scratch – Diff between revs 66 and 67

Subversion Repositories:
Rev:
Only display areas with differences – Ignore whitespace
Rev 66 Rev 67
1 <?php 1 <?php
2   2  
3 ########################################################################### 3 ###########################################################################
4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ## 4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
5 ########################################################################### 5 ###########################################################################
6   6  
7 require_once('php/pseudocrypt.php'); 7 require_once('php/pseudocrypt.php');
8 require_once('php/functions.php'); 8 require_once('php/functions.php');
9 require_once('config.php'); 9 require_once('vendor/mustangostang/spyc/Spyc.php');
-   10  
-   11 ### Load configuration.
-   12 $config = spyc_load_file('config.yaml');
10   13  
11 #### POST -> upload / GET -> download 14 #### POST -> upload / GET -> download
12 switch ($_SERVER['REQUEST_METHOD']) { 15 switch ($_SERVER['REQUEST_METHOD']) {
13 case 'POST': 16 case 'POST':
14 #### Retrieve uploaded file. 17 #### Retrieve uploaded file.
15 if (!empty($_FILES['file']) and 18 if (!empty($_FILES['file']) and
16 is_uploaded_file($_FILES['file']['tmp_name'])) { 19 is_uploaded_file($_FILES['file']['tmp_name'])) {
17 if($_FILES['file']['size'] > $ALLOWED_ASSET_SIZE * 1048576) { 20 if($_FILES['file']['size'] > $config['ALLOWED_ASSET_SIZE'] * 1048576) {
18 header('File size exceeds '.$ALLOWED_ASSET_SIZE.'MiB.', true, 403); 21 header('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.', true, 403);
19 return; 22 return;
20 } 23 }
21 # Regular multipart/form-data upload. 24 # Regular multipart/form-data upload.
22 $name = $_FILES['file']['name']; 25 $name = $_FILES['file']['name'];
23 $data = atomized_get_contents($_FILES['file']['tmp_name']); 26 $data = atomized_get_contents($_FILES['file']['tmp_name']);
24 } else { 27 } else {
25 if((int)get_file_size("php://input") > $ALLOWED_ASSET_SIZE * 1048576) { 28 if((int)get_file_size("php://input") > $config['ALLOWED_ASSET_SIZE'] * 1048576) {
26 header('File size exceeds '.$ALLOWED_ASSET_SIZE.'MiB.', true, 403); 29 header('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.', true, 403);
27 return; 30 return;
28 } 31 }
29 # Raw POST data. 32 # Raw POST data.
30 $name = urldecode(@$_SERVER['HTTP_X_FILE_NAME']); 33 $name = urldecode(@$_SERVER['HTTP_X_FILE_NAME']);
31 $data = atomized_get_contents("php://input"); 34 $data = atomized_get_contents("php://input");
32 } 35 }
33   36  
34 #### Grab the file extension. 37 #### Grab the file extension.
35 $fileExtension = pathinfo($name, PATHINFO_EXTENSION); 38 $fileExtension = pathinfo($name, PATHINFO_EXTENSION);
36   39  
37 #### If the extension is not allowed then change it to a text extension. 40 #### If the extension is not allowed then change it to a text extension.
38 if (!isset($fileExtension) || 41 if (!isset($fileExtension) ||
39 !in_array(strtoupper($fileExtension), 42 !in_array(strtoupper($fileExtension),
40 array_map('strtoupper', $ALLOWED_FILE_EXTENSIONS))) { 43 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
41 header('File extension not allowed.', true, 403); 44 header('File extension not allowed.', true, 403);
42 return; 45 return;
43 } 46 }
44 47
45 #### Hash filename. 48 #### Hash filename.
46 $file = strtolower( 49 $file = strtolower(
47 PseudoCrypt::hash( 50 PseudoCrypt::hash(
48 preg_replace( 51 preg_replace(
49 '/\D/', 52 '/\D/',
50 '', 53 '',
51 hash( 54 hash(
52 'sha512', 55 'sha512',
53 $data 56 $data
54 ) 57 )
55 ), 58 ),
56 $ASSET_HASH_SIZE 59 $config['ASSET_HASH_SIZE']
57 ) 60 )
58 ); 61 );
59   62  
60 #### Build the user path. 63 #### Build the user path.
61 $userPath = join( 64 $userPath = join(
62 DIRECTORY_SEPARATOR, 65 DIRECTORY_SEPARATOR,
63 array( 66 array(
64 $STORE_FOLDER, 67 $config['STORE_FOLDER'],
65 $file 68 $file
66 ) 69 )
67 ); 70 );
68   71  
69 #### Check for path traversals 72 #### Check for path traversals
70 $pathPart = pathinfo($userPath.'.'.$fileExtension); 73 $pathPart = pathinfo($userPath.'.'.$fileExtension);
71 if (strcasecmp( 74 if (strcasecmp(
72 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) { 75 realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
73 header('Internal server error.', true, 500); 76 header('Internal server error.', true, 500);
74 return; 77 return;
75 } 78 }
76   79  
77 #### Store the file. 80 #### Store the file.
