summaryrefslogtreecommitdiff
path: root/static
AgeCommit message (Collapse)Author
2016-01-27Fix undeclared vars in html_success() and text_success()Juuso Lapinlampi
As explained by clsr: > <clsr> With default PHP settings, that'd print a warning, then treat > $result as if it was an empty string before appending. This bug was introduced in commit a92961f24072bc4c3881bf0e2f609562f3703471 and 1411bce1dc13bf6fea66b5899ba29d50d5c53bb0. Reported-by: clsr <clsr@clsr.net> Suggested-by: clsr <clsr@clsr.net>
2016-01-27Add missing newline to Response.class.phpJuuso Lapinlampi
Right before text_error(), there was a missing newline. This bug was introduced in commit a92961f24072bc4c3881bf0e2f609562f3703471.
2016-01-06Amend year 2016 to Response/LICENSE copyrightJuuso Lapinlampi
New code has been added to Response.class.php this year in commit b94ac9a. Update LICENSE and Response.class.php copyright header with year 2016. We can't do this for every file in the project repository unless they are actually changed, due to the way our copyright legislation works. We also can't remove the mention of 2015, because most of the code was initially published in 2015 and so remains copyrighted since that year.
2016-01-06Merge WubTheCaptain's branch 'refactor-response-api'Juuso Lapinlampi
Clean up a lot of the cruft in Response class. Gyazo is deprecated and falls back to 'text' for similar functionality, reducing code duplication. It will be removed in a future release. CSV gets a text/csv Content-Type. CSV linebreaks are also now CRLF, and values are wrapped in quotes. The default error is now a JSON response instead of a generic 400 Bad Request in plaintext. output=json is now explicit and no longer undefined behavior.
2016-01-06Fix gyazo response fallthrough to text responseJuuso Lapinlampi
The gyazo response would return an empty response, because the construct didn't actually fallthrough to text properly. Force gyazo's response type to be 'text' to fix the issue. Accordingly, the 'gyazo' cases for send() and error() now become dead code. Remove them. OK ewhal@
2015-11-16Fix generate_name() imaginary column "pomf" to "files"Juuso Lapinlampi
(Partially reverts commit e0bb4e0.) Actually fix generate_name() COUNT query this time. It still had an imaginary table "pomf" from e0bb4e0. Change it to "files" like in the schema. For code consistency, :filename is reverted back to :name as it was before commit e0bb4e0. That commit is bogus and doesn't fix the issue due to skipping the code review process. The problem with this COUNT query in first place was that it checked imaginary columns (name) from an imaginary table (pomf) in the database. This led to the "same filename" check not working at all, and the other code only relying on checking the same hash (currently SHA-1) for returning the filename before generate_name(). By luck, generated filenames could collide and another file of the same generated filename would be returned, discarding the new upload. I discovered this bug about a month ago myself, but back then there was no reliable way to reproduce it and no good description of the bug. This bug was introduced in commit 5b77a4e. Reported-by: Vhum Vhum <vhumvhum1@gmail.com> Suggested-by: Luminarys <luminarys@fuwa.se> OK ewhal@, luminarys@
2015-11-16Change SQL query from name to filename to resolve duplicate entries in the ↵Eliot Whalan
database
2015-10-27Merge branch 'validate-csv' into refactor-response-apiJuuso Lapinlampi
Validate CSV responses by wrapping them in double quotes and using CRLF linebreaks. CRLF linebreaks are used to conform RFC 4180. Double quotes can be useful to avoid subtle bugs and validation errors. This code is ugly. For future improvement, something like arrays could be used or dropping support for CSV API completely. Vague OKs from ewhal@, luminarys@
2015-10-11Pretty print JSON responsesJuuso Lapinlampi
To understand and document the API, responses should be correct, accurate and human readable. Server-side compression (gzip) will compensate for the extra whitespace. OK ewhal@
2015-10-04JSON-ify the default invalid response type errorJuuso Lapinlampi
Code re-use is good. The previous implementation doesn't reuse existing text_error() functions and also forgoes using text/plain header with the text implementation. This fixes consistency where JSON is assumed to be the default output. It is a common practice among APIs to default all errors to JSON, such as the Stripe and Tumblr APIs.
2015-10-04Clarify Gyazo deprecation warning to use text responseJuuso Lapinlampi
It is a little unclear what the deprecation warning wants the developer to do. The fallthrough comment to text response may not be immediately obvious to the reader. This commit helps to understand the intention and to avoid bugs such as commit daac77a.
