summaryrefslogtreecommitdiff
path: root/static/upload.php
diff options
context:
space:
mode:
Diffstat (limited to 'static/upload.php')
-rw-r--r--static/upload.php316
1 files changed, 136 insertions, 180 deletions
diff --git a/static/upload.php b/static/upload.php
index 43b0c31..7756e03 100644
--- a/static/upload.php
+++ b/static/upload.php
@@ -1,241 +1,197 @@
<?php
+// Check if we can compress our output; if we can, we'll do it
+if (ini_get('zlib.output_compression') !== 'Off'
+ && isset($_SERVER["HTTP_ACCEPT_ENCODING"])
+ && strpos($_SERVER["HTTP_ACCEPT_ENCODING"], 'gzip') !== false)
+ ob_start("ob_gzhandler");
+
session_start();
+include_once 'classes/Response.class.php';
+include_once 'classes/UploadException.class.php';
include_once 'classes/UploadedFile.class.php';
-//include_once 'includes/database.inc.php'; Included in database.inc.php
include_once 'includes/database.inc.php';
+
+
/**
- * Generates a name for the file, retrying until we get an unused one
+ * Generates a random name for the file, retrying until we get an unused one
*
- * @param UploadedFile $file
+ * @param UploadedFile $file
* @return string
*/
function generate_name ($file) {
+ global $db;
global $doubledots;
+
// We start at N retries, and --N until we give up
$tries = POMF_FILES_RETRIES;
- // We rip out the extension using pathinfo
- $ext = pathinfo($file->name, PATHINFO_EXTENSION);
- // And if we realize it's actually a doubledot
- // we just override $ext
+ $ext = pathinfo($file->name, PATHINFO_EXTENSION);
+
+ // Check if extension is a double-dot extension and, if true, override $ext
$revname = strrev($file->name);
foreach ($doubledots as $ddot) {
if (stripos($revname, $ddot) === 0) {
$ext = strrev($ddot);
}
}
+
+
do {
- // If we run out of tries, throw an exception. Should be caught and JSONified.
- if ($tries-- == 0) throw new Exception('Gave up trying to find an unused name');
- //Random filename generator
- $newname='';
- $startNumber = ord('a');
- $endNumber = ord('z');
+ // Iterate until we reach the maximum number of retries
+ if ($tries-- == 0) throw new Exception('Gave up trying to find an unused name', 500);
+
+ $chars = 'abcdefghijklmnopqrstuvwxyz';
+ $name = '';
for ($i = 0; $i < 6; $i++) {
- $newname .= chr(mt_rand($startNumber, $endNumber));
+ $name .= $chars[mt_rand(0, 25)];
+ // $chars string length is hardcoded, should use a variable to store it?
}
- // To add a dot or not after a file which has no extension
- if ($ext != '') $newname .= '.' . strip_tags($ext);
- } while (file_exists(POMF_FILES_ROOT . $newname)); // TODO: check the database instead?
- return $newname;
+
+ // Add the extension to the file name
+ if (isset($ext) && $ext !== '')
+ $name .= '.' . strip_tags($ext);
+
+ // Check if a file with the same name does already exist in the database
+ $q = $db->prepare('SELECT COUNT(name) FROM pomf WHERE name = (:name)');
+ $q->bindValue(':name', $name, PDO::PARAM_STR);
+ $q->execute();
+ $result = $q->fetchColumn();
+ // If it does, generate a new name
+ } while($result > 0);
+
+ return $name;
}
+
/**
* Handles the uploading and db entry for a file
*
- * @param UploadedFile $file
+ * @param UploadedFile $file
* @return array
*/
function upload_file ($file) {
global $db;
- // If the file has an error attached, we just throw it as an exception.
- if ($file->error) throw new Exception($file->error);
- // Check if we have a file with that hash in the db
- if(empty($_SESSION['id'])){
- $q = $db->prepare("SELECT hash, filename, size FROM files WHERE hash = (:hash) AND user = (:user)");
- $q->bindValue('hash', $file->get_sha1());
- $q->bindValue('user', '0');
+
+ // Handle file errors
+ if ($file->error) throw new UploadException($file->error);
+
+ // Check if a file with the same hash and size (a file which is the same) does already exist in
+ // the database; if it does, delete the file just uploaded and return the proper link and data.
+ $q = $db->prepare('SELECT filename, COUNT(*) AS count FROM files WHERE hash = (:hash) ' .
