Mercurial > prosody-modules

comparison mod_http_upload_external/share_v2.php @ 2978:ac99a04231b1

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
mod_http_upload_external: Add newer 'v2' protocol (and share_v2.php) which supports content-type preservation
author Matthew Wild <mwild1@gmail.com>
date Mon, 02 Apr 2018 10:57:17 +0100
parents
children 887a8100343a
comparison
equal deleted inserted replaced
2977:7036e82f83f5 2978:ac99a04231b1
1 <?php
2
3 /*
4 PHP script to handle file uploads and downloads for Prosody's mod_http_upload_external
5
6 Tested with Apache 2.2+ and PHP 5.3+
7
8 ** Why this script?
9
10 This script only allows uploads that have been authorized by mod_http_upload_external. It
11 attempts to make the upload/download as safe as possible, considering that there are *many*
12 security concerns involved with allowing arbitrary file upload/download on a web server.
13
14 With that said, I do not consider myself a PHP developer, and at the time of writing, this
15 code has had no external review. Use it at your own risk. I make no claims that this code
16 is secure.
17
18 ** How to use?
19
20 Drop this file somewhere it will be served by your web server. Edit the config options below.
21
22 In Prosody set:
23
24 http_upload_external_base_url = "https://your.example.com/path/to/share.php/"
25 http_upload_external_secret = "this is your secret string"
26 http_upload_external_protocol = "v2";
27
28 ** License
29
30 (C) 2016 Matthew Wild <mwild1@gmail.com>
31
32 Permission is hereby granted, free of charge, to any person obtaining a copy of this software
33 and associated documentation files (the "Software"), to deal in the Software without restriction,
34 including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
35 and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
36 subject to the following conditions:
37
38 The above copyright notice and this permission notice shall be included in all copies or substantial
39 portions of the Software.
40
41 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
42 BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
43 NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
44 DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
45 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
46
47 */
48
49 /*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
50 /* CONFIGURATION OPTIONS */
51 /*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
52
53 /* Change this to a directory that is writable by your web server, but is outside your web root */
54 $CONFIG_STORE_DIR = '/tmp';
55
56 /* This must be the same as 'http_upload_external_secret' that you set in Prosody's config file */
57 $CONFIG_SECRET = 'this is your secret string';
58
59 /* For people who need options to tweak that they don't understand... here you are */
60 $CONFIG_CHUNK_SIZE = 4096;
61
62 /*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
63 /* END OF CONFIGURATION */
64 /*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
65
66 /* Do not edit below this line unless you know what you are doing (spoiler: nobody does) */
67
68 $upload_file_name = substr($_SERVER['PHP_SELF'], strlen($_SERVER['SCRIPT_NAME'])+1);
69 $store_file_name = $CONFIG_STORE_DIR . '/store-' . hash('sha256', $upload_file_name);
70
71 $request_method = $_SERVER['REQUEST_METHOD'];
72
73 if(array_key_exists('v2', $_GET) === TRUE && $request_method === 'PUT') {
74 $upload_file_size = $_SERVER['HTTP_CONTENT_LENGTH'];
75 $upload_token = $_SERVER['HTTP_UPLOAD_SIGNATURE'];
76
77 if(array_key_exists('HTTP_CONTENT_TYPE', $_SERVER) === TRUE) {
78 $upload_file_type = $_SERVER['HTTP_CONTENT_TYPE'];
79 } else {
80 $upload_file_type = 'application/octet-stream';
81 }
82
83 // Imagine being able to store the file data in the content-type!
84 if(strlen($upload_file_type) > 255) {
85 header('HTTP/1.0 400 Bad Request');
86 exit;
87 }
88
89 $calculated_token = hash_hmac('sha256', "$upload_file_name\0$upload_file_size\0$upload_file_type", $CONFIG_SECRET);
90 if(function_exists('hash_equals') {
91 if(hash_equals($calculated_token, $upload_token) !== TRUE) {
92 header('HTTP/1.0 403 Forbidden');
93 exit;
94 }
95 }
96 else {
97 if($upload_token !== $calculated_token) {
98 header('HTTP/1.0 403 Forbidden');
99 exit;
100 }
101 }
102 /* Open a file for writing */
103 $store_file = fopen($store_file_name, 'x');
104
105 if($store_file === FALSE) {
106 header('HTTP/1.0 409 Conflict');
107 exit;
108 }
109
110 /* PUT data comes in on the stdin stream */
111 $incoming_data = fopen('php://input', 'r');
112
113 /* Read the data a chunk at a time and write to the file */
114 while ($data = fread($incoming_data, $CONFIG_CHUNK_SIZE)) {
115 fwrite($store_file, $data);
116 }
117
118 /* Close the streams */
119 fclose($incoming_data);
120 fclose($store_file);
121 file_put_contents($store_file_name.'-type', $upload_file_type);
122 } else if($request_method === 'GET' || $request_method === 'HEAD') {
123 // Send file (using X-Sendfile would be nice here...)
124 if(file_exists($store_file_name)) {
125 $mime_type = file_get_contents($store_file_name.'-type');
126 if($mime_type === FALSE) {
127 $mime_type = 'application/octet-stream';
128 }
129 header('Content-Disposition: attachment');
130 header('Content-Type: '.$mime_type);
131 header('Content-Length: '.filesize($store_file_name));
132 header('Content-Security-Policy: "default-src \'none\'"');
133 header('X-Content-Security-Policy: "default-src \'none\'"');
134 header('X-WebKit-CSP: "default-src 'none'"');
135 if($request_method !== 'HEAD') {
136 readfile($store_file_name);
137 }
138 } else {
139 header('HTTP/1.0 404 Not Found');
140 }
141 } else {
142 header('HTTP/1.0 400 Bad Request');
143 }
144
145 exit;