scratch – Diff between revs 62 and 66

Subversion Repositories:
Rev:
Only display areas with differences – Ignore whitespace
Rev 62 Rev 66
1 <?php 1 <?php
2   2  
3 ########################################################################### 3 ###########################################################################
4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ## 4 ## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
5 ########################################################################### 5 ###########################################################################
6   6  
7 require_once('inc/pseudocrypt.php'); 7 require_once('php/pseudocrypt.php');
8 require_once('inc/functions.php'); 8 require_once('php/functions.php');
9 require_once('config.php'); 9 require_once('config.php');
10   10  
11 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or 11 if(!isset($_POST['fingerprint']) or empty($_POST['fingerprint']) or
12 !isset($_POST['action']) or empty($_POST['action'])) { 12 !isset($_POST['action']) or empty($_POST['action'])) {
13 header('Internal server error.', true, 500); 13 header('Internal server error.', true, 500);
14 return; 14 return;
15 } 15 }
16   16  
17 #### Check fingerprint consistency. 17 #### Check fingerprint consistency.
18 $fingerprint = strtoupper($_POST['fingerprint']); 18 $fingerprint = strtoupper($_POST['fingerprint']);
19 if(strlen($fingerprint) !== 32) { 19 if(strlen($fingerprint) !== 32) {
20 header('Internal server error.', true, 500); 20 header('Internal server error.', true, 500);
21 return; 21 return;
22 } 22 }
23   23  
24 $action = strtoupper($_POST['action']); 24 $action = strtoupper($_POST['action']);
25   25  
26 #### Data must be sent in order to save a file. 26 #### Data must be sent in order to save a file.
27 if($action === 'SAVE' and !isset($_POST['data'])) { 27 if($action === 'SAVE' and !isset($_POST['data'])) {
28 header('Internal server error.', true, 500); 28 header('Internal server error.', true, 500);
29 return; 29 return;
30 } 30 }
31   31  
32 #### Hash fingerprint. 32 #### Hash fingerprint.
33 $file = strtolower( 33 $file = strtolower(
34 PseudoCrypt::hash( 34 PseudoCrypt::hash(
35 preg_replace( 35 preg_replace(
36 '/\D/', 36 '/\D/',
37 '', 37 '',
38 hash( 38 hash(
39 'sha512', 39 'sha512',
40 $fingerprint 40 $fingerprint
41 ) 41 )
42 ), 42 ),
43 $ASSET_HASH_SIZE 43 $ASSET_HASH_SIZE
44 ) 44 )
45 ); 45 );
46   46  
47 #### Build the user path. 47 #### Build the user path.
48 $userPath = join( 48 $userPath = join(
49 DIRECTORY_SEPARATOR, 49 DIRECTORY_SEPARATOR,
50 array( 50 array(
51 $STORE_FOLDER, 51 $STORE_FOLDER,
52 $file 52 $file
53 ) 53 )
54 ); 54 );
55   55  
56 #### Check for path traversals 56 #### Check for path traversals
57 $pathPart = pathinfo($userPath.'.html'); 57 $pathPart = pathinfo($userPath.'.html');
58 if (strcasecmp( 58 if (strcasecmp(
59 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) { 59 realpath($pathPart['dirname']), realpath($STORE_FOLDER)) != 0) {
60 header('Internal server error.', true, 500); 60 header('Internal server error.', true, 500);
61 return; 61 return;
62 } 62 }
63   63  
64 switch($action) { 64 switch($action) {
65 case 'SAVE': 65 case 'SAVE':
66 #### Store the file. 66 #### Store the file.
67 atomized_put_contents($userPath.'.html', $_POST['data']); 67 atomized_put_contents($userPath.'.html', $_POST['data']);
68 break; 68 break;
69 case 'LOAD': 69 case 'LOAD':
70 if(!file_exists($userPath.'.html')) { 70 if(!file_exists($userPath.'.html')) {
71 ### If the file does not exist, present an empty file instead of 404. 71 ### If the file does not exist, present an empty file instead of 404.
72 echo ''; 72 echo '';
73 return; 73 return;
74 } 74 }
75 ### Set no-cache 75 ### Set no-cache
76 header('Content-Type: text/html; charset=utf-8'); 76 header('Content-Type: text/html; charset=utf-8');
77 header('Cache-Control: no-cache, no-store, must-revalidate'); 77 header('Cache-Control: no-cache, no-store, must-revalidate');
78 header('Pragma: no-cache'); 78 header('Pragma: no-cache');
79 header('Expires: 0'); 79 header('Expires: 0');
80 ### Open MIME info database and send the content type. 80 ### Open MIME info database and send the content type.
81 header('Content-type: text/html'); 81 header('Content-type: text/html');
82 ### Send the file along with the inline content disposition. 82 ### Send the file along with the inline content disposition.
83 header('Content-length: '.(int)get_file_size($userPath.'.html')); 83 header('Content-length: '.(int)get_file_size($userPath.'.html'));
84 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"'); 84 header('Content-Disposition: inline; filename="' . basename($userPath.'.html') . '"');
85 header('X-Sendfile: '.$userPath.'.html'); 85 header('X-Sendfile: '.$userPath.'.html');
86 break; 86 break;
87 } 87 }
88   88  
89   89