KAZ/depollueur
7
1 Fork 0
Code Issues Pull Requests Projects Releases Activity

fix faille

Browse Source
This commit is contained in:
francois committed 2026-10-23 17:56:20 +02:00
1 parent bf96993c29
commit 818c83a99d
8 files changed
+57 -71
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

src/Jirafeau/a.php
+28 -35
View File
@@ -13,7 +13,7 @@
action: a=login a=logout a=r[on|off] a=p[minute|hour|day|week|month|quarter|semester]
*/
require ("lib/attach-setup.php");
require (__DIR__ . "/lib/attach-setup.php");
$modeText = ['none' => "sans", 'footer' => "pied de page", 'attachment' => "pièce jointe", 'both' => "les deux"];
$trackText = ['on' => "oui", 'off' => "non"];
@@ -173,31 +173,24 @@ function period2seconds ($periodName) {
switch ($periodName) {
case 'minute':
return JIRAFEAU_MINUTE;
break;
case 'hour':
return JIRAFEAU_HOUR;
break;
case 'day':
return JIRAFEAU_DAY;
break;
case 'week':
return JIRAFEAU_WEEK;
break;
case 'month':
return JIRAFEAU_MONTH;
break;
case 'quarter':
return JIRAFEAU_QUARTER;
break;
case 'semester':
return JIRAFEAU_SEMESTER;
break;
case 'year':
return JIRAFEAU_YEAR;
break;
default:
returnError (t ('ERR_OCC') . ' (periodName)');
}
return null;
}
// ========================================
@@ -266,7 +259,7 @@ function updateArchiveCacheUpTo ($period) {
while ( ($d = array_shift ($stack)) && $d != null) {
$dir = scandir ($d);
foreach ($dir as $dirName) {
if (strcmp ($dirName, '.') == 0 || strcmp ($dirName, '..') == 0 ||
if (strcmp ($dirName, '.') === 0 || strcmp ($dirName, '..') === 0 ||
preg_match ('/\.tmp/i', "$dirName")) {
continue;
}
@@ -323,7 +316,7 @@ function readArchiveFromLines ($lines) {
break;
// XXX issue ")"
case preg_match ("/^\s*new:\s*([0-9a-zA-Z_-]+)\s+([0-9a-zA-Z_-]+)\)?\s*$/", $line, $matches):
$archive [T_NEW][] = [$matches [1], $matches [2]];
$archive [T_NEWKAZ][] = [$matches [1], $matches [2]];
break;
case preg_match ("/^\s*old:\s*([0-9a-zA-Z_-]+)\s+([0-9a-zA-Z_-]+)\)?\s*$/", $line, $matches):
$archive [T_OLD][] = [$matches [1], $matches [2]];
@@ -418,8 +411,8 @@ function deleteAction ($linkName) {
return;
}
$fileToDelete = false;
if ($archiveInfo [T_NEW])
foreach ($archiveInfo [T_NEW] as [$fileName, $cryptKey]) {
if ($archiveInfo [T_NEWKAZ])
foreach ($archiveInfo [T_NEWKAZ] as [$fileName, $cryptKey]) {
$fileLink = jirafeau_get_link ($fileName);
if (! count ($fileLink))
continue;
@@ -436,8 +429,8 @@ function deleteAction ($linkName) {
$message .= "l'envoi ".$archiveInfo [T_TIME]." est supprimé";
if ($fileToDelete)
$message .= " avec<ul>";
if ($archiveInfo [T_NEW])
foreach ($archiveInfo [T_NEW] as [$fileName, $cryptKey]) {
if ($archiveInfo [T_NEWKAZ])
foreach ($archiveInfo [T_NEWKAZ] as [$fileName, $cryptKey]) {
$fileLink = jirafeau_get_link ($fileName);
if (! count ($fileLink))
continue;
@@ -459,7 +452,7 @@ function deleteAction ($linkName) {
continue;
$dir = scandir ($d);
foreach ($dir as $dirName) {
if (strcmp ($dirName, '.') == 0 || strcmp ($dirName, '..') == 0 ||
if (strcmp ($dirName, '.') === 0 || strcmp ($dirName, '..') === 0 ||
preg_match ('/\.tmp/i', "$dirName")) {
continue;
}
@@ -477,8 +470,8 @@ function deleteAction ($linkName) {
$archiveInfo = readArchiveFromLink ($dirLink);