+ 'AND size = (:size)');
+ $q->bindValue(':hash', $file->get_sha1(), PDO::PARAM_STR);
+ $q->bindValue(':size', $file->size, PDO::PARAM_INT);
$q->execute();
$result = $q->fetch();
- // If we found a file with the same checksums, then we can assume it's a dupe
- // so we don't bother with it, and just unlink (delete) the tmpfile and return
- // the previous data.
- if ($result['hash'] === $file->get_sha1()) {
+ if ($result['count'] > 0) {
unlink($file->tempfile);
return array(
- 'hash' => $result['hash'],
+ 'hash' => $file->get_sha1(),
'name' => $file->name,
- 'url' => $result['filename'],
- 'size' => $result['size']
+ 'url' => $result['filename'],
+ 'size' => $file->size
);
- } else {
- // Generate a name for the file
- $newname = generate_name($file);
- // Attempt to move it to the static directory
- if (move_uploaded_file($file->tempfile, POMF_FILES_ROOT . $newname)) {
+ }
+
+ // Generate a name for the file
+ $newname = generate_name($file);
+
+ // Attempt to move it to the static directory
+ if (move_uploaded_file($file->tempfile, POMF_FILES_ROOT . $newname)) {
+ // Need to change permissions for the new file to make it world readable
+ if (chmod(POMF_FILES_ROOT . $newname, 0644)) {
// Add it to the database
- $q = $db->prepare('INSERT INTO files (hash, orginalname, filename, size, date, expire, delid)' .
- 'VALUES (:hash, :orig, :name, :size, :date, :expires, :delid)');
- $q->bindValue(':hash', $file->get_sha1());
- $q->bindValue(':orig', strip_tags($file->name));
- $q->bindValue(':name', $newname);
- $q->bindValue(':size', $file->size);
- $q->bindValue(':date', date('Y-m-d'));
- $q->bindValue(':expires', null);
- $q->bindValue(':delid', sha1($file->tempfile));
+ if (empty($_SESSION['id'])) {
+ // Query if user is NOT logged in
+ $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, ' .
+ 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, ' .
+ ':exp, :del)');
+ } else {
+ // Query if user is logged in (insert user id together with other data)
+ $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, ' .
+ 'expire, delid, user) VALUES (:hash, :orig, :name, :size, ' .
+ ':date, :expires, :delid, :user)');
+ $q->bindValue(':user', $_SESSION['id'], PDO::PARAM_INT);
+ }
+
+ // Common parameters binding
+ $q->bindValue(':hash', $file->get_sha1(), PDO::PARAM_STR);
+ $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR);
+ $q->bindValue(':name', $newname, PDO::PARAM_STR);
+ $q->bindValue(':size', $file->size, PDO::PARAM_INT);
+ $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR);
+ $q->bindValue(':exp', null, PDO::PARAM_STR);
+ $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR);
$q->execute();
+
return array(
'hash' => $file->get_sha1(),
'name' => $file->name,
- 'url' => $newname,
+ 'url' => $newname,
'size' => $file->size
);
} else {
- throw new Exception('Failed to move file to destination');
+ throw new Exception('Failed to change file permissions', 500);
}
- }
-}else{//if session exists
- $q = $db->prepare("SELECT hash, filename, size FROM files WHERE hash = (:hash) AND user = (:user)");
- $q->bindValue('hash', $file->get_sha1());
- $q->bindValue('user', $_SESSION['id']);
- $q->execute();
- $result = $q->fetch();
- // If we found a file with the same checksums, then we can assume it's a dupe
- // so we don't bother with it, and just unlink (delete) the tmpfile and return
- // the previous data.
- if ($result['hash'] === $file->get_sha1()) {
- unlink($file->tempfile);
- return array(
- 'hash' => $result['hash'],
- 'name' => $file->name,
- 'url' => $result['filename'],
- 'size' => $result['size']
- );
- } else {
- // Generate a name for the file
- $newname = generate_name($file);
- // Attempt to move it to the static directory
- if (move_uploaded_file($file->tempfile, POMF_FILES_ROOT . $newname)) {
- // Add it to the database
- $q = $db->prepare('INSERT INTO files (hash, orginalname, filename, size, date, expire, delid, user)' .
