script.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2015  Jerome Jutteau <jerome@jutteau.fr>
   5  *
   6  *  This program is free software: you can redistribute it and/or modify
   7  *  it under the terms of the GNU Affero General Public License as
   8  *  published by the Free Software Foundation, either version 3 of the
   9  *  License, or (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU Affero General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU Affero General Public License
  17  *  along with this program.  If not, see <https://www.gnu.org/licenses/>.
  18  */
  19
  20 /* This file offer a kind of API for jirafeau. */
  21
  22 define('JIRAFEAU_ROOT', dirname(__FILE__) . '/');
  23
  24 require(JIRAFEAU_ROOT . 'lib/settings.php');
  25 require(JIRAFEAU_ROOT . 'lib/functions.php');
  26 require(JIRAFEAU_ROOT . 'lib/lang.php');
  27
  28 global $script_langages;
  29 $script_langages = array('bash' => 'Bash');
  30
  31 /* Operations may take a long time.
  32  * Be sure PHP's safe mode is off.
  33  */
  34 @set_time_limit(0);
  35
  36 if ($_SERVER['REQUEST_METHOD'] == "GET" && count($_GET) == 0) {
  37     require(JIRAFEAU_ROOT . 'lib/template/header.php');
  38     check_errors($cfg);
  39     if (has_error()) {
  40         show_errors();
  41         require(JIRAFEAU_ROOT . 'lib/template/footer.php');
  42         exit;
  43     } ?>
  44     <div class="info">
  45     <h2>Scripting interface</h2>
  46     <p>This interface permits to script your uploads and downloads.</p>
  47     <p>See <a href="https://gitlab.com/mojo42/Jirafeau/blob/master/script.php">source code</a> of this interface to get available calls :)</p>
  48     <p>You may download a preconfigured <a href="script.php?lang=bash">Bash Script</a> to easily send to and get files from the API via command line.</p>
  49     </div>
  50     <br />
  51     <?php
  52     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
  53     exit;
  54 }
  55
  56 /* Lets use interface now. */
  57 header('Content-Type: text/plain; charset=utf-8');
  58
  59 check_errors($cfg);
  60 if (has_error()) {
  61     echo 'Error 1';
  62     exit;
  63 }
  64
  65 session_start();
  66
  67 /* Upload file */
  68 if (isset($_FILES['file']) && is_writable(VAR_FILES)
  69     && is_writable(VAR_LINKS)) {
  70     if (!jirafeau_user_session_logged()) {
  71         if (isset($_POST['upload_password']) &&
  72             !jirafeau_challenge_upload($cfg, get_ip_address($cfg), $_POST['upload_password'])) {
  73             echo 'Error 3: Invalid password';
  74             exit;
  75         } elseif (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), null)) {
  76             echo 'Error 2: No password nor allowed IP';
  77             exit;
  78         }
  79     }
  80
  81     $key = '';
  82     if (isset($_POST['key'])) {
  83         $key = $_POST['key'];
  84     }
  85
  86     $time = time();
  87     if (!isset($_POST['time']) || !$cfg['availabilities'][$_POST['time']]) {
  88         echo 'Error 4: The parameter time is invalid.';
  89         exit;
  90     } else {
  91         switch ($_POST['time']) {
  92             case 'minute':
  93                 $time += JIRAFEAU_MINUTE;
  94                 break;
  95             case 'hour':
  96                 $time += JIRAFEAU_HOUR;
  97                 break;
  98             case 'day':
  99                 $time += JIRAFEAU_DAY;
 100                 break;
 101             case 'week':
 102                 $time += JIRAFEAU_WEEK;
 103                 break;
 104             case 'fortnight':
 105                 $time += JIRAFEAU_FORTNIGHT;
 106                 break;
 107             case 'month':
 108                 $time += JIRAFEAU_MONTH;
 109                 break;
 110             case 'quarter':
 111                 $time += JIRAFEAU_QUARTER;
 112                 break;
 113             case 'year':
 114                 $time += JIRAFEAU_YEAR;
 115                 break;
 116             default:
 117                 $time = JIRAFEAU_INFINITY;
 118                 break;
 119         }
 120     }
 121
 122     // Check file size
 123     if ($cfg['maximal_upload_size'] > 0 &&
 124         $_FILES['file']['size'] > $cfg['maximal_upload_size'] * 1024 * 1024) {
 125         echo 'Error 5: Your file exceeds the maximum authorized file size.';
 126         exit;
 127     }
 128
 129     // Check if one time download is enabled
 130     if (!$cfg['one_time_download'] && isset($_POST['one_time_download'])) {