if (! count ($archiveInfo))
return;
if ($archiveInfo [T_NEW])
foreach ($archiveInfo [T_NEW] as [$newName, $cryptKey]) {
if ($archiveInfo [T_NEWKAZ])
foreach ($archiveInfo [T_NEWKAZ] as [$newName, $cryptKey]) {
if ($fileName != $newName)
continue;
if ($sender == $archiveInfo [T_SENDER]) {
@@ -487,7 +480,7 @@ function deleteAction ($linkName) {
$message .= jirafeau_escape ($fileLink ['file_name'])." est supprim&eacute;";
// check empty dir
$empty = true;
foreach ([T_OLD, T_NEW] as $cat)
foreach ([T_OLD, T_NEWKAZ] as $cat)
if ($empty && isset ($archiveInfo [$cat]))
foreach ($archiveInfo [$cat] as [$l, $c])
if (count (jirafeau_get_link ($l))) {
@@ -532,7 +525,7 @@ if ($doUpdate) {
returnError (t ('FILE_404'));
$linkName = $matches [1];
$link = jirafeau_get_link ($linkName);
if (count ($link) == 0)
if (count ($link) === 0)
returnError (t ('FILE_404'));
$time = updateLink ($linkName, $link, $maxTime);
$content = '' . $time . NL;
@@ -540,7 +533,7 @@ if ($doUpdate) {
if (isKazArchive ($link)) {
$archiveInfo = readArchiveFromLink ($l);
if (count ($archiveInfo)) {
foreach ([T_OLD, T_NEW] as $cat)
foreach ([T_OLD, T_NEWKAZ] as $cat)
if (isset ($archiveInfo [$cat]))
foreach ($archiveInfo [$cat] as [$linkName, $cryptKey])
updateLink ($linkName, jirafeau_get_link ($linkName), $maxTime);
@@ -557,14 +550,14 @@ if ($doUpdate) {
if ($doDownload) {
// check archive exist
$couple = explode ("~", $_REQUEST [A_GET], 2);
if (count ($couple) == 0)
if (count ($couple) === 0)
returnError (E_BAD_ARCHIVE_NAME);
$linkName = $couple [0];
if (!$linkName || !preg_match ('/[0-9a-zA-Z_-]+$/', $linkName))
returnError (E_BAD_ARCHIVE_NAME);
$cryptKey = count ($couple) == 2 ? $couple [1] : "";
$cryptKey = count ($couple) === 2 ? $couple [1] : "";
$link = jirafeau_get_link ($linkName);
if (count ($link) == 0)
if (count ($link) === 0)
returnError (t ('FILE_404'));
$key = $link ['key'];
if ($key && (empty ($cryptKey) || $key != $cryptKey))
@@ -576,11 +569,11 @@ if ($doDownload) {
$archiveContent = [];
$modif = false;
$singleName = [];
foreach ([T_OLD, T_NEW] as $cat)
foreach ([T_OLD, T_NEWKAZ] as $cat)
if (isset ($archiveInfo [$cat]))
foreach ($archiveInfo [$cat] as [$linkName, $cryptKey]) {
$link = jirafeau_get_link ($linkName);
if (count ($link) == 0) {
if (count ($link) === 0) {
if (isset ($archiveContent [T_NOT_FOUND]))
++$archiveContent [T_NOT_FOUND];
else
@@ -644,9 +637,9 @@ if ($doDownload) {
$info .= $archiveContent [T_RENAME]. ($archiveContent [T_RENAME] ? M_FILE_RENAMED : M_FILES_RENAMED).NL;
$zip->addFromString ($dirname.T_WARNING_FILENAME, $info);
}
foreach ([T_OLD, T_NEW] as $cat)
foreach ([T_OLD, T_NEWKAZ] as $cat)
if (isset ($archiveContent [$cat])) {
$subdir = $dirname . "-".($cat == T_NEW ? M_NEW_ATTACHEMENT_DIRNAME : M_OLD_ATTACHEMENT_DIRNAME);
$subdir = $dirname . "-".($cat == T_NEWKAZ ? M_NEW_ATTACHEMENT_DIRNAME : M_OLD_ATTACHEMENT_DIRNAME);
foreach ($archiveContent [$cat][T_ENTRIES] as $entry) {
$p = s2p ($entry [T_HASH]);
if ($entry [T_CRYPTED]) {
@@ -693,7 +686,7 @@ if ($doDownload) {
$r = fopen ($tmpFileName.".zip", 'r');
while (!feof ($r)) {
print fread ($r, 1024);
ob_flush ();
//ob_flush ();
}
fclose ($r);
@@ -921,14 +914,14 @@ if ($archives) {
