f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <jerome@jutteau.fr>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define('JIRAFEAU_ROOT', dirname(__FILE__) . '/');
  21
  22 require(JIRAFEAU_ROOT . 'lib/settings.php');
  23 require(JIRAFEAU_ROOT . 'lib/functions.php');
  24 require(JIRAFEAU_ROOT . 'lib/lang.php');
  25
  26 if (!isset($_GET['h']) || empty($_GET['h'])) {
  27     header('Location: ./');
  28     exit;
  29 }
  30
  31 /* Operations may take a long time.
  32  * Be sure PHP's safe mode is off.
  33  */
  34 @set_time_limit(0);
  35
  36 $link_name = $_GET['h'];
  37
  38 if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
  39     require(JIRAFEAU_ROOT.'lib/template/header.php');
  40     echo '<div class="error"><p>' . t('FILE_404') . '</p></div>';
  41     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  42     exit;
  43 }
  44
  45 $link = jirafeau_get_link($link_name);
  46 if (count($link) == 0) {
  47     require(JIRAFEAU_ROOT.'lib/template/header.php');
  48     echo '<div class="error"><p>' . t('FILE_404') .
  49     '</p></div>';
  50     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  51     exit;
  52 }
  53
  54 $delete_code = '';
  55 if (isset($_GET['d']) && !empty($_GET['d']) &&  $_GET['d'] != '1') {
  56     $delete_code = $_GET['d'];
  57 }
  58
  59 $crypt_key = '';
  60 if (isset($_GET['k']) && !empty($_GET['k'])) {
  61     $crypt_key = $_GET['k'];
  62 }
  63
  64 $do_download = false;
  65 if (isset($_GET['d']) && $_GET['d'] == '1') {
  66     $do_download = true;
  67 }
  68
  69 $do_preview = false;
  70 if (isset($_GET['p']) && !empty($_GET['p'])) {
  71     $do_preview = true;
  72 }
  73
  74 $p = s2p($link['hash']);
  75 if (!file_exists(VAR_FILES . $p . $link['hash'])) {
  76     jirafeau_delete_link($link_name);
  77     require(JIRAFEAU_ROOT.'lib/template/header.php');
  78     echo '<div class="error"><p>'.t('FILE_NOT_AVAIL').
  79     '</p></div>';
  80     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  81     exit;
  82 }
  83
  84 if (!empty($delete_code) && $delete_code == $link['link_code']) {
  85     require(JIRAFEAU_ROOT.'lib/template/header.php');
  86     if (isset($_POST['do_delete'])) {
  87         jirafeau_delete_link($link_name);
  88         echo '<div class="message"><p>'.t('FILE_DELETED').
  89             '</p></div>';
  90     } else { ?>
  91         <div>
  92         <form action="<?php echo 'f.php?h=' . $link_name . '&amp;d=' . $delete_code; ?>" method="post" id="submit_delete_post" class="form login">
  93         <input type="hidden" name="do_delete" value="1" />
  94         <fieldset>
  95              <legend> <?php echo t('CONFIRM_DEL') ?> </legend>
  96              <table>
  97              <tr><td>
  98              <?php echo t('GONNA_DEL') . ' "' . jirafeau_escape($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' ?>
  99              </td></tr>
 100              <tr><td>
 101                 <?php echo t('USING_SERVICE'). ' <a href="tos.php" target="_blank" rel="noopener noreferrer">' . t('TOS') . '</a>.' ?>
 102              </td></tr>
 103              <tr><td>
 104                 <input type="submit" id="submit_delete" value="<?php echo t('DELETE'); ?>"/>
 105              </td></tr>
 106              </table>
 107          </fieldset></form></div><?php
 108     }
 109     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 110     exit;
 111 }
 112
 113 if ($link['time'] != JIRAFEAU_INFINITY && time() > $link['time']) {
 114     jirafeau_delete_link($link_name);
 115     require(JIRAFEAU_ROOT.'lib/template/header.php');
 116     echo '<div class="error"><p>'.
 117     t('FILE_EXPIRED') . ' ' .
 118     t('FILE_DELETED') .
 119     '</p></div>';
 120     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
 121     exit;
 122 }
 123
 124 if (empty($crypt_key) && $link['crypted']) {
 125     require(JIRAFEAU_ROOT.'lib/template/header.php');
 126     echo '<div class="error"><p>' . t('FILE_404') .
