scratch – Diff between revs 73 and 81

Subversion Repositories:

?pathlinks?

Rev 73 – Rev 83 – Go to most recent revision – Details – Blame – Last modification – View Log

     case 'POST':
         #### Retrieve uploaded file.
         if (!empty($_FILES['file']) and
             is_uploaded_file($_FILES['file']['tmp_name'])) {
             if($_FILES['file']['size'] > $config['ALLOWED_ASSET_SIZE'] * 1048576) {
+                http_response_code(403);
-                header('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.', true, 403);
+                die('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.');
-                return;
+            }
             # Regular multipart/form-data upload.
             $name = $_FILES['file']['name'];
             $data = atomized_get_contents($_FILES['file']['tmp_name']);
         } else {
             if((int)get_file_size("php://input") > $config['ALLOWED_ASSET_SIZE'] * 1048576) {
+                http_response_code(403);
-                header('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.', true, 403);
+                die('File size exceeds '.$config['ALLOWED_ASSET_SIZE'].'MiB.');
-                return;
+            }
             # Raw POST data.
             $name = urldecode(@$_SERVER['HTTP_X_FILE_NAME']);
             $data = atomized_get_contents("php://input");
+        }
         #### If the extension is not allowed then change it to a text extension.
         if (!isset($fileExtension) ||
             !in_array(strtoupper($fileExtension),
                 array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
-            header('File extension not allowed.', true, 403);
+            http_response_code(403);
-            return;
+            die('File extension not allowed.');
+        }
         #### Hash filename.
         #### Check for path traversals
         $pathPart = pathinfo($userPath.'.'.$fileExtension);
         if (strcasecmp(
             realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
-            header('Internal server error.', true, 500);
+            http_response_code(500);
-            return;
+            die('Internal server error.');
+        }
         #### Store the file.
-        atomized_put_contents($userPath.'.'.$fileExtension, $data);
+        $timestamp = atomized_put_contents($userPath.'.'.$fileExtension, $data);
+        ### Return the URL to the file.
+        header('Content-Type: text/plain; charset=utf-8');
+        echo json_encode(
+            array(
+                "hash" => $file,
-        ### Return the URL to the file.
+                "timestamp" => $timestamp
         header('Content-Type: text/plain; charset=utf-8');
-        echo $file;
+        );
     break;
     case 'GET':
         ### If no file has been specified for download then return.
-        if (!isset($_GET['o']) or empty($_GET['o'])) {
+        if (!isset($_GET['hash']) or empty($_GET['hash'])) {
-            header('File not found.', true, 404);
+            http_response_code(404);
-            return;
+            die('File not found.');
+        }
         ### Find the requested file.
         $file = array_shift(
             preg_grep(
-                "/$_GET[o]/",
+                '/'.$_GET['hash'].'/',
+                scandir($config['STORE_FOLDER'])
-                scandir($config['STORE_FOLDER'])
+            )
+        );
-        );
+        if (!isset($file) or empty($file)) {
             http_response_code(404);
-        if (!isset($file) or empty($file))
+            die('File not found.');
             return;
         ### Check the path for path traversals.
         $fileExtension = pathinfo($file, PATHINFO_EXTENSION);
         #### If the extension is not allowed then return.
         if (!isset($fileExtension) ||
             !in_array(strtoupper($fileExtension),
         #### Check for path traversals
         $pathPart = pathinfo($userPath);
         if (strcasecmp(
             realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
-            header('Internal server error.', true, 500);
+            http_response_code(500);
-            return;
+            die('Internal server error.');
+        }
         ### Hook for HTML files to display properly.
             break;
             default:
                 ### Open MIME info database and send the content type.
                 $finfo = finfo_open(FILEINFO_MIME_TYPE);
                 if (!$finfo) {
-                    header('Internal server error.', true, 500);
+                    http_response_code(500);
-                    return;
+                    die('Internal server error.');
+                }
                 header('Content-type: '.finfo_file($finfo, $userPath));
                 finfo_close($finfo);
             break;
+        }
+        ### Tell browser not to cache files.
+        header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
+        header("Cache-Control: post-check=0, pre-check=0", false);
         header("Pragma: no-cache");
         ### Send the file along with the inline content disposition.
         header('Content-length: '.(int)get_file_size($userPath));
         header('Content-Disposition: inline; filename="' . basename($userPath) . '"');
         header('Content-Transfer-Encoding: binary');