From bbf66982fa132454a6dcff57e155f2fa14644a99 Mon Sep 17 00:00:00 2001 From: Eliot Whalan Date: Sun, 19 Jun 2016 08:21:04 +1000 Subject: Move php directory to php/ to avoid confusion --- Makefile | 2 +- php/classes/Response.class.php | 242 +++++++++++++++++++++++++++ php/classes/UploadException.class.php | 120 +++++++++++++ php/classes/UploadedFile.class.php | 33 ++++ php/grill.php | 17 ++ php/includes/database.inc.php | 30 ++++ php/includes/settings.inc.php | 100 +++++++++++ php/upload.php | 208 +++++++++++++++++++++++ static/php/classes/Response.class.php | 242 --------------------------- static/php/classes/UploadException.class.php | 120 ------------- static/php/classes/UploadedFile.class.php | 33 ---- static/php/grill.php | 17 -- static/php/includes/database.inc.php | 30 ---- static/php/includes/settings.inc.php | 100 ----------- static/php/upload.php | 208 ----------------------- 15 files changed, 751 insertions(+), 751 deletions(-) create mode 100755 php/classes/Response.class.php create mode 100755 php/classes/UploadException.class.php create mode 100644 php/classes/UploadedFile.class.php create mode 100644 php/grill.php create mode 100644 php/includes/database.inc.php create mode 100644 php/includes/settings.inc.php create mode 100644 php/upload.php delete mode 100755 static/php/classes/Response.class.php delete mode 100755 static/php/classes/UploadException.class.php delete mode 100644 static/php/classes/UploadedFile.class.php delete mode 100644 static/php/grill.php delete mode 100644 static/php/includes/database.inc.php delete mode 100644 static/php/includes/settings.inc.php delete mode 100644 static/php/upload.php diff --git a/Makefile b/Makefile index aae3d22..90da669 100644 --- a/Makefile +++ b/Makefile @@ -24,7 +24,7 @@ min-js: @echo "// @license-end" >> ./dist/pomf.min.js copy: - @cp -r ./static/php/* ./dist/ + @cp -r ./php/* ./dist/ @cp ./static/img/*.png ./dist/img @cp ./static/img/favicon.ico ./dist/favicon.ico diff --git a/php/classes/Response.class.php b/php/classes/Response.class.php new file mode 100755 index 0000000..fac7db5 --- /dev/null +++ b/php/classes/Response.class.php @@ -0,0 +1,242 @@ +type = $response_type; + break; + case 'html': + header('Content-Type: text/html; charset=UTF-8'); + $this->type = $response_type; + break; + case 'json': + header('Content-Type: application/json; charset=UTF-8'); + $this->type = $response_type; + break; + case 'gyazo': + // Deprecated API since version 2.0.0, fallback to similar text API + header('Content-Type: text/plain; charset=UTF-8'); + $this->type = 'text'; + break; + case 'text': + header('Content-Type: text/plain; charset=UTF-8'); + $this->type = $response_type; + break; + default: + header('Content-Type: application/json; charset=UTF-8'); + $this->type = 'json'; + $this->error(400, 'Invalid response type. Valid options are: csv, html, json, text.'); + break; + } + } + + /** + * Routes error messages depending on response type. + * + * @param int $code HTTP status code number. + * @param int $desc Descriptive error message. + * @return void + */ + public function error($code, $desc) + { + $response = null; + + switch ($this->type) { + case 'csv': + $response = $this->csvError($desc); + break; + case 'html': + $response = $this->htmlError($code, $desc); + break; + case 'json': + $response = $this->jsonError($code, $desc); + break; + case 'text': + $response = $this->textError($code, $desc); + break; + } + + http_response_code(500); // "500 Internal Server Error" + echo $response; + } + + /** + * Routes success messages depending on response type. + * + * @param mixed[] $files + * @return void + */ + public function send($files) + { + $response = null; + + switch ($this->type) { + case 'csv': + $response = $this->csvSuccess($files); + break; + case 'html': + $response = $this->htmlSuccess($files); + break; + case 'json': + $response = $this->jsonSuccess($files); + break; + case 'text': + $response = $this->textSuccess($files); + break; + } + + http_response_code(200); // "200 OK". Success. + echo $response; + } + + /** + * Indicates with CSV body the request was invalid. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param int $description Descriptive error message. + * @return string Error message in CSV format. + */ + private static function csvError($description) + { + return '"error"'."\r\n"."\"$description\""."\r\n"; + } + + /** + * Indicates with CSV body the request was successful. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param mixed[] $files + * @return string Success message in CSV format. + */ + private static function csvSuccess($files) + { + $result = '"name","url","hash","size"'."\r\n"; + foreach ($files as $file) { + $result .= '"'.$file['name'].'"'.','. + '"'.$file['url'].'"'.','. + '"'.$file['hash'].'"'.','. + '"'.$file['size'].'"'."\r\n"; + } + + return $result; + } + + /** + * Indicates with HTML body the request was invalid. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param int $code HTTP status code number. + * @param int $description Descriptive error message. + * @return string Error message in HTML format. + */ + private static function htmlError($code, $description) + { + return '

ERROR: ('.$code.') '.$description.'

