f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define('JIRAFEAU_ROOT', dirname(__FILE__) . '/');
  21
  22 require(JIRAFEAU_ROOT . 'lib/settings.php');
  23 require(JIRAFEAU_ROOT . 'lib/functions.php');
  24 require(JIRAFEAU_ROOT . 'lib/lang.php');
  25
  26 if (!isset($_GET['h']) || empty($_GET['h'])) {
  27     header('Location: ./');
  28     exit;
  29 }
  30
  31 /* Operations may take a long time.
  32  * Be sure PHP's safe mode is off.
  33  */
  34 @set_time_limit(0);
  35 /* Remove errors. */
  36 @error_reporting(0);
  37
  38 $link_name = $_GET['h'];
  39
  40 if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
  41     require(JIRAFEAU_ROOT.'lib/template/header.php');
  42     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  43     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  44     exit;
  45 }
  46
  47 $link = jirafeau_get_link($link_name);
  48 if (count($link) == 0) {
  49     require(JIRAFEAU_ROOT.'lib/template/header.php');
  50     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  51     '</p></div>';
  52     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  53     exit;
  54 }
  55
  56 $delete_code = '';
  57 if (isset($_GET['d']) && !empty($_GET['d']) &&  $_GET['d'] != '1') {
  58     $delete_code = $_GET['d'];
  59 }
  60
  61 $crypt_key = '';
  62 if (isset($_GET['k']) && !empty($_GET['k'])) {
  63     $crypt_key = $_GET['k'];
  64 }
  65
  66 $do_download = false;
  67 if (isset($_GET['d']) && $_GET['d'] == '1') {
  68     $do_download = true;
  69 }
  70
  71 $do_preview = false;
  72 if (isset($_GET['p']) && !empty($_GET['p'])) {
  73     $do_preview = true;
  74 }
  75
  76 $p = s2p($link['md5']);
  77 if (!file_exists(VAR_FILES . $p . $link['md5'])) {
  78     jirafeau_delete_link($link_name);
  79     require(JIRAFEAU_ROOT.'lib/template/header.php');
  80     echo '<div class="error"><p>'.t('File not available.').
  81     '</p></div>';
  82     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  83     exit;
  84 }
  85
  86 if (!empty($delete_code) && $delete_code == $link['link_code']) {
  87     jirafeau_delete_link($link_name);
  88     require(JIRAFEAU_ROOT.'lib/template/header.php');
  89     echo '<div class="message"><p>'.t('File has been deleted.').
  90      '</p></div>';
  91     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  92     exit;
  93 }
  94
  95 if ($link['time'] != JIRAFEAU_INFINITY && time() > $link['time']) {
  96     jirafeau_delete_link($link_name);
  97     require(JIRAFEAU_ROOT.'lib/template/header.php');
  98     echo '<div class="error"><p>'.
  99     t('The time limit of this file has expired.') . ' ' .
 100     t('File has been deleted.') .
 101     '</p></div>';
 102     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
 103     exit;
 104 }
 105
 106 if (empty($crypt_key) && $link['crypted']) {
 107     require(JIRAFEAU_ROOT.'lib/template/header.php');
 108     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 109     '</p></div>';
 110     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 111     exit;
 112 }
 113
 114 $password_challenged = false;
 115 if (!empty($link['key'])) {
 116     if (!isset($_POST['key'])) {
 117         require(JIRAFEAU_ROOT.'lib/template/header.php');
 118         echo '<div>' .
 119              '<form action="f.php" method="post" id="submit_post" class="form login">'; ?>
 120              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 121         echo '<fieldset>' .
 122              '<legend>' . t('Password protection') .
 123              '</legend><table><tr><td>' .
 124              t('Give the password of this file') . ' : ' .
 125              '<input type = "password" name = "key" />' .
 126              '</td></tr>' .
 127              '<tr><td>' .
 128              t('By using our services, you accept our'). ' <a href="tos.php">' . t('Terms of Service') . '</a>.' .
 129              '</td></tr>';
 130
 131         if ($link['onetime'] == 'O') {
 132             echo '<tr><td id="self_destruct">' .
 133                  t('Warning, this file will self-destruct after being read') .
