diff options
Diffstat (limited to 'static/upload.php')
| -rw-r--r-- | static/upload.php | 92 |
1 files changed, 53 insertions, 39 deletions
diff --git a/static/upload.php b/static/upload.php index a37c549..ebedeab 100644 --- a/static/upload.php +++ b/static/upload.php @@ -1,10 +1,14 @@ <?php /** - * Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com> - * Copyright (c) 2013, 2014, 2015 Eric Johansson <neku@pomf.se> - * Copyright (c) 2015 cenci0 <alchimist94@gmail.com> - * Copyright (c) 2015 the Pantsu.cat developers <hostmaster@pantsu.cat> + * Handles POST uploads, generates filenames, moves files around and commits + * uploaded metadata to database. + * + * @copyright Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com> + * @copyright Copyright (c) 2013, 2014, 2015 Eric Johansson <neku@pomf.se> + * @copyright Copyright (c) 2015 cenci0 <alchimist94@gmail.com> + * @copyright Copyright (c) 2015, 2016 the Pantsu.cat developers + * <hostmaster@pantsu.cat> * * Permission is hereby granted, free of charge, to any person obtaining a copy * of this software and associated documentation files (the "Software"), to deal @@ -26,16 +30,17 @@ */ // Check if we can compress our output; if we can, we'll do it +// This feature is deprecated since version 2.1.0. if (ini_get('zlib.output_compression') !== 'Off' && isset($_SERVER['HTTP_ACCEPT_ENCODING']) && strpos($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') !== false) { ob_start('ob_gzhandler'); } -include_once 'classes/Response.class.php'; -include_once 'classes/UploadException.class.php'; -include_once 'classes/UploadedFile.class.php'; -include_once 'includes/database.inc.php'; +require_once 'classes/Response.class.php'; +require_once 'classes/UploadException.class.php'; +require_once 'classes/UploadedFile.class.php'; +require_once 'includes/database.inc.php'; /** * Generates a random name for the file, retrying until we get an unused one. @@ -65,7 +70,8 @@ function generate_name($file) do { // Iterate until we reach the maximum number of retries if ($tries-- === 0) { - throw new Exception('Gave up trying to find an unused name', 500); + throw new Exception('Gave up trying to find an unused name', + 500); // HTTP status code "500 Internal Server Error" } $chars = range('a', 'z'); @@ -128,37 +134,45 @@ function upload_file($file) // Generate a name for the file $newname = generate_name($file); + // Store the file's full file path in memory + $uploadDir = POMF_FILES_ROOT; + $uploadFile = $uploadDir . $newname; + // Attempt to move it to the static directory - if (move_uploaded_file($file->tempfile, POMF_FILES_ROOT.$newname)) { - // Need to change permissions for the new file to make it world readable - if (chmod(POMF_FILES_ROOT.$newname, 0644)) { - // Add it to the database - $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, '. - 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, '. - ':exp, :del)'); - - // Common parameters binding - $q->bindValue(':hash', $file->get_sha1(), PDO::PARAM_STR); - $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR); - $q->bindValue(':name', $newname, PDO::PARAM_STR); - $q->bindValue(':size', $file->size, PDO::PARAM_INT); - $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR); - $q->bindValue(':exp', null, PDO::PARAM_STR); - $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR); - $q->execute(); - - return array( - 'hash' => $file->get_sha1(), - 'name' => $file->name, - 'url' => POMF_URL.$newname, - 'size' => $file->size, - ); - } else { - throw new Exception('Failed to change file permissions', 500); - } - } else { - throw new Exception('Failed to move file to destination', 500); + if (!move_uploaded_file($file->tempfile, $uploadFile)) { + throw new Exception('Failed to move file to destination', + 500); // HTTP status code "500 Internal Server Error" + } + + // Need to change permissions for the new file to make it world readable + if (!chmod($uploadFile, 0644)) { + throw new Exception('Failed to change file permissions', + 500); // HTTP status code "500 Internal Server Error" } + + // Add it to the database + // 'expire' support is deprecated since version 2.1.0. It may be + // removed in a future release. + $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, '. + 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, '. + ':exp, :del)'); + + // Common parameters binding + $q->bindValue(':hash', $file->get_sha1(), PDO::PARAM_STR); + $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR); + $q->bindValue(':name', $newname, PDO::PARAM_STR); + $q->bindValue(':size', $file->size, PDO::PARAM_INT); + $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR); + $q->bindValue(':exp', null, PDO::PARAM_STR); // Deprecated since version 2.1.0 + $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR); + $q->execute(); + + return array( + 'hash' => $file->get_sha1(), + 'name' => $file->name, + 'url' => POMF_URL.$newname, + 'size' => $file->size, + ); } /** @@ -201,7 +215,7 @@ function refiles($files) $f->tempfile = $file['tmp_name']; $f->error = $file['error']; // 'expire' doesn't exist neither in $_FILES nor in UploadedFile; - // commented out for future implementation + // it was never implemented and has been deprecated since version 2.1.0. //$f->expire = $file['expire']; $result[] = $f; } |