[BUGFIX] Disallow file preview for image/svg+xml files

[jirafeau.git] / lib / functions.php

diff --git a/lib/functions.php b/lib/functions.php
index 53733ca3a16d3b5fdb43ead28b60c3a5e9da100e..6e5c88650422f9e34cbafee1c148fd3c1ac692a1 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -28,7 +28,7 @@ function s2p($s)
     $block_size = 8;
     $p = '';
     for ($i = 0; $i < strlen($s); $i++) {
     $block_size = 8;
     $p = '';
     for ($i = 0; $i < strlen($s); $i++) {

-        $p .= $s{$i};
+        $p .= $s[$i];

         if (($i + 1) % $block_size == 0) {
             $p .= '/';
         }
         if (($i + 1) % $block_size == 0) {
             $p .= '/';
         }


@@ -68,16 +68,16 @@ function base_16_to_64($num)
     # Convert long hex string to bin.
     $size = strlen($num);
     for ($i = 0; $i < $size; $i++) {
     # Convert long hex string to bin.
     $size = strlen($num);
     for ($i = 0; $i < $size; $i++) {

-        $b .= $hex2bin{hexdec($num{$i})};
+        $b .= $hex2bin[hexdec($num[$i])];

     }
     # Convert long bin to base 64.
     $size *= 4;
     for ($i = $size - 6; $i >= 0; $i -= 6) {
     }
     # Convert long bin to base 64.
     $size *= 4;
     for ($i = $size - 6; $i >= 0; $i -= 6) {

-        $o = $m{bindec(substr($b, $i, 6))} . $o;
+        $o = $m[bindec(substr($b, $i, 6))] . $o;

     }
     # Some few bits remaining ?
     if ($i < 0 && $i > -6) {
     }
     # Some few bits remaining ?
     if ($i < 0 && $i > -6) {

-        $o = $m{bindec(substr($b, 0, $i + 6))} . $o;
+        $o = $m[bindec(substr($b, 0, $i + 6))] . $o;

     }
     return $o;
 }
     }
     return $o;
 }


@@ -509,10 +509,15 @@ function jirafeau_upload($file, $one_time_download, $key, $time, $ip, $crypt, $l
 function jirafeau_is_viewable($mime)
 {
     if (!empty($mime)) {
 function jirafeau_is_viewable($mime)
 {
     if (!empty($mime)) {

-        /* Actually, verify if mime-type is an image or a text. */
-        $viewable = array('image', 'text', 'video', 'audio');
+        $viewable = array('image', 'video', 'audio');

         $decomposed = explode('/', $mime);
         $decomposed = explode('/', $mime);

-        return in_array($decomposed[0], $viewable);
+        if (in_array($decomposed[0], $viewable) && strpos($mime, 'image/svg+xml') === false) {
+            return true;
+        }
+        $viewable = array('text/plain');
+        if (in_array($mime, $viewable)) {
+            return true;
+        }

     }
     return false;
 }
     }
     return false;
 }


@@ -843,12 +848,16 @@ function jirafeau_admin_bug_report($cfg)
     $out .= "- mcrypt version: " . phpversion('mcrypt') . "<br/>";
     $php_options =  [
         'post_max_size',
     $out .= "- mcrypt version: " . phpversion('mcrypt') . "<br/>";
     $php_options =  [
         'post_max_size',

-        'upload_max_filesize'
+        'upload_max_filesize',
+        'safe_mode',
+        'max_execution_time',
+        'max_input_time'

     ];
     foreach ($php_options as &$o) {
         $v = ini_get($o);
         $out .= "- $o: " . jirafeau_strval($v) . " (" . gettype($v). ")<br/>";
     }
     ];
     foreach ($php_options as &$o) {
         $v = ini_get($o);
         $out .= "- $o: " . jirafeau_strval($v) . " (" . gettype($v). ")<br/>";
     }

+    $out .= "- can set_time_limit: " . (set_time_limit(0) ? "yes" : "no") . "<br/>";

     $out .= "<br/>";
 
     $out .= "# File permissions<br/>";
     $out .= "<br/>";
 
     $out .= "# File permissions<br/>";


@@ -869,10 +878,15 @@ function jirafeau_admin_bug_report($cfg)
     $out .= "# Browser details<br/>";
     $out .= "<script type='text/javascript' lang='Javascript'>
         // @license magnet:?xt=urn:btih:0b31508aeb0634b347b8270c7bee4d411b5d4109&dn=agpl-3.0.txt AGPL-v3-or-Later
     $out .= "# Browser details<br/>";
     $out .= "<script type='text/javascript' lang='Javascript'>
         // @license magnet:?xt=urn:btih:0b31508aeb0634b347b8270c7bee4d411b5d4109&dn=agpl-3.0.txt AGPL-v3-or-Later

-        document.write('- HTML5 support: ' + (check_html5_file_api() ? 'yes' : 'no') + '<br/>');
-        document.write('- User agent: ' + navigator.userAgent + '<br/>');
+        document.write('- html5 support: ' + (check_html5_file_api() ? 'yes' : 'no') + '<br/>');
+        document.write('- user agent: ' + navigator.userAgent + '<br/>');

         // @license-end
         </script>";
         // @license-end
         </script>";

+    $out .= "<br/>";
+
+    $out .= "# Memory<br/>";
+    $out .= "- memory_get_peak_usage: " . jirafeau_human_size(memory_get_peak_usage()) . "<br/>";
+

     $out .= "</code></fieldset>";
     return $out;
 }
     $out .= "</code></fieldset>";
     return $out;
 }