summaryrefslogtreecommitdiff
path: root/static
diff options
context:
space:
mode:
Diffstat (limited to 'static')
-rwxr-xr-xstatic/classes/Response.class.php99
-rwxr-xr-xstatic/classes/UploadException.class.php8
-rw-r--r--static/classes/UploadedFile.class.php18
-rw-r--r--static/includes/database.inc.php6
-rw-r--r--static/includes/settings.inc.php71
-rw-r--r--static/upload.php92
6 files changed, 234 insertions, 60 deletions
diff --git a/static/classes/Response.class.php b/static/classes/Response.class.php
index eed8ce7..48b9b58 100755
--- a/static/classes/Response.class.php
+++ b/static/classes/Response.class.php
@@ -1,8 +1,11 @@
<?php
/**
- * Copyright (c) 2015 cenci0 <alchimist94@gmail.com>
- * Copyright (c) 2015, 2016 the Pantsu.cat developers <hostmaster@pantsu.cat>
+ * Prints file upload API responses depending on desired response type format.
+ *
+ * @copyright Copyright (c) 2015 cenci0 <alchimist94@gmail.com>
+ * @copyright Copyright (c) 2015, 2016 the Pantsu.cat developers
+ * <hostmaster@pantsu.cat>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -23,10 +26,30 @@
* SOFTWARE.
*/
+/**
+ * The Response class is a do-it-all for getting responses out in different
+ * formats.
+ *
+ * @todo Create sub-classes to split and extend this god object.
+ */
class Response
{
+ /**
+ * Indicates response type used for routing.
+ *
+ * Valid strings are 'csv', 'html', 'json' and 'text'.
+ *
+ * @var string $type Response type
+ */
private $type;
+ /**
+ * Indicates requested response type.
+ *
+ * Valid strings are 'csv', 'html', 'json', 'gyazo' and 'text'.
+ *
+ * @param string|null $response_type Response type
+ */
public function __construct($response_type = null)
{
switch ($response_type) {
@@ -59,6 +82,13 @@ class Response
}
}
+ /**
+ * Routes error messages depending on response type.
+ *
+ * @param int $code HTTP status code number.
+ * @param int $desc Descriptive error message.
+ * @return void
+ */
public function error($code, $desc)
{
$response = null;
@@ -82,6 +112,12 @@ class Response
echo $response;
}
+ /**
+ * Routes success messages depending on response type.
+ *
+ * @param mixed[] $files
+ * @return void
+ */
public function send($files)
{
$response = null;
@@ -105,11 +141,25 @@ class Response
echo $response;
}
+ /**
+ * Indicates with CSV body the request was invalid.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param int $description Descriptive error message.
+ * @return string Error message in CSV format.
+ */
private static function csv_error($description)
{
return '"error"'."\r\n"."\"$description\""."\r\n";
}
+ /**
+ * Indicates with CSV body the request was successful.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param mixed[] $files
+ * @return string Success message in CSV format.
+ */
private static function csv_success($files)
{
$result = '"name","url","hash","size"'."\r\n";
@@ -123,11 +173,26 @@ class Response
return $result;
}
+ /**
+ * Indicates with HTML body the request was invalid.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param int $code HTTP status code number.
+ * @param int $description Descriptive error message.
+ * @return string Error message in HTML format.
+ */
private static function html_error($code, $description)
{
return '<p>ERROR: ('.$code.') '.$description.'</p>';
}
+ /**
+ * Indicates with HTML body the request was successful.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param mixed[] $files
+ * @return string Success message in HTML format.
+ */
private static function html_success($files)
{
$result = '';
@@ -139,6 +204,14 @@ class Response
return $result;
}
+ /**
+ * Indicates with JSON body the request was invalid.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param int $code HTTP status code number.
+ * @param int $description Descriptive error message.
+ * @return string Error message in pretty-printed JSON format.
+ */
private static function json_error($code, $description)
{
return json_encode(array(
@@ -148,6 +221,13 @@ class Response
), JSON_PRETTY_PRINT);
}
+ /**
+ * Indicates with JSON body the request was successful.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param mixed[] $files
+ * @return string Success message in pretty-printed JSON format.