 127     '</p></div>';
 128     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 129     exit;
 130 }
 131
 132 $password_challenged = false;
 133 if (!empty($link['key'])) {
 134     if (!isset($_POST['key'])) {
 135         require(JIRAFEAU_ROOT.'lib/template/header.php');
 136         echo '<div>' .
 137              '<form action="f.php" method="post" id="submit_post" class="form login">'; ?>
 138              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 139         echo '<fieldset>' .
 140              '<legend>' . t('PSW_PROTEC') .
 141              '</legend><table><tr><td>' .
 142              t('GIMME_PSW') . ' : ' .
 143              '<input type = "password" name = "key" autocomplete = "current-password"/>' .
 144              '</td></tr>' .
 145              '<tr><td>' .
 146              t('USING_SERVICE'). ' <a href="tos.php" target="_blank" rel="noopener noreferrer">' . t('TOS') . '</a>.' .
 147              '</td></tr>';
 148
 149         if ($link['onetime'] == 'O') {
 150             echo '<tr><td id="self_destruct">' .
 151                  t('AUTO_DESTRUCT') .
 152                  '</td></tr>';
 153         } ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('DL'); ?>"
 154         onclick="document.getElementById('submit_post').action='<?php
 155         echo 'f.php?h=' . $link_name . '&amp;d=1';
 156         if (!empty($crypt_key)) {
 157             echo '&amp;k=' . urlencode($crypt_key);
 158         } ?>';
 159         document.getElementById('submit_download').submit ();"/><?php
 160         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 161             ?><input type="submit" id = "submit_preview"  value="<?php echo t('PREVIEW'); ?>"
 162             onclick="document.getElementById('submit_post').action='<?php
 163             echo 'f.php?h=' . $link_name . '&amp;p=1';
 164             if (!empty($crypt_key)) {
 165                 echo '&amp;k=' . urlencode($crypt_key);
 166             } ?>';
 167             document.getElementById('submit_preview').submit ();"/><?php
 168         }
 169         echo '</td></tr></table></fieldset></form></div>';
 170         require(JIRAFEAU_ROOT.'lib/template/footer.php');
 171         exit;
 172     } else {
 173         if ($link['key'] == md5($_POST['key'])) {
 174             $password_challenged = true;
 175         } else {
 176             sleep(2);
 177             require(JIRAFEAU_ROOT.'lib/template/header.php');
 178             echo '<div class="error"><p>' . t('ACCESS_KO') .
 179             '</p></div>';
 180             require(JIRAFEAU_ROOT.'lib/template/footer.php');
 181             exit;
 182         }
 183     }
 184 }
 185
 186 if (!$password_challenged && !$do_download && !$do_preview) {
 187     require(JIRAFEAU_ROOT.'lib/template/header.php');
 188     echo '<div>' .
 189              '<form action="f.php" method="post" id="submit_post" class="form download">'; ?>
 190              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 191         echo '<fieldset><legend>' . jirafeau_escape($link['file_name']) . '</legend><table>' .
 192              '<tr><td>' .
 193              t('NOW_DOWNLOADING') . ' "' . jirafeau_escape($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' .
 194              '</td></tr>' .
 195              '<tr><td>' .
 196              t('USING_SERVICE'). ' <a href="tos.php" target="_blank" rel="noopener noreferrer">' . t('TOS') . '</a>.' .
 197              '</td></tr>';
 198
 199     if ($link['onetime'] == 'O') {
 200         echo '<tr><td id="self_destruct">' .
 201                  t('AUTO_DESTRUCT') .
 202                  '</td></tr>';
 203     } ?>
 204         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('DL'); ?>"
 205         onclick="document.getElementById('submit_post').action='<?php
 206         echo 'f.php?h=' . $link_name . '&amp;d=1';
 207     if (!empty($crypt_key)) {
 208         echo '&amp;k=' . urlencode($crypt_key);
 209     } ?>';
 210         document.getElementById('submit_post').submit ();"/><?php
 211
 212         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 213             ?><input type="submit" id = "submit_preview"  value="<?php echo t('PREVIEW'); ?>"
 214             onclick="document.getElementById('submit_post').action='<?php
 215         echo 'f.php?h=' . $link_name . '&amp;p=1';
 216             if (!empty($crypt_key)) {
 217                 echo '&amp;k=' . urlencode($crypt_key);
 218             } ?>';
 219         document.getElementById('submit_post').submit ();"/><?php
 220         }
 221     echo '</td></tr>';
 222     echo '</table></fieldset></form></div>';
 223     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 224     exit;
 225 }
 226
 227 header('HTTP/1.0 200 OK');
 228 header('Content-Length: ' . $link['file_size']);
 229 if (!jirafeau_is_viewable($link['mime_type']) || !$cfg['preview'] || $do_download) {
 230     header('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 231 } else {
 232     header('Content-Disposition: filename="' . $link['file_name'] . '"');
 233 }
 234 header('Content-Type: ' . $link['mime_type']);
 235 if ($cfg['file_hash'] == "md5") {
 236     header('Content-MD5: ' . hex_to_base64($link['hash']));
 237 }
 238 if ($cfg['litespeed_workaround']) {
 239     // Work around that LiteSpeed truncates large files.
