Add show.php: Display file securely on some (shitty) servers.

1 files changed, 74 insertions, 0 deletions

diff --git a/static/php/show.php b/static/php/show.php
new file mode 100644
index 0000000..613e0e4
--- /dev/null
+++ b/static/php/show.php
@@ -0,0 +1,74 @@
+<?php
+session_start();
+
+/**
+ * Finds file in a database and shows its content.
+ *
+ * @copyright Copyright (c) 2017 Paulina Laura Emilia <vilene@posteo.net>
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+require_once 'includes/database.inc.php';
+
+// Seconds in one non-leap year
+define('ONE_YEAR', 31536000);
+
+/**
+ * Converts timestamp to HTTP-date format as defined by RFC 7231.
+ *
+ * @param int $timestamp
+ *
+ * @return string
+ */
+function httpDate($timestamp)
+{
+    return gmdate('D, d M Y H:i:s T', $timestamp);
+}
+
+try {
+    // Get file from a database
+    $q = $db->prepare('SELECT filename, mime, size, date FROM files
+                       WHERE filename = (:filename)');
+    $q->bindValue(':filename', $_GET['filename'], PDO::PARAM_STR);
+
+    if ($q->execute()) {
+        if ($q->rowCount() > 0) {
+            $file = $q->fetch(PDO::FETCH_OBJ);
+
+            // File metadata
+            header('Content-Length: ' . $file->size);
+            header('Content-Type: ' . $file->mime);
+
+            // Cache control
+            header('Cache-Control: public, immutable, max-age=' . ONE_YEAR);
+            header('Expires: ' . httpDate(time() + ONE_YEAR));
+            header('Last-Modified: ' . httpDate(strtotime($file->date)));
+            header('Pragma: public');
+
+            readfile(POMF_FILES_ROOT . $file->filename);
+            exit;
+        } else {
+            throw new Exception('File not found', 404);
+        }
+    } else {
+        $err = $q->errorInfo();
+        throw new Exception('SQL error: ' . $err[2], 500);
+    }
+} catch (Exception $e) {
+    header('Content-Type: text/plain', true, $e->getCode());
+
+    echo $e->getCode() . ': ' . $e->getMessage();
+    exit;
+}