Fix input sanitize in scripting interface

[jirafeau_project.git] / script.php

diff --git a/script.php b/script.php
index eda2cc99d215b4ef5977764bf37ecb6f21479dd6..396538ccc0a86ad9060680b3eac5dd264b482fbd 100755 (executable)
--- a/script.php
+++ b/script.php
@@ -30,19 +30,19 @@ require (JIRAFEAU_ROOT . 'lib/settings.php');
 require (JIRAFEAU_ROOT . 'lib/functions.php');\r
 require (JIRAFEAU_ROOT . 'lib/lang.php');\r
 \r
 require (JIRAFEAU_ROOT . 'lib/functions.php');\r
 require (JIRAFEAU_ROOT . 'lib/lang.php');\r
 \r

-if (file_exists (JIRAFEAU_ROOT . 'install.php'))\r
-{\r
-    header('Content-Type: text; charset=utf-8');\r
-    echo "Error";\r
-    exit;\r
-}\r
-\r

  global $script_langages;\r
  $script_langages = array ('bash' => 'Bash');\r
 \r
 if ($_SERVER['REQUEST_METHOD'] == "GET" && count ($_GET) == 0)\r
 {\r
     require (JIRAFEAU_ROOT . 'lib/template/header.php');\r
  global $script_langages;\r
  $script_langages = array ('bash' => 'Bash');\r
 \r
 if ($_SERVER['REQUEST_METHOD'] == "GET" && count ($_GET) == 0)\r
 {\r
     require (JIRAFEAU_ROOT . 'lib/template/header.php');\r

+    check_errors ();\r
+    if (has_error ())\r
+    {\r
+        show_errors ();\r
+        require (JIRAFEAU_ROOT . 'lib/template/footer.php');\r
+        exit;\r
+    }\r

     echo '<div class="info">';\r
     echo '<h2>' . t('Welcome to Jirafeau\'s query interface') . '</h2>';\r
     echo '<p>';\r
     echo '<div class="info">';\r
     echo '<h2>' . t('Welcome to Jirafeau\'s query interface') . '</h2>';\r
     echo '<p>';\r


@@ -50,6 +50,19 @@ if ($_SERVER['REQUEST_METHOD'] == "GET" && count ($_GET) == 0)
             ' ' . t('The instructions above show how to query this interface.');\r
     echo '</p>';\r
     \r
             ' ' . t('The instructions above show how to query this interface.');\r
     echo '</p>';\r
     \r

+    echo '<h3>' . t('Get Jirafeau\'s version') . ':</h3>';\r
+    echo '<p>';\r
+    echo t('Send a GET query to') . ': <i>' . $web_root . 'script.php</i><br />';\r
+    echo '<br />';\r
+    echo t('Parameters') . ':<br />';\r
+    echo "<b>get_version=</b>1<i> (" . t('Required') . ")</i> <br />";\r
+    echo '</p>';\r
+    echo '<p>' . t('This will return brut text content.') . ' ' .\r
+            t('First line is the version number.') . '<br /></p>';\r
+    echo '<p>';\r
+    echo t('Example') . ": <a href=\"" . $web_root . "script.php?get_version=1\">" . $web_root . "script.php?get_version=1</a> ";\r
+    echo '</p>';\r
+\r

     echo '<h3>' . t('Get server capacity') . ':</h3>';\r
     echo '<p>';\r
     echo t('Send a GET query to') . ': <i>' . $web_root . 'script.php</i><br />';\r
     echo '<h3>' . t('Get server capacity') . ':</h3>';\r
     echo '<p>';\r
     echo t('Send a GET query to') . ': <i>' . $web_root . 'script.php</i><br />';\r


@@ -122,6 +135,47 @@ if ($_SERVER['REQUEST_METHOD'] == "GET" && count ($_GET) == 0)
     foreach ($script_langages as $lang => $name)\r
         echo "$name: <a href=\"" . $web_root . "script.php?lang=$lang\">" . $web_root . "script.php?lang=$lang</a> ";\r
     echo '</p>';\r
     foreach ($script_langages as $lang => $name)\r
         echo "$name: <a href=\"" . $web_root . "script.php?lang=$lang\">" . $web_root . "script.php?lang=$lang</a> ";\r
     echo '</p>';\r