 131         echo 'Error 26: One time download is disabled.';
 132         exit;
 133     }
 134
 135     if ($cfg['store_uploader_ip']) {
 136         $ip = get_ip_address($cfg);
 137     } else {
 138         $ip = "";
 139     }
 140
 141     $res = jirafeau_upload(
 142         $_FILES['file'],
 143         isset($_POST['one_time_download']),
 144         $key,
 145         $time,
 146         $ip,
 147         $cfg['enable_crypt'],
 148         $cfg['link_name_length'],
 149         $cfg['file_hash']
 150     );
 151
 152     if (empty($res) || $res['error']['has_error']) {
 153         echo 'Error 6 ' . $res['error']['why'];
 154         exit;
 155     }
 156     /* Print direct link. */
 157     echo $res['link'];
 158     /* Print delete link. */
 159     echo NL;
 160     echo $res['delete_link'];
 161     /* Print decrypt key. */
 162     echo NL;
 163     echo urlencode($res['crypt_key']);
 164 } elseif (isset($_GET['h'])) {
 165     $link_name = $_GET['h'];
 166     $key = '';
 167     if (isset($_POST['key'])) {
 168         $key = $_POST['key'];
 169     }
 170     $d = '';
 171     if (isset($_GET['d'])) {
 172         $d = $_GET['d'];
 173     }
 174
 175     if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
 176         echo 'Error 7';
 177         exit;
 178     }
 179
 180     $link = jirafeau_get_link($link_name);
 181     if (count($link) == 0) {
 182         echo 'Error 8';
 183         exit;
 184     }
 185     if (strlen($d) > 0 && $d == $link['link_code']) {
 186         jirafeau_delete_link($link_name);
 187         echo "Ok";
 188         exit;
 189     }
 190     if ($link['time'] != JIRAFEAU_INFINITY && time() > $link['time']) {
 191         jirafeau_delete_link($link_name);
 192         echo 'Error 9';
 193         exit;
 194     }
 195     if (strlen($link['key']) > 0 && md5($key) != $link['key']) {
 196         sleep(2);
 197         echo 'Error 10';
 198         exit;
 199     }
 200     $p = s2p($link['hash']);
 201     if (!file_exists(VAR_FILES . $p . $link['hash'])) {
 202         echo 'Error 11';
 203         exit;
 204     }
 205
 206     /* Read file. */
 207     header('Content-Length: ' . $link['file_size']);
 208     header('Content-Type: ' . $link['mime_type']);
 209     header('Content-Disposition: attachment; filename="' .
 210             $link['file_name'] . '"');
 211
 212     $r = fopen(VAR_FILES . $p . $link['hash'], 'r');
 213     while (!feof($r)) {
 214         print fread($r, 1024);
 215     }
 216     fclose($r);
 217
 218     if ($link['onetime'] == 'O') {
 219         jirafeau_delete_link($link_name);
 220     }
 221     exit;
 222 } elseif (isset($_GET['get_capacity'])) {
 223     echo jirafeau_get_max_upload_size_bytes();
 224 } elseif (isset($_GET['get_maximal_upload_size'])) {
 225     echo $cfg['maximal_upload_size'];
 226 } elseif (isset($_GET['get_version'])) {
 227     echo JIRAFEAU_VERSION;
 228 } elseif (isset($_GET['lang'])) {
 229     $l=$_GET['lang'];
 230     if ($l == "bash") {
 231         ?>
 232 #!/bin/bash
 233
 234 # This script has been auto-generated by Jirafeau but you can still edit options below.
 235
 236 # Config begin
 237 proxy='' # Or set JIRAFEAU_PROXY.
 238 url='<?php echo $cfg['web_root']; ?>' # Or set JIRAFEAU_URL.
 239 time='<?php echo $cfg['availability_default']; ?>' # Or set JIRAFEAU_TIME.
 240 one_time='' # Or set JIRAFEAU_ONE_TIME.
 241 curl='' # Or set JIRAFEAU_CURL_PATH.
 242 upload_password='' # Or set JIRAFEAU_UPLOAD_PASSWD
 243 # Config end
 244
 245 if [ -n "$JIRAFEAU_PROXY" ]; then
 246     proxy="$JIRAFEAU_PROXY"
 247 fi
 248
 249 if [ -n "$JIRAFEAU_URL" ]; then
 250     url="$JIRAFEAU_URL"
 251 fi
 252
 253 if [ -z "$url" ]; then
 254     echo "Please set url in script parameters or export JIRAFEAU_URL"
 255 fi
 256
 257 if [ -n "$JIRAFEAU_TIME" ]; then
 258     time="$JIRAFEAU_TIME"
 259 fi
 260
 261 if [ -n "$JIRAFEAU_ONE_TIME" ]; then
 262     one_time='1'
 263 fi
 264
 265 if [ -n "$JIRAFEAU_UPLOAD_PASSWD" ]; then
 266     upload_password="$JIRAFEAU_UPLOAD_PASSWD"
 267 fi
 268
 269 if [ -z "$curl" ]; then
 270     curl="$JIRAFEAU_CURL_PATH"
 271 fi
 272
 273 if [ -z "$curl" ] && [ -e "/usr/bin/curl" ]; then
 274     curl="/usr/bin/curl"
 275 fi
 276
 277 if [ -z "$curl" ] && [ -e "/bin/curl.exe" ]; then
 278     curl="/bin/curl.exe"
 279 fi
 280
 281 if [ -z "$curl" ]; then
 282     echo "Please set your curl binary path (by editing this script or export JIRAFEAU_CURL_PATH global variable)."
