f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/');
  21
  22 require (JIRAFEAU_ROOT . 'lib/lang.php');
  23 require (JIRAFEAU_ROOT . 'lib/config.original.php');
  24 require (JIRAFEAU_ROOT . 'lib/settings.php');
  25 require (JIRAFEAU_ROOT . 'lib/functions.php');
  26
  27 if (!isset ($_GET['h']) || empty ($_GET['h']))
  28 {
  29     header ('Location: ' . $cfg['web_root']);
  30     exit;
  31 }
  32
  33 /* Operations may take a long time.
  34  * Be sure PHP's safe mode is off.
  35  */
  36 @set_time_limit(0);
  37 /* Remove errors. */
  38 @error_reporting(0);
  39
  40 $link_name = $_GET['h'];
  41
  42 if (!preg_match ('/[0-9a-zA-Z_-]+$/', $link_name))
  43 {
  44     require (JIRAFEAU_ROOT.'lib/template/header.php');
  45     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  46     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  47     exit;
  48 }
  49
  50 $link = jirafeau_get_link ($link_name);
  51 if (count ($link) == 0)
  52 {
  53     /* Try alias. */
  54     $alias = jirafeau_get_alias (md5 ($link_name));
  55     if (count ($alias) > 0)
  56         $link = jirafeau_get_link ($alias["destination"]);
  57 }
  58 if (count ($link) == 0)
  59 {
  60     require (JIRAFEAU_ROOT.'lib/template/header.php');
  61     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  62     '</p></div>';
  63     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  64     exit;
  65 }
  66
  67 $delete_code = '';
  68 if (isset ($_GET['d']) && !empty ($_GET['d']) &&  $_GET['d'] != '1')
  69     $delete_code = $_GET['d'];
  70
  71 $crypt_key = '';
  72 if (isset ($_GET['k']) && !empty ($_GET['k']))
  73     $crypt_key = $_GET['k'];
  74
  75 $do_download = false;
  76 if (isset ($_GET['d']) && $_GET['d'] == '1')
  77     $do_download = true;
  78
  79 $do_preview = false;
  80 if (isset ($_GET['p']) && !empty ($_GET['p']))
  81     $do_preview = true;
  82
  83 $p = s2p ($link['md5']);
  84 if (!file_exists (VAR_FILES . $p . $link['md5']))
  85 {
  86     jirafeau_delete_link ($link_name);
  87     require (JIRAFEAU_ROOT.'lib/template/header.php');
  88     echo '<div class="error"><p>'.t('File not available.').
  89     '</p></div>';
  90     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  91     exit;
  92 }
  93
  94 if (!empty ($delete_code) && $delete_code == $link['link_code'])
  95 {
  96     jirafeau_delete_link ($link_name);
  97     require (JIRAFEAU_ROOT.'lib/template/header.php');
  98     echo '<div class="message"><p>'.t('File has been deleted.').
  99      '</p></div>';
 100     require (JIRAFEAU_ROOT.'lib/template/footer.php');
 101     exit;
 102 }
 103
 104 if ($link['time'] != JIRAFEAU_INFINITY && time () > $link['time'])
 105 {
 106     jirafeau_delete_link ($link_name);
 107     require (JIRAFEAU_ROOT.'lib/template/header.php');
 108     echo '<div class="error"><p>'.
 109     t('The time limit of this file has expired.') . ' ' .
 110     t('File has been deleted.') .
 111     '</p></div>';
 112     require (JIRAFEAU_ROOT . 'lib/template/footer.php');
 113     exit;
 114 }
 115
 116 if (empty ($crypt_key) && $link['crypted'])
 117 {
 118     require (JIRAFEAU_ROOT.'lib/template/header.php');
 119     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 120     '</p></div>';
 121     require (JIRAFEAU_ROOT.'lib/template/footer.php');
 122     exit;
 123 }
 124
 125 $password_challenged = false;
 126 if (!empty ($link['key']))
 127 {
 128     if (!isset ($_POST['key']))
 129     {
 130         require (JIRAFEAU_ROOT.'lib/template/header.php');
 131         echo '<div>' .
 132              '<form action = "';
 133         echo $cfg['web_root'] . '/f.php';
 134         echo '" ' .
 135              'method = "post" id = "submit_post">'; ?>
 136              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 137         echo '<fieldset>' .
 138              '<legend>' . t('Password protection') .
 139              '</legend><table><tr><td>' .
 140              t('Give the password of this file') . ' : ' .
 141              '<input type = "password" name = "key" />' .
 142              '</td></tr>' .
 143              '<tr><td>' .
 144              t('By using our services, you accept our'). ' <a href="' . $cfg['web_root'] . '/tos.php' . '">' . t('Term Of Service') . '</a>' .
 145              '</td></tr>';
 146
 147         if ($link['onetime'] == 'O')
 148         {
 149             echo '<tr><td id="self_destruct">' .
