From 818c83a99d1bfb30870d703106cb7d2f54599c45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Fran=C3=A7ois?= <francois@kaz.bzh>
Date: Fri, 23 Oct 2026 17:56:20 +0200
Subject: [PATCH] fix faille

---
 src/Jirafeau/a.php                   | 63 +++++++++++++---------------
 src/Jirafeau/c.php                   | 17 ++++----
 src/Jirafeau/f.php                   |  4 +-
 src/Jirafeau/lib/attach-setup.php    | 25 ++++++-----
 src/Jirafeau/lib/config.original.php |  2 +
 src/Jirafeau/lib/settings.php        |  2 +-
 src/Jirafeau/lib/template/page.php   |  2 +-
 src/Jirafeau/s.php                   | 13 ++----
 8 files changed, 57 insertions(+), 71 deletions(-)

diff --git a/src/Jirafeau/a.php b/src/Jirafeau/a.php
index 2b113c0..0a23b6e 100644
--- a/src/Jirafeau/a.php
+++ b/src/Jirafeau/a.php
@@ -13,7 +13,7 @@
  action: a=login a=logout a=r[on|off] a=p[minute|hour|day|week|month|quarter|semester]
 */
 
-require ("lib/attach-setup.php");
+require (__DIR__ . "/lib/attach-setup.php");
 
 $modeText = ['none' => "sans", 'footer' => "pied de page", 'attachment' => "pi&egrave;ce jointe", 'both' => "les deux"];
 $trackText = ['on' => "oui", 'off' => "non"];
@@ -173,31 +173,24 @@ function period2seconds ($periodName) {
     switch ($periodName) {
     case 'minute':
         return JIRAFEAU_MINUTE;
-        break;
     case 'hour':
         return JIRAFEAU_HOUR;
-        break;
     case 'day':
         return JIRAFEAU_DAY;
-        break;
     case 'week':
         return JIRAFEAU_WEEK;
-        break;
     case 'month':
         return JIRAFEAU_MONTH;
-        break;
     case 'quarter':
         return JIRAFEAU_QUARTER;
-        break;
     case 'semester':
         return JIRAFEAU_SEMESTER;
-        break;
     case 'year':
         return JIRAFEAU_YEAR;
-        break;
     default:
         returnError (t ('ERR_OCC') . ' (periodName)');
     }
+    return null;
 }
 