'; + } + + /** + * Indicates with HTML body the request was successful. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param mixed[] $files + * @return string Success message in HTML format. + */ + private static function htmlSuccess($files) + { + $result = ''; + + foreach ($files as $file) { + $result .= ''.$file['url'].'
'; + } + + return $result; + } + + /** + * Indicates with JSON body the request was invalid. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param int $code HTTP status code number. + * @param int $description Descriptive error message. + * @return string Error message in pretty-printed JSON format. + */ + private static function jsonError($code, $description) + { + return json_encode(array( + 'success' => false, + 'errorcode' => $code, + 'description' => $description, + ), JSON_PRETTY_PRINT); + } + + /** + * Indicates with JSON body the request was successful. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param mixed[] $files + * @return string Success message in pretty-printed JSON format. + */ + private static function jsonSuccess($files) + { + return json_encode(array( + 'success' => true, + 'files' => $files, + ), JSON_PRETTY_PRINT); + } + + /** + * Indicates with plain text body the request was invalid. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param int $code HTTP status code number. + * @param int $description Descriptive error message. + * @return string Error message in plain text format. + */ + private static function text_error($code, $description) + { + return 'ERROR: ('.$code.') '.$description; + } + + /** + * Indicates with plain text body the request was successful. + * + * @deprecated 2.1.0 Will be renamed to camelCase format. + * @param mixed[] $files + * @return string Success message in plain text format. + */ + private static function text_success($files) + { + $result = ''; + + foreach ($files as $file) { + $result .= $file['url']."\n"; + } + + return $result; + } +} diff --git a/php/classes/UploadException.class.php b/php/classes/UploadException.class.php new file mode 100755 index 0000000..7740ee6 --- /dev/null +++ b/php/classes/UploadException.class.php @@ -0,0 +1,120 @@ + + * @author Michiel Thalen + * @copyright + * -------------------------------------------------------------------- + * The PHP License, version 3.01 + * Copyright (c) 1999 - 2014 The PHP Group. All rights reserved. + * -------------------------------------------------------------------- + * + * Redistribution and use in source and binary forms, with or without + * modification, is permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in + * the documentation and/or other materials provided with the + * distribution. + * + * 3. The name "PHP" must not be used to endorse or promote products + * derived from this software without prior written permission. For + * written permission, please contact group@php.net. + * + * 4. Products derived from this software may not be called "PHP", nor + * may "PHP" appear in their name, without prior written permission + * from group@php.net. You may indicate that your software works in + * conjunction with PHP by saying "Foo for PHP" instead of calling + * it "PHP Foo" or "phpfoo" + * + * 5. The PHP Group may publish revised and/or new versions of the + * license from time to time. Each version will be given a + * distinguishing version number. + * Once covered code has been published under a particular version + * of the license, you may always continue to use it under the terms + * of that version. You may also choose to use such covered code + * under the terms of any subsequent version of the license + * published by the PHP Group. No one other than the PHP Group has + * the right to modify the terms applicable to covered code created + * under this License. + * + * 6. Redistributions of any form whatsoever must retain the following + * acknowledgment: + * "This product includes PHP software, freely available from + * ". + * + * THIS SOFTWARE IS PROVIDED BY THE PHP DEVELOPMENT TEAM ``AS IS'' AND + * ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE PHP + * DEVELOPMENT TEAM OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, + * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES + * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR + * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) + * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, + * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) + * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED + * OF THE POSSIBILITY OF SUCH