f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/');
  21
  22 require (JIRAFEAU_ROOT . 'lib/settings.php');
  23 require (JIRAFEAU_ROOT . 'lib/functions.php');
  24 require (JIRAFEAU_ROOT . 'lib/lang.php');
  25
  26 if (!isset ($_GET['h']) || empty ($_GET['h']))
  27 {
  28     header ('Location: ' . $cfg['web_root']);
  29     exit;
  30 }
  31
  32 /* Operations may take a long time.
  33  * Be sure PHP's safe mode is off.
  34  */
  35 @set_time_limit(0);
  36 /* Remove errors. */
  37 @error_reporting(0);
  38
  39 $link_name = $_GET['h'];
  40
  41 if (!preg_match ('/[0-9a-zA-Z_-]+$/', $link_name))
  42 {
  43     require (JIRAFEAU_ROOT.'lib/template/header.php');
  44     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  45     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  46     exit;
  47 }
  48
  49 $link = jirafeau_get_link ($link_name);
  50 if (count ($link) == 0)
  51 {
  52     /* Try alias. */
  53     $alias = jirafeau_get_alias (md5 ($link_name));
  54     if (count ($alias) > 0)
  55         $link = jirafeau_get_link ($alias["destination"]);
  56 }
  57 if (count ($link) == 0)
  58 {
  59     require (JIRAFEAU_ROOT.'lib/template/header.php');
  60     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  61     '</p></div>';
  62     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  63     exit;
  64 }
  65
  66 $delete_code = '';
  67 if (isset ($_GET['d']) && !empty ($_GET['d']) &&  $_GET['d'] != '1')
  68     $delete_code = $_GET['d'];
  69
  70 $crypt_key = '';
  71 if (isset ($_GET['k']) && !empty ($_GET['k']))
  72     $crypt_key = $_GET['k'];
  73
  74 $do_download = false;
  75 if (isset ($_GET['d']) && $_GET['d'] == '1')
  76     $do_download = true;
  77
  78 $do_preview = false;
  79 if (isset ($_GET['p']) && !empty ($_GET['p']))
  80     $do_preview = true;
  81
  82 $p = s2p ($link['md5']);
  83 if (!file_exists (VAR_FILES . $p . $link['md5']))
  84 {
  85     jirafeau_delete_link ($link_name);
  86     require (JIRAFEAU_ROOT.'lib/template/header.php');
  87     echo '<div class="error"><p>'.t('File not available.').
  88     '</p></div>';
  89     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  90     exit;
  91 }
  92
  93 if (!empty ($delete_code) && $delete_code == $link['link_code'])
  94 {
  95     jirafeau_delete_link ($link_name);
  96     require (JIRAFEAU_ROOT.'lib/template/header.php');
  97     echo '<div class="message"><p>'.t('File has been deleted.').
  98      '</p></div>';
  99     require (JIRAFEAU_ROOT.'lib/template/footer.php');
 100     exit;
 101 }
 102
 103 if ($link['time'] != JIRAFEAU_INFINITY && time () > $link['time'])
 104 {
 105     jirafeau_delete_link ($link_name);
 106     require (JIRAFEAU_ROOT.'lib/template/header.php');
 107     echo '<div class="error"><p>'.
 108     t('The time limit of this file has expired.') . ' ' .
 109     t('File has been deleted.') .
 110     '</p></div>';
 111     require (JIRAFEAU_ROOT . 'lib/template/footer.php');
 112     exit;
 113 }
 114
 115 if (empty ($crypt_key) && $link['crypted'])
 116 {
 117     require (JIRAFEAU_ROOT.'lib/template/header.php');
 118     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 119     '</p></div>';
 120     require (JIRAFEAU_ROOT.'lib/template/footer.php');
 121     exit;
 122 }
 123
 124 $password_challenged = false;
 125 if (!empty ($link['key']))
 126 {
 127     if (!isset ($_POST['key']))
 128     {
 129         require (JIRAFEAU_ROOT.'lib/template/header.php');
 130         echo '<div>' .
 131              '<form action = "';
 132         echo JIRAFEAU_ABSPREFIX . 'f.php';
 133         echo '" ' .
 134              'method = "post" id = "submit_post">'; ?>
 135              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 136         echo '<fieldset>' .
 137              '<legend>' . t('Password protection') .
 138              '</legend><table><tr><td>' .
 139              t('Give the password of this file') . ' : ' .
 140              '<input type = "password" name = "key" />' .
 141              '</td></tr>' .
 142              '<tr><td>' .
 143              t('By using our services, you accept our'). ' <a href="' . JIRAFEAU_ABSPREFIX . 'tos.php' . '">' . t('Terms of Service') . '</a>.' .
 144              '</td></tr>';
 145
 146         if ($link['onetime'] == 'O')
 147         {
 148             echo '<tr><td id="self_destruct">' .
 149                  t('Warning, this file will self-destruct after being read') .