 // ========================================
@@ -266,7 +259,7 @@ function updateArchiveCacheUpTo ($period) {
     while ( ($d = array_shift ($stack)) && $d != null) {
         $dir = scandir ($d);
         foreach ($dir as $dirName) {
-            if (strcmp ($dirName, '.') == 0 || strcmp ($dirName, '..') == 0 ||
+            if (strcmp ($dirName, '.') === 0 || strcmp ($dirName, '..') === 0 ||
                 preg_match ('/\.tmp/i', "$dirName")) {
                 continue;
             }
@@ -323,7 +316,7 @@ function readArchiveFromLines ($lines) {
             break;
             // XXX issue ")"
         case preg_match ("/^\s*new:\s*([0-9a-zA-Z_-]+)\s+([0-9a-zA-Z_-]+)\)?\s*$/", $line, $matches):
-            $archive [T_NEW][] = [$matches [1], $matches [2]];
+            $archive [T_NEWKAZ][] = [$matches [1], $matches [2]];
             break;
         case preg_match ("/^\s*old:\s*([0-9a-zA-Z_-]+)\s+([0-9a-zA-Z_-]+)\)?\s*$/", $line, $matches):
             $archive [T_OLD][] = [$matches [1], $matches [2]];
@@ -418,8 +411,8 @@ function deleteAction ($linkName) {
             return;
         }
         $fileToDelete = false;
-        if ($archiveInfo [T_NEW])
-            foreach ($archiveInfo [T_NEW] as [$fileName, $cryptKey]) {
+        if ($archiveInfo [T_NEWKAZ])
+            foreach ($archiveInfo [T_NEWKAZ] as [$fileName, $cryptKey]) {
                 $fileLink = jirafeau_get_link ($fileName);
                 if (! count ($fileLink))
                     continue;
@@ -436,8 +429,8 @@ function deleteAction ($linkName) {
         $message .= "l'envoi ".$archiveInfo [T_TIME]." est supprim&eacute;";
         if ($fileToDelete)
             $message .= " avec<ul>";
-        if ($archiveInfo [T_NEW])
-            foreach ($archiveInfo [T_NEW] as [$fileName, $cryptKey]) {
+        if ($archiveInfo [T_NEWKAZ])
+            foreach ($archiveInfo [T_NEWKAZ] as [$fileName, $cryptKey]) {
                 $fileLink = jirafeau_get_link ($fileName);
                 if (! count ($fileLink))
                     continue;
@@ -459,7 +452,7 @@ function deleteAction ($linkName) {
             continue;
         $dir = scandir ($d);
         foreach ($dir as $dirName) {
-            if (strcmp ($dirName, '.') == 0 || strcmp ($dirName, '..') == 0 ||
+            if (strcmp ($dirName, '.') === 0 || strcmp ($dirName, '..') === 0 ||
                 preg_match ('/\.tmp/i', "$dirName")) {
                 continue;
             }
@@ -477,8 +470,8 @@ function deleteAction ($linkName) {
             $archiveInfo = readArchiveFromLink ($dirLink);
             if (! count ($archiveInfo))
                 return;
-            if ($archiveInfo [T_NEW])
-                foreach ($archiveInfo [T_NEW] as [$newName, $cryptKey]) {
+            if ($archiveInfo [T_NEWKAZ])
+                foreach ($archiveInfo [T_NEWKAZ] as [$newName, $cryptKey]) {
                     if ($fileName != $newName)
                         continue;
                     if ($sender == $archiveInfo [T_SENDER]) {
@@ -487,7 +480,7 @@ function deleteAction ($linkName) {
                             $message .= jirafeau_escape ($fileLink ['file_name'])." est supprim&eacute;";
                             // check empty dir
                             $empty = true;
-                            foreach ([T_OLD, T_NEW] as $cat)
+                            foreach ([T_OLD, T_NEWKAZ] as $cat)
                                 if ($empty && isset ($archiveInfo [$cat]))
                                     foreach ($archiveInfo [$cat] as [$l, $c])
                                         if (count (jirafeau_get_link ($l))) {
@@ -532,7 +525,7 @@ if ($doUpdate) {
         returnError (t ('FILE_404'));
     $linkName = $matches [1];
     $link = jirafeau_get_link ($linkName);
-    if (count ($link) == 0)
+    if (count ($link) === 0)
         returnError (t ('FILE_404'));
     $time = updateLink ($linkName, $link, $maxTime);
     $content = '' . $time . NL;
@@ -540,7 +533,7 @@ if ($doUpdate) {
     if (isKazArchive ($link)) {
         $archiveInfo = readArchiveFromLink ($l);
         if (count ($archiveInfo)) {
-            foreach ([T_OLD, T_NEW] as $cat)
+            foreach ([T_OLD, T_NEWKAZ] as $cat)
                 if (isset ($archiveInfo [$cat]))
                     foreach ($archiveInfo [$cat] as [$linkName, $cryptKey])
                         updateLink ($linkName, jirafeau_get_link ($linkName), $maxTime);
@@ -557,14 +550,14 @@ if ($doUpdate) {
 if ($doDownload) {
     // check archive exist
     $couple = explode ("~", $_REQUEST [A_GET], 2);
-    if (count ($couple) == 0)
+    if (count ($couple) === 0)
         returnError (E_BAD_ARCHIVE_NAME);
     $linkName = $couple [0];
     if (!$linkName || !preg_match ('/[0-9a-zA-Z_-]+$/', $linkName))
         returnError (E_BAD_ARCHIVE_NAME);
-    $cryptKey = count ($couple) == 2 ? $couple [1] : "";
+    $cryptKey = count ($couple) === 2 ? $couple [1] : "";
     $link = jirafeau_get_link ($linkName);
-    if (count ($link) == 0)
+    if (count ($link) === 0)
         returnError (t ('FILE_404'));
     $key = $link ['key'];
     if ($key && (empty ($cryptKey) || $key != $cryptKey))
@@ -576,11 +569,11 @@ if ($doDownload) {
     $archiveContent = [];
     $modif = false;
     $singleName = [];
-    foreach ([T_OLD, T_NEW] as $cat)
+    foreach ([T_OLD, T_NEWKAZ] as $cat)
         if (isset ($archiveInfo [$cat]))
             foreach ($archiveInfo [$cat] as [$linkName, $cryptKey]) {
                 $link = jirafeau_get_link ($linkName);
-                if (count ($link) == 0) {
+                if (count ($link) === 0) {
                     if (isset ($archiveContent [T_NOT_FOUND]))
                         ++$archiveContent [T_NOT_FOUND];
                     else
@@ -644,9 +637,9 @@ if ($doDownload) {
             $info .= $archiveContent [T_RENAME]. ($archiveContent [T_RENAME] ? M_FILE_RENAMED : M_FILES_RENAMED).NL;
         $zip->addFromString ($dirname.T_WARNING_FILENAME, $info);
     }
-    foreach ([T_OLD, T_NEW] as $cat)
+    foreach ([T_OLD, T_NEWKAZ] as $cat)
         if (isset ($archiveContent [$cat])) {
-            $subdir = $dirname . "-".($cat == T_NEW ? M_NEW_ATTACHEMENT_DIRNAME : M_OLD_ATTACHEMENT_DIRNAME);
+            $subdir = $dirname . "-".($cat == T_NEWKAZ ? M_NEW_ATTACHEMENT_DIRNAME : M_OLD_ATTACHEMENT_DIRNAME);
             foreach ($archiveContent [$cat][T_ENTRIES] as $entry) {
                 $p = s2p ($entry [T_HASH]);
                 if ($entry [T_CRYPTED]) {
@@ -693,7 +686,7 @@ if ($doDownload) {
     $r = fopen ($tmpFileName.".zip", 'r');
     while (!feof ($r)) {
         print fread ($r, 1024);
-        ob_flush ();
+        //ob_flush ();
     }
     fclose ($r);
 
