f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/');
  21
  22 require (JIRAFEAU_ROOT . 'lib/lang.php');
  23 require (JIRAFEAU_ROOT . 'lib/config.original.php');
  24 require (JIRAFEAU_ROOT . 'lib/settings.php');
  25 require (JIRAFEAU_ROOT . 'lib/functions.php');
  26
  27 if (!isset ($_GET['h']) || empty ($_GET['h']))
  28 {
  29     header ('Location: ' . $cfg['web_root']);
  30     exit;
  31 }
  32
  33 /* Operations may take a long time.
  34  * Be sure PHP's safe mode is off.
  35  */
  36 @set_time_limit(0);
  37 /* Remove errors. */
  38 @error_reporting(0);
  39
  40 $link_name = $_GET['h'];
  41
  42 if (!preg_match ('/[0-9a-zA-Z_-]+$/', $link_name))
  43 {
  44     require (JIRAFEAU_ROOT.'lib/template/header.php');
  45     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  46     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  47     exit;
  48 }
  49
  50 $link = jirafeau_get_link ($link_name);
  51 if (count ($link) == 0)
  52 {
  53     require (JIRAFEAU_ROOT.'lib/template/header.php');
  54     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  55     '</p></div>';
  56     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  57     exit;
  58 }
  59
  60 $delete_code = '';
  61 if (isset ($_GET['d']) && !empty ($_GET['d']) &&  $_GET['d'] != '1')
  62     $delete_code = $_GET['d'];
  63
  64 $crypt_key = '';
  65 if (isset ($_GET['k']) && !empty ($_GET['k']))
  66     $crypt_key = $_GET['k'];
  67
  68 $do_download = false;
  69 if (isset ($_GET['d']) && $_GET['d'] == '1')
  70     $do_download = true;
  71
  72 $do_preview = false;
  73 if (isset ($_GET['p']) && !empty ($_GET['p']))
  74     $do_preview = true;
  75
  76 $p = s2p ($link['md5']);
  77 if (!file_exists (VAR_FILES . $p . $link['md5']))
  78 {
  79     jirafeau_delete_link ($link_name);
  80     require (JIRAFEAU_ROOT.'lib/template/header.php');
  81     echo '<div class="error"><p>'.t('File not available.').
  82     '</p></div>';
  83     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  84     exit;
  85 }
  86
  87 if (!empty ($delete_code) && $delete_code == $link['link_code'])
  88 {
  89     jirafeau_delete_link ($link_name);
  90     require (JIRAFEAU_ROOT.'lib/template/header.php');
  91     echo '<div class="message"><p>'.t('File has been deleted.').
  92      '</p></div>';
  93     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  94     exit;
  95 }
  96
  97 if ($link['time'] != JIRAFEAU_INFINITY && time () > $link['time'])
  98 {
  99     jirafeau_delete_link ($link_name);
 100     require (JIRAFEAU_ROOT.'lib/template/header.php');
 101     echo '<div class="error"><p>'.
 102     t('The time limit of this file has expired.') . ' ' .
 103     t('File has been deleted.') .
 104     '</p></div>';
 105     require (JIRAFEAU_ROOT . 'lib/template/footer.php');
 106     exit;
 107 }
 108
 109 if (empty ($crypt_key) && $link['crypted'])
 110 {
 111     require (JIRAFEAU_ROOT.'lib/template/header.php');
 112     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 113     '</p></div>';
 114     require (JIRAFEAU_ROOT.'lib/template/footer.php');
 115     exit;
 116 }
 117
 118 $password_challenged = false;
 119 if (!empty ($link['key']))
 120 {
 121     if (!isset ($_POST['key']))
 122     {
 123         require (JIRAFEAU_ROOT.'lib/template/header.php');
 124         echo '<div>' .
 125              '<form action = "';
 126         echo $cfg['web_root'] . '/f.php';
 127         echo '" ' .
 128              'method = "post" id = "submit_post">'; ?>
 129              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 130         echo '<fieldset>' .
 131              '<legend>' . t('Password protection') .
 132              '</legend><table><tr><td>' .
 133              t('Give the password of this file') . ' : ' .
 134              '<input type = "password" name = "key" />' .
 135              '</td></tr>' .
 136              '<tr><td>' .
 137              t('By using our services, you accept our'). ' <a href="' . $cfg['web_root'] . '/tos.php' . '">' . t('Term Of Service') . '</a>' .
 138              '</td></tr>' .
