scratch – Diff between revs 140 and 141

Subversion Repositories:

?pathlinks?

Rev 140 – Details – Blame – Last modification – View Log

Only display areas with differences – Ignore whitespace

 <?php
 ###########################################################################
 ##  Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3      ##
 ###########################################################################
 require_once('php/pseudocrypt.php');
 require_once('php/functions.php');
+require_once('php/ip.php');
 require_once('vendor/autoload.php');
 ### Load configuration.
 $config = spyc_load_file('config.yaml');
 #### POST -> upload / GET -> download
 switch ($_SERVER['REQUEST_METHOD']) {
     case 'POST':
         #### Script restrictions.
         session_start();
         if (empty($_POST['token']) || !hash_equals($_SESSION['token'], $_POST['token'])) {
             http_response_code(403);
             die('Forbidden.');
+        }
         #### Retrieve uploaded file.
         if (!empty($_FILES['file']) and
             is_uploaded_file($_FILES['file']['tmp_name'])) {
             if($_FILES['file']['size'] > $config['ALLOWED_ASSET_SIZE'] * 1048576) {
                 http_response_code(403);
                 die('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.');
+            }
             # Regular multipart/form-data upload.
             $name = $_FILES['file']['name'];
             $data = atomized_get_contents($_FILES['file']['tmp_name']);
         } else {
             if((int)get_file_size("php://input") > $config['ALLOWED_ASSET_SIZE'] * 1048576) {
                 http_response_code(403);
                 die('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.');
+            }
             # Raw POST data.
             $name = urldecode(@$_SERVER['HTTP_X_FILE_NAME']);
             $data = atomized_get_contents("php://input");
+        }
         #### Grab the file extension.
         $fileExtension = pathinfo($name, PATHINFO_EXTENSION);
         #### If the extension is not allowed then change it to a text extension.
         if (!isset($fileExtension) ||
             !in_array(strtoupper($fileExtension),
                 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
             http_response_code(403);
             die('File extension not allowed.');
+        }
         #### Hash filename.
         $file = strtolower(
             PseudoCrypt::hash(
                 preg_replace(
                     '/\D/',
                     '',
                     hash(
                         'sha512',
                         $data
+                    )
                 ),
                 $config['ASSET_HASH_SIZE']
+            )
         );
         #### Build the user path.
         $userPath = join(
             DIRECTORY_SEPARATOR,
             array(
                 $config['STORE_FOLDER'],
                 $file
+            )
         );
         #### Check for path traversals.
         $pathPart = pathinfo($userPath.'.'.$fileExtension);
         if (strcasecmp(
             realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
             http_response_code(500);
             die('Internal server error.');
+        }
         #### Store the file.
         $timestamp = atomized_put_contents($userPath.'.'.$fileExtension, $data);
         ### Log IP address.
         $db = new PDO('sqlite:db/scratch.sqlite3');
         $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
         try {
             $db->beginTransaction();
             ## Create tags table if it does not exist.
             $db->query('CREATE TABLE IF NOT EXISTS "uploaders" ("hash" text NOT NULL COLLATE NOCASE, "ip" text COLLATE NOCASE, UNIQUE("hash") ON CONFLICT REPLACE)');
             $q = $db->prepare('REPLACE INTO "uploaders" ("hash", "ip") VALUES(:hash, :ip)');
             $q->bindParam(':hash', $file);
-            $q->bindParam(':ip', $_SERVER['REMOTE_ADDR']);
+            $q->bindParam(':ip', get_ip_address());
             $q->execute();
             $db->commit();
         } catch (Exception $e) {
             error_log($e);
             ## Rollback.
             $db->rollback();
+        }
         ### Process any sent tags.
         if(isset($_POST['tags'])) {
             $tags = json_decode(
                 stripslashes(
                     $_POST['tags']
+                )
             );
             ## If we have any tags then insert them into the database.
             if(!empty($tags)) {
                 ## Connect or create the scratch database.
                 $db = new PDO('sqlite:db/scratch.sqlite3');
