scratch – Blame information for rev 66

Subversion Repositories:
Rev:
Rev Author Line No. Line
28 office 1 <?php
2  
3 ###########################################################################
4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
5 ###########################################################################
6  
66 office 7 require_once('php/pseudocrypt.php');
8 require_once('php/functions.php');
28 office 9 require_once('config.php');
10  
37 office 11 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or
57 office 12 !isset($_POST['action']) or empty($_POST['action'])) {
13 header('Internal server error.', true, 500);
14 return;
15 }
37 office 16  
17 #### Check fingerprint consistency.
18 $fingerprint = strtoupper($_POST['fingerprint']);
57 office 19 if(strlen($fingerprint) !== 32) {
20 header('Internal server error.', true, 500);
37 office 21 return;
57 office 22 }
37 office 23  
24 $action = strtoupper($_POST['action']);
25  
26 #### Data must be sent in order to save a file.
57 office 27 if($action === 'SAVE' and !isset($_POST['data'])) {
28 header('Internal server error.', true, 500);
37 office 29 return;
57 office 30 }
37 office 31  
32 #### Hash fingerprint.
33 $file = strtolower(
34 PseudoCrypt::hash(
35 preg_replace(
36 '/\D/',
37 '',
38 hash(
39 'sha512',
50 office 40 $fingerprint
37 office 41 )
48 office 42 ),
43 $ASSET_HASH_SIZE
49 office 44 )
37 office 45 );
46  
28 office 47 #### Build the user path.
48 $userPath = join(
49 DIRECTORY_SEPARATOR,
50 array(
51 $STORE_FOLDER,
37 office 52 $file
28 office 53 )
54 );
55  
56 #### Check for path traversals
49 office 57 $pathPart = pathinfo($userPath.'.html');
28 office 58 if (strcasecmp(
57 office 59 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) {
60 header('Internal server error.', true, 500);
28 office 61 return;
57 office 62 }
28 office 63  
37 office 64 switch($action) {
65 case 'SAVE':
28 office 66 #### Store the file.
49 office 67 atomized_put_contents($userPath.'.html', $_POST['data']);
28 office 68 break;
37 office 69 case 'LOAD':
57 office 70 if(!file_exists($userPath.'.html')) {
62 office 71 ### If the file does not exist, present an empty file instead of 404.
72 echo '';
29 office 73 return;
57 office 74 }
53 office 75 ### Set no-cache
76 header('Content-Type: text/html; charset=utf-8');
77 header('Cache-Control: no-cache, no-store, must-revalidate');
78 header('Pragma: no-cache');
79 header('Expires: 0');
80 ### Open MIME info database and send the content type.
81 header('Content-type: text/html');
82 ### Send the file along with the inline content disposition.
83 header('Content-length: '.(int)get_file_size($userPath.'.html'));
84 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"');
85 header('X-Sendfile: '.$userPath.'.html');
28 office 86 break;
87 }
88