foreach ($archives as $archiveInfo) {
$contentSize = 0;
$archContent = '';
foreach ([T_NEW, T_OLD] as $cat) {
$liStyle = $cat == T_NEW ? "font-weight: bold;" : "font-style: italic;";
foreach ([T_NEWKAZ, T_OLD] as $cat) {
$liStyle = $cat == T_NEWKAZ ? "font-weight: bold;" : "font-style: italic;";
if (isset ($archiveInfo [$cat]))
foreach ($archiveInfo [$cat] as [$linkName, $cryptKey]) {
$link = jirafeau_get_link ($linkName);
if (count ($link) == 0)
if (count ($link) === 0)
continue;
if ($cat == T_NEW )
if ($cat == T_NEWKAZ )
$contentSize += $link ['file_size'];
$lf = $linkName;
$kf = $link ['key'];
@@ -942,7 +935,7 @@ if ($archives) {
jirafeau_escape ($link ['file_name']).
' ('.jirafeau_escape ($link ['mime_type']).
' '.jirafeau_human_size ($link ['file_size']).')';
if ($cat == T_NEW)
if ($cat == T_NEWKAZ)
$archContent .=
'<a data-tooltip="supprimer" href="javascript:rmFile (\''.$lf.'\');"> &#9850; </a>';
$archContent .=
@@ -981,7 +974,7 @@ echo
'<button type="submit">'.M_LOGOUT.'</button>'.
'.</form>';
if (count ($userTab)) {
foreach ($userTab as $time => $entry)
foreach ($userTab as $entry)
echo $entry;
} else
echo
src/Jirafeau/c.php
+8 -9
View File
@@ -11,17 +11,17 @@
c.php?g=l~k => zip
*/
require ("lib/attach-setup.php");
require (__DIR__ . "/lib/attach-setup.php");
// ========================================
function setUserProfile ($profile, $listUrl) {
if (!$profile)
return;
return null;
if (!file_exists (VAR_CLOUD))
mkdir (VAR_CLOUD, 0755);
if (empty ($listUrl)) {
rmUserProfile ($profile);
return;
return null;
}
return file_put_contents (VAR_CLOUD.$profile, json_encode ($listUrl, JSON_PRETTY_PRINT)) !== false;
}
@@ -39,10 +39,9 @@ function rmUserProfile ($profile) {
* @return array Données Nextcloud de l'utilisateur.
*/
function getUserProfile ($profile) {
$listUrl = [];
if ($profile && file_exists (VAR_CLOUD.$profile))
$listUrl = json_decode (file_get_contents (VAR_CLOUD.$profile), true);
return $listUrl;
return json_decode (file_get_contents (VAR_CLOUD.$profile), true);
return [];
}
// ==============================================
@@ -111,7 +110,7 @@ function manageUrl () {
session_start ();
//phpinfo ();
displayHeadPage ($title);
displayHeadPage ($title ?? '');
echo '<div class="block-info">'.M_SWITCH_WELCOME.'</div>'.NL;
// logout
@@ -179,7 +178,7 @@ if (isset ($_REQUEST [A_GET]) || isset ($_REQUEST [A_HASH])) {
} else if (isset ($_REQUEST [A_HASH])) {
$tmpComp = explode ("~", $_REQUEST [A_HASH]);
$query .= '/f.php?'.http_build_query ([
'd' => $_REQUEST ['d'],
'd' => $_REQUEST ['d'] ?? '',
A_HASH => $tmpComp [0],
'k' => $tmpComp [1]
]);
@@ -194,7 +193,7 @@ if (isset ($_REQUEST [A_GET]) || isset ($_REQUEST [A_HASH])) {
} else
echo '<div class="block"><div class="block-info">'.M_SWITCH_NO_FILE.'</div></div>'.NL;
if (!($logged || empty ($profile))) {
if (!$logged && !empty ($profile)) {
displayProfileName (M_SWITCH_FORGET);
}
src/Jirafeau/f.php
+2 -2
View File
@@ -43,7 +43,7 @@ if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
}
$link = jirafeau_get_link($link_name);
if (count($link) == 0) {
if (count($link) === 0) {
require(JIRAFEAU_ROOT.'lib/template/header.php');
echo '<div class="error"><p>' . t('FILE_404') .