 283     exit
 284 fi
 285
 286 if [ -z "$2" ]; then
 287     echo "Jirafeau Bash Script <?php echo JIRAFEAU_VERSION; ?>"
 288     echo "--------------------------"
 289     echo "Usage:"
 290     echo "    $0 OPTIONS"
 291     echo
 292     echo "Options:"
 293     echo "    $0 send FILE [PASSWORD]"
 294     echo "    $0 get URL [PASSWORD]"
 295     echo "    $0 delete URL"
 296     echo
 297     echo "Global variables to export:"
 298     echo "    JIRAFEAU_PROXY: Domain and port of proxy server, eg. »proxyserver.example.com:3128«"
 299     echo "    JIRAFEAU_URL : URI to Jirafeau installation with trailing slash, eg. »https://example.com/jirafeau/«"
 300     echo "    JIRAFEAU_TIME : expiration time, eg. »minute«, »hour«, »day«, »week«, fortnight, »month«, »quarter«, »year« or »none«"
 301     echo "    JIRAFEAU_ONE_TIME : self-destroy after first download, eg. »1« to enable or »« (empty) to disable"
 302     echo "    JIRAFEAU_CURL : alternative path to curl binary"
 303     echo "    JIRAFEAU_UPLOAD_PASSWD : upload password"
 304
 305     exit 0
 306 fi
 307
 308 if [ -n "$proxy" ]; then
 309     proxy="-x $proxy"
 310 fi
 311
 312 options=''
 313 if [ -n "$one_time" ]; then
 314     options="$options -F one_time_download=1"
 315 fi
 316
 317 if [ -n "$upload_password" ]; then
 318     options="$options -F upload_password=$upload_password"
 319 fi
 320
 321 password=''
 322 if [ -n "$3" ]; then
 323     password="$3"
 324     options="$options -F key=$password"
 325 fi
 326
 327 apipage='script.php'
 328 downloadpage='f.php'
 329
 330 if [ "$1" == "send" ]; then
 331     if [ ! -f "$2" ]; then
 332         echo "File \"$2\" does not exists."
 333         exit
 334     fi
 335
 336     # Ret result
 337     res=$($curl -X POST --http1.0 $proxy $options \
 338                   -F "time=$time" \
 339                   -F "file=@$2" \
 340                   $url$apipage)
 341
 342     if [[ "$res" == Error* ]]; then
 343         echo "Error while uploading."
 344         echo $res
 345         exit
 346     fi
 347
 348     # Not using head or tail to minimise command dependencies
 349     code=$(cnt=0; echo "$res" | while read l; do
 350         if [[ "$cnt" == "0" ]]; then
 351             echo "$l"
 352         fi
 353         cnt=$(( cnt + 1 ))
 354         done)
 355     del_code=$(cnt=0; echo "$res" | while read l; do
 356         if [[ "$cnt" == "1" ]]; then
 357             echo "$l"
 358         fi
 359         cnt=$(( cnt + 1 ))
 360         done)
 361     key_code=$(cnt=0; echo "$res" | while read l; do
 362         if [[ "$cnt" == "2" ]]; then
 363             echo "$l"
 364         fi
 365         cnt=$(( cnt + 1 ))
 366         done)
 367
 368     echo
 369     echo "Download page:"
 370     if [[ $key_code ]]; then
 371         echo "    ${url}${downloadpage}?h=$code&k=$key_code"
 372     else
 373         echo "    ${url}${downloadpage}?h=$code"
 374     fi
 375     echo "Direct download:"
 376     if [[ $key_code ]]; then
 377         echo "    ${url}${downloadpage}?h=$code&k=$key_code&d=1"
 378     else
 379         echo "    ${url}${downloadpage}?h=$code&d=1"
 380     fi
 381     echo "Delete link:"
 382     echo "    ${url}${downloadpage}?h=$code&d=$del_code"
 383     echo
 384     echo "Download via API:"
 385     if [[ $key_code ]]; then
 386         echo "    ${0} get ${url}${apipage}?h=$code&k=$key_code [PASSWORD]"
 387     else
 388         echo "    ${0} get ${url}${apipage}?h=$code [PASSWORD]"
 389     fi
 390     echo "Delete via API:"
 391     echo "    ${0} delete \"${url}${downloadpage}?h=$code&d=$del_code\""
 392
 393 elif [ "$1" == "get" ]; then
 394     if [ -z "$password" ]; then
 395         $curl $proxy -OJ "$2"
 396     else
 397         $curl $proxy -OJ -X POST -F key=$password "$2"
 398     fi