DAMAGE. + * + * -------------------------------------------------------------------- + * + * This software consists of voluntary contributions made by many + * individuals on behalf of the PHP Group. + * + * The PHP Group can be contacted via Email at group@php.net. + * + * For more information on the PHP Group and the PHP project, + * please see . + * + * PHP includes the Zend Engine, freely available at + * . + */ + +class UploadException extends Exception +{ + public function __construct($code) + { + $message = $this->codeToMessage($code); + parent::__construct($message, 500); + } + + private function codeToMessage($code) + { + switch ($code) { + case UPLOAD_ERR_INI_SIZE: + $message = 'The uploaded file exceeds the upload_max_filesize directive in php.ini'; + break; + case UPLOAD_ERR_FORM_SIZE: + $message = 'The uploaded file exceeds the MAX_FILE_SIZE directive that was '. + 'specified in the HTML form'; + break; + case UPLOAD_ERR_PARTIAL: + $message = 'The uploaded file was only partially uploaded'; + break; + case UPLOAD_ERR_NO_FILE: + $message = 'No file was uploaded'; + break; + case UPLOAD_ERR_NO_TMP_DIR: + $message = 'Missing a temporary folder'; + break; + case UPLOAD_ERR_CANT_WRITE: + $message = 'Failed to write file to disk'; + break; + case UPLOAD_ERR_EXTENSION: + $message = 'File upload stopped by extension'; + break; + + default: + $message = 'Unknown upload error'; + break; + } + + return $message; + } +} diff --git a/php/classes/UploadedFile.class.php b/php/classes/UploadedFile.class.php new file mode 100644 index 0000000..03b7429 --- /dev/null +++ b/php/classes/UploadedFile.class.php @@ -0,0 +1,33 @@ +sha1) { + $this->sha1 = sha1_file($this->tempfile); + } + + return $this->sha1; + } +} diff --git a/php/grill.php b/php/grill.php new file mode 100644 index 0000000..5984b12 --- /dev/null +++ b/php/grill.php @@ -0,0 +1,17 @@ + + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +require_once 'settings.inc.php'; + +/* NOTE: we don't have to unref the PDO because we're not long-running */ +$db = new PDO(POMF_DB_CONN, POMF_DB_USER, POMF_DB_PASS); diff --git a/php/includes/settings.inc.php b/php/includes/settings.inc.php new file mode 100644 index 0000000..872fde0 --- /dev/null +++ b/php/includes/settings.inc.php @@ -0,0 +1,100 @@ + + * @copyright Copyright (c) 2015 cenci0 + * @copyright Copyright (c) 2015, 2016 the Pantsu.cat developers + * + * + * Permission is hereby granted, free of charge, to any person obtaining a copy + * of this software and associated documentation files (the "Software"), to deal + * in the Software without restriction, including without limitation the rights + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell + * copies of the Software, and to permit persons to whom the Software is + * furnished to do so, subject to the following conditions: + * + * The above copyright notice and this permission notice shall be included in + * all copies or substantial portions of the Software. + * + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE + * SOFTWARE. + */ + +/** + * PDO connection socket + * + * Database connection to use for communication. Currently, MySQL is the only + * DSN prefix supported. + * + * @see http://php.net/manual/en/ref.pdo-mysql.connection.php PHP manual for + * PDO_MYSQL DSN. + * @param string POMF_DB_CONN DSN:host|unix_socket=hostname|path;dbname=database + */ +define('POMF_DB_CONN', 'mysql:unix_socket=/tmp/mysql.sock;dbname=pomf'); + +/** + * PDO database login credentials + */ + +/** @param string POMF_DB_NAME Database username */ +define('POMF_DB_USER', 'pomf'); +/** @param string POMF_DB_PASS Database password */ +define('POMF_DB_PASS', '***'); + +/** + * File system location where to store uploaded files + * + * @param string Path to directory with trailing delimiter + */ +define('POMF_FILES_ROOT', '/mnt/pantsu/http/files/'); + +/** + * Maximum number of iterations while generating a new filename + * + * Pomf uses an algorithm to generate random filenames. Sometimes a file may + * exist under a randomly generated filename, so we count tries and keep trying. + * If this value is exceeded, we give up trying to generate a new filename. + * + * @param int POMF_FILES_RETRIES Number of attempts to retry + */ +define('POMF_FILES_RETRIES', 15); + +/** + * The length of generated filename (without file extension) + * + * @param int POMF_FILES_LENGTH Number of random alphabetical ASCII characters + * to use + */ +define('POMF_FILES_LENGTH', 6); + +/** + * URI to prepend to links for uploaded files + * + * @param string POMF_URL URI with trailing