78 atomized_put_contents($userPath.'.'.$fileExtension, $data); 81 atomized_put_contents($userPath.'.'.$fileExtension, $data);
79   82  
80 ### Return the URL to the file. 83 ### Return the URL to the file.
81 header('Content-Type: text/plain; charset=utf-8'); 84 header('Content-Type: text/plain; charset=utf-8');
82 echo sprintf('%s/%s', trim($URL_PATH, '/'), $file); 85 echo sprintf('%s/%s', trim($config['URL_PATH'], '/'), $file);
83 break; 86 break;
84 case 'GET': 87 case 'GET':
85 ### If no file has been specified for download then return. 88 ### If no file has been specified for download then return.
86 if (!isset($_GET['o']) or empty($_GET['o'])) { 89 if (!isset($_GET['o']) or empty($_GET['o'])) {
87 header('File not found.', true, 404); 90 header('File not found.', true, 404);
88 return; 91 return;
89 } 92 }
90   93  
91 ### Find the requested file. 94 ### Find the requested file.
92 $file = array_shift( 95 $file = array_shift(
93 preg_grep( 96 preg_grep(
94 "/$_GET[o]/", 97 "/$_GET[o]/",
95 scandir($STORE_FOLDER) 98 scandir($config['STORE_FOLDER'])
96 ) 99 )
97 ); 100 );
98   101  
99 if (!isset($file) or empty($file)) 102 if (!isset($file) or empty($file))
100 return; 103 return;
101 104
102 ### Check the path for path traversals. 105 ### Check the path for path traversals.
103 $fileExtension = pathinfo($file, PATHINFO_EXTENSION); 106 $fileExtension = pathinfo($file, PATHINFO_EXTENSION);
104   107  
105 #### If the extension is not allowed then return. 108 #### If the extension is not allowed then return.
106 if (!isset($fileExtension) || 109 if (!isset($fileExtension) ||
107 !in_array(strtoupper($fileExtension), 110 !in_array(strtoupper($fileExtension),
108 array_map('strtoupper', $ALLOWED_FILE_EXTENSIONS))) { 111 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
109 header('File extension not allowed.', true, 403); 112 header('File extension not allowed.', true, 403);
110 return; 113 return;
111 } 114 }
112 115
113 #### Build the user path. 116 #### Build the user path.
114 $userPath = join( 117 $userPath = join(
115 DIRECTORY_SEPARATOR, 118 DIRECTORY_SEPARATOR,
116 array( 119 array(
117 $STORE_FOLDER, 120 $config['STORE_FOLDER'],
118 $file 121 $file
119 ) 122 )
120 ); 123 );
121   124  
122 #### Check for path traversals 125 #### Check for path traversals
123 $pathPart = pathinfo($userPath); 126 $pathPart = pathinfo($userPath);
124 if (strcasecmp( 127 if (strcasecmp(
125 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) { 128 realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
126 header('Internal server error.', true, 500); 129 header('Internal server error.', true, 500);
127 return; 130 return;
128 } 131 }
129   132  
130 ### Hook for HTML files to display properly. 133 ### Hook for HTML files to display properly.
131 switch(strtoupper($fileExtension)) { 134 switch(strtoupper($fileExtension)) {
132 case "HTML": 135 case "HTML":
133 case "HTM": 136 case "HTM":
134 header('Content-type: text/html'); 137 header('Content-type: text/html');
135 break; 138 break;
136 break; 139 break;
137 default: 140 default:
138 ### Open MIME info database and send the content type. 141 ### Open MIME info database and send the content type.
139 $finfo = finfo_open(FILEINFO_MIME_TYPE); 142 $finfo = finfo_open(FILEINFO_MIME_TYPE);
140 if (!$finfo) { 143 if (!$finfo) {
141 header('Internal server error.', true, 500); 144 header('Internal server error.', true, 500);
142 return; 145 return;
143 } 146 }
144 header('Content-type: '.finfo_file($finfo, $userPath)); 147 header('Content-type: '.finfo_file($finfo, $userPath));
145 finfo_close($finfo); 148 finfo_close($finfo);
146 break; 149 break;
147 } 150 }
148 151
149 ### Send the file along with the inline content disposition. 152 ### Send the file along with the inline content disposition.
150 header('Content-length: '.(int)get_file_size($userPath)); 153 header('Content-length: '.(int)get_file_size($userPath));
151 header('Content-Disposition: inline; filename="' . basename($userPath) . '"'); 154 header('Content-Disposition: inline; filename="' . basename($userPath) . '"');
152 header('Content-Transfer-Encoding: binary'); 155 header('Content-Transfer-Encoding: binary');
153 header('X-Sendfile: '.$userPath); 156 header('X-Sendfile: '.$userPath);
154 break; 157 break;
155 } 158 }
156   159