 399 elif [ "$1" == "delete" ]; then
 400     $curl $proxy "$2" --data-raw "do_delete=1%2F" | grep "div class" |sed -e "s/<[^>]\+>//g"
 401 fi
 402 <?php
 403     } else {
 404         echo 'Error 12';
 405         exit;
 406     }
 407 }
 408 /* Initialize an asynchronous upload. */
 409 elseif (isset($_GET['init_async'])) {
 410     if (jirafeau_user_session_logged()) {
 411     } elseif (isset($_POST['upload_password'])) {
 412         if (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), $_POST['upload_password'])) {
 413             echo 'Error 20: Invalid password';
 414             exit;
 415         }
 416     } else {
 417         if (!jirafeau_challenge_upload($cfg, get_ip_address($cfg), null)) {
 418             echo 'Error 19: No password nor allowed IP';
 419             exit;
 420         }
 421     }
 422
 423     if (!isset($_POST['filename'])) {
 424         echo 'Error 21';
 425         exit;
 426     }
 427
 428     $type = '';
 429     if (isset($_POST['type'])) {
 430         $type = $_POST['type'];
 431     }
 432
 433     $key = '';
 434     if (isset($_POST['key'])) {
 435         $key = $_POST['key'];
 436     }
 437
 438     // Check if one time download is enabled
 439     if (!$cfg['one_time_download'] && isset($_POST['one_time_download'])) {
 440         echo 'Error 26: One time download is disabled.';
 441         exit;
 442     }
 443
 444     $time = time();
 445     if (!isset($_POST['time']) || !$cfg['availabilities'][$_POST['time']]) {
 446         echo 'Error 22';
 447         exit;
 448     } else {
 449         switch ($_POST['time']) {
 450             case 'minute':
 451                 $time += JIRAFEAU_MINUTE;
 452                 break;
 453             case 'hour':
 454                 $time += JIRAFEAU_HOUR;
 455                 break;
 456             case 'day':
 457                 $time += JIRAFEAU_DAY;
 458                 break;
 459             case 'week':
 460                 $time += JIRAFEAU_WEEK;
 461                 break;
 462             case 'fortnight':
 463                 $time += JIRAFEAU_FORTNIGHT;
 464                 break;
 465             case 'month':
 466                 $time += JIRAFEAU_MONTH;
 467                 break;
 468             case 'quarter':
 469                 $time += JIRAFEAU_QUARTER;
 470                 break;
 471             case 'year':
 472                 $time += JIRAFEAU_YEAR;
 473                 break;
 474             default:
 475                 $time = JIRAFEAU_INFINITY;
 476                 break;
 477         }
 478     }
 479
 480     if ($cfg['store_uploader_ip']) {
 481         $ip = get_ip_address($cfg);
 482     } else {
 483         $ip = "";
 484     }
 485
 486     echo jirafeau_async_init(
 487         $_POST['filename'],
 488         $type,
 489         isset($_POST['one_time_download']),
 490         $key,
 491         $time,
 492         $ip
 493     );
 494 }
 495 /* Continue an asynchronous upload. */
 496 elseif (isset($_GET['push_async'])) {
 497     if ((!isset($_POST['ref']))
 498         || (!isset($_FILES['data']))
 499         || (!isset($_POST['code']))) {
 500         echo 'Error 23';
 501     } else {
 502         echo jirafeau_async_push(
 503             $_POST['ref'],
 504             $_FILES['data'],
 505             $_POST['code'],
 506             $cfg['maximal_upload_size']
 507         );
 508     }
 509 }
 510 /* Finalize an asynchronous upload. */
 511 elseif (isset($_GET['end_async'])) {
 512     if (!isset($_POST['ref'])
 513         || !isset($_POST['code'])) {
 514         echo 'Error 24';
 515     } else {
 516         echo jirafeau_async_end($_POST['ref'], $_POST['code'], $cfg['enable_crypt'], $cfg['link_name_length'], $cfg['file_hash']);
 517     }
 518 } else {
 519     echo 'Error 25';
 520 }
 521 exit;
 522 ?>