 150                  t('Warning, this file will self-destruct after being read') .
 151                  '</td></tr>';
 152         }
 153
 154         ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 155         onclick="document.getElementById('submit_post').action='
 156 <?php
 157         echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;d=1';
 158         if (!empty($crypt_key))
 159             echo '&amp;k=' . urlencode($crypt_key);
 160 ?>';
 161         document.getElementById('submit_download').submit ();"/><?php
 162         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type']))
 163         {
 164             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 165             onclick="document.getElementById('submit_post').action='
 166             <?php
 167             echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;p=1';
 168             if (!empty($crypt_key))
 169                 echo '&amp;k=' . urlencode($crypt_key);
 170             ?>';
 171             document.getElementById('submit_preview').submit ();"/><?php
 172         }
 173         echo '</td></tr></table></fieldset></form></div>';
 174         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 175         exit;
 176     }
 177     else
 178     {
 179         if ($link['key'] == md5 ($_POST['key']))
 180             $password_challenged = true;
 181         else
 182         {
 183             sleep (2);
 184             require (JIRAFEAU_ROOT.'lib/template/header.php');
 185             echo '<div class="error"><p>' . t('Access denied') .
 186             '</p></div>';
 187             require (JIRAFEAU_ROOT.'lib/template/footer.php');
 188             exit;
 189         }
 190     }
 191 }
 192
 193 if (!$password_challenged && !$do_download && !$do_preview)
 194 {
 195         require (JIRAFEAU_ROOT.'lib/template/header.php');
 196         echo '<div>' .
 197              '<form action = "';
 198         echo $cfg['web_root'] . '/f.php';
 199         echo '" ' .
 200              'method = "post" id = "submit_post">'; ?>
 201              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 202         echo '<fieldset><legend>' . htmlspecialchars($link['file_name']) . '</legend><table>' .
 203              '<tr><td>' .
 204              t('You are about to download') . ' "' . htmlspecialchars($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ')' .
 205              '</td></tr>' .
 206              '<tr><td>' .
 207              t('By using our services, you accept our'). ' <a href="' . $cfg['web_root'] . '/tos.php' . '">' . t('Term Of Service') . '</a>' .
 208              '</td></tr>';
 209
 210         if ($link['onetime'] == 'O')
 211         {
 212             echo '<tr><td id="self_destruct">' .
 213                  t('Warning, this file will self-destruct after being read') .
 214                  '</td></tr>';
 215         }
 216
 217         ?>
 218         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 219         onclick="document.getElementById('submit_post').action='
 220 <?php
 221         echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;d=1';
 222         if (!empty($crypt_key))
 223             echo '&amp;k=' . urlencode($crypt_key);
 224 ?>';
 225         document.getElementById('submit_post').submit ();"/><?php
 226
 227         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type']))
 228         {
 229             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 230             onclick="document.getElementById('submit_post').action='
 231 <?php
 232         echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;p=1';
 233         if (!empty($crypt_key))
 234             echo '&amp;k=' . urlencode($crypt_key);
 235 ?>';
 236         document.getElementById('submit_post').submit ();"/><?php
 237         }
 238         echo '</td></tr>';
 239         echo '</table></fieldset></form></div>';
 240         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 241         exit;
 242 }
 243
 244 header ('HTTP/1.0 200 OK');
 245 header ('Content-Length: ' . $link['file_size']);
 246 if (!jirafeau_is_viewable ($link['mime_type']) || !$cfg['preview'] || $do_download)
 247     header ('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 248 else
 249     header ('Content-Disposition: filename="' . $link['file_name'] . '"');
 250 header ('Content-Type: ' . $link['mime_type']);
 251 header ('Content-MD5: ' . hex_to_base64($link['md5']));
 252
 253 /* Read encrypted file. */
 254 if ($link['crypted'])
 255 {
 256     /* Init module */
 257     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 258     /* Extract key and iv. */
 259     $md5_key = md5 ($crypt_key);
 260     $iv = jirafeau_crypt_create_iv ($md5_key, mcrypt_enc_get_iv_size($m));
 261     /* Init module. */
 262     mcrypt_generic_init ($m, $md5_key, $iv);
 263     /* Decrypt file. */
 264     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 265     while (!feof ($r))
 266     {
 267         $dec = mdecrypt_generic($m, fread ($r, 1024));
 268         print $dec;
 269         ob_flush();
 270     }
 271     fclose ($r);
 272     /* Cleanup. */
 273     mcrypt_generic_deinit($m);
 274     mcrypt_module_close($m);
 275 }
 276 /* Read file. */
 277 else
 278 {
 279     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 280     while (!feof ($r))
 281     {
 282         print fread ($r, 1024);
 283         ob_flush();
 284     }
 285     fclose ($r);
 286 }
 287
 288 if ($link['onetime'] == 'O')
 289     jirafeau_delete_link ($link_name);
 290 exit;
 291
 292 ?>