[BUGFIX] Disallow file preview for image/svg+xml files

[jirafeau_project.git] / lib / functions.js.php

diff --git a/lib/functions.js.php b/lib/functions.js.php
index b2580b512b9d3029a508868a290b4b733f768e9b..14fad1da5fa98eadc2473c90cba890ad6161cba3 100644 (file)
--- a/lib/functions.js.php
+++ b/lib/functions.js.php
@@ -1,7 +1,7 @@
 <?php
 /*
  *  Jirafeau, your web file repository
 <?php
 /*
  *  Jirafeau, your web file repository

- *  Copyright (C) 2015  Jerome Jutteau <j.jutteau@gmail.com>
+ *  Copyright (C) 2015  Jerome Jutteau <jerome@jutteau.fr>

  *  Copyright (C) 2015  Nicola Spanti (RyDroid) <dev@nicola-spanti.info>
  *
  *  This program is free software: you can redistribute it and/or modify
  *  Copyright (C) 2015  Nicola Spanti (RyDroid) <dev@nicola-spanti.info>
  *
  *  This program is free software: you can redistribute it and/or modify


@@ -182,16 +182,17 @@ function show_link (reference, delete_code, crypt_key, date)
         }
 
         // Test if content can be previewed
         }
 
         // Test if content can be previewed

-         type = document.getElementById('file_select').files[0].type;
-         if (type.indexOf("image") > -1 ||
-             type.indexOf("audio") > -1 ||
-             type.indexOf("text") > -1 ||
-             type.indexOf("video") > -1)
-         {
+        type = document.getElementById('file_select').files[0].type;
+        if ((type.startsWith('image/')
+                || type.startsWith('audio')
+                || type.startsWith('text/plain')
+                || type.startsWith('video/'))
+            && !type.includes('image/svg+xml'))
+        {

             document.getElementById('preview_link').href = preview_link_href;
             document.getElementById('preview_link_text').innerHTML = web_root + preview_link_href;
             document.getElementById('upload_finished_preview').style.display = '';
             document.getElementById('preview_link').href = preview_link_href;
             document.getElementById('preview_link_text').innerHTML = web_root + preview_link_href;
             document.getElementById('upload_finished_preview').style.display = '';

-         }
+        }

     }
 
     // Direct download link
     }
 
     // Direct download link


@@ -273,12 +274,18 @@ function control_selected_file_size(max_size, error_str)
     }
 }
 
     }
 }
 

+function XHRErrorHandler(e)
+{
+    var text = "${e.type}: ${e.loaded} bytes transferred"
+    console.log(text)
+}
+

 function pop_failure (e)
 {
 function pop_failure (e)
 {

-    var text = "An error occured";
+    var text = "<p>An error occured";

     if (typeof e !== 'undefined')
     if (typeof e !== 'undefined')

-        text = e;
-    text = "<p>" + text + "</p>";
+        text += ": " + e;
+    text += "</p>";

     document.getElementById('error_pop').innerHTML = e;
 
     document.getElementById('uploading').style.display = 'none';
     document.getElementById('error_pop').innerHTML = e;
 
     document.getElementById('uploading').style.display = 'none';


@@ -339,8 +346,8 @@ function classic_upload (file, time, password, one_time, upload_password)
 
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", upload_progress, false);
 
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", upload_progress, false);

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)


@@ -370,6 +377,10 @@ function classic_upload (file, time, password, one_time, upload_password)
 
             show_link (res[0], res[1], res[2], expiryDate);
         }
 
             show_link (res[0], res[1], res[2], expiryDate);
         }

+        else
+        {
+            pop_failure ("<?php echo t("ERR_OCC"); ?>");
+        }

     }
     req.open ("POST", 'script.php' , true);
 
     }
     req.open ("POST", 'script.php' , true);
 


@@ -398,6 +409,7 @@ var async_global_ref = '';
 var async_global_max_size = 0;
 var async_global_time;
 var async_global_transfering = 0;
 var async_global_max_size = 0;
 var async_global_time;
 var async_global_transfering = 0;

+var async_global_last_code;

 
 function async_upload_start (max_size, file, time, password, one_time, upload_password)
 {
 
 function async_upload_start (max_size, file, time, password, one_time, upload_password)
 {


@@ -407,8 +419,8 @@ function async_upload_start (max_size, file, time, password, one_time, upload_pa
     async_global_time = time;
 
     var req = new XMLHttpRequest ();
     async_global_time = time;
 
     var req = new XMLHttpRequest ();

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)