delimiter + */ +define('POMF_URL', 'https://i.pantsu.cat/'); + +/** + * Double dot file extensions + * + * Pomf keeps the last file extension for the uploaded file. In other words, an + * uploaded file with `.tar.gz` extension will be given a random filename which + * ends in `.gz` unless configured here to ignore discards for `.tar.gz`. + * + * @param string[] $doubledots Array of double dot file extensions strings + * without the first prefixing dot + */ +$doubledots = array_map('strrev', array( + 'tar.gz', + 'tar.bz', + 'tar.bz2', + 'tar.xz', + 'user.js', +)); diff --git a/php/upload.php b/php/upload.php new file mode 100644 index 0000000..476120b --- /dev/null +++ b/php/upload.php @@ -0,0 +1,208 @@ +name, PATHINFO_EXTENSION); + + // Check if extension is a double-dot extension and, if true, override $ext + $revname = strrev($file->name); + foreach ($doubledots as $ddot) { + if (stripos($revname, $ddot) === 0) { + $ext = strrev($ddot); + } + } + + do { + // Iterate until we reach the maximum number of retries + if ($tries-- === 0) { + throw new Exception('Gave up trying to find an unused name', + 500); // HTTP status code "500 Internal Server Error" + } + + $chars = range('a', 'z'); + $name = ''; + for ($i = 0; $i < $length; ++$i) { + $name .= $chars[array_rand($chars)]; + } + + // Add the extension to the file name + if (isset($ext) && $ext !== '') { + $name .= '.'.strip_tags($ext); + } + + // Check if a file with the same name does already exist in the database + $q = $db->prepare('SELECT COUNT(filename) FROM files WHERE filename = (:name)'); + $q->bindValue(':name', $name, PDO::PARAM_STR); + $q->execute(); + $result = $q->fetchColumn(); + // If it does, generate a new name + } while ($result > 0); + + return $name; +} + +/** + * Handles the uploading and db entry for a file. + * + * @param UploadedFile $file + * + * @return array + */ +function uploadFile($file) +{ + global $db; + + // Handle file errors + if ($file->error) { + throw new UploadException($file->error); + } + + // Check if a file with the same hash and size (a file which is the same) + // does already exist in the database; if it does, return the proper link + // and data. PHP deletes the temporary file just uploaded automatically. + $q = $db->prepare('SELECT filename, COUNT(*) AS count FROM files WHERE hash = (:hash) '. + 'AND size = (:size)'); + $q->bindValue(':hash', $file->getSha1(), PDO::PARAM_STR); + $q->bindValue(':size', $file->size, PDO::PARAM_INT); + $q->execute(); + $result = $q->fetch(); + if ($result['count'] > 0) { + return array( + 'hash' => $file->getSha1(), + 'name' => $file->name, + 'url' => POMF_URL.$result['filename'], + 'size' => $file->size, + ); + } + + // Generate a name for the file + $newname = generateName($file); + + // Store the file's full file path in memory + $uploadFile = POMF_FILES_ROOT . $newname; + + // Attempt to move it to the static directory + if (!move_uploaded_file($file->tempfile, $uploadFile)) { + throw new Exception('Failed to move file to destination', + 500); // HTTP status code "500 Internal Server Error" + } + + // Need to change permissions for the new file to make it world readable + if (!chmod($uploadFile, 0644)) { + throw new Exception('Failed to change file permissions', + 500); // HTTP status code "500 Internal Server Error" + } + + // Add it to the database + // 'expire' support is deprecated since version 2.1.0. It may be + // removed in a future release. + $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, '. + 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, '. + ':exp, :del)'); + + // Common parameters binding + $q->bindValue(':hash', $file->getSha1(), PDO::PARAM_STR); + $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR); + $q->bindValue(':name', $newname, PDO::PARAM_STR); + $q->bindValue(':size', $file->size, PDO::PARAM_INT); + $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR); + $q->bindValue(':exp', null, PDO::PARAM_STR); // Deprecated since version 2.1.0 + $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR); + $q->execute(); + + return array( + 'hash' => $file->getSha1(), + 'name' => $file->name, + 'url' => POMF_URL.