                 ## Set the error mode to exceptions.
                 $db->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION);
                 try {
                     $db->beginTransaction();
                     ## Create tags table if it does not exist.
                     $db->query('CREATE TABLE IF NOT EXISTS "tags" ("hash" text NOT NULL COLLATE NOCASE, "tag" text COLLATE NOCASE, UNIQUE("hash", "tag") ON CONFLICT REPLACE)');
                     ## Now add all the tags.
                     foreach($tags as $tag) {
                         $q = $db->prepare('REPLACE INTO "tags" ("hash", "tag") VALUES(:hash, :tag)');
                         $q->bindParam(':hash', $file);
                         $q->bindParam(':tag', $tag);
                         $q->execute();
+                    }
                     $db->commit();
                 } catch (Exception $e) {
                     error_log($e);
                     ## Rollback.
                     $db->rollback();
+                }
+            }
+        }
         ### Hook for various file extensions.
         $opengraph = FALSE;
         switch(strtoupper($fileExtension)) {
             case 'MP4':
             case 'GIF':
                 $opengraph = TRUE;
                 break;
+        }
         ### Return the URL to the file.
         header('Content-Type: text/plain; charset=utf-8');
         echo json_encode(
             array(
                 "hash" => $file,
                 "timestamp" => $timestamp,
                 "opengraph" => $opengraph
+            )
         );
     break;
     case 'GET':
         ### Tell browser not to cache files.
         header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
         header("Cache-Control: post-check=0, pre-check=0", false);
         header("Pragma: no-cache");
         ### If no file has been specified for download then return.
         if (!isset($_GET['hash']) or empty($_GET['hash'])) {
             http_response_code(404);
             die('File not found.');
+        }
         ### Find the requested file.
         $file = array_shift(
             preg_grep(
                 '/'.$_GET['hash'].'/',
                 scandir($config['STORE_FOLDER'])
+            )
         );
         if (!isset($file) or empty($file)) {
             http_response_code(404);
             die('File not found.');
+        }
         ### Check the path for path traversals.
         $fileExtension = pathinfo($file, PATHINFO_EXTENSION);
         #### If the extension is not allowed then return.
         if (!isset($fileExtension) ||
             !in_array(strtoupper($fileExtension),
                 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
             http_response_code(403);
             die('File extension not allowed.');
+        }
         #### Build the user path.
         $userPath = join(
             DIRECTORY_SEPARATOR,
             array(
                 $config['STORE_FOLDER'],
                 $file
+            )
         );
         #### Check for path traversals
         $pathPart = pathinfo($userPath);
         if (strcasecmp(
             realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
             http_response_code(500);
             die('Internal server error.');
+        }
         ### Hook for various file extensions.
         switch(strtoupper($fileExtension)) {
             case "HTML":
             case "HTM":
                 header('Content-type: text/html');
                 break;
             break;
             case "URL":
                 if(preg_match(
                     "/URL=(https?:\/\/[\-_\.\+!\*'\(\),a-zA-Z0-9]+:?[0-9]{0,5}\/.*?)\n/",
                         file_get_contents($userPath), $matches)) {
                     header('Location: '.$matches[1]);
                     return;
+                }
             break;
             default:
                 ### Open MIME info database and send the content type.
                 $finfo = finfo_open(FILEINFO_MIME_TYPE);
                 if (!$finfo) {
                     http_response_code(500);
                     die('Internal server error.');
+                }
                 header('Content-type: '.finfo_file($finfo, $userPath));
                 finfo_close($finfo);
             break;
+        }
         ### Send the file along with the inline content disposition.
         header('Content-length: '.(int)get_file_size($userPath));
         header('Content-Disposition: inline; filename="' . basename($userPath) . '"');
         header('Content-Transfer-Encoding: binary');
         header('X-Sendfile: '.$userPath);
     break;
+}