f.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define('JIRAFEAU_ROOT', dirname(__FILE__) . '/');
  21
  22 require(JIRAFEAU_ROOT . 'lib/settings.php');
  23 require(JIRAFEAU_ROOT . 'lib/functions.php');
  24 require(JIRAFEAU_ROOT . 'lib/lang.php');
  25
  26 if (!isset($_GET['h']) || empty($_GET['h'])) {
  27     header('Location: ./');
  28     exit;
  29 }
  30
  31 /* Operations may take a long time.
  32  * Be sure PHP's safe mode is off.
  33  */
  34 @set_time_limit(0);
  35 /* Remove errors. */
  36 @error_reporting(0);
  37
  38 $link_name = $_GET['h'];
  39
  40 if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
  41     require(JIRAFEAU_ROOT.'lib/template/header.php');
  42     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  43     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  44     exit;
  45 }
  46
  47 $link = jirafeau_get_link($link_name);
  48 if (count($link) == 0) {
  49     /* Try alias. */
  50     $alias = jirafeau_get_alias(md5($link_name));
  51     if (count($alias) > 0) {
  52         $link = jirafeau_get_link($alias["destination"]);
  53     }
  54 }
  55 if (count($link) == 0) {
  56     require(JIRAFEAU_ROOT.'lib/template/header.php');
  57     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  58     '</p></div>';
  59     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  60     exit;
  61 }
  62
  63 $delete_code = '';
  64 if (isset($_GET['d']) && !empty($_GET['d']) &&  $_GET['d'] != '1') {
  65     $delete_code = $_GET['d'];
  66 }
  67
  68 $crypt_key = '';
  69 if (isset($_GET['k']) && !empty($_GET['k'])) {
  70     $crypt_key = $_GET['k'];
  71 }
  72
  73 $do_download = false;
  74 if (isset($_GET['d']) && $_GET['d'] == '1') {
  75     $do_download = true;
  76 }
  77
  78 $do_preview = false;
  79 if (isset($_GET['p']) && !empty($_GET['p'])) {
  80     $do_preview = true;
  81 }
  82
  83 $p = s2p($link['md5']);
  84 if (!file_exists(VAR_FILES . $p . $link['md5'])) {
  85     jirafeau_delete_link($link_name);
  86     require(JIRAFEAU_ROOT.'lib/template/header.php');
  87     echo '<div class="error"><p>'.t('File not available.').
  88     '</p></div>';
  89     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  90     exit;
  91 }
  92
  93 if (!empty($delete_code) && $delete_code == $link['link_code']) {
  94     jirafeau_delete_link($link_name);
  95     require(JIRAFEAU_ROOT.'lib/template/header.php');
  96     echo '<div class="message"><p>'.t('File has been deleted.').
  97      '</p></div>';
  98     require(JIRAFEAU_ROOT.'lib/template/footer.php');
  99     exit;
 100 }
 101
 102 if ($link['time'] != JIRAFEAU_INFINITY && time() > $link['time']) {
 103     jirafeau_delete_link($link_name);
 104     require(JIRAFEAU_ROOT.'lib/template/header.php');
 105     echo '<div class="error"><p>'.
 106     t('The time limit of this file has expired.') . ' ' .
 107     t('File has been deleted.') .
 108     '</p></div>';
 109     require(JIRAFEAU_ROOT . 'lib/template/footer.php');
 110     exit;
 111 }
 112
 113 if (empty($crypt_key) && $link['crypted']) {
 114     require(JIRAFEAU_ROOT.'lib/template/header.php');
 115     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 116     '</p></div>';
 117     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 118     exit;
 119 }
 120
 121 $password_challenged = false;
 122 if (!empty($link['key'])) {
 123     if (!isset($_POST['key'])) {
 124         require(JIRAFEAU_ROOT.'lib/template/header.php');
 125         echo '<div>' .
 126              '<form action="f.php" method="post" id="submit_post" class="form login">'; ?>
 127              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 128         echo '<fieldset>' .
 129              '<legend>' . t('Password protection') .
 130              '</legend><table><tr><td>' .
 131              t('Give the password of this file') . ' : ' .
 132              '<input type = "password" name = "key" />' .
 133              '</td></tr>' .
 134              '<tr><td>' .
 135              t('By using our services, you accept our'). ' <a href="tos.php">' . t('Terms of Service') . '</a>.' .
 136              '</td></tr>';
 137
 138         if ($link['onetime'] == 'O') {
 139             echo '<tr><td id="self_destruct">' .
 140                  t('Warning, this file will self-destruct after being read') .