+ */
private static function json_success($files)
{
return json_encode(array(
@@ -156,11 +236,26 @@ class Response
), JSON_PRETTY_PRINT);
}
+ /**
+ * Indicates with plain text body the request was invalid.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param int $code HTTP status code number.
+ * @param int $description Descriptive error message.
+ * @return string Error message in plain text format.
+ */
private static function text_error($code, $description)
{
return 'ERROR: ('.$code.') '.$description;
}
+ /**
+ * Indicates with plain text body the request was successful.
+ *
+ * @deprecated 2.1.0 Will be renamed to camelCase format.
+ * @param mixed[] $files
+ * @return string Success message in plain text format.
+ */
private static function text_success($files)
{
$result = '';
diff --git a/static/classes/UploadException.class.php b/static/classes/UploadException.class.php
index dbe47eb..7740ee6 100755
--- a/static/classes/UploadException.class.php
+++ b/static/classes/UploadException.class.php
@@ -1,6 +1,11 @@
<?php
/**
+ * Returns a human readable error description for file upload errors.
+ *
+ * @author Dan Brown <danbrown@php.net>
+ * @author Michiel Thalen
+ * @copyright
* --------------------------------------------------------------------
* The PHP License, version 3.01
* Copyright (c) 1999 - 2014 The PHP Group. All rights reserved.
@@ -71,9 +76,6 @@
* <http://www.zend.com>.
*/
-// Exception class extension from: http://php.net/manual/en/features.file-upload.errors.php#89374
-// Handles files error returning a proper error description
-
class UploadException extends Exception
{
public function __construct($code)
diff --git a/static/classes/UploadedFile.class.php b/static/classes/UploadedFile.class.php
index ac39646..ccbaea8 100644
--- a/static/classes/UploadedFile.class.php
+++ b/static/classes/UploadedFile.class.php
@@ -1,7 +1,11 @@
<?php
/**
- * Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com>
+ * Returns information about uploaded files.
+ *
+ * @copyright Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com>
+ * @copyright Copyright (c) 2016 the Pantsu.cat developers
+ * <hostmaster@pantsu.cat>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -31,13 +35,19 @@ class UploadedFile
public $tempfile;
public $error;
- /* Cached checksums */
+ /**
+ * SHA-1 checksum
+ *
+ * @deprecated 2.1.0 To be replaced with SHA-256 hashing.
+ * @var string 40 digit hexadecimal hash (160 bits)
+ */
private $sha1;
/**
- * Generates the SHA1 or returns the cached SHA1 hash for the file.
+ * Generates the SHA-1 or returns the cached SHA-1 hash for the file.
*
- * @return string
+ * @deprecated 2.1.0 To be replaced with SHA-256 hashing.
+ * @return string|false $sha1
*/
public function get_sha1()
{
diff --git a/static/includes/database.inc.php b/static/includes/database.inc.php
index 0374afa..7a1d4f9 100644
--- a/static/includes/database.inc.php
+++ b/static/includes/database.inc.php
@@ -1,7 +1,9 @@
<?php
/**
- * Copyright (c) 2013 Peter Lejeck <peter.lejeck@gmail.com>
+ * Prepares a PDO connection between Pomf and a database server.
+ *
+ * @copyright Copyright (c) 2013 Peter Lejeck <peter.lejeck@gmail.com>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -22,7 +24,7 @@
* SOFTWARE.
*/
-include_once 'settings.inc.php';
+require_once 'settings.inc.php';
/* NOTE: we don't have to unref the PDO because we're not long-running */
$db = new PDO(POMF_DB_CONN, POMF_DB_USER, POMF_DB_PASS);
diff --git a/static/includes/settings.inc.php b/static/includes/settings.inc.php
index 6072249..872fde0 100644
--- a/static/includes/settings.inc.php
+++ b/static/includes/settings.inc.php
@@ -1,9 +1,12 @@
<?php
/**
- * Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com>
- * Copyright (c) 2015 cenci0 <alchimist94@gmail.com>
- * Copyright (c) 2015 the Pantsu.cat developers <hostmaster@pantsu.cat>
+ * User configurable settings for Pomf.