- 'VALUES (:hash, :orig, :name, :size, :date, :expires, :delid, :user)');
- $q->bindValue(':hash', $file->get_sha1());
- $q->bindValue(':orig', strip_tags($file->name));
- $q->bindValue(':name', $newname);
- $q->bindValue(':size', $file->size);
- $q->bindValue(':date', date('Y-m-d'));
- $q->bindValue(':expires', null);
- $q->bindValue(':delid', sha1($file->tempfile));
- $q->bindValue(':user', $_SESSION['id']);
- $q->execute();
- return array(
- 'hash' => $file->get_sha1(),
- 'name' => $file->name,
- 'url' => $newname,
- 'size' => $file->size
- );
- } else {
- throw new Exception('Failed to move file to destination');
- }
- }
-}
-}
-/**
- * Reorganize the $_FILES array into something saner
- *
- * @param $_FILES
- */
-function refiles ($files) {
- $out = array();
- for ($i = 0, $n = count($files['name']); $i < $n; ++$i) {
- // We create a new UploadedFile instance
- $file = new UploadedFile();
- // And fill it with our shit
- $file->name = $files['name'][$i];
- $file->mime = $files['type'][$i];
- $file->tempfile = $files['tmp_name'][$i];
- $file->error = $files['error'][$i];
- $file->size = $files['size'][$i];
- $file->expire = $files['expire'][$i];
- $out[] = $file;
- }
- return $out;
-}
-/**
- * Give a response that gyazo understands
- */
-function respond_gyazo ($code, $files) {
- if ($files instanceof Exception) {
- echo "ERROR: " . $files->getMessage();
} else {
- echo 'http://a.pomf.se/' . $files[0]['url'];
+ throw new Exception('Failed to move file to destination', 500);
}
}
+
/**
- * Responds to a request in CSV form.
+ * Reorder files array by file
+ *
+ * @param $_FILES
+ * @return array
*/
-function respond_csv ($code, $files) {
- if ($files instanceof Exception) {
- echo "error\n";
- echo $files->getMessage() . "\n";
- } else {
- echo "name,url,hash,size\n";
- foreach ($files as $file) {
- echo "${file['name']},${file['url']},${file['hash']},${file['size']}\n";
- }
- }
+function diverse_array ($files) {
+ $result = array();
+ foreach ($files as $key1 => $value1)
+ foreach ($value1 as $key2 => $value2)
+ $result[$key2][$key1] = $value2;
+
+ return $result;
}
+
/**
- * Responds to a request in JSON form.
- */
-function respond_json ($code, $files) {
- // Now we send the response based on the type
- if ($files instanceof Exception) {
- // If it's an Exception, we put the message in the error field
- echo json_encode(array(
- 'success' => false,
- 'error' => $files->getMessage()
- ));
- } elseif (is_array($files)) {
- echo json_encode(array(
- 'success' => true,
- 'error' => null,
- 'files' => $files
- ));
- }
-}
-/**
- * Determines the proper response function based on $_GET['output]
+ * Reorganize the $_FILES array into something saner
+ *
+ * @param $_FILES
+ * @return array
*/
-function respond ($code, $files = null) {
- if (is_int($code)) { // If the code is an integer, we assume it's a response code
- http_response_code($code);
- } else { // Otherwise we just use the default and shift
- http_response_code(200);
- $files = $code;
- }
- $format = array_key_exists('output', $_GET) ? $_GET['output'] : 'json';
- switch ($format) {
- case 'gyazo':
- respond_gyazo($code, $files);
- break;
- case 'csv':
- respond_csv($code, $files);
- break;
- case 'json':
- respond_json($code, $files);
- break;
+function refiles ($files) {
+ $result = array();
+ $files = diverse_array($files);
+
+ foreach ($files as $file) {
+ $f = new UploadedFile();
+ $f->name = $file['name'];
+ $f->mime = $file['type'];
+ $f->size = $file['size'];
+ $f->tempfile = $file['tmp_name'];
+ $f->error = $file['error'];
+ // 'expire' doesn't exist neither in $_FILES nor in UploadedFile;
+ // commented out for future implementation
+ //$f->expire = $file['expire'];
+ $result[] = $f;
}
+
+ return $result;
}
+
+
+
+$type = isset($_GET['output']) ? $_GET['output'] : 'json';
+$response = new Response($type);
if (isset($_FILES['files'])) {
+ $uploads = refiles($_FILES['files']);
try {
- $uploads = refiles($_FILES['files']);
- foreach ($uploads as $upload) {
- $out[] = upload_file($upload);
- }
- respond($out);
+ foreach ($uploads as $upload)
+ $res[] = upload_file($upload);
+ $response->send($res);
} catch (Exception $e) {
- respond(500, $e);
+ $response->error($e->getCode(), $e->getMessage());
}
} else {
- respond(500, new Exception('Nigga what you doin\' here?'));
+ $response->error(400, 'No input file(s)');
}
+
?>
generated by cgit v1.2.3 (git 2.25.1) at 2026-10-22 06:58:27 +0200