scratch – Rev 104
?pathlinks?
<?php
###########################################################################
## Copyright (C) Wizardry and Steamworks 2017 - License: GNU GPLv3 ##
###########################################################################
require_once('php/pseudocrypt.php');
require_once('php/functions.php');
require_once('vendor/autoload.php');
### Load configuration.
$config = spyc_load_file('config.yaml');
### If no file has been specified for download then return.
if (!isset($_GET['hash']) or empty($_GET['hash'])) {
http_response_code(404);
die('File not found.');
}
### Find the requested file.
$file = array_shift(
preg_grep(
"/".$_GET['hash']."/",
scandir($config['STORE_FOLDER'])
)
);
if (!isset($file) or empty($file)) {
http_response_code(404);
die('File not found.');
}
### Check the path for path traversals.
$fileExtension = pathinfo($file, PATHINFO_EXTENSION);
#### If the extension is not allowed then return.
if (!isset($fileExtension) ||
!in_array(strtoupper($fileExtension),
array_map('strtoupper', $config['ALLOWED_FILE_EXTENSIONS']))) {
http_response_code(403);
die('File extension not allowed.');
}
#### Build the user path.
$userPath = join(
DIRECTORY_SEPARATOR,
array(
$config['STORE_FOLDER'],
$file
)
);
#### Check for path traversals
$pathPart = pathinfo($userPath);
if (strcasecmp(
realpath($pathPart['dirname']), realpath($config['STORE_FOLDER'])) != 0) {
http_response_code(500);
die('Internal server error.');
}
#### Check if the file exists.
if (!file_exists($userPath)) {
http_response_code(404);
die('File not found.');
}
$CANON_URL = $config['URL_PATH'].$_GET['hash'];
$GRAPH_URL = $config['URL_PATH'].'og/'.$_GET['hash'];
$VIDEO_URL = $config['URL_PATH'].'file.php?hash='.$_GET['hash'];
switch(strtoupper($fileExtension)) {
case 'GIF':
list($width, $height) = getimagesize($userPath);
echo <<<END
<html>
<head>
<meta property="og:site_name" content="Scratch Copy">
<meta property="og:url" content="$GRAPH_URL">
<meta property="og:title" content="Scratch Copy">
<meta property="og:type" content="video.other">
<meta property="og:image" content="$CANON_URL">
<meta property="og:image:width" content="$width">
<meta property="og:image:height" content="$height">
</head>
<body>
<p>
<img src="$URL">
</p>
</body>
</html>
END;
break;
case 'MP4':
echo <<<END
<html>
<head>
<!-- These two aren't necessary for embedding. -->
<meta property="og:site_name" content="Scratch Copy">
<meta property="og:title" content="Scratch Copy">
<meta property="og:type" content="video.other">
<meta property="og:description" content="Scratch Copy">
<meta property="og:url" content="$GRAPH_URL">
<meta property="og:image" content="https://scratch.grimore.org/img/blueprint.png">
<meta property="og:video" content='https://scratch.grimore.org/flowplayer/flowplayer.swf?config={"clip":{"url":"$CANON_URL"}}'>
<meta property="og:video:secure_url" content='https://scratch.grimore.org/flowplayer/flowplayer.swf?config={"clip":{"url":"$CANON_URL"}}'>
<meta property="og:video:type" content="application/x-shockwave-flash">
<meta property="og:video:height" content="254">
<meta property="og:video:width" content="650">
</head>
<body>
<p>
<object width="425" height="300" id="Scratch Copy" name="Scratch Copy" data="https://scratch.grimore.org/flowplayer/flowplayer.swf" type="application/x-shockwave-flash"><param name="movie" value="https://scratch.grimore.org/flowplayer/flowplayer.swf" /><param name="allowfullscreen" value="true" /><param name="allowscriptaccess" value="always" /><param name="flashvars" value='config={"clip":{"url":"$CANON_URL"}}' /></object>
</p>
</body>
</html>
END;
break;
}