$newname, + 'size' => $file->size, + ); +} + +/** + * Reorder files array by file. + * + * @param $_FILES + * + * @return array + */ +function diverseArray($files) +{ + $result = array(); + + foreach ($files as $key1 => $value1) { + foreach ($value1 as $key2 => $value2) { + $result[$key2][$key1] = $value2; + } + } + + return $result; +} + +/** + * Reorganize the $_FILES array into something saner. + * + * @param $_FILES + * + * @return array + */ +function refiles($files) +{ + $result = array(); + $files = diverseArray($files); + + foreach ($files as $file) { + $f = new UploadedFile(); + $f->name = $file['name']; + $f->mime = $file['type']; + $f->size = $file['size']; + $f->tempfile = $file['tmp_name']; + $f->error = $file['error']; + // 'expire' doesn't exist neither in $_FILES nor in UploadedFile; + // it was never implemented and has been deprecated since version 2.1.0. + //$f->expire = $file['expire']; + $result[] = $f; + } + + return $result; +} + +$type = isset($_GET['output']) ? $_GET['output'] : 'json'; +$response = new Response($type); + +if (isset($_FILES['files'])) { + $uploads = refiles($_FILES['files']); + + try { + foreach ($uploads as $upload) { + $res[] = uploadFile($upload); + } + $response->send($res); + } catch (Exception $e) { + $response->error($e->getCode(), $e->getMessage()); + } +} else { + $response->error(400, 'No input file(s)'); +} diff --git a/static/php/classes/Response.class.php b/static/php/classes/Response.class.php deleted file mode 100755 index fac7db5..0000000 --- a/static/php/classes/Response.class.php +++ /dev/null @@ -1,242 +0,0 @@ -type = $response_type; - break; - case 'html': - header('Content-Type: text/html; charset=UTF-8'); - $this->type = $response_type; - break; - case 'json': - header('Content-Type: application/json; charset=UTF-8'); - $this->type = $response_type; - break; - case 'gyazo': - // Deprecated API since version 2.0.0, fallback to similar text API - header('Content-Type: text/plain; charset=UTF-8'); - $this->type = 'text'; - break; - case 'text': - header('Content-Type: text/plain; charset=UTF-8'); - $this->type = $response_type; - break; - default: - header('Content-Type: application/json; charset=UTF-8'); - $this->type = 'json'; - $this->error(400, 'Invalid response type. Valid options are: csv, html, json, text.'); - break; - } - } - - /** - * Routes error messages depending on response type. - * - * @param int $code HTTP status code number. - * @param int $desc Descriptive error message. - * @return void - */ - public function error($code, $desc) - { - $response = null; - - switch ($this->type) { - case 'csv': - $response = $this->csvError($desc); - break; - case 'html': - $response = $this->htmlError($code, $desc); - break; - case 'json': - $response = $this->jsonError($code, $desc); - break; - case 'text': - $response = $this->textError($code, $desc); - break; - } - - http_response_code(500); // "500 Internal Server Error" - echo $response; - } - - /** - * Routes success messages depending on response type. - * - * @param mixed[] $files - * @return void - */ - public function send($files) - { - $response = null; - - switch ($this->type) { - case 'csv': - $response = $this->csvSuccess($files); - break; - case 'html': - $response = $this->htmlSuccess($files); - break; - case 'json': - $response = $this->jsonSuccess($files); - break; - case 'text': - $response = $this->textSuccess($files); - break; - } - - http_response_code(200); // "200 OK". Success. - echo $response; - } - - /** - * Indicates with CSV body the request was invalid. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param int $description Descriptive error message. - * @return string Error message in CSV format. - */ - private static function csvError($description) - { - return '"error"'."\r\n"."\"$description\""."\r\n"; - } - - /** - * Indicates with CSV body the request was successful. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param mixed[] $files - * @return string Success message in CSV format. - */ - private static function csvSuccess($files) - { - $result = '"name","url","hash","size"'."\r\n"; - foreach ($files as $file) { - $result .= '"'.$file['name'].'"'.','. - '"'.$file['url'].'"'.','. - '"'.$file['hash'].'"'.','. - '"'.$file['size'].'"'."\r\n"; - } - - return $result; - } - - /** - * Indicates with HTML body the request was invalid. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param int $code HTTP status code number. - * @param int $description Descriptive error message. - * @return string Error message in HTML format. - */ - private static function htmlError($code, $description) - { - return '

ERROR: ('.$code.') '.$description.'

'; - } - - /** - * Indicates with HTML body the request was successful. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param mixed[] $files - * @return string Success message in HTML format. - */ - private static function htmlSuccess($files) - { - $result = ''; - - foreach ($files as $file) { - $result .= ''.$file['url'].'
