f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <jerome@jutteau.fr>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define('JIRAFEAU_ROOT', dirname(__FILE__) . '/');
  21
  22 require(JIRAFEAU_ROOT . 'lib/settings.php');
  23 require(JIRAFEAU_ROOT . 'lib/functions.php');
  24 require(JIRAFEAU_ROOT . 'lib/lang.php');
  25
  26 if (!isset($_GET['h']) || empty($_GET['h'])) {
  27     header('Location: ./');
  28     exit;
  29 }
  30
  31 /* Operations may take a long time.
  32  * Be sure PHP's safe mode is off.
  33  */
  34 @set_time_limit(0);
  35 /* Remove errors. */
  36 @error_reporting(0);
  37
  38 $link_name = $_GET['h'];
  39
  40 if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
  41     require(JIRAFEAU_ROOT.'lib/template/header.php');
  42     echo '<div class="error"><p>' . t('FILE_404') . '</p></div>';
  43     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  44     exit;
  45 }
  46
  47 $link = jirafeau_get_link($link_name);
  48 if (count($link) == 0) {
  49     require(JIRAFEAU_ROOT.'lib/template/header.php');
  50     echo '<div class="error"><p>' . t('FILE_404') .
  51     '</p></div>';
  52     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  53     exit;
  54 }
  55
  56 $delete_code = '';
  57 if (isset($_GET['d']) && !empty($_GET['d']) &&  $_GET['d'] != '1') {
  58     $delete_code = $_GET['d'];
  59 }
  60
  61 $crypt_key = '';
  62 if (isset($_GET['k']) && !empty($_GET['k'])) {
  63     $crypt_key = $_GET['k'];
  64 }
  65
  66 $do_download = false;
  67 if (isset($_GET['d']) && $_GET['d'] == '1') {
  68     $do_download = true;
  69 }
  70
  71 $do_preview = false;
  72 if (isset($_GET['p']) && !empty($_GET['p'])) {
  73     $do_preview = true;
  74 }
  75
  76 $p = s2p($link['hash']);
  77 if (!file_exists(VAR_FILES . $p . $link['hash'])) {
  78     jirafeau_delete_link($link_name);
  79     require(JIRAFEAU_ROOT.'lib/template/header.php');
  80     echo '<div class="error"><p>'.t('FILE_NOT_AVAIL').
  81     '</p></div>';
  82     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  83     exit;
  84 }
  85
  86 if (!empty($delete_code) && $delete_code == $link['link_code']) {
  87     require(JIRAFEAU_ROOT.'lib/template/header.php');
  88     if (isset($_POST['do_delete'])) {
  89         jirafeau_delete_link($link_name);
  90         echo '<div class="message"><p>'.t('FILE_DELETED').
  91             '</p></div>';
  92     } else { ?>
  93         <div>
  94         <form action="f.php" method="post" id="submit_delete_post" class="form login">
  95         <input type="hidden" name="do_delete" value=1/>
  96         <fieldset>
  97              <legend> <?php echo t('CONFIRM_DEL') ?> </legend>
  98              <table>
  99              <tr><td>
 100              <?php echo t('GONNA_DEL') . ' "' . jirafeau_escape($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' ?>
 101              </td></tr>
 102              <tr><td>
 103                 <?php echo t('USING_SERVICE'). ' <a href="tos.php" target="_blank" rel="noopener noreferrer">' . t('TOS') . '</a>.' ?>
 104              </td></tr>
 105              <tr><td>
 106                 <input type="submit" id="submit_delete"  value="<?php echo t('DELETE'); ?>"
 107                 onclick="document.getElementById('submit_delete_post').action='<?php echo 'f.php?h=' . $link_name . '&amp;d=' . $delete_code . "';"; ?>
 108                 document.getElementById('submit_delete').submit ();"/>
 109              </td></tr>
 110              </table>
 111          </fieldset></form></div><?php
 112     }
 113     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 114     exit;
 115 }
 116
 117 if ($link['time'] != JIRAFEAU_INFINITY && time() > $link['time']) {
 118     jirafeau_delete_link($link_name);
 119     require(JIRAFEAU_ROOT.'lib/template/header.php');
 120     echo '<div class="error"><p>'.
