prosody-modules: mod_http_upload_external/share

annotate mod_http_upload_external/share_v2.php @ 5185:09d6bbd6c8a4

mod_http_oauth2: Fix treatment of 'redirect_uri' parameter in code flow It's optional and the one stored in the client registration should really be used instead. RFC 6749 says an URI provided as parameter MUST be validated against the stored one but does not say how. Given that the client needs their secret to proceed, it seems fine to leave this for later.

author	Kim Alvefur <zash@zash.se>
date	Thu, 02 Mar 2023 22:00:42 +0100
parents	b0ad1604f77e
children

rev	line source
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	1 <?php
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	2
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	3 /*
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	4 PHP script to handle file uploads and downloads for Prosody's mod_http_upload_external
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	5
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	6 Tested with Apache 2.2+ and PHP 5.3+
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	7
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	8 ** Why this script?
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	9
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	10 This script only allows uploads that have been authorized by mod_http_upload_external. It
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	11 attempts to make the upload/download as safe as possible, considering that there are many
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	12 security concerns involved with allowing arbitrary file upload/download on a web server.
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	13
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	14 With that said, I do not consider myself a PHP developer, and at the time of writing, this
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	15 code has had no external review. Use it at your own risk. I make no claims that this code
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	16 is secure.
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	17
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	18 ** How to use?
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	19
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	20 Drop this file somewhere it will be served by your web server. Edit the config options below.
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	21
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	22 In Prosody set:
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	23
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	24 http_upload_external_base_url = "https://your.example.com/path/to/share.php/"
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	25 http_upload_external_secret = "this is your secret string"
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	26 http_upload_external_protocol = "v2";
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	27
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	28 ** License
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	29
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	30 (C) 2016 Matthew Wild <mwild1@gmail.com>
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	31
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	32 Permission is hereby granted, free of charge, to any person obtaining a copy of this software
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	33 and associated documentation files (the "Software"), to deal in the Software without restriction,
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	34 including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	35 and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	36 subject to the following conditions:
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	37
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	38 The above copyright notice and this permission notice shall be included in all copies or substantial
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	39 portions of the Software.
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	40
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	41 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	42 BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	43 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	44 DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	45 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	46
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	47 */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	48
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	49 /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	50 /* CONFIGURATION OPTIONS */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	51 /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	52
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	53 /* Change this to a directory that is writable by your web server, but is outside your web root */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	54 $CONFIG_STORE_DIR = '/tmp';
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	55
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	56 /* This must be the same as 'http_upload_external_secret' that you set in Prosody's config file */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	57 $CONFIG_SECRET = 'this is your secret string';
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	58
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	59 /* For people who need options to tweak that they don't understand... here you are */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	60 $CONFIG_CHUNK_SIZE = 4096;
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	61
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	62 /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	63 /* END OF CONFIGURATION */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	64 /\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	65
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	66 /* Do not edit below this line unless you know what you are doing (spoiler: nobody does) */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	67
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	68 $upload_file_name = substr($_SERVER['PHP_SELF'], strlen($_SERVER['SCRIPT_NAME'])+1);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	69 $store_file_name = $CONFIG_STORE_DIR . '/store-' . hash('sha256', $upload_file_name);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	70
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	71 $request_method = $_SERVER['REQUEST_METHOD'];
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	72
3226 3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	73 /* Set CORS headers */
3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	74 header('Access-Control-Allow-Methods: GET, PUT, OPTIONS');
3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	75 header('Access-Control-Allow-Headers: Content-Type');
3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	76 header('Access-Control-Max-Age: 7200');
3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	77 header('Access-Control-Allow-Origin: *');
3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	78
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	79 if(array_key_exists('v2', $_GET) === TRUE && $request_method === 'PUT') {
3228 bada43f3a546 mod_http_upload_external: share_v2.php: Comment out verbose debug logging Matthew Wild <mwild1@gmail.com> parents: 3226 diff changeset	80 // error_log(var_export($_SERVER, TRUE));
3161 887a8100343a share_v2.php: Fix array keys Matthew Wild <mwild1@gmail.com> parents: 2978 diff changeset	81 $upload_file_size = $_SERVER['CONTENT_LENGTH'];
887a8100343a share_v2.php: Fix array keys Matthew Wild <mwild1@gmail.com> parents: 2978 diff changeset	82 $upload_token = $_GET['v2'];
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	83
3161 887a8100343a share_v2.php: Fix array keys Matthew Wild <mwild1@gmail.com> parents: 2978 diff changeset	84 if(array_key_exists('CONTENT_TYPE', $_SERVER) === TRUE) {
