Escape filenames to not break HTML views

[jirafeau.git] / lib / functions.php

diff --git a/lib/functions.php b/lib/functions.php
index c2cad4653d209eab87a083dff6e359f90644f9d1..0f42e217d7ba380c16e1940333fa85807fcd415e 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -614,7 +614,7 @@ jirafeau_admin_list ($name, $file_hash, $link_hash)
                     continue;
 
                 /* Filter. */
                     continue;
 
                 /* Filter. */

-                if (!empty ($name) && !preg_match ("/$name/i", $l['file_name']))
+                if (!empty ($name) && !preg_match ("/$name/i", htmlspecialchars($l['file_name'])))

                     continue;
                 if (!empty ($file_hash) && $file_hash != $l['md5'])
                     continue;
                     continue;
                 if (!empty ($file_hash) && $file_hash != $l['md5'])
                     continue;


@@ -626,7 +626,7 @@ jirafeau_admin_list ($name, $file_hash, $link_hash)
                 '<form action = "admin.php" method = "post">' .
                 '<input type = "hidden" name = "action" value = "download"/>' .
                 '<input type = "hidden" name = "link" value = "' . $node . '"/>' .
                 '<form action = "admin.php" method = "post">' .
                 '<input type = "hidden" name = "action" value = "download"/>' .
                 '<input type = "hidden" name = "link" value = "' . $node . '"/>' .

-                '<input type = "submit" value = "' . $l['file_name'] . '" />' .
+                '<input type = "submit" value = "' . htmlspecialchars($l['file_name']) . '" />' .

                 '</form>';
                 echo '</td>';
                 echo '<td>' . $l['mime_type'] . '</td>';
                 '</form>';
                 echo '</td>';
                 echo '<td>' . $l['mime_type'] . '</td>';


@@ -1084,3 +1084,64 @@ function jirafeau_challenge_upload_password ($cfg, $password)
     return false;
 }
 
     return false;
 }
 

+/**
+ * Test if visitor's IP is authorized to upload.
+ * @param $ip IP to be challenged
+ * @return true if IP is authorized, false otherwise.
+ */
+function jirafeau_challenge_upload_ip ($cfg, $ip)
+{
+    if (count ($cfg['upload_ip']) == 0)
+        return true;
+    forEach ($cfg['upload_ip'] as $i)
+    {
+        if ($i == $ip)
+            return true;
+        // CIDR test for IPv4 only.
+        if (strpos ($i, '/') !== false)
+        {
+            list ($subnet, $mask) = explode('/', $i);
+            if ((ip2long ($ip) & ~((1 << (32 - $mask)) - 1) ) == ip2long ($subnet))
+                return true;
+        }
+    }
+    return false;
+}
+
+/**
+ * Get the ip address of the client from REMOTE_ADDR
+ * or from HTTP_X_FORWARDED_FOR if behind a proxy
+ * @returns an the client ip address
+ */
+function get_ip_address($cfg) {
+    if (count ($cfg['proxy_ip']) == 0 ||
+        empty ($_SERVER['HTTP_X_FORWARDED_FOR']))
+        return $_SERVER['REMOTE_ADDR'];
+
+    $iplist = explode (',', $_SERVER['HTTP_X_FORWARDED_FOR']);
+    if (count ($iplist) == 0)
+        return $_SERVER['REMOTE_ADDR'];
+
+    foreach ($cfg['proxy_ip'] as $proxy_ip)
+    {
+        if ($_SERVER['REMOTE_ADDR'] != $proxy_ip)
+            continue;
+
+        // Take the last IP (the one which has been set by our proxy).
+        $ip = end($iplist);
+        $ip = preg_replace ('/\s+/', '', $ip);
+        return $ip;
+    }
+    return $_SERVER['REMOTE_ADDR'];
+}
+
+/**
+ * Convert hexadecimal string to base64
+ */
+function hex_to_base64($hex)
+{
+    $b = '';
+    foreach (str_split ($hex, 2) as $pair)
+        $b .= chr (hexdec ($pair));
+    return base64_encode ($b);
+}