 121     t('FILE_EXPIRED') . ' ' .
 122     t('FILE_DELETED') .
 123     '</p></div>';
 124     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
 125     exit;
 126 }
 127
 128 if (empty($crypt_key) && $link['crypted']) {
 129     require(JIRAFEAU_ROOT.'lib/template/header.php');
 130     echo '<div class="error"><p>' . t('FILE_404') .
 131     '</p></div>';
 132     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 133     exit;
 134 }
 135
 136 $password_challenged = false;
 137 if (!empty($link['key'])) {
 138     if (!isset($_POST['key'])) {
 139         require(JIRAFEAU_ROOT.'lib/template/header.php');
 140         echo '<div>' .
 141              '<form action="f.php" method="post" id="submit_post" class="form login">'; ?>
 142              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 143         echo '<fieldset>' .
 144              '<legend>' . t('PSW_PROTEC') .
 145              '</legend><table><tr><td>' .
 146              t('GIMME_PSW') . ' : ' .
 147              '<input type = "password" name = "key" />' .
 148              '</td></tr>' .
 149              '<tr><td>' .
 150              t('USING_SERVICE'). ' <a href="tos.php" target="_blank" rel="noopener noreferrer">' . t('TOS') . '</a>.' .
 151              '</td></tr>';
 152
 153         if ($link['onetime'] == 'O') {
 154             echo '<tr><td id="self_destruct">' .
 155                  t('AUTO_DESTRUCT') .
 156                  '</td></tr>';
 157         } ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('DL'); ?>"
 158         onclick="document.getElementById('submit_post').action='<?php
 159         echo 'f.php?h=' . $link_name . '&amp;d=1';
 160         if (!empty($crypt_key)) {
 161             echo '&amp;k=' . urlencode($crypt_key);
 162         } ?>';
 163         document.getElementById('submit_download').submit ();"/><?php
 164         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 165             ?><input type="submit" id = "submit_preview"  value="<?php echo t('PREVIEW'); ?>"
 166             onclick="document.getElementById('submit_post').action='<?php
 167             echo 'f.php?h=' . $link_name . '&amp;p=1';
 168             if (!empty($crypt_key)) {
 169                 echo '&amp;k=' . urlencode($crypt_key);
 170             } ?>';
 171             document.getElementById('submit_preview').submit ();"/><?php
 172
 173         }
 174         echo '</td></tr></table></fieldset></form></div>';
 175         require(JIRAFEAU_ROOT.'lib/template/footer.php');
 176         exit;
 177     } else {
 178         if ($link['key'] == md5($_POST['key'])) {
 179             $password_challenged = true;
 180         } else {
 181             sleep(2);
 182             require(JIRAFEAU_ROOT.'lib/template/header.php');
 183             echo '<div class="error"><p>' . t('ACCESS_KO') .
 184             '</p></div>';
 185             require(JIRAFEAU_ROOT.'lib/template/footer.php');
 186             exit;
 187         }
 188     }
 189 }
 190
 191 if (!$password_challenged && !$do_download && !$do_preview) {
 192     require(JIRAFEAU_ROOT.'lib/template/header.php');
 193     echo '<div>' .
 194              '<form action="f.php" method="post" id="submit_post" class="form download">'; ?>
 195              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 196         echo '<fieldset><legend>' . jirafeau_escape($link['file_name']) . '</legend><table>' .
 197              '<tr><td>' .
 198              t('NOW_DOWNLOADING') . ' "' . jirafeau_escape($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' .
 199              '</td></tr>' .
 200              '<tr><td>' .
 201              t('USING_SERVICE'). ' <a href="tos.php" target="_blank" rel="noopener noreferrer">' . t('TOS') . '</a>.' .
