| <?php |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| define('IN_PHPBB', true); |
| $phpbb_root_path = (defined('PHPBB_ROOT_PATH')) ? PHPBB_ROOT_PATH : './../'; |
| $phpEx = substr(strrchr(__FILE__, '.'), 1); |
| |
| |
| |
| if (isset($_SERVER['CONTENT_TYPE'])) |
| { |
| if ($_SERVER['CONTENT_TYPE'] === 'application/x-java-archive') |
| { |
| exit; |
| } |
| } |
| else if (isset($_SERVER['HTTP_USER_AGENT']) && strpos($_SERVER['HTTP_USER_AGENT'], 'Java') !== false) |
| { |
| exit; |
| } |
| |
| if (isset($_GET['avatar'])) |
| { |
| require($phpbb_root_path . 'config.' . $phpEx); |
| |
| if (!defined('PHPBB_INSTALLED') || empty($dbms) || empty($acm_type)) |
| { |
| exit; |
| } |
| |
| require($phpbb_root_path . 'includes/acm/acm_' . $acm_type . '.' . $phpEx); |
| require($phpbb_root_path . 'includes/cache.' . $phpEx); |
| require($phpbb_root_path . 'includes/db/' . $dbms . '.' . $phpEx); |
| require($phpbb_root_path . 'includes/constants.' . $phpEx); |
| |
| $db = new $sql_db(); |
| $cache = new cache(); |
| |
| |
| if (!@$db->sql_connect($dbhost, $dbuser, $dbpasswd, $dbname, $dbport, false, false)) |
| { |
| exit; |
| } |
| unset($dbpasswd); |
| |
| |
| $browser = (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : 'msie 6.0'; |
| |
| $config = $cache->obtain_config(); |
| $filename = $_GET['avatar']; |
| $avatar_group = false; |
| $exit = false; |
| |
| if ($filename[0] === 'g') |
| { |
| $avatar_group = true; |
| $filename = substr($filename, 1); |
| } |
| |
| |
| if (strpos($filename, '.') == false) |
| { |
| header('HTTP/1.0 403 Forbidden'); |
| $exit = true; |
| } |
| |
| if (!$exit) |
| { |
| $ext = substr(strrchr($filename, '.'), 1); |
| $stamp = (int) substr(stristr($filename, '_'), 1); |
| $filename = (int) $filename; |
| $exit = set_modified_headers($stamp, $browser); |
| } |
| if (!$exit && !in_array($ext, array('png', 'gif', 'jpg', 'jpeg'))) |
| { |
| |
| header("HTTP/1.0 403 Forbidden"); |
| $exit = true; |
| } |
| |
| |
| if (!$exit) |
| { |
| if (!$filename) |
| { |
| |
| header("HTTP/1.0 403 Forbidden"); |
| } |
| else |
| { |
| send_avatar_to_browser(($avatar_group ? 'g' : '') . $filename . '.' . $ext, $browser); |
| } |
| } |
| file_gc(); |
| } |
| |
| |
| include($phpbb_root_path . 'common.' . $phpEx); |
| |
| $download_id = request_var('id', 0); |
| $mode = request_var('mode', ''); |
| $thumbnail = request_var('t', false); |
| |
| |
| $user->session_begin(false); |
| $auth->acl($user->data); |
| $user->setup('viewtopic'); |
| |
| if (!$download_id) |
| { |
| trigger_error('NO_ATTACHMENT_SELECTED'); |
| } |
| |
| if (!$config['allow_attachments'] && !$config['allow_pm_attach']) |
| { |
| trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED'); |
| } |
| |
| $sql = 'SELECT attach_id, in_message, post_msg_id, extension, is_orphan, poster_id, filetime |
| FROM ' . ATTACHMENTS_TABLE . " |
| WHERE attach_id = $download_id"; |
| $result = $db->sql_query_limit($sql, 1); |
| $attachment = $db->sql_fetchrow($result); |
| $db->sql_freeresult($result); |
| |
| if (!$attachment) |
| { |
| trigger_error('ERROR_NO_ATTACHMENT'); |
| } |
| |
| if ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachment['in_message'] && !$config['allow_pm_attach'])) |
| { |
| trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED'); |