 139              '<tr><td>';
 140             ?><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 141             onclick="document.getElementById('submit_post').action='
 142 <?php
 143         echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;d=1';
 144         if (!empty($crypt_key))
 145             echo '&amp;k=' . urlencode($crypt_key);
 146 ?>';
 147         document.getElementById('submit_download').submit ();"/><?php
 148         if ($cfg['download_page'] && $cfg['preview'] && jirafeau_is_viewable($link['mime_type']))
 149         {
 150             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 151             onclick="document.getElementById('submit_post').action='
 152             <?php
 153             echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;p=1';
 154             if (!empty($crypt_key))
 155                 echo '&amp;k=' . urlencode($crypt_key);
 156             ?>';
 157             document.getElementById('submit_preview').submit ();"/><?php
 158         }
 159         echo '</td></tr></table></fieldset></form></div>';
 160         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 161         exit;
 162     }
 163     else
 164     {
 165         if ($link['key'] == md5 ($_POST['key']))
 166             $password_challenged = true;
 167         else
 168         {
 169             header ("Access denied");
 170             require (JIRAFEAU_ROOT.'lib/template/header.php');
 171             echo '<div class="error"><p>' . t('Access denied') .
 172             '</p></div>';
 173             require (JIRAFEAU_ROOT.'lib/template/footer.php');
 174             exit;
 175         }
 176     }
 177 }
 178
 179 if ($cfg['download_page'] && !$password_challenged && !$do_download && !$do_preview)
 180 {
 181         require (JIRAFEAU_ROOT.'lib/template/header.php');
 182         echo '<div>' .
 183              '<form action = "';
 184         echo $cfg['web_root'] . '/f.php';
 185         echo '" ' .
 186              'method = "post" id = "submit_post">'; ?>
 187              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 188         echo '<fieldset><legend>' . $link['file_name'] . '</legend><table>' .
 189              '<tr><td>' .
 190              t('You are about to download') . ' "' . $link['file_name'] . '" (' . jirafeau_human_size($link['file_size']) . ')' .
 191              '</td></tr>' .
 192              '<tr><td>' .
 193              t('By using our services, you accept our'). ' <a href="' . $cfg['web_root'] . '/tos.php' . '">' . t('Term Of Service') . '</a>';
 194             ?></td></tr><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 195             onclick="document.getElementById('submit_post').action='
 196 <?php
 197         echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;d=1';
 198         if (!empty($crypt_key))
 199             echo '&amp;k=' . urlencode($crypt_key);
 200 ?>';
 201         document.getElementById('submit_download').submit ();"/><?php
 202
 203         if ($cfg['download_page'] && $cfg['preview'] && jirafeau_is_viewable($link['mime_type']))
 204         {
 205             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 206             onclick="document.getElementById('submit_post').action='
 207 <?php
 208         echo $cfg['web_root'] . '/f.php?h=' . $link_name . '&amp;p=1';
 209         if (!empty($crypt_key))
 210             echo '&amp;k=' . urlencode($crypt_key);
 211 ?>';
 212         document.getElementById('submit_preview').submit ();"/><?php
 213         }
 214         echo '</td></tr>';
 215         echo '</table></fieldset></form></div>';
 216         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 217         exit;
 218 }
 219
 220 header ('HTTP/1.0 200 OK');
 221 header ('Content-Length: ' . $link['file_size']);
 222 if (!jirafeau_is_viewable ($link['mime_type']) || !$cfg['preview'] || $do_download)
 223     header ('Content-Disposition: attachment; filename="' .
 224         $link['file_name'] . '"');
 225 header ('Content-Type: ' . $link['mime_type']);
 226
 227 /* Read encrypted file. */
 228 if ($link['crypted'])
 229 {
 230     /* Init module */
 231     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 232     /* Extract key and iv. */
 233     $md5_key = md5 ($crypt_key);
 234     $iv = jirafeau_crypt_create_iv ($md5_key, mcrypt_enc_get_iv_size($m));
 235     /* Init module. */
 236     mcrypt_generic_init ($m, $md5_key, $iv);
 237     /* Decrypt file. */
 238     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 239     while (!feof ($r))
 240     {
 241         $dec = mdecrypt_generic($m, fread ($r, 1024));
 242         print $dec;
 243         ob_flush();
 244     }
 245     fclose ($r);
 246     /* Cleanup. */
 247     mcrypt_generic_deinit($m);
 248     mcrypt_module_close($m);
 249 }
 250 /* Read file. */
 251 else
 252 {
 253     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 254     while (!feof ($r))
 255     {
 256         print fread ($r, 1024);
 257         ob_flush();
 258     }
 259     fclose ($r);
 260 }
 261
 262 if ($link['onetime'] == 'O')
 263     jirafeau_delete_link ($link_name);
 264 exit;
 265
 266 ?>