file.php

   1 <?php
   2 /*
   3  *  Jirafeau, your web file repository
   4  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
   5  *  Copyright (C) 2012  Jerome Jutteau <j.jutteau@gmail.com>
   6  *
   7  *  This program is free software: you can redistribute it and/or modify
   8  *  it under the terms of the GNU Affero General Public License as
   9  *  published by the Free Software Foundation, either version 3 of the
  10  *  License, or (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU Affero General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU Affero General Public License
  18  *  along with this program.  If not, see <http://www.gnu.org/licenses/>.
  19  */
  20 define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/');
  21
  22 require (JIRAFEAU_ROOT . 'lib/lang.php');
  23 require (JIRAFEAU_ROOT . 'lib/config.php');
  24 require (JIRAFEAU_ROOT . 'lib/settings.php');
  25 require (JIRAFEAU_ROOT . 'lib/functions.php');
  26
  27 if (!isset ($_GET['h']) || empty ($_GET['h']))
  28 {
  29     header ('Location: ' . $cfg['web_root']);
  30     exit;
  31 }
  32
  33 /* Operations may take a long time.
  34  * Be sure PHP's safe mode is off.
  35  */
  36 set_time_limit(0);
  37
  38 $link_name = $_GET['h'];
  39
  40 if (!preg_match ('/[0-9a-zA-Z_-]{22}$/', $link_name))
  41 {
  42     require (JIRAFEAU_ROOT.'lib/template/header.php');
  43     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') . '</p></div>';
  44     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  45     exit;
  46 }
  47
  48 $link = jirafeau_get_link ($link_name);
  49 if (count ($link) == 0)
  50 {
  51     require (JIRAFEAU_ROOT.'lib/template/header.php');
  52     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
  53     '</p></div>';
  54     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  55     exit;
  56 }
  57
  58 $delete_code = '';
  59 if (isset ($_GET['d']) && !empty ($_GET['d']))
  60     $delete_code = $_GET['d'];
  61
  62 $crypt_key = '';
  63 if (isset ($_GET['k']) && !empty ($_GET['k']))
  64     $crypt_key = $_GET['k'];
  65
  66 $button_download = false;
  67 if (isset ($_GET['bd']) && !empty ($_GET['bd']))
  68     $button_download = true;
  69
  70 $button_preview = false;
  71 if (isset ($_GET['bp']) && !empty ($_GET['bp']))
  72     $button_preview = true;
  73
  74 $p = s2p ($link['md5']);
  75 if (!file_exists (VAR_FILES . $p . $link['md5']))
  76 {
  77     jirafeau_delete_link ($link_name);
  78     require (JIRAFEAU_ROOT.'lib/template/header.php');
  79     echo '<div class="error"><p>'.t('File not available.').
  80     '</p></div>';
  81     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  82     exit;
  83 }
  84
  85 if (!empty ($delete_code) && $delete_code == $link['link_code'])
  86 {
  87     jirafeau_delete_link ($link_name);
  88     require (JIRAFEAU_ROOT.'lib/template/header.php');
  89     echo '<div class="message"><p>'.t('File has been deleted.').
  90      '</p></div>';
  91     require (JIRAFEAU_ROOT.'lib/template/footer.php');
  92     exit;
  93 }
  94
  95 if ($link['time'] != JIRAFEAU_INFINITY && time () > $link['time'])
  96 {
  97     jirafeau_delete_link ($link_name);
  98     require (JIRAFEAU_ROOT.'lib/template/header.php');
  99     echo '<div class="error"><p>'.
 100     t('The time limit of this file has expired.') . ' ' .
 101     t('File has been deleted.') .
 102     '</p></div>';
 103     require (JIRAFEAU_ROOT . 'lib/template/footer.php');
 104     exit;
 105 }
 106
 107 if (empty ($crypt_key) && $link['crypted'])
 108 {
 109     require (JIRAFEAU_ROOT.'lib/template/header.php');
 110     echo '<div class="error"><p>' . t('Sorry, the requested file is not found') .
 111     '</p></div>';
 112     require (JIRAFEAU_ROOT.'lib/template/footer.php');
 113     exit;
 114 }
 115
 116 $password_challenged = false;
 117 if (!empty ($link['key']))
 118 {
 119     if (!isset ($_POST['key']))
 120     {
 121         require (JIRAFEAU_ROOT.'lib/template/header.php');
 122         echo '<div>' .
 123              '<form action = "';
 124         echo $cfg['web_root'] . '/file.php';
 125         echo '" ' .
 126              'method = "post" id = "submit">'; ?>
 127              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 128         echo '<fieldset>' .
 129              '<legend>' . t('Password protection') .
 130              '</legend><table><tr><td>' .
 131              t('Give the password of this file') . ' : ' .
 132              '<input type = "password" name = "key" />' .
 133              '</td></tr>' .
 134              '<tr><td>' .
 135              t('By using our services, you accept of our'). ' <a href="' . $cfg['web_root'] . '/tos.php' . '">' . t('Term Of Service') . '</a>' .
 136              '</td></tr>' .