+    \r
+    echo '<h3>' . t('Initalize a asynchronous transfert') . ':</h3>';\r
+    echo '<p>';\r
+    echo t('The goal is to permit to transfert big file, chunk by chunk.') . ' ';\r
+    echo t('Chunks of data must be sent in order.');\r
+    echo '</p>';\r
+    echo '<p>';\r
+    echo t('Send a GET query to') . ': <i>' . $web_root . 'script.php?init_async</i><br />';\r
+    echo '<br />';\r
+    echo t('Parameters') . ':<br />';\r
+    echo "<b>filename=</b>file_name.ext<i> (" . t('Required') . ")</i> <br />";\r
+    echo "<b>type=</b>MIME_TYPE<i> (" . t('Optional') . ")</i> <br />";\r
+    echo "<b>time=</b>[minute|hour|day|week|month|none]<i> (" . t('Optional') . ', '. t('default: none') . ")</i> <br />";\r
+    echo "<b>password=</b>your_password<i> (" . t('Optional') . ")</i> <br />";\r
+    echo "<b>one_time_download=</b>1<i> (" . t('Optional') . ")</i> <br />";\r
+    echo '</p>';\r
+    echo '<p>' . t('This will return brut text content.') . ' ' .\r
+         t('First line is the asynchronous transfert reference and the second line the code to use in the next operation.') . '<br /></p>';\r
+\r
+    echo '<h3>' . t('Push data during asynchronous transfert') . ':</h3>';\r
+    echo '<p>';\r
+    echo t('Send a GET query to') . ': <i>' . $web_root . 'script.php?push_async</i><br />';\r
+    echo '<br />';\r
+    echo t('Parameters') . ':<br />';\r
+    echo "<b>ref=</b>async_reference<i> (" . t('Required') . ")</i> <br />";\r
+    echo "<b>data=</b>data_chunk<i> (" . t('Required') . ")</i> <br />";\r
+    echo "<b>code=</b>last_provided_code<i> (" . t('Required') . ")</i> <br />";\r
+    echo '</p>';\r
+    echo '<p>' . t('This will return brut text content.') . ' ' .\r
+         t('Returns the next code to use.') . '<br /></p>';\r
+\r
+    echo '<h3>' . t('Finalize asynchronous transfert') . ':</h3>';\r
+    echo '<p>';\r
+    echo t('Send a GET query to') . ': <i>' . $web_root . 'script.php?end_async</i><br />';\r
+    echo '<br />';\r
+    echo t('Parameters') . ':<br />';\r
+    echo "<b>ref=</b>async_reference<i> (" . t('Required') . ")</i> <br />";\r
+    echo "<b>code=</b>last_provided_code<i> (" . t('Required') . ")</i> <br />";\r
+    echo '</p>';\r
+    echo '<p>' . t('This will return brut text content.') . ' ' .\r
+         t('First line is the download reference and the second line the delete code.') . '<br /></p>';\r

 \r
     echo '</div><br />';\r
     require (JIRAFEAU_ROOT . 'lib/template/footer.php');\r
 \r
     echo '</div><br />';\r
     require (JIRAFEAU_ROOT . 'lib/template/footer.php');\r


@@ -225,11 +279,19 @@ elseif (isset ($_GET['h']))
         exit;\r
     }\r
 \r
         exit;\r
     }\r
 \r

+    /* Read file. */\r

     header ('Content-Length: ' . $link['file_size']);\r
     header ('Content-Type: ' . $link['mime_type']);\r
     header ('Content-Disposition: attachment; filename="' .\r
             $link['file_name'] . '"');\r
     header ('Content-Length: ' . $link['file_size']);\r
     header ('Content-Type: ' . $link['mime_type']);\r
     header ('Content-Disposition: attachment; filename="' .\r
             $link['file_name'] . '"');\r

