scratch – Diff between revs 73 and 81
?pathlinks?
Rev 73 | Rev 81 | |||
---|---|---|---|---|
Line 10... | Line 10... | |||
10 | |
10 | |
|
11 | ### Load configuration. |
11 | ### Load configuration. |
|
Line 12... | Line 12... | |||
12 | $config = spyc_load_file('config.yaml'); |
12 | $config = spyc_load_file('config.yaml'); |
|
13 | |
13 | |
|
- | 14 | ### If no file has been specified for download then return. |
||
14 | ### If no file has been specified for download then return. |
15 | if (!isset($_GET['hash']) or empty($_GET['hash'])) { |
|
- | 16 | http_response_code(404); |
||
- | 17 | die('File not found.'); |
||
- | 18 | } |
||
- | 19 | |
||
- | 20 | ### If no timestamp has been provided then return. |
||
15 | if (!isset($_GET['o']) or empty($_GET['o'])) { |
21 | if (!isset($_GET['timestamp']) or empty($_GET['timestamp'])) { |
|
16 | header('File not found.', true, 404); |
22 | http_response_code(403); |
|
Line 17... | Line 23... | |||
17 | return; |
23 | die('Forbidden.'); |
|
18 | } |
24 | } |
|
19 | |
25 | |
|
20 | ### Find the requested file. |
26 | ### Find the requested file. |
|
21 | $file = array_shift( |
27 | $file = array_shift( |
|
22 | preg_grep( |
28 | preg_grep( |
|
23 | "/$_GET[o]/", |
29 | "/".$_GET['hash']."/", |
|
Line 24... | Line 30... | |||
24 | scandir($config['STORE_FOLDER']) |
30 | scandir($config['STORE_FOLDER']) |
|
25 | ) |
31 | ) |
|
26 | ); |
32 | ); |
|
27 | |
33 | |
|
Line 28... | Line 34... | |||
28 | if (!isset($file) or empty($file)) { |
34 | if (!isset($file) or empty($file)) { |
|
29 | header('File not found.', true, 404); |
35 | http_response_code(404); |
|
Line 30... | Line 36... | |||
30 | return; |
36 | die('File not found.'); |
|
31 | } |
37 | } |
|
32 | |
38 | |
|
33 | ### Check the path for path traversals. |
39 | ### Check the path for path traversals. |
|
- | 40 | $fileExtension = pathinfo($file, PATHINFO_EXTENSION); |
||
34 | $fileExtension = pathinfo($file, PATHINFO_EXTENSION); |
41 | |
|
35 | |
- | ||
36 | #### If the extension is not allowed then return. |
42 | #### If the extension is not allowed then return. |
|
Line 37... | Line 43... | |||
37 | if (!isset($fileExtension) || |
43 | if (!isset($fileExtension) || |
|
38 | !in_array(strtoupper($fileExtension), |
44 | !in_array(strtoupper($fileExtension), |
|
39 | array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) { |
45 | array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) { |
|
Line 52... | Line 58... | |||
52 | |
58 | |
|
53 | #### Check for path traversals |
59 | #### Check for path traversals |
|
54 | $pathPart = pathinfo($userPath); |
60 | $pathPart = pathinfo($userPath); |
|
55 | if (strcasecmp( |
61 | if (strcasecmp( |
|
56 | realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) { |
62 | realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) { |
|
57 | header('Internal server error.', true, 500); |
63 | http_response_code(500); |
|
58 | return; |
64 | die('Internal server error.'); |
|
Line -... | Line 65... | |||
- | 65 | } |
||
59 | } |
66 | |
|
- | 67 | #### Check if the file exists. |
||
60 | |
68 | if (!file_exists($userPath)) { |
|
- | 69 | http_response_code(404); |
||
- | 70 | die('File not found.'); |
||
- | 71 | } |
||
- | 72 | |
||
- | 73 | ### Check if the timestamp matches. |
||
61 | if (!file_exists($userPath)) { |
74 | if (filemtime($userPath) != $_GET['timestamp']) { |
|
62 | header('File not found.', true, 404); |
75 | http_response_code(403); |
|
Line 63... | Line 76... | |||
63 | return; |
76 | die('Forbidden.'); |