+ *
+ * @copyright Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com>
+ * @copyright Copyright (c) 2015 cenci0 <alchimist94@gmail.com>
+ * @copyright Copyright (c) 2015, 2016 the Pantsu.cat developers
+ * <hostmaster@pantsu.cat>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -24,22 +27,70 @@
* SOFTWARE.
*/
-// PDO socket
-// mysql.sock path can be different from /tmp/mysql.sock, see /etc/my.cnf
+/**
+ * PDO connection socket
+ *
+ * Database connection to use for communication. Currently, MySQL is the only
+ * DSN prefix supported.
+ *
+ * @see http://php.net/manual/en/ref.pdo-mysql.connection.php PHP manual for
+ * PDO_MYSQL DSN.
+ * @param string POMF_DB_CONN DSN:host|unix_socket=hostname|path;dbname=database
+ */
define('POMF_DB_CONN', 'mysql:unix_socket=/tmp/mysql.sock;dbname=pomf');
-// MySQL user and password
+
+/**
+ * PDO database login credentials
+ */
+
+/** @param string POMF_DB_NAME Database username */
define('POMF_DB_USER', 'pomf');
+/** @param string POMF_DB_PASS Database password */
define('POMF_DB_PASS', '***');
-// Root location of files
+/**
+ * File system location where to store uploaded files
+ *
+ * @param string Path to directory with trailing delimiter
+ */
define('POMF_FILES_ROOT', '/mnt/pantsu/http/files/');
-// Maximum number of iterations while generating a new filename
+
+/**
+ * Maximum number of iterations while generating a new filename
+ *
+ * Pomf uses an algorithm to generate random filenames. Sometimes a file may
+ * exist under a randomly generated filename, so we count tries and keep trying.
+ * If this value is exceeded, we give up trying to generate a new filename.
+ *
+ * @param int POMF_FILES_RETRIES Number of attempts to retry
+ */
define('POMF_FILES_RETRIES', 15);
-// Number of random characters to use in a new filename
+
+/**
+ * The length of generated filename (without file extension)
+ *
+ * @param int POMF_FILES_LENGTH Number of random alphabetical ASCII characters
+ * to use
+ */
define('POMF_FILES_LENGTH', 6);
-// URL to prepend to output (include trailing slash)
+
+/**
+ * URI to prepend to links for uploaded files
+ *
+ * @param string POMF_URL URI with trailing delimiter
+ */
define('POMF_URL', 'https://i.pantsu.cat/');
+/**
+ * Double dot file extensions
+ *
+ * Pomf keeps the last file extension for the uploaded file. In other words, an
+ * uploaded file with `.tar.gz` extension will be given a random filename which
+ * ends in `.gz` unless configured here to ignore discards for `.tar.gz`.
+ *
+ * @param string[] $doubledots Array of double dot file extensions strings
+ * without the first prefixing dot
+ */
$doubledots = array_map('strrev', array(
'tar.gz',
'tar.bz',
diff --git a/static/upload.php b/static/upload.php
index a37c549..ebedeab 100644
--- a/static/upload.php
+++ b/static/upload.php
@@ -1,10 +1,14 @@
<?php
/**
- * Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com>
- * Copyright (c) 2013, 2014, 2015 Eric Johansson <neku@pomf.se>
- * Copyright (c) 2015 cenci0 <alchimist94@gmail.com>
- * Copyright (c) 2015 the Pantsu.cat developers <hostmaster@pantsu.cat>
+ * Handles POST uploads, generates filenames, moves files around and commits
+ * uploaded metadata to database.
+ *
+ * @copyright Copyright (c) 2013, 2014 Peter Lejeck <peter.lejeck@gmail.com>
+ * @copyright Copyright (c) 2013, 2014, 2015 Eric Johansson <neku@pomf.se>
+ * @copyright Copyright (c) 2015 cenci0 <alchimist94@gmail.com>
+ * @copyright Copyright (c) 2015, 2016 the Pantsu.cat developers
+ * <hostmaster@pantsu.cat>
*
* Permission is hereby granted, free of charge, to any person obtaining a copy
* of this software and associated documentation files (the "Software"), to deal
@@ -26,16 +30,17 @@
*/
// Check if we can compress our output; if we can, we'll do it
+// This feature is deprecated since version 2.1.0.