'</p></div>';
@@ -276,7 +276,7 @@ elseif ($link['crypted']) {
}
/* Read file. */
else {
if ($cfg['use_xsendfile']) {
if ($cfg['use_xsendfile'] ?? '') {
$file_web_path = preg_replace('#^' . $_SERVER['DOCUMENT_ROOT'] . '#', '', VAR_FILES);
header('X-Sendfile: ' . $file_web_path . $p . $link['hash']);
} else {
src/Jirafeau/lib/attach-setup.php
+12 -13
View File
@@ -8,7 +8,7 @@
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;
require 'vendor/autoload.php';
require __DIR__ . '/../vendor/autoload.php';
define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/../');
@@ -146,7 +146,7 @@ define ('T_CRYPT_KEY', 'crypt_key');
define ('T_ENTRIES', 'entries');
define ('T_FILENAME', 'file_name');
define ('T_HASH', 'hash');
define ('T_NEW', 'new');
define ('T_NEWKAZ', 'new');
define ('T_SIGN', 'sign');
define ('T_NOT_FOUND', 'not_found');
define ('T_OLD', 'old');
@@ -193,7 +193,7 @@ require (JIRAFEAU_ROOT . 'lib/template/page.php');
function cleanToken () {
if (!file_exists (VAR_TOKENS))
mkdir (VAR_TOKENS, 0755);
$d = dir (VAR_TOKENS);
dir (VAR_TOKENS);
$oldest = strtotime (TOKEN_USE_LIMIT);
foreach (glob (VAR_TOKENS."*") as $file) {
if (file_exists ($file) && filemtime ($file) <= $oldest)
@@ -213,7 +213,7 @@ function rmToken ($sender) {
function setToken ($sender) {
if (!$sender)
return;
return null;
$token = md5 (rand ());
if (file_put_contents (VAR_TOKENS.$sender, T_CREATE.": ".time ().NL.T_TOKEN.": ".$token.NL))
return $token;
@@ -235,7 +235,7 @@ function setLoggedToken ($sender, $token) {
*/
function getTokenVar ($sender, $varName) {
if (!$sender)
return;
return null;
if (!file_exists (VAR_TOKENS.$sender))
return false;
$content = file_get_contents (VAR_TOKENS.$sender);
@@ -269,13 +269,13 @@ function setSenderFake ($error, $sender, $owner, $dirLink, $fileLink) {
if (!file_exists (VAR_FAKE))
mkdir (VAR_FAKE, 0755);
$dirTime = $fileTime = $fileName = $fileType = $ip = '';
if (count ($dirLink) != 0) {
if (count ($dirLink) !== 0) {
$dirTime = $dirLink ['upload_date'].date (" Y-m-d H:i:s", $dirLink ['upload_date']);
$ip = $dirLink ['ip'];
}
if (!$sender)
return;
if (count ($fileLink) != 0) {
if (count ($fileLink) !== 0) {
$fileTime = $fileLink ['upload_date'].date (" Y-m-d H:i:s", $fileLink ['upload_date']);
$fileName = $link ['file_name'];
$fileType = $link ['mime_type'];
@@ -292,7 +292,7 @@ function setSenderFake ($error, $sender, $owner, $dirLink, $fileLink) {
"fileTime: ".$fileTime.NL.
"fileType: <".$fileType.">".NL.