| } |
| |
| $row = array(); |
| |
| if ($attachment['is_orphan']) |
| { |
| |
| $own_attachment = ($auth->acl_get('a_attach') || $attachment['poster_id'] == $user->data['user_id']) ? true : false; |
| |
| if (!$own_attachment || ($attachment['in_message'] && !$auth->acl_get('u_pm_download')) || (!$attachment['in_message'] && !$auth->acl_get('u_download'))) |
| { |
| trigger_error('ERROR_NO_ATTACHMENT'); |
| } |
| |
| |
| $extensions = $cache->obtain_attach_extensions(true); |
| } |
| else |
| { |
| if (!$attachment['in_message']) |
| { |
| |
| $sql = 'SELECT p.forum_id, f.forum_password, f.parent_id |
| FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f |
| WHERE p.post_id = ' . $attachment['post_msg_id'] . ' |
| AND p.forum_id = f.forum_id'; |
| $result = $db->sql_query_limit($sql, 1); |
| $row = $db->sql_fetchrow($result); |
| $db->sql_freeresult($result); |
| |
| |
| $f_download = (!$row) ? $auth->acl_getf_global('f_download') : $auth->acl_get('f_download', $row['forum_id']); |
| |
| if ($auth->acl_get('u_download') && $f_download) |
| { |
| if ($row && $row['forum_password']) |
| { |
| |
| login_forum_box($row); |
| } |
| } |
| else |
| { |
| trigger_error('SORRY_AUTH_VIEW_ATTACH'); |
| } |
| } |
| else |
| { |
| $row['forum_id'] = false; |
| if (!$auth->acl_get('u_pm_download')) |
| { |
| header('HTTP/1.0 403 Forbidden'); |
| trigger_error('SORRY_AUTH_VIEW_ATTACH'); |
| } |
| |
| |
| $sql = 'SELECT user_id, author_id |
| FROM ' . PRIVMSGS_TO_TABLE . ' |
| WHERE msg_id = ' . $attachment['post_msg_id']; |
| $result = $db->sql_query($sql); |
| |
| $allowed = false; |
| while ($user_row = $db->sql_fetchrow($result)) |
| { |
| if ($user->data['user_id'] == $user_row['user_id'] || $user->data['user_id'] == $user_row['author_id']) |
| { |
| $allowed = true; |
| break; |
| } |
| } |
| $db->sql_freeresult($result); |
| |
| if (!$allowed) |
| { |
| header('HTTP/1.0 403 Forbidden'); |
| trigger_error('ERROR_NO_ATTACHMENT'); |
| } |
| } |
| |
| |
| $extensions = array(); |
| if (!extension_allowed($row['forum_id'], $attachment['extension'], $extensions)) |
| { |
| trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension'])); |
| } |
| } |
| |
| if (!download_allowed()) |
| { |
| header('HTTP/1.0 403 Forbidden'); |
| trigger_error($user->lang['LINKAGE_FORBIDDEN']); |
| } |
| |
| $download_mode = (int) $extensions[$attachment['extension']]['download_mode']; |
| |
| |
| $sql = 'SELECT attach_id, is_orphan, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype, filetime |
| FROM ' . ATTACHMENTS_TABLE . " |
| WHERE attach_id = $download_id"; |
| $result = $db->sql_query_limit($sql, 1); |
| $attachment = $db->sql_fetchrow($result); |
| $db->sql_freeresult($result); |
| |
| if (!$attachment) |
| { |
| trigger_error('ERROR_NO_ATTACHMENT'); |
| } |
| |
| $attachment['physical_filename'] = basename($attachment['physical_filename']); |
| $display_cat = $extensions[$attachment['extension']]['display_cat']; |
| |
| if (($display_cat == ATTACHMENT_CATEGORY_IMAGE || $display_cat == ATTACHMENT_CATEGORY_THUMB) && !$user->optionget('viewimg')) |
| { |
| $display_cat = ATTACHMENT_CATEGORY_NONE; |
| } |
| |
| if ($display_cat == ATTACHMENT_CATEGORY_FLASH && !$user->optionget('viewflash')) |
| { |
| $display_cat = ATTACHMENT_CATEGORY_NONE; |