 134                  '</td></tr>';
 135         } ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 136         onclick="document.getElementById('submit_post').action='<?php
 137         echo 'f.php?h=' . $link_name . '&amp;d=1';
 138         if (!empty($crypt_key)) {
 139             echo '&amp;k=' . urlencode($crypt_key);
 140         } ?>';
 141         document.getElementById('submit_download').submit ();"/><?php
 142         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 143             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 144             onclick="document.getElementById('submit_post').action='<?php
 145             echo 'f.php?h=' . $link_name . '&amp;p=1';
 146             if (!empty($crypt_key)) {
 147                 echo '&amp;k=' . urlencode($crypt_key);
 148             } ?>';
 149             document.getElementById('submit_preview').submit ();"/><?php
 150
 151         }
 152         echo '</td></tr></table></fieldset></form></div>';
 153         require(JIRAFEAU_ROOT.'lib/template/footer.php');
 154         exit;
 155     } else {
 156         if ($link['key'] == md5($_POST['key'])) {
 157             $password_challenged = true;
 158         } else {
 159             sleep(2);
 160             require(JIRAFEAU_ROOT.'lib/template/header.php');
 161             echo '<div class="error"><p>' . t('Access denied') .
 162             '</p></div>';
 163             require(JIRAFEAU_ROOT.'lib/template/footer.php');
 164             exit;
 165         }
 166     }
 167 }
 168
 169 if (!$password_challenged && !$do_download && !$do_preview) {
 170     require(JIRAFEAU_ROOT.'lib/template/header.php');
 171     echo '<div>' .
 172              '<form action="f.php" method="post" id="submit_post" class="form download">'; ?>
 173              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 174         echo '<fieldset><legend>' . htmlspecialchars($link['file_name']) . '</legend><table>' .
 175              '<tr><td>' .
 176              t('You are about to download') . ' "' . htmlspecialchars($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' .
 177              '</td></tr>' .
 178              '<tr><td>' .
 179              t('By using our services, you accept our'). ' <a href="tos.php">' . t('Terms of Service') . '</a>.' .
 180              '</td></tr>';
 181
 182     if ($link['onetime'] == 'O') {
 183         echo '<tr><td id="self_destruct">' .
 184                  t('Warning, this file will self-destruct after being read') .
 185                  '</td></tr>';
 186     } ?>
 187         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 188         onclick="document.getElementById('submit_post').action='<?php
 189         echo 'f.php?h=' . $link_name . '&amp;d=1';
 190     if (!empty($crypt_key)) {
 191         echo '&amp;k=' . urlencode($crypt_key);
 192     } ?>';
 193         document.getElementById('submit_post').submit ();"/><?php
 194
 195         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 196             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 197             onclick="document.getElementById('submit_post').action='<?php
 198         echo 'f.php?h=' . $link_name . '&amp;p=1';
 199             if (!empty($crypt_key)) {
 200                 echo '&amp;k=' . urlencode($crypt_key);
 201             } ?>';
 202         document.getElementById('submit_post').submit ();"/><?php
 203
 204         }
 205     echo '</td></tr>';
 206     echo '</table></fieldset></form></div>';
 207     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 208     exit;
 209 }
 210
 211 header('HTTP/1.0 200 OK');
 212 header('Content-Length: ' . $link['file_size']);
 213 if (!jirafeau_is_viewable($link['mime_type']) || !$cfg['preview'] || $do_download) {
 214     header('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 215 } else {
 216     header('Content-Disposition: filename="' . $link['file_name'] . '"');
 217 }
 218 header('Content-Type: ' . $link['mime_type']);
 219 header('Content-MD5: ' . hex_to_base64($link['md5']));
 220
 221 /* Read encrypted file. */
 222 if ($link['crypted']) {
 223     /* Init module */
 224     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 225     /* Extract key and iv. */
 226     $md5_key = md5($crypt_key);
 227     $iv = jirafeau_crypt_create_iv($md5_key, mcrypt_enc_get_iv_size($m));
 228     /* Init module. */
 229     mcrypt_generic_init($m, $md5_key, $iv);
 230     /* Decrypt file. */
 231     $r = fopen(VAR_FILES . $p . $link['md5'], 'r');
 232     while (!feof($r)) {
 233         $dec = mdecrypt_generic($m, fread($r, 1024));
 234         print $dec;
 235         ob_flush();
 236     }
 237     fclose($r);
 238     /* Cleanup. */
 239     mcrypt_generic_deinit($m);
 240     mcrypt_module_close($m);
 241 }
 242 /* Read file. */
 243 else {
 244     $r = fopen(VAR_FILES . $p . $link['md5'], 'r');
 245     while (!feof($r)) {
 246         print fread($r, 1024);
 247         ob_flush();
 248     }
 249     fclose($r);
 250 }
 251
 252 if ($link['onetime'] == 'O') {
 253     jirafeau_delete_link($link_name);
 254 }
 255 exit;
 256
 257 ?>