scratch – Diff between revs 53 and 57

Subversion Repositories:
Rev:
Only display areas with differences – Ignore whitespace
Rev 53 Rev 57
1 <?php 1 <?php
2   2  
3 ########################################################################### 3 ###########################################################################
4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ## 4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
5 ########################################################################### 5 ###########################################################################
6   6  
7 require_once('inc/pseudocrypt.php'); 7 require_once('inc/pseudocrypt.php');
8 require_once('inc/functions.php'); 8 require_once('inc/functions.php');
9 require_once('config.php'); 9 require_once('config.php');
10   10  
11 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or 11 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or
12 !isset($_POST['action']) or empty($_POST['action'])) 12 !isset($_POST['action']) or empty($_POST['action'])) {
-   13 header('Internal server error.', true, 500);
13 return; 14 return;
-   15 }
14   16  
15 #### Check fingerprint consistency. 17 #### Check fingerprint consistency.
16 $fingerprint = strtoupper($_POST['fingerprint']); 18 $fingerprint = strtoupper($_POST['fingerprint']);
17 if(strlen($fingerprint) !== 32) 19 if(strlen($fingerprint) !== 32) {
-   20 header('Internal server error.', true, 500);
18 return; 21 return;
-   22 }
19   23  
20 $action = strtoupper($_POST['action']); 24 $action = strtoupper($_POST['action']);
21   25  
22 #### Data must be sent in order to save a file. 26 #### Data must be sent in order to save a file.
23 if($action === 'SAVE' and !isset($_POST['data'])) 27 if($action === 'SAVE' and !isset($_POST['data'])) {
-   28 header('Internal server error.', true, 500);
24 return; 29 return;
-   30 }
25   31  
26 #### Hash fingerprint. 32 #### Hash fingerprint.
27 $file = strtolower( 33 $file = strtolower(
28 PseudoCrypt::hash( 34 PseudoCrypt::hash(
29 preg_replace( 35 preg_replace(
30 '/\D/', 36 '/\D/',
31 '', 37 '',
32 hash( 38 hash(
33 'sha512', 39 'sha512',
34 $fingerprint 40 $fingerprint
35 ) 41 )
36 ), 42 ),
37 $ASSET_HASH_SIZE 43 $ASSET_HASH_SIZE
38 ) 44 )
39 ); 45 );
40   46  
41 #### Build the user path. 47 #### Build the user path.
42 $userPath = join( 48 $userPath = join(
43 DIRECTORY_SEPARATOR, 49 DIRECTORY_SEPARATOR,
44 array( 50 array(
45 $STORE_FOLDER, 51 $STORE_FOLDER,
46 $file 52 $file
47 ) 53 )
48 ); 54 );
49   55  
50 #### Check for path traversals 56 #### Check for path traversals
51 $pathPart = pathinfo($userPath.'.html'); 57 $pathPart = pathinfo($userPath.'.html');
52 if (strcasecmp( 58 if (strcasecmp(
53 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) 59 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) {
-   60 header('Internal server error.', true, 500);
54 return; 61 return;
-   62 }
55   63  
56 switch($action) { 64 switch($action) {
57 case 'SAVE': 65 case 'SAVE':
58 #### Store the file. 66 #### Store the file.
59 atomized_put_contents($userPath.'.html', $_POST['data']); 67 atomized_put_contents($userPath.'.html', $_POST['data']);
60 break; 68 break;
61 case 'LOAD': 69 case 'LOAD':
62 if(!file_exists($userPath.'.html')) 70 if(!file_exists($userPath.'.html')) {
-   71 header('File not found.', true, 404);
63 return; 72 return;
-   73 }
64 ### Set no-cache 74 ### Set no-cache
65 header('Content-Type: text/html; charset=utf-8'); 75 header('Content-Type: text/html; charset=utf-8');
66 header('Cache-Control: no-cache, no-store, must-revalidate'); 76 header('Cache-Control: no-cache, no-store, must-revalidate');
67 header('Pragma: no-cache'); 77 header('Pragma: no-cache');
68 header('Expires: 0'); 78 header('Expires: 0');
69 ### Open MIME info database and send the content type. 79 ### Open MIME info database and send the content type.
70 header('Content-type: text/html'); 80 header('Content-type: text/html');
71 ### Send the file along with the inline content disposition. 81 ### Send the file along with the inline content disposition.
72 header('Content-length: '.(int)get_file_size($userPath.'.html')); 82 header('Content-length: '.(int)get_file_size($userPath.'.html'));
73 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"'); 83 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"');
74 header('X-Sendfile: '.$userPath.'.html'); 84 header('X-Sendfile: '.$userPath.'.html');
75 break; 85 break;
76 } 86 }
77   87  
78   88