scratch – Rev 7

Subversion Repositories:
Rev:
<?php

###########################################################################
##  Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3      ##
###########################################################################

require_once('includes/pseudocrypt.php');
require_once('includes/functions.php');
require_once('config.php');

# Upload data can be POST'ed as raw form data or uploaded via <iframe> and
# <form> using regular multipart/form-data enctype (which is handled by
# PHP $_FILES).
if (!empty($_FILES['file']) and 
    is_uploaded_file($_FILES['file']['tmp_name'])) {
    # Regular multipart/form-data upload.
    $name = $_FILES['file']['name'];
    $data = file_get_contents($_FILES['file']['tmp_name']);
} else {
    # Raw POST data.
    $name = urldecode(@$_SERVER['HTTP_X_FILE_NAME']);
    $data = file_get_contents("php://input");
}

## Hash filename and check storage in the upload folder.
$fileExtension = pathinfo($name, PATHINFO_EXTENSION);
if ($fileExtension != '') {
    $storePath = realpath($STORE_FOLDER);
    $file = strtolower(
        PseudoCrypt::hash(
            preg_replace(
                '/\D/',
                '',
                hash(
                    'sha512',
                    $name
                )
            )
        ).
        '.'.
        $fileExtension
    );
    $userPath = join(
        DIRECTORY_SEPARATOR,
        array(
            $STORE_FOLDER,
            $file
        )
    );
    $pathPart = pathinfo($userPath);
    if (realpath($pathPart['dirname']) == $storePath) {
        atomized_put_contents($userPath, $data);
        $output = sprintf('%s/%s', trim($URL_PATH, '/'), $file);
    }
}

# Return the URL to the file.
header('Content-Type: text/plain; charset=utf-8');
echo $output;