 150                  '</td></tr>';
 151         }
 152
 153         ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 154         onclick="document.getElementById('submit_post').action='<?php
 155         echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;d=1';
 156         if (!empty($crypt_key))
 157             echo '&amp;k=' . urlencode($crypt_key);
 158 ?>';
 159         document.getElementById('submit_download').submit ();"/><?php
 160         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type']))
 161         {
 162             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 163             onclick="document.getElementById('submit_post').action='<?php
 164             echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;p=1';
 165             if (!empty($crypt_key))
 166                 echo '&amp;k=' . urlencode($crypt_key);
 167             ?>';
 168             document.getElementById('submit_preview').submit ();"/><?php
 169         }
 170         echo '</td></tr></table></fieldset></form></div>';
 171         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 172         exit;
 173     }
 174     else
 175     {
 176         if ($link['key'] == md5 ($_POST['key']))
 177             $password_challenged = true;
 178         else
 179         {
 180             sleep (2);
 181             require (JIRAFEAU_ROOT.'lib/template/header.php');
 182             echo '<div class="error"><p>' . t('Access denied') .
 183             '</p></div>';
 184             require (JIRAFEAU_ROOT.'lib/template/footer.php');
 185             exit;
 186         }
 187     }
 188 }
 189
 190 if (!$password_challenged && !$do_download && !$do_preview)
 191 {
 192         require (JIRAFEAU_ROOT.'lib/template/header.php');
 193         echo '<div>' .
 194              '<form action="';
 195         echo JIRAFEAU_ABSPREFIX . 'f.php';
 196         echo '" ' .
 197              'method = "post" id = "submit_post">'; ?>
 198              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 199         echo '<fieldset><legend>' . htmlspecialchars($link['file_name']) . '</legend><table>' .
 200              '<tr><td>' .
 201              t('You are about to download') . ' "' . htmlspecialchars($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' .
 202              '</td></tr>' .
 203              '<tr><td>' .
 204              t('By using our services, you accept our'). ' <a href="' . JIRAFEAU_ABSPREFIX . 'tos.php' . '">' . t('Terms of Service') . '</a>.' .
 205              '</td></tr>';
 206
 207         if ($link['onetime'] == 'O')
 208         {
 209             echo '<tr><td id="self_destruct">' .
 210                  t('Warning, this file will self-destruct after being read') .
 211                  '</td></tr>';
 212         }
 213
 214         ?>
 215         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 216         onclick="document.getElementById('submit_post').action='<?php
 217         echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;d=1';
 218         if (!empty($crypt_key))
 219             echo '&amp;k=' . urlencode($crypt_key);
 220 ?>';
 221         document.getElementById('submit_post').submit ();"/><?php
 222
 223         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type']))
 224         {
 225             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 226             onclick="document.getElementById('submit_post').action='<?php
 227         echo JIRAFEAU_ABSPREFIX . 'f.php?h=' . $link_name . '&amp;p=1';
 228         if (!empty($crypt_key))
 229             echo '&amp;k=' . urlencode($crypt_key);
 230 ?>';
 231         document.getElementById('submit_post').submit ();"/><?php
 232         }
 233         echo '</td></tr>';
 234         echo '</table></fieldset></form></div>';
 235         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 236         exit;
 237 }
 238
 239 header ('HTTP/1.0 200 OK');
 240 header ('Content-Length: ' . $link['file_size']);
 241 if (!jirafeau_is_viewable ($link['mime_type']) || !$cfg['preview'] || $do_download)
 242     header ('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 243 else
 244     header ('Content-Disposition: filename="' . $link['file_name'] . '"');
 245 header ('Content-Type: ' . $link['mime_type']);
 246 header ('Content-MD5: ' . hex_to_base64($link['md5']));
 247
 248 /* Read encrypted file. */
 249 if ($link['crypted'])
 250 {
 251     /* Init module */
 252     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 253     /* Extract key and iv. */
 254     $md5_key = md5 ($crypt_key);
 255     $iv = jirafeau_crypt_create_iv ($md5_key, mcrypt_enc_get_iv_size($m));
 256     /* Init module. */
 257     mcrypt_generic_init ($m, $md5_key, $iv);
 258     /* Decrypt file. */
 259     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 260     while (!feof ($r))
 261     {
 262         $dec = mdecrypt_generic($m, fread ($r, 1024));
 263         print $dec;
 264         ob_flush();
 265     }
 266     fclose ($r);
 267     /* Cleanup. */
 268     mcrypt_generic_deinit($m);
 269     mcrypt_module_close($m);
 270 }
 271 /* Read file. */
 272 else
 273 {
 274     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 275     while (!feof ($r))
 276     {
 277         print fread ($r, 1024);
 278         ob_flush();
 279     }
 280     fclose ($r);
 281 }
 282
 283 if ($link['onetime'] == 'O')
 284     jirafeau_delete_link ($link_name);
 285 exit;
 286
 287 ?>