| } |
| |
| if ($thumbnail) |
| { |
| $attachment['physical_filename'] = 'thumb_' . $attachment['physical_filename']; |
| } |
| else if (($display_cat == ATTACHMENT_CATEGORY_NONE || $display_cat == ATTACHMENT_CATEGORY_IMAGE) && !$attachment['is_orphan']) |
| { |
| |
| $sql = 'UPDATE ' . ATTACHMENTS_TABLE . ' |
| SET download_count = download_count + 1 |
| WHERE attach_id = ' . $attachment['attach_id']; |
| $db->sql_query($sql); |
| } |
| |
| if ($display_cat == ATTACHMENT_CATEGORY_IMAGE && $mode === 'view' && (strpos($attachment['mimetype'], 'image') === 0) && ((strpos(strtolower($user->browser), 'msie') !== false) && (strpos(strtolower($user->browser), 'msie 8.0') === false))) |
| { |
| wrap_img_in_html(append_sid($phpbb_root_path . 'download/file.' . $phpEx, 'id=' . $attachment['attach_id']), $attachment['real_filename']); |
| } |
| else |
| { |
| |
| if ($download_mode == PHYSICAL_LINK) |
| { |
| |
| if (!@is_dir($phpbb_root_path . $config['upload_path'])) |
| { |
| trigger_error($user->lang['PHYSICAL_DOWNLOAD_NOT_POSSIBLE']); |
| } |
| |
| redirect($phpbb_root_path . $config['upload_path'] . '/' . $attachment['physical_filename']); |
| file_gc(); |
| } |
| else |
| { |
| send_file_to_browser($attachment, $config['upload_path'], $display_cat); |
| file_gc(); |
| } |
| } |
| |
| |
| |
| |
| |
| |
| function send_avatar_to_browser($file, $browser) |
| { |
| global $config, $phpbb_root_path; |
| |
| $prefix = $config['avatar_salt'] . '_'; |
| $image_dir = $config['avatar_path']; |
| |
| |
| if (substr($image_dir, -1, 1) == '/' || substr($image_dir, -1, 1) == '\\') |
| { |
| $image_dir = substr($image_dir, 0, -1) . '/'; |
| } |
| $image_dir = str_replace(array('../', '..\\', './', '.\\'), '', $image_dir); |
| |
| if ($image_dir && ($image_dir[0] == '/' || $image_dir[0] == '\\')) |
| { |
| $image_dir = ''; |
| } |
| $file_path = $phpbb_root_path . $image_dir . '/' . $prefix . $file; |
| |
| if ((@file_exists($file_path) && @is_readable($file_path)) && !headers_sent()) |
| { |
| header('Pragma: public'); |
| |
| $image_data = @getimagesize($file_path); |
| header('Content-Type: ' . image_type_to_mime_type($image_data[2])); |
| |
| if (strpos(strtolower($browser), 'msie') !== false && strpos(strtolower($browser), 'msie 8.0') === false) |
| { |
| header('Content-Disposition: attachment; ' . header_filename($file)); |
| |
| if (strpos(strtolower($browser), 'msie 6.0') !== false) |
| { |
| header('Expires: -1'); |
| } |
| else |
| { |
| header('Expires: ' . gmdate('D, d M Y H:i:s \G\M\T', time() + 31536000)); |
| } |
| } |
| else |
| { |
| header('Content-Disposition: inline; ' . header_filename($file)); |
| header('Expires: ' . gmdate('D, d M Y H:i:s \G\M\T', time() + 31536000)); |
| } |
| |
| $size = @filesize($file_path); |
| if ($size) |
| { |
| header("Content-Length: $size"); |
| } |
| |
| if (@readfile($file_path) == false) |
| { |
| $fp = @fopen($file_path, 'rb'); |
| |
| if ($fp !== false) |
| { |
| while (!feof($fp)) |
| { |
| echo fread($fp, 8192); |
| } |
| fclose($fp); |
| } |
| } |
| |
| flush(); |
| } |
| else |
| { |
| header('HTTP/1.0 404 not found'); |
| } |
| } |
| |
| |
| |
| |
| |
| |
| function wrap_img_in_html($src, $title) |
| { |
| echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-Strict.dtd">'; |
