[BUGFIX] Disallow file preview for image/svg+xml files

[jirafeau.git] / lib / functions.php

diff --git a/lib/functions.php b/lib/functions.php
index b3dc9045f930dc9462bf5c6cbcdcc7a7daeee72f..6e5c88650422f9e34cbafee1c148fd3c1ac692a1 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -28,7 +28,7 @@ function s2p($s)
     $block_size = 8;
     $p = '';
     for ($i = 0; $i < strlen($s); $i++) {
-        $p .= $s{$i};
+        $p .= $s[$i];
         if (($i + 1) % $block_size == 0) {
             $p .= '/';
         }
@@ -68,16 +68,16 @@ function base_16_to_64($num)
     # Convert long hex string to bin.
     $size = strlen($num);
     for ($i = 0; $i < $size; $i++) {
-        $b .= $hex2bin{hexdec($num{$i})};
+        $b .= $hex2bin[hexdec($num[$i])];
     }
     # Convert long bin to base 64.
     $size *= 4;
     for ($i = $size - 6; $i >= 0; $i -= 6) {
-        $o = $m{bindec(substr($b, $i, 6))} . $o;
+        $o = $m[bindec(substr($b, $i, 6))] . $o;
     }
     # Some few bits remaining ?
     if ($i < 0 && $i > -6) {
-        $o = $m{bindec(substr($b, 0, $i + 6))} . $o;
+        $o = $m[bindec(substr($b, 0, $i + 6))] . $o;
     }
     return $o;
 }
@@ -509,10 +509,15 @@ function jirafeau_upload($file, $one_time_download, $key, $time, $ip, $crypt, $l
 function jirafeau_is_viewable($mime)
 {
     if (!empty($mime)) {
-        /* Actually, verify if mime-type is an image or a text. */
-        $viewable = array('image', 'text', 'video', 'audio');
+        $viewable = array('image', 'video', 'audio');
         $decomposed = explode('/', $mime);
-        return in_array($decomposed[0], $viewable);
+        if (in_array($decomposed[0], $viewable) && strpos($mime, 'image/svg+xml') === false) {
+            return true;
+        }
+        $viewable = array('text/plain');
+        if (in_array($mime, $viewable)) {
+            return true;
+        }
     }
     return false;
 }
@@ -680,7 +685,9 @@ function jirafeau_admin_list($name, $file_hash, $link_hash)
                 echo t('EXPIRE') . ': ' . ($l['time'] == -1 ? '∞' : jirafeau_get_datetimefield($l['time'])) . '<br/>';
                 echo t('ONETIME') . ': ' . ($l['onetime'] == 'O' ? 'Yes' : 'No') . '<br/>';
                 echo t('UPLOAD_DATE') . ': ' . jirafeau_get_datetimefield($l['upload_date']) . '<br/>';
-                echo t('ORIGIN') . ': ' . $l['ip'] . '<br/>';
+                if (strlen($l['ip']) > 0) {
+                    echo t('ORIGIN') . ': ' . $l['ip'] . '<br/>';
+                }
                 echo '</td><td>';
                 echo '<form method="post">' .
                 '<input type = "hidden" name = "action" value = "download"/>' .
@@ -786,6 +793,104 @@ function jirafeau_admin_clean_async()
     }
     return $count;
 }
+
+/**
+ * Better strval function for debug purposes
+ */
+function jirafeau_strval($value)
+{
+    if (gettype($value) == "boolean") {
+        return $value ? 'true' : 'false';
+    }
+    return strval($value);
+}
+
+/**
+ * Show file/folder permissions
+ */
+function jirafeau_fileperms($path)
+{
+    $out = substr(sprintf("%o", @fileperms($path)), -4) . ", ";
+    $out .= "read " . (is_readable($path) ? "OK" : "KO") . ", ";
+    $out .= "write " . (is_writable($path) ? "OK" : "KO");
+    return $out;
+}
+
+/**
+ * Show some useful informations for bug reporting.
