From de0b847eed784dd3af654665e0fd8325e94c7b1f Mon Sep 17 00:00:00 2001
From: Neku <neku@pomf.se>
Date: Sun, 24 Aug 2014 21:44:27 +0200
Subject: fixed vuln + other ghetto updates

---
 static/upload.php | 79 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 76 insertions(+), 3 deletions(-)

(limited to 'static')

diff --git a/static/upload.php b/static/upload.php
index 2ef06a9..f0adb68 100644
--- a/static/upload.php
+++ b/static/upload.php
@@ -1,4 +1,6 @@
 <?php
+session_start();
+
 //error_reporting(E_ERROR | E_WARNING | E_PARSE);
 include_once 'classes/UploadedFile.class.php';
 //include_once 'includes/database.inc.php'; Included in database.inc.php
@@ -37,7 +39,7 @@ function generate_name ($file) {
 		$newname .= chr(mt_rand(ord("a"), ord("z")));    // + random lowercase letter
 		$newname .= chr(mt_rand(ord("a"), ord("z")));    // + random lowercase letter
 		// To add a dot or not after a file which has no extension
-		if ($ext != '') $newname .= '.' . $ext;
+		if ($ext != '') $newname .= '.' . strip_tags($ext);
 
 	} while (file_exists(POMF_FILES_ROOT . $newname)); // TODO: check the database instead?
 
@@ -58,8 +60,10 @@ function upload_file ($file) {
 	if ($file->error) throw new Exception($file->error);
 
 	// Check if we have a file with that hash in the db
-	$q = $db->prepare("SELECT hash, filename, size FROM files WHERE hash = (:hash)");
+	if(empty($_SESSION['id'])){
+	$q = $db->prepare("SELECT hash, filename, size FROM files WHERE hash = (:hash) AND user = (:user)");
 	$q->bindValue('hash', $file->get_sha1());
+	$q->bindValue('user', '0');
 	$q->execute();
 	$result = $q->fetch();
 
@@ -74,6 +78,7 @@ function upload_file ($file) {
 			'url' => $result['filename'],
 			'size' => $result['size']
 		);
+
 	} else {
 		// Generate a name for the file
 		$newname = generate_name($file);
@@ -84,7 +89,7 @@ function upload_file ($file) {
 			$q = $db->prepare('INSERT INTO files (hash, orginalname, filename, size, date, expire, delid)' .
 			                  'VALUES (:hash, :orig, :name, :size, :date, :expires, :delid)');
 			$q->bindValue(':hash', $file->get_sha1());
-			$q->bindValue(':orig', $file->name);
+			$q->bindValue(':orig', strip_tags($file->name));
 			$q->bindValue(':name', $newname);
 			$q->bindValue(':size', $file->size);
 			$q->bindValue(':date', date('Y-m-d'));
@@ -101,9 +106,76 @@ function upload_file ($file) {
 			throw new Exception('Failed to move file to destination');
 		}
 	}
+}else{//if session exists
+        $q = $db->prepare("SELECT hash, filename, size FROM files WHERE hash = (:hash) AND user = (:user)");
+        $q->bindValue('hash', $file->get_sha1());
+	$q->bindValue('user', $_SESSION['id']);
+        $q->execute();
+        $result = $q->fetch();
+
+        // If we found a file with the same checksums, then we can assume it's a dupe
+        // so we don't bother with it, and just unlink (delete) the tmpfile and return
+        // the previous data.
+        if ($result['hash'] === $file->get_sha1()) {
+                unlink($file->tempfile);
+                return array(
+                        'hash' => $result['hash'],
+                        'name' => $file->name,
+                        'url' => $result['filename'],
+                        'size' => $result['size']
+                );
+
+        } else {
+                // Generate a name for the file
+                $newname = generate_name($file);
+
+                // Attempt to move it to the static directory
+                if (move_uploaded_file($file->tempfile, POMF_FILES_ROOT . $newname)) {
+                        // Add it to the database
+                        $q = $db->prepare('INSERT INTO files (hash, orginalname, filename, size, date, expire, delid, user)' .
+                                          'VALUES (:hash, :orig, :name, :size, :date, :expires, :delid, :user)');
+                        $q->bindValue(':hash', $file->get_sha1());
+                        $q->bindValue(':orig', strip_tags($file->name));
+                        $q->bindValue(':name', $newname);
+                        $q->bindValue(':size', $file->size);
+                        $q->bindValue(':date', date('Y-m-d'));
+                        $q->bindValue(':expires', null);
+                        $q->bindValue(':delid', sha1($file->tempfile));
+                      	$q->bindValue(':user', $_SESSION['id']);
+			$q->execute();
+                        return array(
+                                'hash' => $file->get_sha1(),
+                                'name' => $file->name,
+                                'url' => $newname,
+                                'size' => $file->size
+                        );
+                } else {
+                        throw new Exception('Failed to move file to destination');
+                }
+        }
+}
 }
 
 
+
+//function expirecalc ($in){
+//  switch($in){
+//   case '5': $when=5; break;
+//   case '15': $when=15; break;
+//   case '30': $when=30; break;
+//   case '0': $when=NULL; break;
+//   default: $when=5;
+//   }
+//   if ($when == NULL){
+//     return NULL;
+//}else{
+//     return date('Y-m-d', time() + ($when * 60 * 60 * 24)); }
+//}
+
+
+
+
+
 /**
  * Reorganize the $_FILES array into something saner
  *
@@ -120,6 +192,7 @@ function refiles ($files) {
 		$file->tempfile = $files['tmp_name'][$i];
 		$file->error = $files['error'][$i];
 		$file->size = $files['size'][$i];
+		$file->expire = $files['expire'][$i];
 		$out[] = $file;
 	}
 	return $out;
-- 
cgit v1.2.3