 202              '</td></tr>';
 203
 204     if ($link['onetime'] == 'O') {
 205         echo '<tr><td id="self_destruct">' .
 206                  t('AUTO_DESTRUCT') .
 207                  '</td></tr>';
 208     } ?>
 209         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('DL'); ?>"
 210         onclick="document.getElementById('submit_post').action='<?php
 211         echo 'f.php?h=' . $link_name . '&amp;d=1';
 212     if (!empty($crypt_key)) {
 213         echo '&amp;k=' . urlencode($crypt_key);
 214     } ?>';
 215         document.getElementById('submit_post').submit ();"/><?php
 216
 217         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 218             ?><input type="submit" id = "submit_preview"  value="<?php echo t('PREVIEW'); ?>"
 219             onclick="document.getElementById('submit_post').action='<?php
 220         echo 'f.php?h=' . $link_name . '&amp;p=1';
 221             if (!empty($crypt_key)) {
 222                 echo '&amp;k=' . urlencode($crypt_key);
 223             } ?>';
 224         document.getElementById('submit_post').submit ();"/><?php
 225
 226         }
 227     echo '</td></tr>';
 228     echo '</table></fieldset></form></div>';
 229     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 230     exit;
 231 }
 232
 233 header('HTTP/1.0 200 OK');
 234 header('Content-Length: ' . $link['file_size']);
 235 if (!jirafeau_is_viewable($link['mime_type']) || !$cfg['preview'] || $do_download) {
 236     header('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 237 } else {
 238     header('Content-Disposition: filename="' . $link['file_name'] . '"');
 239 }
 240 header('Content-Type: ' . $link['mime_type']);
 241 if ($cfg['file_hash'] == "md5") {
 242     header('Content-MD5: ' . hex_to_base64($link['hash']));
 243 }
 244 if ($cfg['litespeed_workaround']) {
 245     // Work around that LiteSpeed truncates large files.
 246     // See https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:internal-redirect
 247     if ($_GET['litespeed_workaround'] == 'phase2') {
 248         $file_web_path = preg_replace('#^' . $_SERVER['DOCUMENT_ROOT'] . '#', '', VAR_FILES);
 249         header('X-LiteSpeed-Location: ' . $file_web_path . $p . $link['hash']);
 250     } else {
 251         // Since Content-Type isn't forwarded by LiteSpeed, first
 252         // redirect to the same URL but append the file name.
 253         header('Location: ' . $_SERVER['PHP_SELF'] . '/' . $link['file_name'] . '?' .
 254                $_SERVER['QUERY_STRING'] . '&litespeed_workaround=phase2');
 255     }
 256 }
 257 /* Read encrypted file. */
 258 else if ($link['crypted']) {
 259     /* Init module */
 260     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 261     /* Extract key and iv. */
 262     $hash_key = md5($crypt_key);
 263     $iv = jirafeau_crypt_create_iv($hash_key, mcrypt_enc_get_iv_size($m));
 264     /* Init module. */
 265     mcrypt_generic_init($m, $hash_key, $iv);
 266     /* Decrypt file. */
 267     $r = fopen(VAR_FILES . $p . $link['hash'], 'r');
 268     while (!feof($r)) {
 269         $dec = mdecrypt_generic($m, fread($r, 1024));
 270         print $dec;
 271         ob_flush();
 272     }
 273     fclose($r);
 274     /* Cleanup. */
 275     mcrypt_generic_deinit($m);
 276     mcrypt_module_close($m);
 277 }
 278 /* Read file. */
 279 else {
 280     $r = fopen(VAR_FILES . $p . $link['hash'], 'r');
 281     while (!feof($r)) {
 282         print fread($r, 1024);
 283         ob_flush();
 284     }
 285     fclose($r);
 286 }
 287
 288 if ($link['onetime'] == 'O') {
 289     jirafeau_delete_link($link_name);
 290 }
 291 exit;
 292
 293 ?>