887a8100343a share_v2.php: Fix array keys Matthew Wild <mwild1@gmail.com> parents: 2978 diff changeset	85 $upload_file_type = $_SERVER['CONTENT_TYPE'];
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	86 } else {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	87 $upload_file_type = 'application/octet-stream';
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	88 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	89
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	90 // Imagine being able to store the file data in the content-type!
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	91 if(strlen($upload_file_type) > 255) {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	92 header('HTTP/1.0 400 Bad Request');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	93 exit;
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	94 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	95
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	96 $calculated_token = hash_hmac('sha256', "$upload_file_name\0$upload_file_size\0$upload_file_type", $CONFIG_SECRET);
3162 3797be8f491f share_v2.php: Fix syntax errors Matthew Wild <mwild1@gmail.com> parents: 3161 diff changeset	97 if(function_exists('hash_equals')) {
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	98 if(hash_equals($calculated_token, $upload_token) !== TRUE) {
3163 31b85864a615 share_v2.php: Add error logging Matthew Wild <mwild1@gmail.com> parents: 3162 diff changeset	99 error_log("Token mismatch: calculated $calculated_token got $upload_token");
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	100 header('HTTP/1.0 403 Forbidden');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	101 exit;
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	102 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	103 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	104 else {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	105 if($upload_token !== $calculated_token) {
3163 31b85864a615 share_v2.php: Add error logging Matthew Wild <mwild1@gmail.com> parents: 3162 diff changeset	106 error_log("Token mismatch: calculated $calculated_token got $upload_token");
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	107 header('HTTP/1.0 403 Forbidden');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	108 exit;
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	109 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	110 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	111 /* Open a file for writing */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	112 $store_file = fopen($store_file_name, 'x');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	113
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	114 if($store_file === FALSE) {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	115 header('HTTP/1.0 409 Conflict');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	116 exit;
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	117 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	118
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	119 /* PUT data comes in on the stdin stream */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	120 $incoming_data = fopen('php://input', 'r');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	121
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	122 /* Read the data a chunk at a time and write to the file */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	123 while ($data = fread($incoming_data, $CONFIG_CHUNK_SIZE)) {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	124 fwrite($store_file, $data);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	125 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	126
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	127 /* Close the streams */
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	128 fclose($incoming_data);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	129 fclose($store_file);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	130 file_put_contents($store_file_name.'-type', $upload_file_type);
4310 b0ad1604f77e mod_http_upload_external: update php scripts to return HTTP 201 Created on upload Richard Schwab <hgprosodyim-lawrpxz9uw@central-intelligence.agency> parents: 3228 diff changeset	131
b0ad1604f77e mod_http_upload_external: update php scripts to return HTTP 201 Created on upload Richard Schwab <hgprosodyim-lawrpxz9uw@central-intelligence.agency> parents: 3228 diff changeset	132 // https://xmpp.org/extensions/xep-0363.html#upload
b0ad1604f77e mod_http_upload_external: update php scripts to return HTTP 201 Created on upload Richard Schwab <hgprosodyim-lawrpxz9uw@central-intelligence.agency> parents: 3228 diff changeset	133 // A HTTP status Code of 201 means that the server is now ready to serve the file via the provided GET URL.
b0ad1604f77e mod_http_upload_external: update php scripts to return HTTP 201 Created on upload Richard Schwab <hgprosodyim-lawrpxz9uw@central-intelligence.agency> parents: 3228 diff changeset	134 header('HTTP/1.0 201 Created');
b0ad1604f77e mod_http_upload_external: update php scripts to return HTTP 201 Created on upload Richard Schwab <hgprosodyim-lawrpxz9uw@central-intelligence.agency> parents: 3228 diff changeset	135 exit;
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	136 } else if($request_method === 'GET' \|\| $request_method === 'HEAD') {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	137 // Send file (using X-Sendfile would be nice here...)
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	138 if(file_exists($store_file_name)) {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	139 $mime_type = file_get_contents($store_file_name.'-type');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	140 if($mime_type === FALSE) {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	141 $mime_type = 'application/octet-stream';
3164 5176b8d81ec7 share_v2.php: Remove content-disposition if mime type is set Matthew Wild <mwild1@gmail.com> parents: 3163 diff changeset	142 header('Content-Disposition: attachment');
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	143 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	144 header('Content-Type: '.$mime_type);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	145 header('Content-Length: '.filesize($store_file_name));
3162 3797be8f491f share_v2.php: Fix syntax errors Matthew Wild <mwild1@gmail.com> parents: 3161 diff changeset	146 header("Content-Security-Policy: \"default-src 'none'\"");
3797be8f491f share_v2.php: Fix syntax errors Matthew Wild <mwild1@gmail.com> parents: 3161 diff changeset	147 header("X-Content-Security-Policy: \"default-src 'none'\"");
3797be8f491f share_v2.php: Fix syntax errors Matthew Wild <mwild1@gmail.com> parents: 3161 diff changeset	148 header("X-WebKit-CSP: \"default-src 'none'\"");
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	149 if($request_method !== 'HEAD') {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	150 readfile($store_file_name);
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	151 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	152 } else {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	153 header('HTTP/1.0 404 Not Found');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	154 }
3226 3b13f19652e2 mod_http_upload_external: Update share.php and share_v2.php to allow cross-domain requests Matthew Wild <mwild1@gmail.com> parents: 3164 diff changeset	155 } else if($request_method === 'OPTIONS') {
2978 ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	156 } else {
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	157 header('HTTP/1.0 400 Bad Request');
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	158 }
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	159
ac99a04231b1 mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation Matthew Wild <mwild1@gmail.com> parents: diff changeset	160 exit;

Mercurial > prosody-modules

annotate mod_http_upload_external/share_v2.php @ 5185:09d6bbd6c8a4