@@ -470,6 +482,7 @@ function async_upload_progress (e)
 
 function async_upload_push (code)
 {
 
 function async_upload_push (code)
 {

+    async_global_last_code = code;

     if (async_global_transfered == async_global_file.size)
     {
         hide_upload_progression ();
     if (async_global_transfered == async_global_file.size)
     {
         hide_upload_progression ();


@@ -478,31 +491,53 @@ function async_upload_push (code)
     }
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", async_upload_progress, false);
     }
     var req = new XMLHttpRequest ();
     req.upload.addEventListener ("progress", async_upload_progress, false);

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
     req.onreadystatechange = function ()
     {

-        if (req.readyState == 4 && req.status == 200)
+        if (req.readyState == 4)

         {
         {

-            var res = req.responseText;
+            if (req.status == 200)
+            {
+                var res = req.responseText;

 
 

-            if (/^Error/.test(res))
+                // This error may be triggered when Jirafeau does not receive any file in POST.
+                // This may be due to bad php configuration where post_max_size is too low
+                // comparing to upload_max_filesize. Let's retry with lower file size.
+                if (res === "Error 23")
+                {
+                    async_global_max_size = Math.max(1, async_global_max_size - 500);
+                    async_upload_push (async_global_last_code);
+                    return;
+                }
+                else if (/^Error/.test(res))
+                {
+                    pop_failure (res);
+                    return;
+                }
+
+                res = res.split ("\n");
+                var code = res[0]
+                async_global_transfered = async_global_transfering;
+                async_upload_push (code);
+                return;
+            }
+            else

             {
             {

-                pop_failure (res);
+                if (req.status == 413) // Request Entity Too Large
+                {
+                    // lower async_global_max_size and retry
+                    async_global_max_size = Math.max(1, parseInt (async_global_max_size * 0.8));
+                }
+                async_upload_push (async_global_last_code);

                 return;
             }
                 return;
             }

-
-            res = res.split ("\n");
-            var code = res[0]
-            async_global_transfered = async_global_transfering;
-            async_upload_push (code);

         }
     }
     req.open ("POST", 'script.php?push_async' , true);
 
         }
     }
     req.open ("POST", 'script.php?push_async' , true);
 

-    var chunk_size = parseInt (async_global_max_size * 0.50);

     var start = async_global_transfered;
     var start = async_global_transfered;

-    var end = start + chunk_size;
+    var end = start + async_global_max_size;

     if (end >= async_global_file.size)
         end = async_global_file.size;
     var blob = async_global_file.slice (start, end);
     if (end >= async_global_file.size)
         end = async_global_file.size;
     var blob = async_global_file.slice (start, end);


@@ -518,8 +553,8 @@ function async_upload_push (code)
 function async_upload_end (code)
 {
     var req = new XMLHttpRequest ();
 function async_upload_end (code)
 {
     var req = new XMLHttpRequest ();

-    req.addEventListener ("error", pop_failure, false);
-    req.addEventListener ("abort", pop_failure, false);
+    req.addEventListener ("error", XHRErrorHandler, false);
+    req.addEventListener ("abort", XHRErrorHandler, false);

     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)
     req.onreadystatechange = function ()
     {
         if (req.readyState == 4 && req.status == 200)


@@ -560,8 +595,7 @@ function upload (max_size)
 {
     var one_time_checkbox = document.getElementById('one_time_download');
     var one_time = one_time_checkbox !== null ? one_time_checkbox.checked : false;
 {
     var one_time_checkbox = document.getElementById('one_time_download');
     var one_time = one_time_checkbox !== null ? one_time_checkbox.checked : false;

-    if (check_html5_file_api ()
-        && document.getElementById('file_select').files[0].size >= max_size)
+    if (check_html5_file_api ())

     {
         async_upload_start (
             max_size,
     {
         async_upload_start (
             max_size,


@@ -623,17 +657,17 @@ function upload_time_estimation_speed_string()
     if (s <= 1000)
     {
         res = s.toString();
     if (s <= 1000)
     {
         res = s.toString();

-        scale = "Bit/s";
+        scale = "B/s";

     }
     else if (s < 1000000)
     {
         res = Math.floor(s/100) / 10;
     }
     else if (s < 1000000)
     {
         res = Math.floor(s/100) / 10;

-        scale = "KBit/s";
+        scale = "KB/s";

     }
     else
     {
         res = Math.floor(s/100000) / 10;
     }
     else
     {
         res = Math.floor(s/100000) / 10;

-        scale = "Mbit/s";
+        scale = "MB/s";

     }
     if (res == 0)
         return '';
     }
     if (res == 0)
         return '';