Merge pull request #36 from thxo/remove-dot-suffix-randomname

Ensure no trailing dot in random filenames

diff --git a/README.md b/README.md
index 110eda774168cdb6eb981aee63a4fabca0f5bd80..cb3f58f87c0f467f1188deec76d8b9230b8f70c3 100644 (file)
--- a/README.md
+++ b/README.md
@@ -2,10 +2,13 @@
 [Uguu.se](http://uguu.se) source code, stores files and deletes after X amount of time.
 
 # Tested with:
-* Nginx+PHP5-FPM (PHP 5.4) on Debian 7 Wheezy
 * Apache (PHP 5.4) on Ubuntu 14.04 LTS
 * Apache (PHP 5.6) on Debian 8 Jessie
+* Apache (PHP 5.6.33 (remi-php56)) on CentOS 6.9
+* Nginx+PHP5-FPM (PHP 5.4) on Debian 7 Wheezy
 * Nginx+PHP5-FPM (PHP 5.6) on Debian 8 Jessie
+* Nginx+PHP7-FPM (PHP 7.0) on Debian 9 Stretch
+* [Caddy](https://caddyserver.com/) + php7.0-fpm on Ubuntu 16.04.4 LTS
 
 # Install:
 
@@ -88,6 +91,18 @@ server{
 }
 ```
 
+Or something like this for usage with caddy:
+```
+uguu.se {
+    fastcgi / /var/run/php/php7.0-fpm.sock php
+    root /home/neku/www
+}
+
+a.uguu.se {
+    root /home/neku/www/files
+}
+```
+
 
 # Using the API
 

diff --git a/includes/config.template.php b/includes/config.template.php
index 28c74144adb00a1fc1a9fc719ffac33643bd92fb..6efcdc656551df213f3c84dc7b4946c288b366b7 100644 (file)
--- a/includes/config.template.php
+++ b/includes/config.template.php
@@ -15,7 +15,11 @@ define("CONFIG_MAX_RETENTION_TIME", "60");
 define("CONFIG_MAX_RETENTION_TEXT", "1 hour");
 //Length of the random chain appended to the filename
 define("CONFIG_RANDOM_LENGTH", "12");
-//This is the list of blocked extensions, you can remove extensions or add to this list as you like
-define ("CONFIG_BLOCKED_EXTENSIONS", serialize(array("exe", "scr", "rar", "zip", "com", "vbs", "bat", "cmd", "html", "htm", "msi", "php", "php5")));
+//Operate on a BLACKLIST or a WHITELIST when blocking file extensions
+define("CONFIG_EXTENSION_BLOCKING_MODE", "BLACKLIST");
+//This is the list of blocked extensions in BLACKLIST mode (default mode), you can remove extensions or add to this list as you like
+define("CONFIG_BLOCKED_EXTENSIONS", serialize(array("exe", "scr", "rar", "zip", "com", "vbs", "bat", "cmd", "html", "htm", "msi", "php", "php5")));
+//This is the list of allowed extensions in WHITELIST mode, you can remove extensions or add to this list as you like
+define("CONFIG_ALLOWED_EXTENSIONS", serialize(array("txt", "pdf")));
 //https://wiki.gentoo.org/wiki/Handbook to set this string correctly, or just ignore it
 define("VERYLO_NG_STRING_THATDOESNTREALLYD_O_ANYTHING", "ok");

diff --git a/includes/core.php b/includes/core.php
index 5e915478074103c83c7efd21f2a5769c67619019..8f48a5145ecfb710516429fc8ebdaeda9ac75b85 100644 (file)
--- a/includes/core.php
+++ b/includes/core.php
@@ -9,14 +9,7 @@ function save_file ($file, $name, $arg, $type){
         case 'random':
             $ext = pathinfo($file.$name, PATHINFO_EXTENSION);
             $ext = strtolower($ext);
-            if(in_array($ext, unserialize(CONFIG_BLOCKED_EXTENSIONS))){
-              if($type==='normal'){
-                include_once(CONFIG_ROOT_PATH.'error_meow.php');
-                exit(0);
-              }else{
-                exit('File type not allowed.');
-              }
-            }
+            verify_extension($ext, $type);
             $file_name = gen_name('random', $ext);
             while(file_exists(CONFIG_FILES_PATH.$file_name)){
               $file_name = gen_name('random', $ext);
@@ -28,14 +21,7 @@ function save_file ($file, $name, $arg, $type){
                 $file_name = gen_name('custom_original', $name);
                 $ext = pathinfo($file_name, PATHINFO_EXTENSION);
                 $ext = strtolower($ext);
-                if(in_array($ext, unserialize(CONFIG_BLOCKED_EXTENSIONS))){
-                 if($type==='normal'){
-                   include_once(CONFIG_ROOT_PATH.'error_meow.php');
-                   exit(0);
-                 }else{
-                   exit('File type not allowed.');
-                 }
-                }
+                verify_extension($ext, $type);
             while(file_exists(CONFIG_FILES_PATH.$file_name)){
                 $file_name = gen_name('custom_original', $name);
             }
@@ -79,3 +65,21 @@ function gen_name($arg, $in){
             break;
     }
 }
+
+//Verify that the extension is allowed
+function verify_extension($ext, $type){
+    if(CONFIG_EXTENSION_BLOCKING_MODE === "WHITELIST") {
+        $allowed = in_array($ext, unserialize(CONFIG_ALLOWED_EXTENSIONS));
+    }else{
+        $allowed = !in_array($ext, unserialize(CONFIG_BLOCKED_EXTENSIONS));
+    }
+
+    if(!$allowed){
+        if($type==='normal'){
+            include_once(CONFIG_ROOT_PATH.'error_meow.php');
+            exit(0);
+        }else{
+            exit('File type not allowed.');
+        }
+    }
+}

diff --git a/rain/template/upload-done.html b/rain/template/upload-done.html
index e08eb3e2ef5c3dff2b67404497a94794553c8c2b..1b6df2e48cbd8c1300b6669cf5f3b4e339fe2cdf 100644 (file)
--- a/rain/template/upload-done.html
+++ b/rain/template/upload-done.html
@@ -4,7 +4,7 @@
             <div class="card-panel blue-grey darken-1">
                 <div class="card-content white-text">
                     <span class="card-title" style="color: #00FF99"><h3>File uploaded!</h3></span>
-                        <p><a href="{$url_filename}">{$url_filename}</a></p>
+                        <p><a href="{$url_filename}" target="_blank">{$url_filename}</a></p>
                         <p>Your file will be available for download during {$retention_time}.</p>
                 </div>
             </div>

diff --git a/rain/template/upload.html b/rain/template/upload.html
index 5fbfc2e21ac282944b870a012edb3506bbf90336..599b6edcdd8983f2c759ae8c91c0ec914628f52b 100644 (file)
--- a/rain/template/upload.html
+++ b/rain/template/upload.html
@@ -10,7 +10,7 @@
                 </div>
 
                 <p>
-                    <input type="checkbox" id="randomname" name="randomname" />
+                    <input name="randomname" type="checkbox" id="randomname" checked="checked" />
                     <label for="randomname">Generate random filename</label>
                 </p>