From 66561d4b4fe195b81446c94bdbfdcda4fb7167f7 Mon Sep 17 00:00:00 2001
From: Mandragorat Wandystanu <wktir@wandystan.eu>
Date: Fri, 17 Nov 2017 20:29:47 +0100
Subject: Allow users to upload files only when they're logged in to SSW.

---
 static/php/classes/Login.class.php | 59 ++++++++++++++++++++++++++++++++++++++
 static/php/upload.php              | 27 ++++++++++-------
 2 files changed, 75 insertions(+), 11 deletions(-)
 create mode 100644 static/php/classes/Login.class.php

(limited to 'static/php')

diff --git a/static/php/classes/Login.class.php b/static/php/classes/Login.class.php
new file mode 100644
index 0000000..8c15a7a
--- /dev/null
+++ b/static/php/classes/Login.class.php
@@ -0,0 +1,59 @@
+<?php
+/**
+ * Handles user logins to Wandystan’s systems.
+ *
+ * @copyright Copyright (c) 2017 Paulina Laura Emilia <vilene@posteo.net>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+ * SOFTWARE.
+ */
+class Login
+{
+    /**
+     * Number of seconds in one non-leap year.
+     *
+     * @var int ONE_YEAR
+     */
+    const ONE_YEAR = 31536000;
+
+    /**
+     * Starts a server session and sets correctly the cookie parameters.
+     */
+    public function __construct()
+    {
+        if (session_status() !== PHP_SESSION_NONE) {
+            throw new Exception(
+                'No session support or session already started',
+                500
+            );
+        } else {
+            session_set_cookie_params(self::ONE_YEAR, '/', '.wandystan.eu');
+            session_start();
+        }
+    }
+
+    /**
+     * Check if the user is logged in.
+     *
+     * @return bool
+     */
+    public function isLoggedIn()
+    {
+        return $_SESSION['c2_logowanie'] === 'ON' && !empty($_SESSION['c2_id']);
+    }
+}
diff --git a/static/php/upload.php b/static/php/upload.php
index 1bc74c9..9bb9d3f 100644
--- a/static/php/upload.php
+++ b/static/php/upload.php
@@ -1,11 +1,10 @@
 <?php
-session_start();
-
 /**
  * Handles POST uploads, generates filenames, moves files around and commits
  * uploaded metadata to database.
  */
 
+require_once 'classes/Login.class.php';
 require_once 'classes/Response.class.php';
 require_once 'classes/UploadException.class.php';
 require_once 'classes/UploadedFile.class.php';
@@ -206,20 +205,26 @@ function refiles($files)
     return $result;
 }
 
+$login = new Login();
+
 $type = isset($_GET['output']) ? $_GET['output'] : 'json';
 $response = new Response($type);
 
-if (isset($_FILES['files'])) {
-    $uploads = refiles($_FILES['files']);
+if ($login->isLoggedIn()) {
+    if (isset($_FILES['files'])) {
+        $uploads = refiles($_FILES['files']);
 
-    try {
-        foreach ($uploads as $upload) {
-            $res[] = uploadFile($upload);
+        try {
+            foreach ($uploads as $upload) {
+                $res[] = uploadFile($upload);
+            }
+            $response->send($res);
+        } catch (Exception $e) {
+            $response->error($e->getCode(), $e->getMessage());
         }
-        $response->send($res);
-    } catch (Exception $e) {
-        $response->error($e->getCode(), $e->getMessage());
+    } else {
+        $response->error(400, 'No input file(s)');
     }
 } else {
-    $response->error(400, 'No input file(s)');
+    $response->error(403, 'You are not logged in');
 }
-- 
cgit v1.2.3