X-Git-Url: https://git.p6c8.net/jirafeau_project.git/blobdiff_plain/045f02b53953998c9cb0cff34f7f62664bdd66cd..88e724f1380e8cf1fb35567a65bb182a8d6df540:/lib/functions.php?ds=sidebyside

diff --git a/lib/functions.php b/lib/functions.php
index 3a304a4..27e4fc3 100644
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -98,6 +98,9 @@ function is_ssl() {
             return true;
     } elseif ( isset($_SERVER['SERVER_PORT']) && ( '443' == $_SERVER['SERVER_PORT'] ) ) {
         return true;
+    } elseif (isset($_SERVER['HTTP_X_FORWARDED_PROTO'])) {
+        if ($_SERVER['HTTP_X_FORWARDED_PROTO'] == 'https')
+            return true;
     }
     return false;
 }
@@ -443,7 +446,7 @@ jirafeau_upload ($file, $one_time_download, $key, $time, $ip, $crypt, $link_name
 }
 
 /**
- * tells if a mime-type is viewable in a browser
+ * Tells if a mime-type is viewable in a browser
  * @param $mime the mime type
  * @returns a boolean telling if a mime type is viewable
  */
@@ -841,10 +844,11 @@ jirafeau_async_init ($filename, $type, $one_time, $key, $time, $ip)
   * @param $ref asynchronous upload reference
   * @param $file piece of data
   * @param $code client code for this operation
+  * @param $max_file_size maximum allowed file size
   * @return  a string containing a next code to use or the string "Error"
   */
 function
-jirafeau_async_push ($ref, $data, $code)
+jirafeau_async_push ($ref, $data, $code, $max_file_size)
 {
     /* Get async infos. */
     $a = jirafeau_get_async_ref ($ref);
@@ -858,9 +862,21 @@ jirafeau_async_push ($ref, $data, $code)
     
     $p = s2p ($ref);
 
+    /* File path. */
+    $r_path = $data['tmp_name'];
+    $w_path = VAR_ASYNC . $p . $ref . '_data';
+
+    /* Check that file size is not above upload limit. */
+    if ($max_file_size > 0 &&
+        filesize ($r_path) + filesize ($w_path) > $max_file_size * 1024 * 1024)
+    {
+        jirafeau_async_delete ($ref);
+        return "Error";
+    }
+
     /* Concatenate data. */
-    $r = fopen ($data['tmp_name'], 'r');
-    $w = fopen (VAR_ASYNC . $p . $ref . '_data', 'a');
+    $r = fopen ($r_path, 'r');
+    $w = fopen ($w_path, 'a');
     while (!feof ($r))
     {
         if (fwrite ($w, fread ($r, 1024)) === false)
@@ -873,7 +889,7 @@ jirafeau_async_push ($ref, $data, $code)
     }
     fclose ($r);
     fclose ($w);
-    unlink ($data['tmp_name']);
+    unlink ($r_path);
     
     /* Update async file. */
     $code = jirafeau_gen_random (4);
@@ -891,7 +907,7 @@ jirafeau_async_push ($ref, $data, $code)
   * @param $ref asynchronous upload reference
   * @param $code client code for this operation
   * @param $crypt boolean asking to crypt or not
-  * @param $link_name_length link name lenght
+  * @param $link_name_length link name length
   * @return  a string containing the download reference followed by a delete code or the string "Error"
   */
 function
@@ -1068,3 +1084,27 @@ function jirafeau_challenge_upload_password ($cfg, $password)
     return false;
 }
 
+/**
+ * Test if visitor's IP is authorized to upload.
+ * @param $ip IP to be challenged
+ * @return true if IP is authorized, false otherwise.
+ */
+function jirafeau_challenge_upload_ip ($cfg, $ip)
+{
+    if (count ($cfg['upload_ip']) == 0)
+        return true;
+    forEach ($cfg['upload_ip'] as $i)
+    {
+        if ($i == $ip)
+            return true;
+        // CIDR test for IPv4 only.
+        if (strpos ($i, '/') !== false)
+        {
+            list ($subnet, $mask) = explode('/', $i);
+            if ((ip2long ($ip) & ~((1 << (32 - $mask)) - 1) ) == ip2long ($subnet))
+                return true;
+        }
+    }
+    return false;
+}
+