2015-10-04Fix empty Gyazo response with more fallthroughsJuuso Lapinlampi
Gyazo didn't fallthrough correctly to text, because the type would be set to Gyazo while the Gyazo case didn't exist. PHP is so ambiguous sometimes. This adds the missing fallthroughs that were removed in commit e39a920. It should now correctly fallthrough ("fallback") to text response.
2015-10-04Wrap CSV response values in double quotes (")Juuso Lapinlampi
While double quotes are mostly optional in implementations, some CSV linters want double quotes for whatever the reason. Assumably, it reduces the amount of bugs and avoids possible parsing errors. This also has very little relevance for not trusting the user input, but better be safe than sorry. This commit is not very pretty. In a future commit, this issue will be addressed with arrays and fputcsv().
2015-10-04Use CRLF linebreaks for CSV responsesJuuso Lapinlampi
RFC 4180 specifies that CSV files should use CRLF (a carriage-return and line-feed pair, e.g. \r\n).
2015-10-04Fix Gyazo response falling through back to text againJuuso Lapinlampi
This fixes a silly mistake where Gyazo would accidentally use the HTML response instead of text as intended. This bug was introduced in commit 2ca5b6b.
2015-09-30Sort Response default case options alphabeticallyJuuso Lapinlampi
This commit improves readability and compliments commit 6d8b204.
2015-09-30Sort Response code lines alphabetically againJuuso Lapinlampi
This commit improves readability.
2015-09-29Remove default undefined behavior from Response classJuuso Lapinlampi
Let's say some user decides to use output "xml". Unexpectedly, the user would instead receive JSON output. This is undefined behavior in its own way and violates the principle of least surprise. Problems could arise if we added "xml" later with actual application/xml or text/xml content. Right now upload.php overrides an empty output argument to json instead, so this seems safe to do. Any non-existent output will now return a 400 Bad Request error.
2015-09-29Sort upload responses alphabeticallyJuuso Lapinlampi
This commit improves readability by swapping text and html response source line order for alphabetical sorting.
2015-09-29Improve consistency by resorting Response.send()Juuso Lapinlampi
This restores the typical sorting order: - csv - (gyazo) - text - html - default (json)
2015-09-29Deprecate Gyazo response, fallthrough to text/plainJuuso Lapinlampi
A majority of the Gyazo code is just copy-pasted text/plain protocol. This will put an end to that insanity. OK ewhal@
2015-09-29Return Content-Type: text/csv with csv upload outputJuuso Lapinlampi
Previously, CSV would return the wrong filetype text/plain and fallthrough. RFC 4180 registers text/csv MIME type. RFC 7111 is closely related and says to use text/csv to launch the correct application.
2015-09-27Merge branch 'remove-moe-code-in-core' of WubTheCaptain/pomfJuuso Lapinlampi
OK ewhal@
2015-09-27Remove session_start(); from upload.phpJuuso Lapinlampi
Moe panel uses PHP sessions to keep the user logged in. We don't need it anymore, it's not required for core functionality.
2015-09-27Merge branch 'php-strict-comparison'Juuso Lapinlampi
OK ewhal@
2015-09-24Remove unused UploadedFile class $crc32 propertyJuuso Lapinlampi
get_crc32() was removed in commit ea6a7a0194 and never in use in the code. It seems Eric forgot to remove this property.
2015-09-24HTML-ify html_error() response with <p>Eliot Whalan
2015-09-24Rename txt_error() to text_error()Eliot Whalan
2015-09-24Remove code that requires moe panelEliot Whalan
2015-09-24Merge remote-tracking branch 'origin/liberate-img'Eliot Whalan
Remove non-free images
2015-09-23static/upload.php: Use strict comparison for $triesJuuso Lapinlampi
2015-09-23Add Expat copyright headers to PHP filesJuuso Lapinlampi
Interestingly, static/classes/UploadedFile.class.php is not licensed under Expat license. Because it was posted in PHP.net comments, I believe it's under the PHP license.
2015-09-23Remove now-dead code for kawaii grill imagesJuuso Lapinlampi
2015-09-21Clean up HTML response construct, uppercase UTF-8WubTheCaptain
IANA has registered UTF-8 as uppercase, hyphenated. The RFC concerning UTF-8, RFC 3629 also uses this grammar. RFC 2231 says the Content-Type charset value should be: charset := <registered character set name> RFC 5987 further emphasizes this: charset = "UTF-8" / "ISO-8859-1" / mime-charset Therefore lowercase "utf-8" in Content-Type responses is technically incorrect, but case-insensitive according to RFC 2616. Thanks to pantsucat for researching this with me.