| echo '<html>'; |
| echo '<head>'; |
| echo '<meta http-equiv="content-type" content="text/html; charset=UTF-8" />'; |
| echo '<title>' . $title . '</title>'; |
| echo '</head>'; |
| echo '<body>'; |
| echo '<div>'; |
| echo '<img src="' . $src . '" alt="' . $title . '" />'; |
| echo '</div>'; |
| echo '</body>'; |
| echo '</html>'; |
| } |
| |
| |
| |
| |
| function send_file_to_browser($attachment, $upload_dir, $category) |
| { |
| global $user, $db, $config, $phpbb_root_path; |
| |
| $filename = $phpbb_root_path . $upload_dir . '/' . $attachment['physical_filename']; |
| |
| if (!@file_exists($filename)) |
| { |
| trigger_error($user->lang['ERROR_NO_ATTACHMENT'] . '<br /><br />' . sprintf($user->lang['FILE_NOT_FOUND_404'], $filename)); |
| } |
| |
| |
| |
| if ($category != ATTACHMENT_CATEGORY_IMAGE || strpos($attachment['mimetype'], 'image') !== 0) |
| { |
| $attachment['mimetype'] = (strpos(strtolower($user->browser), 'msie') !== false || strpos(strtolower($user->browser), 'opera') !== false) ? 'application/octetstream' : 'application/octet-stream'; |
| } |
| |
| if (@ob_get_length()) |
| { |
| @ob_end_clean(); |
| } |
| |
| |
| $size = @filesize($filename); |
| |
| |
| |
| |
| if (headers_sent() || !@file_exists($filename) || !@is_readable($filename)) |
| { |
| |
| if (!empty($php_errormsg)) |
| { |
| trigger_error($user->lang['UNABLE_TO_DELIVER_FILE'] . '<br />' . sprintf($user->lang['TRACKED_PHP_ERROR'], $php_errormsg)); |
| } |
| |
| trigger_error('UNABLE_TO_DELIVER_FILE'); |
| } |
| |
| |
| header('Pragma: public'); |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| $is_ie8 = (strpos(strtolower($user->browser), 'msie 8.0') !== false); |
| header('Content-Type: ' . $attachment['mimetype'] . (($is_ie8) ? '; authoritative=true;' : '')); |
| |
| if (empty($user->browser) || (!$is_ie8 && (strpos(strtolower($user->browser), 'msie') !== false))) |
| { |
| header('Content-Disposition: attachment; ' . header_filename(htmlspecialchars_decode($attachment['real_filename']))); |
| if (empty($user->browser) || (strpos(strtolower($user->browser), 'msie 6.0') !== false)) |
| { |
| header('expires: -1'); |
| } |
| } |
| else |
| { |
| header('Content-Disposition: ' . ((strpos($attachment['mimetype'], 'image') === 0) ? 'inline' : 'attachment') . '; ' . header_filename(htmlspecialchars_decode($attachment['real_filename']))); |
| if ($is_ie8 && (strpos($attachment['mimetype'], 'image') !== 0)) |
| { |
| header('X-Download-Options: noopen'); |
| } |
| } |
| |
| if ($size) |
| { |
| header("Content-Length: $size"); |
| } |
| |
| |
| $db->sql_close(); |
| |
| if (!set_modified_headers($attachment['filetime'], $user->browser)) |
| { |
| |
| @set_time_limit(0); |
| |
| $fp = @fopen($filename, 'rb'); |
| |
| if ($fp !== false) |
| { |
| while (!feof($fp)) |
| { |
| echo fread($fp, 8192); |
| } |
| fclose($fp); |
| } |
| else |
| { |
| @readfile($filename); |
| } |
| |
| flush(); |
| } |
| file_gc(); |
| } |
| |
| |
| |
| |
| function header_filename($file) |
| { |
| $user_agent = (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : ''; |
| |
| |
| |
| if (strpos($user_agent, 'MSIE') !== false || strpos($user_agent, 'Safari') !== false || strpos($user_agent, 'Konqueror') !== false) |
| { |
| return "filename=" . rawurlencode($file); |