@@ -921,14 +914,14 @@ if ($archives) {
     foreach ($archives as $archiveInfo) {
         $contentSize = 0;
         $archContent = '';
-        foreach ([T_NEW, T_OLD] as $cat) {
-            $liStyle = $cat == T_NEW ? "font-weight: bold;" : "font-style: italic;";
+        foreach ([T_NEWKAZ, T_OLD] as $cat) {
+            $liStyle = $cat == T_NEWKAZ ? "font-weight: bold;" : "font-style: italic;";
             if (isset ($archiveInfo [$cat]))
                 foreach ($archiveInfo [$cat] as [$linkName, $cryptKey]) {
                     $link = jirafeau_get_link ($linkName);
-                    if (count ($link) == 0)
+                    if (count ($link) === 0)
                         continue;
-                    if ($cat == T_NEW )
+                    if ($cat == T_NEWKAZ )
                         $contentSize += $link ['file_size'];
                     $lf = $linkName;
                     $kf = $link ['key'];
@@ -942,7 +935,7 @@ if ($archives) {
                                  jirafeau_escape ($link ['file_name']).
                                  ' ('.jirafeau_escape ($link ['mime_type']).
                                  ' '.jirafeau_human_size ($link ['file_size']).')';
-                    if ($cat == T_NEW)
+                    if ($cat == T_NEWKAZ)
                         $archContent .=
                                      '<a data-tooltip="supprimer" href="javascript:rmFile (\''.$lf.'\');"> &#9850; </a>';
                     $archContent .=
@@ -981,7 +974,7 @@ echo
     '<button type="submit">'.M_LOGOUT.'</button>'.
     '.</form>';
 if (count ($userTab)) {
-    foreach ($userTab as $time => $entry)
+    foreach ($userTab as $entry)
         echo $entry;
 } else
     echo
diff --git a/src/Jirafeau/c.php b/src/Jirafeau/c.php
index 5f80f12..b47eb0b 100644
--- a/src/Jirafeau/c.php
+++ b/src/Jirafeau/c.php
@@ -11,17 +11,17 @@
  c.php?g=l~k => zip
 */
 
-require ("lib/attach-setup.php");
+require (__DIR__ . "/lib/attach-setup.php");
 