+ */
+function jirafeau_admin_bug_report($cfg)
+{
+    $out = "<fieldset><legend>" . t('REPORTING_AN_ISSUE') . "</legend>";
+    $out .= "If you have a problem related to Jirafeau, please <a href='https://gitlab.com/mojo42/Jirafeau/-/issues'>open an issue</a>, explain your problem in english and copy-paste the following content:<br/><br/><code>";
+
+    $out .= "# Jirafeau<br/>";
+    $out .= "- version: " . JIRAFEAU_VERSION . "<br/>";
+    $jirafeau_options = [
+        'debug',
+        'file_hash',
+        'litespeed_workaround',
+        'store_uploader_ip',
+        'installation_done',
+        'enable_crypt',
+        'preview',
+        'maximal_upload_size',
+        'store_uploader_ip'
+    ];
+    foreach ($jirafeau_options as &$o) {
+        $v = $cfg[$o];
+        $out .= "- $o: " . jirafeau_strval($v) . " (" . gettype($v) . ")<br/>";
+    }
+    $out .= "<br/>";
+
+    $out .= "# PHP options<br/>";
+    $out .= "- php version: " . phpversion() . "<br/>";
+    $out .= "- mcrypt version: " . phpversion('mcrypt') . "<br/>";
+    $php_options =  [
+        'post_max_size',
+        'upload_max_filesize',
+        'safe_mode',
+        'max_execution_time',
+        'max_input_time'
+    ];
+    foreach ($php_options as &$o) {
+        $v = ini_get($o);
+        $out .= "- $o: " . jirafeau_strval($v) . " (" . gettype($v). ")<br/>";
+    }
+    $out .= "- can set_time_limit: " . (set_time_limit(0) ? "yes" : "no") . "<br/>";
+    $out .= "<br/>";
+
+    $out .= "# File permissions<br/>";
+    $out .= "- 'var' folder permissions: " . jirafeau_fileperms($cfg['var_root']) . "<br/>";
+    $out .= "- 'file' folder permissions: " . jirafeau_fileperms(VAR_FILES) . "<br/>";
+    $out .= "- 'links' folder permissions: " . jirafeau_fileperms(VAR_LINKS) . "<br/>";
+    $out .= "- 'async' folder permissions: " . jirafeau_fileperms(VAR_ASYNC) . "<br/>";
+    $out .= "<br/>";
+
+    $out .= "# Server details<br/>";
+    $out .= "- server software: " . $_SERVER["SERVER_SOFTWARE"] . "<br/>";
+    $out .= "<br/>";
+
+    $out .= "# OS details<br/>";
+    $out .= "- OS: " . php_uname() . "<br/>";
+    $out .= "<br/>";
+
+    $out .= "# Browser details<br/>";
+    $out .= "<script type='text/javascript' lang='Javascript'>
+        // @license magnet:?xt=urn:btih:0b31508aeb0634b347b8270c7bee4d411b5d4109&dn=agpl-3.0.txt AGPL-v3-or-Later
+        document.write('- html5 support: ' + (check_html5_file_api() ? 'yes' : 'no') + '<br/>');
+        document.write('- user agent: ' + navigator.userAgent + '<br/>');
+        // @license-end
+        </script>";
+    $out .= "<br/>";
+
+    $out .= "# Memory<br/>";
+    $out .= "- memory_get_peak_usage: " . jirafeau_human_size(memory_get_peak_usage()) . "<br/>";
+
+    $out .= "</code></fieldset>";
+    return $out;
+}
+
 /**
  * Read async transfert informations
  * @return array containing informations.
@@ -1426,3 +1531,8 @@ function jirafeau_add_ending_slash($path)
 {
     return $path . ((substr($path, -1) == '/') ? '' : '/');
 }
+
+function jirafeau_default_web_root()
+{
+    return $_SERVER['HTTP_HOST'] . str_replace(basename(__FILE__), '', $_SERVER['REQUEST_URI']);
+}