 137              '<tr><td>';
 138             ?><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 139             onclick="document.getElementById('submit').action='
 140 <?php
 141         echo $cfg['web_root'] . '/file.php?h=' . $link_name . '&amp;bd=1';
 142         if (!empty($crypt_key))
 143             echo '&amp;k=' . urlencode($crypt_key);
 144 ?>';
 145         document.getElementById('submit_download').submit ();"/><?php
 146         if ($cfg['download_page'] && $cfg['preview'])
 147         {
 148             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 149             onclick="document.getElementById('submit').action='
 150 <?php
 151         echo $cfg['web_root'] . '/file.php?h=' . $link_name . '&amp;bp=1';
 152         if (!empty($crypt_key))
 153             echo '&amp;k=' . urlencode($crypt_key);
 154 ?>';
 155         document.getElementById('submit_preview').submit ();"/><?php
 156         }
 157         echo '</td></tr></table></fieldset></form></div>';
 158         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 159         exit;
 160     }
 161     else
 162     {
 163         if ($link['key'] == md5 ($_POST['key']))
 164             $password_challenged = true;
 165         else
 166         {
 167             header ("Access denied");
 168             require (JIRAFEAU_ROOT.'lib/template/header.php');
 169             echo '<div class="error"><p>' . t('Access denied') .
 170             '</p></div>';
 171             require (JIRAFEAU_ROOT.'lib/template/footer.php');
 172             exit;
 173         }
 174     }
 175 }
 176
 177 if ($cfg['download_page'] && !$password_challenged && !$button_download && !$button_preview)
 178 {
 179         require (JIRAFEAU_ROOT.'lib/template/header.php');
 180         echo '<div>' .
 181              '<form action = "';
 182         echo $cfg['web_root'] . '/file.php';
 183         echo '" ' .
 184              'method = "post" id = "submit">'; ?>
 185              <input type = "hidden" name = "jirafeau" value = "<?php echo JIRAFEAU_VERSION ?>"/><?php
 186         echo '<fieldset><legend>' . $link['file_name'] . '</legend><table>' .
 187              '<tr><td>' .
 188              t('You are about to download') . ' "' . $link['file_name'] . '" (' . jirafeau_human_size($link['file_size']) . ')' .
 189              '</td></tr>' .
 190              '<tr><td>' .
 191              t('By using our services, you accept of our'). ' <a href="' . $cfg['web_root'] . '/tos.php' . '">' . t('Term Of Service') . '</a>';
 192             ?><input type="submit" id = "submit_download"  value="<?php echo t('Download'); ?>"
 193             onclick="document.getElementById('submit').action='
 194 <?php
 195         echo $cfg['web_root'] . '/file.php?h=' . $link_name . '&amp;bd=1';
 196         if (!empty($crypt_key))
 197             echo '&amp;k=' . urlencode($crypt_key);
 198 ?>';
 199         document.getElementById('submit_download').submit ();"/><?php
 200
 201         if ($cfg['download_page'] && $cfg['preview'])
 202         {
 203             ?><input type="submit" id = "submit_preview"  value="<?php echo t('Preview'); ?>"
 204             onclick="document.getElementById('submit').action='
 205 <?php
 206         echo $cfg['web_root'] . '/file.php?h=' . $link_name . '&amp;bp=1';
 207         if (!empty($crypt_key))
 208             echo '&amp;k=' . urlencode($crypt_key);
 209 ?>';
 210         document.getElementById('submit_preview').submit ();"/><?php
 211         }
 212         echo '</td></tr>';
 213         echo '</table></fieldset></form></div>';
 214         require (JIRAFEAU_ROOT.'lib/template/footer.php');
 215         exit;
 216 }
 217
 218 header ('HTTP/1.0 200 OK');
 219 header ('Content-Length: ' . $link['file_size']);
 220 if (!jirafeau_is_viewable ($link['mime_type']) || !$cfg['preview'] || $button_download)
 221     header ('Content-Disposition: attachment; filename="' .
 222         $link['file_name'] . '"');
 223 else
 224     header ('Content-Type: ' . $link['mime_type']);
 225
 226 /* Read encrypted file. */
 227 if ($link['crypted'])
 228 {
 229     /* Extract key and iv. */
 230     $ex = explode (".", $crypt_key);
 231     $key = $ex[0];
 232     $iv = base64_decode($ex[1]);
 233     error_log ("crypt_key: " . $crypt_key . " iv: " . $v . " key: ". $key . "\n", 3, "debug.log");
 234     /* Init module */
 235     $m = mcrypt_module_open('rijndael-256', '', 'ofb', '');
 236     mcrypt_generic_init($m, $key, $iv);
 237     /* Decrypt file. */
 238     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 239     while (!feof ($r))
 240     {
 241         $dec = mdecrypt_generic($m, fread ($r, 1024));
 242         print $dec;
 243         ob_flush();
 244     }
 245     fclose ($r);
 246     /* Cleanup. */
 247     mcrypt_generic_deinit($m);
 248     mcrypt_module_close($m);
 249 }
 250 /* Read file. */
 251 else
 252 {
 253     $r = fopen (VAR_FILES . $p . $link['md5'], 'r');
 254     while (!feof ($r))
 255     {
 256         print fread ($r, 1024);
 257         ob_flush();
 258     }
 259     fclose ($r);
 260 }
 261
 262 if ($link['onetime'] == 'O')
 263     jirafeau_delete_link ($link_name);
 264 exit;
 265
 266 ?>