'; - } - - return $result; - } - - /** - * Indicates with JSON body the request was invalid. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param int $code HTTP status code number. - * @param int $description Descriptive error message. - * @return string Error message in pretty-printed JSON format. - */ - private static function jsonError($code, $description) - { - return json_encode(array( - 'success' => false, - 'errorcode' => $code, - 'description' => $description, - ), JSON_PRETTY_PRINT); - } - - /** - * Indicates with JSON body the request was successful. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param mixed[] $files - * @return string Success message in pretty-printed JSON format. - */ - private static function jsonSuccess($files) - { - return json_encode(array( - 'success' => true, - 'files' => $files, - ), JSON_PRETTY_PRINT); - } - - /** - * Indicates with plain text body the request was invalid. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param int $code HTTP status code number. - * @param int $description Descriptive error message. - * @return string Error message in plain text format. - */ - private static function text_error($code, $description) - { - return 'ERROR: ('.$code.') '.$description; - } - - /** - * Indicates with plain text body the request was successful. - * - * @deprecated 2.1.0 Will be renamed to camelCase format. - * @param mixed[] $files - * @return string Success message in plain text format. - */ - private static function text_success($files) - { - $result = ''; - - foreach ($files as $file) { - $result .= $file['url']."\n"; - } - - return $result; - } -} diff --git a/static/php/classes/UploadException.class.php b/static/php/classes/UploadException.class.php deleted file mode 100755 index 7740ee6..0000000 --- a/static/php/classes/UploadException.class.php +++ /dev/null @@ -1,120 +0,0 @@ - - * @author Michiel Thalen - * @copyright - * -------------------------------------------------------------------- - * The PHP License, version 3.01 - * Copyright (c) 1999 - 2014 The PHP Group. All rights reserved. - * -------------------------------------------------------------------- - * - * Redistribution and use in source and binary forms, with or without - * modification, is permitted provided that the following conditions - * are met: - * - * 1. Redistributions of source code must retain the above copyright - * notice, this list of conditions and the following disclaimer. - * - * 2. Redistributions in binary form must reproduce the above copyright - * notice, this list of conditions and the following disclaimer in - * the documentation and/or other materials provided with the - * distribution. - * - * 3. The name "PHP" must not be used to endorse or promote products - * derived from this software without prior written permission. For - * written permission, please contact group@php.net. - * - * 4. Products derived from this software may not be called "PHP", nor - * may "PHP" appear in their name, without prior written permission - * from group@php.net. You may indicate that your software works in - * conjunction with PHP by saying "Foo for PHP" instead of calling - * it "PHP Foo" or "phpfoo" - * - * 5. The PHP Group may publish revised and/or new versions of the - * license from time to time. Each version will be given a - * distinguishing version number. - * Once covered code has been published under a particular version - * of the license, you may always continue to use it under the terms - * of that version. You may also choose to use such covered code - * under the terms of any subsequent version of the license - * published by the PHP Group. No one other than the PHP Group has - * the right to modify the terms applicable to covered code created - * under this License. - * - * 6. Redistributions of any form whatsoever must retain the following - * acknowledgment: - * "This product includes PHP software, freely available from - * ". - * - * THIS SOFTWARE IS PROVIDED BY THE PHP DEVELOPMENT TEAM ``AS IS'' AND - * ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, - * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A - * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE PHP - * DEVELOPMENT TEAM OR ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, - * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES - * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR - * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) - * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, - * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) - * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED - * OF THE POSSIBILITY OF SUCH DAMAGE. - * - * -------------------------------------------------------------------- - * - * This software consists of voluntary contributions made by many - * individuals on behalf of the PHP Group. - * - * The PHP Group can be contacted via Email at group@php.net. - * - * For more information on the PHP Group and the PHP project, - * please see . - * - * PHP includes the Zend Engine, freely available at - * . - */ - -class UploadException extends Exception -{ - public function __construct($code) - { - $message = $this->codeToMessage($code); - parent::__construct($message, 500); - } - - private function codeToMessage($code) - { - switch ($code) { - case UPLOAD_ERR_INI_SIZE: - $message = 'The uploaded file exceeds the upload_max_filesize directive in php.ini'; - break; - case UPLOAD_ERR_FORM_SIZE: - $message = 'The uploaded file exceeds the MAX_FILE_SIZE directive that was '. - 'specified in the HTML form'; - break; - case UPLOAD_ERR_PARTIAL: - $message = 'The uploaded file was only partially uploaded'; - break; - case UPLOAD_ERR_NO_FILE: - $message = 'No file was uploaded'; - break; - case UPLOAD_ERR_NO_TMP_DIR: - $message = 'Missing a temporary folder'; - break; - case UPLOAD_ERR_CANT_WRITE: - $message = 'Failed to write file to disk'; - break; - case UPLOAD_ERR_EXTENSION: - $message = 'File upload stopped by extension'; - break; - - default: - $message = 'Unknown upload error'; - break; - } - - return $message; - } -} diff --git a/static/php/classes/UploadedFile.class.php b/static/php/classes/UploadedFile.class.php deleted file mode 100644 index 03b7429..0000000 --- a/static/php/classes/UploadedFile.class.php +++ /dev/null @@ -1,33 +0,0 @@ -sha1) { - $this->sha1 = sha1_file($this->tempfile); - } - - return $this->sha1; - } -} diff --git a/static/php/grill.php b/static/php/grill.php deleted file mode 100644 index 5984b12..0000000 --- a/static/php/grill.php +++ /dev/null @@ -1,17 +0,0 @@ - - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ - -require_once 'settings.inc.php'; - -/* NOTE: we don't have to unref the PDO because we're not long-running */ -$db = new PDO(POMF_DB_CONN, POMF_DB_USER, POMF_DB_PASS); diff --git a/static/php/includes/settings.inc.php b/static/php/includes/settings.inc.php deleted file mode 100644 index 872fde0..0000000 --- a/static/php/includes/settings.inc.php +++ /dev/null @@ -1,100 +0,0 @@ - - * @copyright Copyright (c) 2015 cenci0 - * @copyright Copyright (c) 2015, 2016 the Pantsu.cat developers - * - * - * Permission is hereby granted, free of charge, to any person obtaining a copy - * of this software and associated documentation files (the "Software"), to deal - * in the Software without restriction, including without limitation the rights - * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell - * copies of the Software, and to permit persons to whom the Software is - * furnished to do so, subject to the following conditions: - * - * The above copyright notice and this permission notice shall be included in - * all copies or substantial portions of the Software. - * - * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR - * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, - * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE - * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER - * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, - * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE - * SOFTWARE. - */ - -/** - * PDO connection socket - * - * Database connection to use for communication. Currently, MySQL is the only - * DSN prefix supported. - * - * @see http://php.net/manual/en/ref.pdo-mysql.connection.php PHP manual for - * PDO_MYSQL DSN. - * @param string POMF_DB_CONN DSN:host|unix_socket=hostname|path;dbname=database - */ -define('POMF_DB_CONN', 'mysql:unix_socket=/tmp/mysql.sock;dbname=pomf'); - -/** - * PDO database login credentials - */ - -/** @param string POMF_DB_NAME Database username */ -define('POMF_DB_USER', 'pomf'); -/** @param string POMF_DB_PASS Database password */ -define('POMF_DB_PASS', '***'); - -/** - * File system location where to store uploaded files - * - * @param string Path to directory with trailing delimiter - */ -define('POMF_FILES_ROOT', '/mnt/pantsu/http/files/'); - -/** - * Maximum number of iterations while generating a new filename - * - * Pomf uses an algorithm to generate random filenames. Sometimes a file may - * exist under a randomly generated filename, so we count tries and keep trying. - * If this value is exceeded, we give up trying to generate a new filename. - * - * @param int POMF_FILES_RETRIES Number of attempts to retry - */ -define('POMF_FILES_RETRIES', 15); - -/** - * The length of generated filename (without file extension) - * - * @param int POMF_FILES_LENGTH Number of random alphabetical ASCII characters - * to use - */ -define('POMF_FILES_LENGTH', 6); - -/** - * URI to prepend to links for uploaded files - * - * @param string POMF_URL URI with trailing delimiter - */ -define('POMF_URL', 'https://i.pantsu.cat/'); - -/** - * Double dot file extensions - * - * Pomf keeps the last file extension for the uploaded file. In other words, an - * uploaded file with `.tar.gz` extension will be given a random filename which - * ends in `.gz` unless configured here to ignore discards for `.tar.gz`. - * - * @param string[] $doubledots Array of double dot file extensions strings - * without the first prefixing dot - */ -$doubledots = array_map('strrev', array( - 'tar.gz', - 'tar.bz', - 'tar.bz2', - 'tar.xz', - 'user.js', -)); diff --git a/static/php/upload.php b/static/php/upload.php deleted file mode 100644 index 476120b..0000000 --- a/static/php/upload.php +++ /dev/null @@ -1,208 +0,0 @@ -name, PATHINFO_EXTENSION); - - // Check if extension is a double-dot extension and, if true, override $ext - $revname = strrev($file->name); - foreach ($doubledots as $ddot) { - if (stripos($revname, $ddot) === 0) { - $ext = strrev($ddot); - } - } - - do { - // Iterate until we reach the maximum number of retries - if ($tries-- === 0) { - throw new Exception('Gave up trying to find an unused name', - 500); // HTTP status code "500 Internal Server Error" - } - - $chars = range('a', 'z'); - $name = ''; - for ($i = 0; $i < $length; ++$i) { - $name .