| } |
| |
| |
| return "filename*=UTF-8''" . rawurlencode($file); |
| } |
| |
| |
| |
| |
| function download_allowed() |
| { |
| global $config, $user, $db; |
| |
| if (!$config['secure_downloads']) |
| { |
| return true; |
| } |
| |
| $url = (!empty($_SERVER['HTTP_REFERER'])) ? trim($_SERVER['HTTP_REFERER']) : trim(getenv('HTTP_REFERER')); |
| |
| if (!$url) |
| { |
| return ($config['secure_allow_empty_referer']) ? true : false; |
| } |
| |
| |
| $url = @parse_url($url); |
| |
| if ($url === false) |
| { |
| return ($config['secure_allow_empty_referer']) ? true : false; |
| } |
| |
| $hostname = $url['host']; |
| unset($url); |
| |
| $allowed = ($config['secure_allow_deny']) ? false : true; |
| $iplist = array(); |
| |
| if (($ip_ary = @gethostbynamel($hostname)) !== false) |
| { |
| foreach ($ip_ary as $ip) |
| { |
| if ($ip) |
| { |
| $iplist[] = $ip; |
| } |
| } |
| } |
| |
| |
| $server_name = $user->host; |
| |
| |
| if ($config['force_server_vars'] || !$server_name) |
| { |
| $server_name = $config['server_name']; |
| } |
| |
| if (preg_match('#^.*?' . preg_quote($server_name, '#') . '.*?$#i', $hostname)) |
| { |
| $allowed = true; |
| } |
| |
| |
| if (!$allowed) |
| { |
| $sql = 'SELECT site_ip, site_hostname, ip_exclude |
| FROM ' . SITELIST_TABLE; |
| $result = $db->sql_query($sql); |
| |
| while ($row = $db->sql_fetchrow($result)) |
| { |
| $site_ip = trim($row['site_ip']); |
| $site_hostname = trim($row['site_hostname']); |
| |
| if ($site_ip) |
| { |
| foreach ($iplist as $ip) |
| { |
| if (preg_match('#^' . str_replace('\*', '.*?', preg_quote($site_ip, '#')) . '$#i', $ip)) |
| { |
| if ($row['ip_exclude']) |
| { |
| $allowed = ($config['secure_allow_deny']) ? false : true; |
| break 2; |
| } |
| else |
| { |
| $allowed = ($config['secure_allow_deny']) ? true : false; |
| } |
| } |
| } |
| } |
| |
| if ($site_hostname) |
| { |
| if (preg_match('#^' . str_replace('\*', '.*?', preg_quote($site_hostname, '#')) . '$#i', $hostname)) |
| { |
| if ($row['ip_exclude']) |
| { |
| $allowed = ($config['secure_allow_deny']) ? false : true; |
| break; |
| } |
| else |
| { |
| $allowed = ($config['secure_allow_deny']) ? true : false; |
| } |
| } |
| } |
| } |
| $db->sql_freeresult($result); |
| } |
| |
| return $allowed; |
| } |
| |
| |
| |
| |
| |
| function set_modified_headers($stamp, $browser) |
| { |
| |
| $last_load = isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) ? strtotime(trim($_SERVER['HTTP_IF_MODIFIED_SINCE'])) : false; |
| if ((strpos(strtolower($browser), 'msie 6.0') === false) && (strpos(strtolower($browser), 'msie 8.0') === false)) |
| { |
| if ($last_load !== false && $last_load <= $stamp) |
| { |
| if (@php_sapi_name() === 'CGI') |
| { |
| header('Status: 304 Not Modified', true, 304); |
| } |
| else |
| { |
| header('HTTP/1.0 304 Not Modified', true, 304); |
| } |
| |
| header('Pragma: public'); |
| header('Expires: ' . gmdate('D, d M Y H:i:s \G\M\T', time() + 31536000)); |
| return true; |
| } |
| else |
| { |
| header('Last-Modified: ' . gmdate('D, d M Y H:i:s', $stamp) . ' GMT'); |
| } |
| } |
| return false; |
| } |
| |
| function file_gc() |
| { |
| global $cache, $db; |
| if (!empty($cache)) |
| { |
| $cache->unload(); |
| } |
| $db->sql_close(); |
| exit; |
| } |
| |
| ?> |