 240     // See https://www.litespeedtech.com/support/wiki/doku.php/litespeed_wiki:config:internal-redirect
 241     if ($_GET['litespeed_workaround'] == 'phase2') {
 242         $file_web_path = preg_replace('#^' . $_SERVER['DOCUMENT_ROOT'] . '#', '', VAR_FILES);
 243         header('X-LiteSpeed-Location: ' . $file_web_path . $p . $link['hash']);
 244     } else {
 245         // Since Content-Type isn't forwarded by LiteSpeed, first
 246         // redirect to the same URL but append the file name.
 247         header('Location: ' . $_SERVER['PHP_SELF'] . '/' . $link['file_name'] . '?' .
 248                $_SERVER['QUERY_STRING'] . '&litespeed_workaround=phase2');
 249     }
 250 }
 251 /* Read encrypted file. */
 252 elseif ($link['crypted']) {
 253     /* Decrypt file. */
 254     $r = fopen(VAR_FILES . $p . $link['hash'], 'rb');
 255     $fs = fstat($r)['size'];
 256
 257     $crypt_header = fread($r, SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES);
 258
 259     /* Init module. */
 260     $crypt_state = sodium_crypto_secretstream_xchacha20poly1305_init_pull($crypt_header, $crypt_key);
 261
 262     /* Decrypt file. */
 263
 264     for ($i = SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_HEADERBYTES; $i < $fs; $i += JIRAFEAU_SODIUM_CHUNKSIZE + SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_ABYTES) {
 265         $to_dec = fread($r, JIRAFEAU_SODIUM_CHUNKSIZE + SODIUM_CRYPTO_SECRETSTREAM_XCHACHA20POLY1305_ABYTES);
 266         [$dec, $crypt_tag] = sodium_crypto_secretstream_xchacha20poly1305_pull($crypt_state, $to_dec);
 267         echo $dec;
 268     }
 269
 270     fclose($r);
 271
 272     /* Cleanup. */
 273     sodium_memzero($crypt_state);
 274 }
 275 /* Read encrypted file (legacy mode using mcrypt). */
 276 elseif ($link['crypted_legacy']) {
 277     /* Init module */
 278     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 279     /* Extract key and iv. */
 280     $hash_key = md5($crypt_key);
 281     $iv = jirafeau_crypt_create_iv($hash_key, mcrypt_enc_get_iv_size($m));
 282     /* Init module. */
 283     mcrypt_generic_init($m, $hash_key, $iv);
 284     /* Decrypt file. */
 285     $r = fopen(VAR_FILES . $p . $link['hash'], 'r');
 286     while (!feof($r)) {
 287         $dec = mdecrypt_generic($m, fread($r, 1024));
 288         print $dec;
 289     }
 290     fclose($r);
 291     /* Cleanup. */
 292     mcrypt_generic_deinit($m);
 293     mcrypt_module_close($m);
 294 }
 295 /* Read file. */
 296 else {
 297     if ($cfg['use_xsendfile']) {
 298         $file_web_path = preg_replace('#^' . $_SERVER['DOCUMENT_ROOT'] . '#', '', VAR_FILES);
 299         header('X-Sendfile: ' . $file_web_path . $p . $link['hash']);
 300     } else {
 301         $r = fopen(VAR_FILES . $p . $link['hash'], 'r');
 302         while (!feof($r)) {
 303             print fread($r, 1024);
 304         }
 305         fclose($r);
 306     }
 307 }
 308
 309 if ($link['onetime'] == 'O') {
 310     jirafeau_delete_link($link_name);
 311 }
 312
 313 jirafeau_write_download_stats($link_name, get_ip_address($cfg));
 314
 315 exit;
 316
 317 ?>