= $chars[array_rand($chars)]; - } - - // Add the extension to the file name - if (isset($ext) && $ext !== '') { - $name .= '.'.strip_tags($ext); - } - - // Check if a file with the same name does already exist in the database - $q = $db->prepare('SELECT COUNT(filename) FROM files WHERE filename = (:name)'); - $q->bindValue(':name', $name, PDO::PARAM_STR); - $q->execute(); - $result = $q->fetchColumn(); - // If it does, generate a new name - } while ($result > 0); - - return $name; -} - -/** - * Handles the uploading and db entry for a file. - * - * @param UploadedFile $file - * - * @return array - */ -function uploadFile($file) -{ - global $db; - - // Handle file errors - if ($file->error) { - throw new UploadException($file->error); - } - - // Check if a file with the same hash and size (a file which is the same) - // does already exist in the database; if it does, return the proper link - // and data. PHP deletes the temporary file just uploaded automatically. - $q = $db->prepare('SELECT filename, COUNT(*) AS count FROM files WHERE hash = (:hash) '. - 'AND size = (:size)'); - $q->bindValue(':hash', $file->getSha1(), PDO::PARAM_STR); - $q->bindValue(':size', $file->size, PDO::PARAM_INT); - $q->execute(); - $result = $q->fetch(); - if ($result['count'] > 0) { - return array( - 'hash' => $file->getSha1(), - 'name' => $file->name, - 'url' => POMF_URL.$result['filename'], - 'size' => $file->size, - ); - } - - // Generate a name for the file - $newname = generateName($file); - - // Store the file's full file path in memory - $uploadFile = POMF_FILES_ROOT . $newname; - - // Attempt to move it to the static directory - if (!move_uploaded_file($file->tempfile, $uploadFile)) { - throw new Exception('Failed to move file to destination', - 500); // HTTP status code "500 Internal Server Error" - } - - // Need to change permissions for the new file to make it world readable - if (!chmod($uploadFile, 0644)) { - throw new Exception('Failed to change file permissions', - 500); // HTTP status code "500 Internal Server Error" - } - - // Add it to the database - // 'expire' support is deprecated since version 2.1.0. It may be - // removed in a future release. - $q = $db->prepare('INSERT INTO files (hash, originalname, filename, size, date, '. - 'expire, delid) VALUES (:hash, :orig, :name, :size, :date, '. - ':exp, :del)'); - - // Common parameters binding - $q->bindValue(':hash', $file->getSha1(), PDO::PARAM_STR); - $q->bindValue(':orig', strip_tags($file->name), PDO::PARAM_STR); - $q->bindValue(':name', $newname, PDO::PARAM_STR); - $q->bindValue(':size', $file->size, PDO::PARAM_INT); - $q->bindValue(':date', date('Y-m-d'), PDO::PARAM_STR); - $q->bindValue(':exp', null, PDO::PARAM_STR); // Deprecated since version 2.1.0 - $q->bindValue(':del', sha1($file->tempfile), PDO::PARAM_STR); - $q->execute(); - - return array( - 'hash' => $file->getSha1(), - 'name' => $file->name, - 'url' => POMF_URL.$newname, - 'size' => $file->size, - ); -} - -/** - * Reorder files array by file. - * - * @param $_FILES - * - * @return array - */ -function diverseArray($files) -{ - $result = array(); - - foreach ($files as $key1 => $value1) { - foreach ($value1 as $key2 => $value2) { - $result[$key2][$key1] = $value2; - } - } - - return $result; -} - -/** - * Reorganize the $_FILES array into something saner. - * - * @param $_FILES - * - * @return array - */ -function refiles($files) -{ - $result = array(); - $files = diverseArray($files); - - foreach ($files as $file) { - $f = new UploadedFile(); - $f->name = $file['name']; - $f->mime = $file['type']; - $f->size = $file['size']; - $f->tempfile = $file['tmp_name']; - $f->error = $file['error']; - // 'expire' doesn't exist neither in $_FILES nor in UploadedFile; - // it was never implemented and has been deprecated since version 2.1.0. - //$f->expire = $file['expire']; - $result[] = $f; - } - - return $result; -} - -$type = isset($_GET['output']) ? $_GET['output'] : 'json'; -$response = new Response($type); - -if (isset($_FILES['files'])) { - $uploads = refiles($_FILES['files']); - - try { - foreach ($uploads as $upload) { - $res[] = uploadFile($upload); - } - $response->send($res); - } catch (Exception $e) { - $response->error($e->getCode(), $e->getMessage()); - } -} else { - $response->error(400, 'No input file(s)'); -} -- cgit v1.2.3