2015-09-19Fix whitespace and restore PSR-2 styleWubTheCaptain
2015-09-18Fix url generation bugpantsucat
2015-09-18Revert ShareX / URL change commitsWubTheCaptain
These commits are ShareX issues, not Pomf issues. Allowing these commits to be in the source reduces maintainability. This reverts commits bbcffe8d745937677352edf25e6a250ca8fd507b, 943e7e62a8ca814d47168bcebf2cc92dbce9a45a and partially 1411bce1dc13bf6fea66b5899ba29d50d5c53bb0.
2015-09-18Add text response classpantsucat
2015-09-17Fix url generation bugpantsucat
2015-09-17Add html response classpantsucat
2015-09-17Fix to work with sharexpantsucat
2015-09-16Indent and format project to PSR-2 styleWubTheCaptain
PSR-2 [1] is a highly regarded style guide in the PHP community according to Stack Overflow [2]. The indentation was out of place in the source code. I've seen a combination of 1 space tabs, 3 space tabs, 4 space tabs and 5 space tabs. Some closing braces on the same line and a lot of the code (especially moe code) had reached the point of losing readability. Converted with php-cs-fixer and some hand adjustment. [1]: http://www.php-fig.org/psr/psr-2/ [2]: https://stackoverflow.com/questions/3638083/list-of-highly-regarded -php-style-guides
2015-09-15Use unix_socket=/tmp/mysql.sock in POMF_DB_CONNWubTheCaptain
2015-09-15Rework generate_name() logicWubTheCaptain
Adds a new config option POMF_FILES_LENGTH. This will allow the user to adjust the length of filenames. Defaults to 6. The filename generator never used character z in new filenames. There are 27 characters in a-z, but the old code uses a magic number of 26 characters. This bug was introduced in commit 5b77a4eaab418836820b2a0bad7c88f0b88136a0. Instead of relying on magic numbers like with mt_rand(), conveniently use arrays with array_rand() instead. More characters can be added with array_merge() in future if desired.
2015-09-15Full git history nowpantsucat
2015-08-15Update upload.phpEric Johansson (neku)
2015-06-24pass full urlKieran Harkin
2015-06-24pass full url back to clientKieran Harkin
2015-06-13Update UploadedFile.class.phpEric Johansson (neku)
crc32 isn't used
2015-02-03Minor code refactoring and updatescenci0
DATABASE UPDATE: `orginalname` renamed to `originalname` (run update.sql to update `files` table). Run `update.sql` to update your database, no data will be lost (if you don't update it, pomf won't work properly). `schema.sql` - `id`s are now unsigned to double the maximum number of supported indexes - `size` and `user` columns are unsigned too (we can't have a negative file size or a negative user id) `static/classes/Response.class.php` New class to manage responses and errors. Using a class for responses makes the code cleaner and easier to add new response type handlers in the future. - The response type is declared while a new variable is initialized and the `error` and `send` methods will print a proper output according to it - The header for the response is also set accordingly to the response type (`text/plain` for `csv`/`gyazo` output, `application/json` for `json` output) `static/classes/UploadException.class.php` `Exception` class extension to manage errors that may have occurred while uploading files to the server. This way every error is reported in detail. `static/includes/settings.inc.php` - `POMF_URL`: add an option to set the domain of the url to prepend to the newly generated filename (before it was hardcoded and it was `http://a.pomf.se/`) [this option is currently used only when the output is set to `gyazo`] `upload.php` - Add functions calls at the beginning to enable the output compression if possible (gzipped output) - Include new classes - `generate_name ()` --- The new name generation algorithm is basically the same of the old one, but it's easier to add/remove characters if needed (eg. lower-case letters isn't enough and you need to add capital-case letters or digits) --- Check directly the database instead of the filesystem to see if a generated filename is already in use - `upload_file ()` --- File errors generate a `UploadException` instead of a normal `Exception` --- Move common code outside the `if` to avoid useless code repetition (only the query is now inside the condition) --- Change file permissions of a file after moving it to the new directory (if the user didn't set a mask previouly these files wouldn't be world readable, we make sure they are) - `diverse_array ()` --- Function to reorder initial `$_FILES` array (easier to handle for `refiles`) - `refiles ()` --- Use a `foreach` cicle instead of a `for` one, easier to understand - Create a new response object and set its response type (`csv`, `gyazo` or default to `json`) - Edit response handling according to the new response class
generated by cgit v1.2.3 (git 2.25.1) at 2026-10-22 08:06:27 +0200