 // ========================================
 function setUserProfile ($profile, $listUrl) {
     if (!$profile)
-        return;
+        return null;
     if (!file_exists (VAR_CLOUD))
         mkdir (VAR_CLOUD, 0755);
     if (empty ($listUrl)) {
         rmUserProfile ($profile);
-        return;
+        return null;
     }
     return file_put_contents (VAR_CLOUD.$profile, json_encode ($listUrl, JSON_PRETTY_PRINT)) !== false;
 }
@@ -39,10 +39,9 @@ function rmUserProfile ($profile) {
  * @return array Données Nextcloud de l'utilisateur.
  */
 function getUserProfile ($profile) {
-    $listUrl = [];
     if ($profile && file_exists (VAR_CLOUD.$profile))
-        $listUrl = json_decode (file_get_contents (VAR_CLOUD.$profile), true);
-    return $listUrl;
+        return json_decode (file_get_contents (VAR_CLOUD.$profile), true);
+    return [];
 }
 
 // ==============================================
@@ -111,7 +110,7 @@ function manageUrl () {
 session_start ();
 
 //phpinfo ();
-displayHeadPage ($title);
+displayHeadPage ($title ?? '');
 echo '<div class="block-info">'.M_SWITCH_WELCOME.'</div>'.NL;
 
 // logout
@@ -179,7 +178,7 @@ if (isset ($_REQUEST [A_GET]) || isset ($_REQUEST [A_HASH])) {
     } else if (isset ($_REQUEST [A_HASH])) {
         $tmpComp = explode ("~", $_REQUEST [A_HASH]);
         $query .= '/f.php?'.http_build_query ([
-            'd' => $_REQUEST ['d'],
+            'd' => $_REQUEST ['d'] ?? '',
             A_HASH => $tmpComp [0],
             'k' => $tmpComp [1]
         ]);
@@ -194,7 +193,7 @@ if (isset ($_REQUEST [A_GET]) || isset ($_REQUEST [A_HASH])) {
 } else
     echo '<div class="block"><div class="block-info">'.M_SWITCH_NO_FILE.'</div></div>'.NL;
 
-if (!($logged || empty ($profile))) {
+if (!$logged && !empty ($profile)) {
     displayProfileName (M_SWITCH_FORGET);
 }
 
diff --git a/src/Jirafeau/f.php b/src/Jirafeau/f.php
index a2d6f0d..35a31cd 100644
--- a/src/Jirafeau/f.php
+++ b/src/Jirafeau/f.php
@@ -43,7 +43,7 @@ if (!preg_match('/[0-9a-zA-Z_-]+$/', $link_name)) {
 }
 
 $link = jirafeau_get_link($link_name);
-if (count($link) == 0) {
+if (count($link) === 0) {
     require(JIRAFEAU_ROOT.'lib/template/header.php');
     echo '<div class="error"><p>' . t('FILE_404') .
                                   '</p></div>';
@@ -276,7 +276,7 @@ elseif ($link['crypted']) {
 }
 /* Read file. */
 else {
-    if ($cfg['use_xsendfile']) {
+    if ($cfg['use_xsendfile'] ?? '') {
         $file_web_path = preg_replace('#^' . $_SERVER['DOCUMENT_ROOT'] . '#', '', VAR_FILES);
         header('X-Sendfile: ' . $file_web_path . $p . $link['hash']);
     } else {
diff --git a/src/Jirafeau/lib/attach-setup.php b/src/Jirafeau/lib/attach-setup.php
index eaa0ec9..3a92945 100644
--- a/src/Jirafeau/lib/attach-setup.php
+++ b/src/Jirafeau/lib/attach-setup.php
@@ -8,7 +8,7 @@
 use PHPMailer\PHPMailer\PHPMailer;
 use PHPMailer\PHPMailer\SMTP;
 use PHPMailer\PHPMailer\Exception;
-require 'vendor/autoload.php';
+require __DIR__ . '/../vendor/autoload.php';
 
 define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/../');
 