-    readfile (VAR_FILES . $p . $link['md5']);\r
+\r
+    $r = fopen (VAR_FILES . $p . $link['md5'], 'r');\r
+    while (!feof ($r))\r
+    {\r
+        print fread ($r, 1024);\r
+        ob_flush();\r
+    }\r
+    fclose ($r);\r

 \r
     if ($link['onetime'] == 'O')\r
         jirafeau_delete_link ($link_name);\r
 \r
     if ($link['onetime'] == 'O')\r
         jirafeau_delete_link ($link_name);\r


@@ -240,6 +302,10 @@ elseif (isset ($_GET['get_capacity']))
     echo min (jirafeau_ini_to_bytes (ini_get ('post_max_size')),\r
               jirafeau_ini_to_bytes (ini_get ('upload_max_filesize')));\r
 }\r
     echo min (jirafeau_ini_to_bytes (ini_get ('post_max_size')),\r
               jirafeau_ini_to_bytes (ini_get ('upload_max_filesize')));\r
 }\r

+elseif (isset ($_GET['get_version']))\r
+{\r
+    echo JIRAFEAU_VERSION;\r
+}\r

 elseif (isset ($_GET['lang']))\r
 {\r
     $l=$_GET['lang'];\r
 elseif (isset ($_GET['lang']))\r
 {\r
     $l=$_GET['lang'];\r


@@ -376,7 +442,75 @@ fi
         exit;\r
     }\r
 }\r
         exit;\r
     }\r
 }\r

+/* Initialize an asynchronous upload. */\r
+elseif (isset ($_GET['init_async']))\r
+{\r
+    if (!isset ($_POST['filename']))\r
+    {\r
+        echo "Error";\r
+        exit;\r
+    }\r
+\r
+    $type = '';\r
+    if (isset ($_POST['type']))\r
+        $type = $_POST['type'];\r
+    \r
+    $key = '';\r
+    if (isset ($_POST['password']))\r
+        $key = $_POST['password'];\r
+\r
+    $time = time ();\r
+    if (!isset ($_POST['time']))\r
+        $time = JIRAFEAU_INFINITY;\r
+    else\r
+        switch ($_POST['time'])\r
+        {\r
+            case 'minute':\r
+                $time += JIRAFEAU_MINUTE;\r
+                break;\r
+            case 'hour':\r
+                $time += JIRAFEAU_HOUR;\r
+                break;\r
+            case 'day':\r
+                $time += JIRAFEAU_DAY;\r
+                break;\r
+            case 'week':\r
+                $time += JIRAFEAU_WEEK;\r
+                break;\r
+            case 'month':\r
+                $time += JIRAFEAU_MONTH;\r
+                break;\r
+            default:\r
+                $time = JIRAFEAU_INFINITY;\r
+                break;\r
+        }\r
+    echo jirafeau_async_init ($_POST['filename'],\r
+                              $type,\r
+                              isset ($_POST['one_time_download']),\r
+                              $key,\r
+                              $time,\r
+                              $_SERVER['REMOTE_ADDR']);\r
+}\r
+/* Continue an asynchronous upload. */\r
+elseif (isset ($_GET['push_async']))\r
+{\r
+    if ((!isset ($_POST['ref']))\r
+        || (!isset ($_FILES['data']))\r
+        || (!isset ($_POST['code'])))\r
+        echo "Error";\r
+    else\r
+        echo jirafeau_async_push ($_POST['ref'], $_FILES['data'], $_POST['code']);                                      \r
+}\r
+/* Finalize an asynchronous upload. */\r
+elseif (isset ($_GET['end_async']))\r
+{\r
+    if (!isset ($_POST['ref'])\r
+        || !isset ($_POST['code']))\r
+        echo "Error";\r
+    else\r
+        echo jirafeau_async_end ($_POST['ref'], $_POST['code']);\r
+}\r

 else\r
     echo "Error";\r
 exit;\r
 else\r
     echo "Error";\r
 exit;\r

-?>
\ No newline at end of file
+?>\r