if (ini_get('zlib.output_compression') !== 'Off'
&& isset($_SERVER['HTTP_ACCEPT_ENCODING'])
&& strpos($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') !== false) {
ob_start('ob_gzhandler');
}
-include_once 'classes/Response.class.php';
-include_once 'classes/UploadException.class.php';
-include_once 'classes/UploadedFile.class.php';
-include_once 'includes/database.inc.php';
+require_once 'classes/Response.class.php';
+require_once 'classes/UploadException.class.php';
+require_once 'classes/UploadedFile.class.php';
+require_once 'includes/database.inc.php';
/**
* Generates a random name for the file, retrying until we get an unused one.
@@ -65,7 +70,8 @@ function generate_name($file)
do {
// Iterate until we reach the maximum number of retries
if ($tries-- === 0) {
- throw new Exception('Gave up trying to find an unused name', 500);
+ throw new Exception('Gave up trying to find an unused name',
+ 500); // HTTP status code "500 Internal Server Error"
}
$chars = range('a', 'z');
@@ -128,37 +134,45 @@ function upload_file($file)
// Generate a name for the file
$newname = generate_name($file);
+ // Store the file's full file path in memory
+ $uploadDir = POMF_FILES_ROOT;
+ $uploadFile = $uploadDir . $newname;
+
// Attempt to move it to the static directory
- if (move_uploaded_file($file->tempfile, POMF_FILES_ROOT.$newname)) {
- // Need to change permissions for the new file to make it world readable
- if (chmod(POMF_FILES_ROOT.$newname, 0644)) {
- // Add it to the database
- $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, '.
- 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, '.
- ':exp, :del)');
-
- // Common parameters binding
- $q->bindValue(':hash', $file->get_sha1(), PDO::PARAM_STR);
- $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR);
- $q->bindValue(':name', $newname, PDO::PARAM_STR);
- $q->bindValue(':size', $file->size, PDO::PARAM_INT);
- $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR);
- $q->bindValue(':exp', null, PDO::PARAM_STR);
- $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR);
- $q->execute();
-
- return array(
- 'hash' => $file->get_sha1(),
- 'name' => $file->name,
- 'url' => POMF_URL.$newname,
- 'size' => $file->size,
- );
- } else {
- throw new Exception('Failed to change file permissions', 500);
- }
- } else {
- throw new Exception('Failed to move file to destination', 500);
+ if (!move_uploaded_file($file->tempfile, $uploadFile)) {
+ throw new Exception('Failed to move file to destination',
+ 500); // HTTP status code "500 Internal Server Error"
+ }
+
+ // Need to change permissions for the new file to make it world readable
+ if (!chmod($uploadFile, 0644)) {
+ throw new Exception('Failed to change file permissions',
+ 500); // HTTP status code "500 Internal Server Error"
}
+
+ // Add it to the database
+ // 'expire' support is deprecated since version 2.1.0. It may be
+ // removed in a future release.
+ $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, '.
+ 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, '.
+ ':exp, :del)');
+
+ // Common parameters binding
+ $q->bindValue(':hash', $file->get_sha1(), PDO::PARAM_STR);
+ $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR);
+ $q->bindValue(':name', $newname, PDO::PARAM_STR);
+ $q->bindValue(':size', $file->size, PDO::PARAM_INT);
+ $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR);
+ $q->bindValue(':exp', null, PDO::PARAM_STR); // Deprecated since version 2.1.0
+ $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR);
+ $q->execute();
+
+ return array(
+ 'hash' => $file->get_sha1(),
+ 'name' => $file->name,
+ 'url' => POMF_URL.$newname,
+ 'size' => $file->size,
+ );
}
/**
@@ -201,7 +215,7 @@ function refiles($files)
$f->tempfile = $file['tmp_name'];
$f->error = $file['error'];
// 'expire' doesn't exist neither in $_FILES nor in UploadedFile;
- // commented out for future implementation
+ // it was never implemented and has been deprecated since version 2.1.0.
//$f->expire = $file['expire'];
$result[] = $f;
}
generated by cgit v1.2.3 (git 2.25.1) at 2026-10-22 11:41:06 +0200