From 3f29bdfac92cfff13b234f3abc9d92bd5b9a2a37 Mon Sep 17 00:00:00 2001 From: Anonke Date: Sat, 30 May 2015 20:46:43 +0200 Subject: the poster IDs were showing in API despite being disabled --- inc/api.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'inc') diff --git a/inc/api.php b/inc/api.php index b77fa3f8..57e4d367 100644 --- a/inc/api.php +++ b/inc/api.php @@ -101,7 +101,7 @@ class Api { $fields = $threadsPage ? $this->threadsPageFields : $this->postFields; $this->translateFields($fields, $post, $apiPost); - if (isset($config['poster_ids'])) $apiPost['id'] = poster_id($post->ip, $post->thread, $board['uri']); + if (isset($config['poster_ids']) && $config['poster_ids']) $apiPost['id'] = poster_id($post->ip, $post->thread, $board['uri']); if ($threadsPage) return $apiPost; // Handle country field -- cgit v1.3 From d3d167affb7f2ac7708e8fe54658df594b6f672c Mon Sep 17 00:00:00 2001 From: czaks Date: Wed, 8 Jul 2015 16:26:58 +0200 Subject: SECURITY: XSS fix for youtube.js/metacafe embed --- inc/config.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'inc') diff --git a/inc/config.php b/inc/config.php index 32308bd4..75506645 100644 --- a/inc/config.php +++ b/inc/config.php @@ -1022,7 +1022,7 @@ '' ), array( - '/^https?:\/\/(\w+\.)?metacafe\.com\/watch\/(\d+)\/([a-zA-Z0-9_\-.]+)\/(\?.+)?$/i', + '/^https?:\/\/(\w+\.)?metacafe\.com\/watch\/(\d+)\/([a-zA-Z0-9_\-.]+)\/(\?[^\'"<>]+)?$/i', '
' ), array( @@ -1665,6 +1665,6 @@ // Youtube.js embed HTML code $config['youtube_js_html'] = '
'. - ''. + ''. ''. '
'; -- cgit v1.3 From 601c8cebc9eaaa7cf5254350c32f9741d2dd05d6 Mon Sep 17 00:00:00 2001 From: 27chan Date: Mon, 10 Aug 2015 22:13:42 -0300 Subject: Add extension mp4 --- inc/lib/webm/ffmpeg.php | 53 +++++++++++++++++++++++++------------------------ 1 file changed, 27 insertions(+), 26 deletions(-) (limited to 'inc') diff --git a/inc/lib/webm/ffmpeg.php b/inc/lib/webm/ffmpeg.php index edd2c73a..faf90608 100644 --- a/inc/lib/webm/ffmpeg.php +++ b/inc/lib/webm/ffmpeg.php @@ -3,60 +3,61 @@ * ffmpeg.php * A barebones ffmpeg based webm implementation for vichan. */ - function get_webm_info($filename) { global $board, $config; - $filename = escapeshellarg($filename); $ffprobe = $config['webm']['ffprobe_path']; $ffprobe_out = array(); $webminfo = array(); - exec("$ffprobe -v quiet -print_format json -show_format -show_streams $filename", $ffprobe_out); $ffprobe_out = json_decode(implode("\n", $ffprobe_out), 1); $webminfo['error'] = is_valid_webm($ffprobe_out); - if(empty($webminfo['error'])) { $webminfo['width'] = $ffprobe_out['streams'][0]['width']; $webminfo['height'] = $ffprobe_out['streams'][0]['height']; + $webminfo['duration'] = $ffprobe_out['format']['duration']; } - return $webminfo; } - function is_valid_webm($ffprobe_out) { global $board, $config; - if (empty($ffprobe_out)) return array('code' => 1, 'msg' => $config['error']['genwebmerror']); - - if ($ffprobe_out['format']['format_name'] != 'matroska,webm') - return array('code' => 2, 'msg' => $config['error']['invalidwebm']); - + $extension = pathinfo($ffprobe_out['format']['filename'], PATHINFO_EXTENSION); + if ($extension === 'webm') { + if ($ffprobe_out['format']['format_name'] != 'matroska,webm') + return array('code' => 2, 'msg' => $config['error']['invalidwebm']); + } elseif ($extension === 'mp4') { + if ($ffprobe_out['streams'][0]['codec_name'] != 'h264' && $ffprobe_out['streams'][1]['codec_name'] != 'aac') + return array('code' => 2, 'msg' => $config['error']['invalidwebm']); + } else { + return array('code' => 1, 'msg' => $config['error']['genwebmerror']); + } if ((count($ffprobe_out['streams']) > 1) && (!