static/php/includes/Upload.class.php

   1 <?php
   2 /*
   3  * Uguu
   4  *
   5  * @copyright Copyright (c) 2022 Go Johansson (nokonoko) <neku@pomf.se>
   6  *
   7  * This program is free software: you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License as published by
   9  * the Free Software Foundation, either version 3 of the License, or
  10  * (at your option) any later version.
  11  *
  12  * This program is distributed in the hope that it will be useful,
  13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  * GNU General Public License for more details.
  16  *
  17  * You should have received a copy of the GNU General Public License
  18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
  19  */
  20
  21
  22 require_once 'Core.namespace.php';
  23
  24 use Core\Database as Database;
  25 use Core\Settings as Settings;
  26
  27 class Upload
  28 {
  29
  30     public static string $FILE_NAME;
  31     public static string $FILE_EXTENSION;
  32     public static string $FILE_MIME;
  33     public static string $SHA1;
  34     public static string $NEW_NAME;
  35     public static string $NEW_NAME_FULL;
  36     public static string $IP;
  37
  38     public static string $FILE_SIZE;
  39     public static string $TEMP_FILE;
  40
  41
  42     public function reFiles($files): array
  43     {
  44         $result = [];
  45         $files = self::diverseArray($files);
  46
  47         foreach ($files as $file) {
  48             self::$FILE_NAME = $file['name'];
  49             self::$FILE_SIZE = $file['size'];
  50             self::$TEMP_FILE = $file['tmp_name'];
  51             $result[] = [self::$FILE_NAME, self::$FILE_SIZE, self::$TEMP_FILE];
  52         }
  53         return $result;
  54     }
  55
  56     public function diverseArray($files): array
  57     {
  58         $result = [];
  59
  60         foreach ($files as $key1 => $value1) {
  61             foreach ($value1 as $key2 => $value2) {
  62                 $result[$key2][$key1] = $value2;
  63             }
  64         }
  65         return $result;
  66     }
  67
  68     /**
  69      * @throws Exception
  70      */
  71     public function uploadFile(): array
  72     {
  73         (new Settings())->loadConfig();
  74
  75         if (Settings::$ANTI_DUPE) {
  76             (new Database())->antiDupe();
  77         }
  78
  79         (new Upload())->generateName();
  80
  81
  82         if (!is_dir(Settings::$FILES_ROOT)) {
  83             throw new Exception('File storage path not accessible.', 500);
  84         }
  85
  86         if (!move_uploaded_file(self::$TEMP_FILE, Settings::$FILES_ROOT . self::$NEW_NAME_FULL)) {
  87             throw new Exception('Failed to move file to destination', 500);
  88         }
  89
  90         if (!chmod(Settings::$FILES_ROOT . self::$NEW_NAME_FULL, 0644)) {
  91             throw new Exception('Failed to change file permissions', 500);
  92         }
  93
  94         (new Database())->newIntoDB();
  95
  96         if (Settings::$SSL) {
  97             $preURL = 'https://';
  98         } else {
  99             $preURL = 'http://';
 100         }
 101
 102         return [
 103             'hash' => self::$SHA1,
 104             'name' => self::$FILE_NAME,
 105             'url' => $preURL . Settings::$URL . '/' . rawurlencode(self::$NEW_NAME_FULL),
 106             'size' => self::$FILE_SIZE
 107         ];
 108     }
 109
 110     /**
 111      * @throws Exception
 112      */
 113     public function generateName(): string
 114     {
 115         (new Upload())->fileInfo();
 116
 117         do {
 118             if (Settings::$FILES_RETRIES === 0) {
 119                 throw new Exception('Gave up trying to find an unused name!', 500);
 120             }
 121
 122             self::$NEW_NAME = '';
 123             for ($i = 0; $i < Settings::$NAME_LENGTH; ++$i) {
 124                 self::$NEW_NAME .= Settings::$ID_CHARSET[mt_rand(0, strlen(Settings::$ID_CHARSET))];
 125             }
 126
 127             if (isset(self::$FILE_EXTENSION) && self::$FILE_EXTENSION !== '') {
 128                 self::$NEW_NAME_FULL = self::$NEW_NAME . '.' . self::$FILE_EXTENSION;
 129             }
 130
 131             if (Settings::$BLACKLIST_DB) {
 132                 (new Database())->checkFileBlacklist();
 133             }
 134
 135             if (Settings::$FILTER_MODE) {
 136                 self::checkMimeBlacklist();
 137                 self::checkExtensionBlacklist();
 138             }
 139         } while ((new Database())->dbCheckNameExists() > 0);
 140
 141         return self::$NEW_NAME_FULL;
 142     }
 143
 144     public function fileInfo()
 145     {
 146         if (isset($_FILES['files'])) {
 147             self::$SHA1 = sha1_file(self::$TEMP_FILE);
 148             $finfo = finfo_open(FILEINFO_MIME_TYPE);
 149             self::$FILE_MIME = finfo_file($finfo, self::$TEMP_FILE);
 150             finfo_close($finfo);
 151
 152             if (Settings::$LOG_IP) {
 153                 self::$IP = $_SERVER['REMOTE_ADDR'];
 154             } else {
 155                 self::$IP = '0';
 156             }
 157
 158             foreach (Settings::$DOUBLE_DOTS as $DDOT) {
 159                 if (stripos(strrev(self::$FILE_NAME), $DDOT) === 0) {
 160                     self::$FILE_EXTENSION = strrev($DDOT);
 161                 } else {
 162                     self::$FILE_EXTENSION = pathinfo(self::$FILE_NAME, PATHINFO_EXTENSION);
 163                 }
 164             }
 165         }
 166     }
 167
 168     /**
 169      * @throws Exception
 170      */
 171     public function checkMimeBlacklist()
 172     {
 173         if (in_array(self::$FILE_MIME, Settings::$BLOCKED_MIME)) {
 174             throw new Exception('Filetype not allowed.', 415);
 175         }
 176     }
 177
 178     /**
 179      * @throws Exception
 180      */
 181     public function checkExtensionBlacklist()
 182     {
 183         if (in_array(self::$FILE_EXTENSION, Settings::$BLOCKED_EXTENSIONS)) {
 184             throw new Exception('Filetype not allowed.', 415);
 185         }
 186     }
 187 }