER['HTTP_REFERER']) != strtoupper($config['URL_PATH'].'FILE.HTML') or
93 office 30 strtoupper($_SERVER['HTTP_REFERER']) != strtoupper($config['URL_PATH'].'TEXT.HTML')
31 )
32 )
33 )
34 {
35 http_response_code(403);
36 die('Forbidden.');
37 }
38  
94 office 39 #### Check if the fingerprint and action are set parameters.
37 office 40 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or
94 office 41 !preg_match('/^[A-Za-z0-9]{32}$/', $_POST['fingerprint']) or
57 office 42 !isset($_POST['action']) or empty($_POST['action'])) {
81 office 43 http_response_code(500);
44 die('Internal server error.');
57 office 45 }
37 office 46  
47 #### Check fingerprint consistency.
48 $fingerprint = strtoupper($_POST['fingerprint']);
57 office 49 if(strlen($fingerprint) !== 32) {
81 office 50 http_response_code(500);
51 die('Internal server error.');
57 office 52 }
37 office 53  
54 $action = strtoupper($_POST['action']);
55  
56 #### Data must be sent in order to save a file.
57 office 57 if($action === 'SAVE' and !isset($_POST['data'])) {
81 office 58 http_response_code(500);
59 die('Internal server error.');
57 office 60 }
37 office 61  
62 #### Hash fingerprint.
63 $file = strtolower(
64 PseudoCrypt::hash(
65 preg_replace(
66 '/\D/',
67 '',
68 hash(
69 'sha512',
50 office 70 $fingerprint
37 office 71 )
48 office 72 ),
67 office 73 $config['ASSET_HASH_SIZE']
49 office 74 )
37 office 75 );
76  
28 office 77 #### Build the user path.
78 $userPath = join(
79 DIRECTORY_SEPARATOR,
80 array(
67 office 81 $config['STORE_FOLDER'],
37 office 82 $file
28 office 83 )
84 );
85  
86 #### Check for path traversals
49 office 87 $pathPart = pathinfo($userPath.'.html');
28 office 88 if (strcasecmp(
67 office 89 realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
81 office 90 http_response_code(500);
91 die('Internal server error.');
57 office 92 }
28 office 93  
37 office 94 switch($action) {
95 case 'SAVE':
28 office 96 #### Store the file.
49 office 97 atomized_put_contents($userPath.'.html', $_POST['data']);
28 office 98 break;
37 office 99 case 'LOAD':
57 office 100 if(!file_exists($userPath.'.html')) {
62 office 101 ### If the file does not exist, present an empty file instead of 404.
102 echo '';
29 office 103 return;
57 office 104 }
53 office 105 ### Set no-cache
106 header('Content-Type: text/html; charset=utf-8');
107 header('Cache-Control: no-cache, no-store, must-revalidate');
108 header('Pragma: no-cache');
109 header('Expires: 0');
110 ### Open MIME info database and send the content type.
111 header('Content-type: text/html');
112 ### Send the file along with the inline content disposition.
113 header('Content-length: '.(int)get_file_size($userPath.'.html'));
114 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"');
115 header('X-Sendfile: '.$userPath.'.html');
28 office 116 break;
117 }
118