@@ -146,7 +146,7 @@ define ('T_CRYPT_KEY', 'crypt_key');
 define ('T_ENTRIES', 'entries');
 define ('T_FILENAME', 'file_name');
 define ('T_HASH', 'hash');
-define ('T_NEW', 'new');
+define ('T_NEWKAZ', 'new');
 define ('T_SIGN', 'sign');
 define ('T_NOT_FOUND', 'not_found');
 define ('T_OLD', 'old');
@@ -193,7 +193,7 @@ require (JIRAFEAU_ROOT . 'lib/template/page.php');
 function cleanToken () {
     if (!file_exists (VAR_TOKENS))
         mkdir (VAR_TOKENS, 0755);
-    $d = dir (VAR_TOKENS);
+    dir (VAR_TOKENS);
     $oldest = strtotime (TOKEN_USE_LIMIT);
     foreach (glob (VAR_TOKENS."*") as $file) {
         if (file_exists ($file) && filemtime ($file) <= $oldest)
@@ -213,7 +213,7 @@ function rmToken ($sender) {
 
 function setToken ($sender) {
     if (!$sender)
-        return;
+        return null;
     $token = md5 (rand ());
     if (file_put_contents (VAR_TOKENS.$sender, T_CREATE.": ".time ().NL.T_TOKEN.": ".$token.NL))
         return $token;
@@ -235,7 +235,7 @@ function setLoggedToken ($sender, $token) {
  */
 function getTokenVar ($sender, $varName) {
     if (!$sender)
-        return;
+        return null;
     if (!file_exists (VAR_TOKENS.$sender))
         return false;
     $content = file_get_contents (VAR_TOKENS.$sender);
@@ -269,13 +269,13 @@ function setSenderFake ($error, $sender, $owner, $dirLink, $fileLink) {
     if (!file_exists (VAR_FAKE))
         mkdir (VAR_FAKE, 0755);
     $dirTime = $fileTime = $fileName = $fileType = $ip = '';
-    if (count ($dirLink) != 0) {
+    if (count ($dirLink) !== 0) {
         $dirTime = $dirLink ['upload_date'].date (" Y-m-d H:i:s", $dirLink ['upload_date']);
         $ip = $dirLink ['ip'];
     }
     if (!$sender)
         return;
-    if (count ($fileLink) != 0) {
+    if (count ($fileLink) !== 0) {
         $fileTime = $fileLink ['upload_date'].date (" Y-m-d H:i:s", $fileLink ['upload_date']);
         $fileName = $link ['file_name'];
         $fileType = $link ['mime_type'];
@@ -292,7 +292,7 @@ function setSenderFake ($error, $sender, $owner, $dirLink, $fileLink) {
              "fileTime: ".$fileTime.NL.
              "fileType: <".$fileType.">".NL.
              "fileName: <".$fileName.">".NL;
-    
+
     $log = $ip.$sender;
     if ($log)
         file_put_contents (VAR_FAKE.$log, $content);
@@ -325,7 +325,7 @@ function sendEMail ($receiver, $receiver_name,  $subject, $body_string){
         $mail->SMTPAutoTLS = false;
         $mail->SMTPSecure  = "none";
         $mail->Port        = 25;
-        $mail->charSet     = "UTF-8";
+        $mail->CharSet     = "UTF-8";
         $mail->ContentType = 'text/html';
 
         global $domain;
@@ -342,10 +342,9 @@ function sendEMail ($receiver, $receiver_name,  $subject, $body_string){
         if (!$mail->send ()) {
             //echo 'Mailer Error: ' . $mail->ErrorInfo;
             return 0;
-        } else {
-            //echo 'Message sent!';
-            return 1;
         }
+        //echo 'Message sent!';
+        return 1;
     } catch (Exception $e) {
         return 0;
     }
@@ -388,7 +387,7 @@ if (isset ($_REQUEST [A_ACTION]) && $_REQUEST [A_ACTION] == T_LOGIN && $sender)
             $url .= "&".A_HASH."=".$_REQUEST [A_HASH];
         $result = sendEMail ($sender, "",  M_EMAIL_SUBJECT,
                              str_replace (["___LINK___", "___IP___", "___DATE___"],
-                                          [$url, $_SERVER ['HTTP_X_REAL_IP'], date ("Y-m-d H:i:s")], M_EMAIL_CONTENT));
+                                          [$url, isset($_SERVER['HTTP_X_REAL_IP']) ? $_SERVER['HTTP_X_REAL_IP'] : $_SERVER['REMOTE_ADDR'], date ("Y-m-d H:i:s")], M_EMAIL_CONTENT));
         if ($result)
             echo M_SEND_TOKEN;
         else
diff --git a/src/Jirafeau/lib/config.original.php b/src/Jirafeau/lib/config.original.php
index 1185a7d..dfbd64b 100644
--- a/src/Jirafeau/lib/config.original.php
+++ b/src/Jirafeau/lib/config.original.php
@@ -1,4 +1,6 @@
 <?php
+declare(strict_types=1);
+
 /*
  *  Jirafeau, your web file repository
  *  Copyright (C) 2008  Julien "axolotl" BERNARD <axolotl@magieeternelle.org>
diff --git a/src/Jirafeau/lib/settings.php b/src/Jirafeau/lib/settings.php
index 24a50f2..e5b0352 100644
--- a/src/Jirafeau/lib/settings.php
+++ b/src/Jirafeau/lib/settings.php
@@ -51,7 +51,7 @@ define('VAR_ASYNC', $cfg['var_root'] . 'async/');
 // helping variable to build absolute link to
 // root of the domain without handling the URL scheme
 $absPrefix = parse_url($cfg['web_root'], PHP_URL_PATH);
-if (true === empty($absPrefix)) {
+if (empty($absPrefix)) {
     // fallback if installation isnt done yet: relative links to same level on the current page
     $absPrefix = './';
 }
diff --git a/src/Jirafeau/lib/template/page.php b/src/Jirafeau/lib/template/page.php
index a8a5757..8ff92e0 100644
--- a/src/Jirafeau/lib/template/page.php
+++ b/src/Jirafeau/lib/template/page.php
@@ -49,7 +49,7 @@
   