 141                  '</td></tr>';
 142         } ?><tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 143         onclick="document.getElementById('submit_post').action='<?php
 144         echo 'f.php?h=' . $link_name . '&amp;d=1';
 145         if (!empty($crypt_key)) {
 146             echo '&amp;k=' . urlencode($crypt_key);
 147         } ?>';
 148         document.getElementById('submit_download').submit ();"/><?php
 149         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 150             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 151             onclick="document.getElementById('submit_post').action='<?php
 152             echo 'f.php?h=' . $link_name . '&amp;p=1';
 153             if (!empty($crypt_key)) {
 154                 echo '&amp;k=' . urlencode($crypt_key);
 155             } ?>';
 156             document.getElementById('submit_preview').submit ();"/><?php
 157
 158         }
 159         echo '</td></tr></table></fieldset></form></div>';
 160         require(JIRAFEAU_ROOT.'lib/template/footer.php');
 161         exit;
 162     } else {
 163         if ($link['key'] == md5($_POST['key'])) {
 164             $password_challenged = true;
 165         } else {
 166             sleep(2);
 167             require(JIRAFEAU_ROOT.'lib/template/header.php');
 168             echo '<div class="error"><p>' . t('Access denied') .
 169             '</p></div>';
 170             require(JIRAFEAU_ROOT.'lib/template/footer.php');
 171             exit;
 172         }
 173     }
 174 }
 175
 176 if (!$password_challenged && !$do_download && !$do_preview) {
 177     require(JIRAFEAU_ROOT.'lib/template/header.php');
 178     echo '<div>' .
 179              '<form action="f.php" method="post" id="submit_post" class="form download">'; ?>
 180              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 181         echo '<fieldset><legend>' . htmlspecialchars($link['file_name']) . '</legend><table>' .
 182              '<tr><td>' .
 183              t('You are about to download') . ' "' . htmlspecialchars($link['file_name']) . '" (' . jirafeau_human_size($link['file_size']) . ').' .
 184              '</td></tr>' .
 185              '<tr><td>' .
 186              t('By using our services, you accept our'). ' <a href="tos.php">' . t('Terms of Service') . '</a>.' .
 187              '</td></tr>';
 188
 189     if ($link['onetime'] == 'O') {
 190         echo '<tr><td id="self_destruct">' .
 191                  t('Warning, this file will self-destruct after being read') .
 192                  '</td></tr>';
 193     } ?>
 194         <tr><td><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 195         onclick="document.getElementById('submit_post').action='<?php
 196         echo 'f.php?h=' . $link_name . '&amp;d=1';
 197     if (!empty($crypt_key)) {
 198         echo '&amp;k=' . urlencode($crypt_key);
 199     } ?>';
 200         document.getElementById('submit_post').submit ();"/><?php
 201
 202         if ($cfg['preview'] && jirafeau_is_viewable($link['mime_type'])) {
 203             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 204             onclick="document.getElementById('submit_post').action='<?php
 205         echo 'f.php?h=' . $link_name . '&amp;p=1';
 206             if (!empty($crypt_key)) {
 207                 echo '&amp;k=' . urlencode($crypt_key);
 208             } ?>';
 209         document.getElementById('submit_post').submit ();"/><?php
 210
 211         }
 212     echo '</td></tr>';
 213     echo '</table></fieldset></form></div>';
 214     require(JIRAFEAU_ROOT.'lib/template/footer.php');
 215     exit;
 216 }
 217
 218 header('HTTP/1.0 200 OK');
 219 header('Content-Length: ' . $link['file_size']);
 220 if (!jirafeau_is_viewable($link['mime_type']) || !$cfg['preview'] || $do_download) {
 221     header('Content-Disposition: attachment; filename="' . $link['file_name'] . '"');
 222 } else {
 223     header('Content-Disposition: filename="' . $link['file_name'] . '"');
 224 }
 225 header('Content-Type: ' . $link['mime_type']);
 226 header('Content-MD5: ' . hex_to_base64($link['md5']));
 227
 228 /* Read encrypted file. */
 229 if ($link['crypted']) {
 230     /* Init module */
 231     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 232     /* Extract key and iv. */
 233     $md5_key = md5($crypt_key);
 234     $iv = jirafeau_crypt_create_iv($md5_key, mcrypt_enc_get_iv_size($m));
 235     /* Init module. */
 236     mcrypt_generic_init($m, $md5_key, $iv);
 237     /* Decrypt file. */
 238     $r = fopen(VAR_FILES . $p . $link['md5'], 'r');
 239     while (!feof($r)) {
 240         $dec = mdecrypt_generic($m, fread($r, 1024));
 241         print $dec;
 242         ob_flush();
 243     }
 244     fclose($r);
 245     /* Cleanup. */
 246     mcrypt_generic_deinit($m);
 247     mcrypt_module_close($m);
 248 }
 249 /* Read file. */
 250 else {
 251     $r = fopen(VAR_FILES . $p . $link['md5'], 'r');
 252     while (!feof($r)) {
 253         print fread($r, 1024);
 254         ob_flush();
 255     }
 256     fclose($r);
 257 }
 258
 259 if ($link['onetime'] == 'O') {
 260     jirafeau_delete_link($link_name);
 261 }
 262 exit;
 263
 264 ?>