scratch – Diff between revs 73 and 81

Subversion Repositories:
Rev:
Show entire file – Ignore whitespace
Rev 73 Rev 81
Line 10... Line 10...
10   10  
11 ### Load configuration. 11 ### Load configuration.
Line 12... Line 12...
12 $config = spyc_load_file('config.yaml'); 12 $config = spyc_load_file('config.yaml');
13   13  
-   14 ### If no file has been specified for download then return.
14 ### If no file has been specified for download then return. 15 if (!isset($_GET['hash']) or empty($_GET['hash'])) {
-   16 http_response_code(404);
-   17 die('File not found.');
-   18 }
-   19  
-   20 ### If no timestamp has been provided then return.
15 if (!isset($_GET['o']) or empty($_GET['o'])) { 21 if (!isset($_GET['timestamp']) or empty($_GET['timestamp'])) {
16 header('File not found.', true, 404); 22 http_response_code(403);
Line 17... Line 23...
17 return; 23 die('Forbidden.');
18 } 24 }
19   25  
20 ### Find the requested file. 26 ### Find the requested file.
21 $file = array_shift( 27 $file = array_shift(
22 preg_grep( 28 preg_grep(
23 "/$_GET[o]/", 29 "/".$_GET['hash']."/",
Line 24... Line 30...
24 scandir($config['STORE_FOLDER']) 30 scandir($config['STORE_FOLDER'])
25 ) 31 )
26 ); 32 );
27   33  
Line 28... Line 34...
28 if (!isset($file) or empty($file)) { 34 if (!isset($file) or empty($file)) {
29 header('File not found.', true, 404); 35 http_response_code(404);
Line 30... Line 36...
30 return; 36 die('File not found.');
31 } 37 }
32   38  
33 ### Check the path for path traversals. 39 ### Check the path for path traversals.
-   40 $fileExtension = pathinfo($file, PATHINFO_EXTENSION);
34 $fileExtension = pathinfo($file, PATHINFO_EXTENSION); 41  
35   -  
36 #### If the extension is not allowed then return. 42 #### If the extension is not allowed then return.
Line 37... Line 43...
37 if (!isset($fileExtension) || 43 if (!isset($fileExtension) ||
38 !in_array(strtoupper($fileExtension), 44 !in_array(strtoupper($fileExtension),
39 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) { 45 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
Line 52... Line 58...
52   58  
53 #### Check for path traversals 59 #### Check for path traversals
54 $pathPart = pathinfo($userPath); 60 $pathPart = pathinfo($userPath);
55 if (strcasecmp( 61 if (strcasecmp(
56 realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) { 62 realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
57 header('Internal server error.', true, 500); 63 http_response_code(500);
58 return; 64 die('Internal server error.');
Line -... Line 65...
-   65 }
59 } 66  
-   67 #### Check if the file exists.
60   68 if (!file_exists($userPath)) {
-   69 http_response_code(404);
-   70 die('File not found.');
-   71 }
-   72  
-   73 ### Check if the timestamp matches.
61 if (!file_exists($userPath)) { 74 if (filemtime($userPath) != $_GET['timestamp']) {
62 header('File not found.', true, 404); 75 http_response_code(403);
Line 63... Line 76...
63 return; 76 die('Forbidden.');