   <div class="table">
     <form class="tr" action="<?php echo $_SERVER ['SCRIPT_NAME']; ?>" method="POST">
-      <input type="email" name="<?php echo A_SENDER; ?>" size="40" value="<?php echo jirafeau_escape ($_REQUEST [A_SENDER]);?>" placeholder="Votre m&eacute;l" required="required"/>
+      <input type="email" name="<?php echo A_SENDER;?>" size="40" value="<?php echo jirafeau_escape ($_REQUEST [A_SENDER] ?? '');?>" placeholder="Votre m&eacute;l" required="required"/>
       <?php echo getHiddenLink (); ?>
       <input type="hidden" name="<?php echo A_ACTION; ?>" value="<?php echo T_LOGIN; ?>" />
       <input type="submit" value="<?php echo M_SEND; ?>" />
diff --git a/src/Jirafeau/s.php b/src/Jirafeau/s.php
index 91d275b..9a42d23 100644
--- a/src/Jirafeau/s.php
+++ b/src/Jirafeau/s.php
@@ -8,7 +8,7 @@
 use PHPMailer\PHPMailer\PHPMailer;
 use PHPMailer\PHPMailer\SMTP;
 use PHPMailer\PHPMailer\Exception;
-require 'vendor/autoload.php';
+require __DIR__ . '/vendor/autoload.php';
 
 define ('JIRAFEAU_ROOT', dirname (__FILE__) . '/');
 
@@ -23,31 +23,24 @@ function period2seconds ($periodName) {
     switch ($periodName) {
     case 'minute':
         return JIRAFEAU_MINUTE;
-        break;
     case 'hour':
         return JIRAFEAU_HOUR;
-        break;
     case 'day':
         return JIRAFEAU_DAY;
-        break;
     case 'week':
         return JIRAFEAU_WEEK;
-        break;
     case 'month':
         return JIRAFEAU_MONTH;
-        break;
     case 'quarter':
         return JIRAFEAU_QUARTER;
-        break;
     case 'semester':
         return JIRAFEAU_SEMESTER;
-        break;
     case 'year':
         return JIRAFEAU_YEAR;
-        break;
     default:
         returnError (t ('ERR_OCC') . ' (periodName)');
     }
+    return null;
 }
 
 // ========================================
@@ -66,7 +59,7 @@ if (! isset ($_FILES ['file'])) {
 // ========================================
 $maxtime = time ()+period2seconds ($_REQUEST ['time']);
 $key = isset ($_REQUEST ['key']) ? $_REQUEST ['key'] : '';
-$ip = $_SERVER ['HTTP_X_REAL_IP']; // XXX
+$ip = isset($_SERVER['HTTP_X_REAL_IP']) ? $_SERVER['HTTP_X_REAL_IP'] : $_SERVER['REMOTE_ADDR'];
 $res = jirafeau_upload (
     $_FILES['file'],
     isset ($_POST ['one_time_download']),