$config['webm']['allow_audio'])) return array('code' => 3, 'msg' => $config['error']['webmhasaudio']); - - if ($ffprobe_out['streams'][0]['codec_name'] != 'vp8') - return array('code' => 2, 'msg' => $config['error']['invalidwebm']); - if (empty($ffprobe_out['streams'][0]['width']) || (empty($ffprobe_out['streams'][0]['height']))) return array('code' => 2, 'msg' => $config['error']['invalidwebm']); - if ($ffprobe_out['format']['duration'] > $config['webm']['max_length']) - return array('code' => 4, 'msg' => $config['error']['webmtoolong']); + return array('code' => 4, 'msg' => sprintf($config['error']['webmtoolong'], $config['webm']['max_length'])); } - -function make_webm_thumbnail($filename, $thumbnail, $width, $height) { +function make_webm_thumbnail($filename, $thumbnail, $width, $height, $duration) { global $board, $config; - $filename = escapeshellarg($filename); - $thumbnail = escapeshellarg($thumbnail); // Should be safe by default but you + $thumbnailfc = escapeshellarg($thumbnail); // Should be safe by default but you // can never be too safe. - $ffmpeg = $config['webm']['ffmpeg_path']; + $ret = 0; $ffmpeg_out = array(); - - exec("$ffmpeg -i $filename -v quiet -ss 00:00:00 -an -vframes 1 -f mjpeg -vf scale=$width:$height $thumbnail 2>&1"); - - return count($ffmpeg_out); + exec("$ffmpeg -strict -2 -ss " . floor($duration / 2) . " -i $filename -v quiet -an -vframes 1 -f mjpeg -vf scale=$width:$height $thumbnailfc 2>&1", $ffmpeg_out, $ret); + // Work around for https://trac.ffmpeg.org/ticket/4362 + if (filesize($thumbnail) === 0) { + // try again with first frame + exec("$ffmpeg -y -strict -2 -ss 0 -i $filename -v quiet -an -vframes 1 -f mjpeg -vf scale=$width:$height $thumbnailfc 2>&1", $ffmpeg_out, $ret); + clearstatcache(); + // failed if no thumbnail size even if ret code 0, ffmpeg is buggy + if (filesize($thumbnail) === 0) { + $ret = 1; + } + } + return $ret; } -- cgit v1.3 From f1cbbbc15a745b36018e7f7b065cd84057a599e1 Mon Sep 17 00:00:00 2001 From: 27chan Date: Mon, 10 Aug 2015 22:15:21 -0300 Subject: Add extension mp4 --- inc/lib/webm/posthandler.php | 19 ++----------------- 1 file changed, 2 insertions(+), 17 deletions(-) (limited to 'inc') diff --git a/inc/lib/webm/posthandler.php b/inc/lib/webm/posthandler.php index a5b7429b..15c6600d 100644 --- a/inc/lib/webm/posthandler.php +++ b/inc/lib/webm/posthandler.php @@ -1,27 +1,22 @@ has_file) foreach ($post->files as &$file) if ($file->extension == 'webm') { + if ($post->has_file) foreach ($post->files as &$file) if ($file->extension == 'webm' || $file->extension == 'mp4') { if ($config['webm']['use_ffmpeg']) { require_once dirname(__FILE__) . '/ffmpeg.php'; $webminfo = get_webm_info($file->file_path); - if (empty($webminfo['error'])) { $file->width = $webminfo['width']; $file->height = $webminfo['height']; - if ($config['spoiler_images'] && isset($_POST['spoiler'])) { $file = webm_set_spoiler($file); } else { $file = set_thumbnail_dimensions($post, $file); $tn_path = $board['dir'] . $config['dir']['thumb'] . $file->file_id . '.jpg'; - - if(false == make_webm_thumbnail($file->file_path, $tn_path, $file->thumbwidth, $file->thumbheight)) { + if(0 == make_webm_thumbnail($file->file_path, $tn_path, $file->thumbwidth, $file->thumbheight, $webminfo['duration'])) { $file->thumb = $file->file_id . '.jpg'; } else { @@ -37,7 +32,6 @@ function postHandler($post) { require_once dirname(__FILE__) . '/videodata.php'; $videoDetails = videoData($file->file_path); if (!isset($videoDetails['container']) || $videoDetails['container'] != 'webm') return "not a WebM file"; - // Set thumbnail $thumbName = $board['dir'] . $config['dir']['thumb'] . $file->file_id . '.webm'; if ($config['spoiler_images'] && isset($_POST['spoiler'])) { @@ -53,12 +47,10 @@ function postHandler($post) { $file->thumb = 'file'; } unset($videoDetails['frame']); - // Set width and height if (isset($videoDetails['width']) && isset($videoDetails['height'])) { $file->width = $videoDetails['width']; $file->height = $videoDetails['height']; - if ($file->thumb != 'file' && $file->thumb != 'spoiler') { $file = set_thumbnail_dimensions($post, $file); } @@ -66,14 +58,11 @@ function postHandler($post) { } } } - function set_thumbnail_dimensions($post,$file) { global $board, $config; - $tn_dimensions = array(); $tn_maxw = $post->op ? $config['thumb_op_width'] : $config['thumb_width']; $tn_maxh = $post->op ? $config['thumb_op_height'] : $config['thumb_height']; - if ($file->width > $tn_maxw || $file->height > $tn_maxh) { $file->thumbwidth = min($tn_maxw, intval(round($file->width * $tn_maxh / $file->height))); $file->thumbheight = min($tn_maxh, intval(round($file->height * $tn_maxw / $file->width))); @@ -81,17 +70,13 @@ function set_thumbnail_dimensions($post,$file) { $file->thumbwidth = $file->width; $file->thumbheight = $file->height; } - return $file; } - function webm_set_spoiler($file) { global $board, $config; - $file->thumb = 'spoiler'; $size = @getimagesize($config['spoiler_image']); $file->thumbwidth = $size[0]; $file->thumbheight = $size[1]; - return $file; } -- cgit v1.3 From 219c1987a90d828b3e0c38b66509617ad78b91ab Mon Sep 17 00:00:00 2001 From: 27chan Date: Mon, 10 Aug 2015 22:25:09 -0300 Subject: Add extension mp4 --- inc/config.php | 1 + 1 file changed, 1 insertion(+) (limited to 'inc') diff --git a/inc/config.php b/inc/config.php index 75506645..69b4bd3a 100644 --- a/inc/config.php +++ b/inc/config.php @@ -754,6 +754,7 @@ $config['file_icons']['default'] = 'file.png'; $config['file_icons']['zip'] = 'zip.png'; $config['file_icons']['webm'] = 'video.png'; + $config['file_icons']['mp4'] = 'video.png'; // Example: Custom thumbnail for certain file extension. // $config['file_icons']['extension'] = 'some_file.png'; -- cgit v1.3 From ccd00c497c7465f14f7b259469ad287524e6b33a Mon Sep 17 00:00:00 2001 From: czaks Date: Tue, 11 Aug 2015 03:46:02 +0200 Subject: a stricter check for webm processing --- inc/lib/webm/ffmpeg.php | 2 ++ 1 file changed, 2 insertions(+) (limited to 'inc') diff --git a/inc/lib/webm/ffmpeg.php b/inc/lib/webm/ffmpeg.php index faf90608..0747b420 100644 --- a/inc/lib/webm/ffmpeg.php +++ b/inc/lib/webm/ffmpeg.php @@ -45,6 +45,8 @@ function make_webm_thumbnail($filename, $thumbnail, $width, $height, $duration) $filename = escapeshellarg($filename); $thumbnailfc = escapeshellarg($thumbnail); // Should be safe by default but you // can never be too safe. + $width = escapeshellarg($width); + $height = escapeshellarg($height); // Same as above. $ffmpeg = $config['webm']['ffmpeg_path']; $ret = 0; $ffmpeg_out = array(); -- cgit v1.3 From 1136cc0e44e5094362cf46e9416a143f594482b0 Mon Sep 17 00:00:00 2001 From: czaks Date: Tue, 11 Aug 2015 03:47:44 +0200 Subject: reflect in readme, that we support .mp4 files as well now --- inc/lib/webm/README.md | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'inc') diff --git a/inc/lib/webm/README.md b/inc/lib/webm/README.md index dc3394c9..d1c2a52a 100644 --- a/inc/lib/webm/README.md +++ b/inc/lib/webm/README.md @@ -30,6 +30,13 @@ If you have an [FFmpeg](https://www.ffmpeg.org/) binary on your server and you w $config['webm']['ffmpeg_path'] = '/path/to/ffmeg'; $config['webm']['ffprobe_path'] = '/path/to/ffprobe'; +MP4 support +----------- + +MP4 support is available only if you use FFmpeg thumbnailing (see above). + + $config['allowed_ext_files'][] = 'mp4'; + License ------- -- cgit v1.3 From 706feeddff55ecafc397137dbc005890fdef963d Mon Sep 17 00:00:00 2001 From: czaks Date: Tue, 11 Aug 2015 04:51:27 +0200 Subject: fix cache_config: webms were thumbnailed twice and with the latest addition, they couldn`t resize at all --- inc/functions.php | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) (limited to 'inc') diff --git a/inc/functions.php b/inc/functions.php index aa91133f..515e3e55 100755 --- a/inc/functions.php +++ b/inc/functions.php @@ -249,9 +249,9 @@ function loadConfig() { if ($config['allow_roll']) event_handler('post', 'diceRoller'); - if (is_array($config['anonymous'])) - $config['anonymous'] = $config['anonymous'][array_rand($config['anonymous'])]; - + if (in_array('webm', $config['allowed_ext_files']) || + in_array('mp4', $config['allowed_ext_files'])) + event_handler('post', 'postHandler'); } // Effectful config processing below: @@ -287,10 +287,9 @@ function loadConfig() { if ($config['cache']['enabled']) require_once 'inc/cache.php'; - if (in_array('webm', $config['allowed_ext_files'])) { + if (in_array('webm', $config['allowed_ext_files']) || + in_array('mp4', $config['allowed_ext_files'])) require_once 'inc/lib/webm/posthandler.php'; - event_handler('post', 'postHandler'); - } event('load-config'); @@ -308,6 +307,9 @@ function loadConfig() { Cache::set('config_'.$boardsuffix, $config); Cache::set('events_'.$boardsuffix, $events); } + + if (is_array($config['anonymous'])) + $config['anonymous'] = $config['anonymous'][array_rand($config['anonymous'])]; if ($config['debug']) { if (!isset($debug)) { -- cgit v1.3 From 6d4e75624063fe6077a654378af9763e32a1c0e8 Mon Sep 17 00:00:00 2001 From: czaks Date: Fri, 11 Sep 2015 12:49:30 +0200 Subject: fix a bug for some bad database state. thanks Seisatsu for testing --- inc/display.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) (limited to 'inc') diff --git a/inc/display.php b/inc/display.php index e7fb9320..90cf3434 100644 --- a/inc/display.php +++ b/inc/display.php @@ -354,7 +354,7 @@ class Post { } if (isset($this->files) && $this->files) - $this->files = json_decode($this->files); + $this->files = @json_decode($this->files); $this->subject = utf8tohtml($this->subject); $this->name = utf8tohtml($this->name); @@ -404,7 +404,7 @@ class Thread { } if (isset($this->files)) - $this->files = json_decode($this->files); + $this->files = @json_decode($this->files); $this->subject = utf8tohtml($this->subject); $this->name = utf8tohtml($this->name); -- cgit v1.3