"fileName: <".$fileName.">".NL;
$log = $ip.$sender;
if ($log)
file_put_contents (VAR_FAKE.$log, $content);
@@ -325,7 +325,7 @@ function sendEMail ($receiver, $receiver_name, $subject, $body_string){
$mail->SMTPAutoTLS = false;
$mail->SMTPSecure = "none";
$mail->Port = 25;
$mail->charSet = "UTF-8";
$mail->CharSet = "UTF-8";
$mail->ContentType = 'text/html';
global $domain;
@@ -342,10 +342,9 @@ function sendEMail ($receiver, $receiver_name, $subject, $body_string){
if (!$mail->send ()) {
//echo 'Mailer Error: ' . $mail->ErrorInfo;
return 0;
} else {
//echo 'Message sent!';
return 1;
}
//echo 'Message sent!';
return 1;
} catch (Exception $e) {
return 0;
}
@@ -388,7 +387,7 @@ if (isset ($_REQUEST [A_ACTION]) && $_REQUEST [A_ACTION] == T_LOGIN && $sender)
$url .= "&".A_HASH."=".$_REQUEST [A_HASH];
$result = sendEMail ($sender, "", M_EMAIL_SUBJECT,
str_replace (["___LINK___", "___IP___", "___DATE___"],
[$url, $_SERVER ['HTTP_X_REAL_IP'], date ("Y-m-d H:i:s")], M_EMAIL_CONTENT));
[$url, isset($_SERVER['HTTP_X_REAL_IP']) ? $_SERVER['HTTP_X_REAL_IP'] : $_SERVER['REMOTE_ADDR'], date ("Y-m-d H:i:s")], M_EMAIL_CONTENT));
if ($result)
echo M_SEND_TOKEN;
else
src/Jirafeau/lib/config.original.php
+2
View File
@@ -1,4 +1,6 @@
<?php
declare(strict_types=1);
/*
* Jirafeau, your web file repository
* Copyright (C) 2008 Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
src/Jirafeau/lib/settings.php
+1 -1
View File
@@ -51,7 +51,7 @@ define('VAR_ASYNC', $cfg['var_root'] . 'async/');
// helping variable to build absolute link to
// root of the domain without handling the URL scheme
$absPrefix = parse_url($cfg['web_root'], PHP_URL_PATH);
if (true === empty($absPrefix)) {
if (empty($absPrefix)) {
// fallback if installation isnt done yet: relative links to same level on the current page
$absPrefix = './';
}
src/Jirafeau/lib/template/page.php
+1 -1
View File
@@ -49,7 +49,7 @@
<div class="table">
<form class="tr" action="<?php echo $_SERVER ['SCRIPT_NAME']; ?>" method="POST">
<input type="email" name="<?php echo A_SENDER; ?>" size="40" value="<?php echo jirafeau_escape ($_REQUEST [A_SENDER]);?>" placeholder="Votre m&eacute;l" required="required"/>
<input type="email" name="<?php echo A_SENDER;?>" size="40" value="<?php echo jirafeau_escape ($_REQUEST [A_SENDER] ?? '');?>" placeholder="Votre m&eacute;l" required="required"/>
<?php echo getHiddenLink (); ?>
<input type="hidden" name="<?php echo A_ACTION; ?>" value="<?php echo T_LOGIN; ?>" />
<input type="submit" value="<?php echo M_SEND; ?>" />
src/Jirafeau/s.php
+3 -10
View File
@@ -8,7 +8,7 @@
use PHPMailer\PHPMailer\PHPMailer;
use PHPMailer\PHPMailer\SMTP;
use PHPMailer\PHPMailer\Exception;
require 'vendor/autoload.php';
require __DIR__ . '/vendor/autoload.php';
define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/');
@@ -23,31 +23,24 @@ function period2seconds ($periodName) {
switch ($periodName) {
case 'minute':
return JIRAFEAU_MINUTE;
break;
case 'hour':
return JIRAFEAU_HOUR;
break;
case 'day':
return JIRAFEAU_DAY;
break;
case 'week':
return JIRAFEAU_WEEK;
break;
case 'month':
return JIRAFEAU_MONTH;
break;
case 'quarter':
return JIRAFEAU_QUARTER;
break;
case 'semester':
return JIRAFEAU_SEMESTER;
break;
case 'year':
return JIRAFEAU_YEAR;
break;
default:
returnError (t ('ERR_OCC') . ' (periodName)');
}
return null;
}
// ========================================
@@ -66,7 +59,7 @@ if (! isset ($_FILES ['file'])) {
// ========================================
$maxtime = time ()+period2seconds ($_REQUEST ['time']);
$key = isset ($_REQUEST ['key']) ? $_REQUEST ['key'] : '';
$ip = $_SERVER ['HTTP_X_REAL_IP']; // XXX
$ip = isset($_SERVER['HTTP_X_REAL_IP']) ? $_SERVER['HTTP_X_REAL_IP'] : $_SERVER['REMOTE_ADDR'];
$res = jirafeau_upload (
$_FILES['file'],
isset ($_POST ['one_time_download']),