From 0de0bc6ceb2c56256bf87724572055297dae76af Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 12 Aug 2013 22:51:46 +1000 Subject: Optional: Allow uploading by URL --- post.php | 45 ++++++++++++++++++++++++++++++++++++++++++++- 1 file changed, 44 insertions(+), 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index 074aa0dc..cfec5430 100644 --- a/post.php +++ b/post.php @@ -268,6 +268,46 @@ if (isset($_POST['delete'])) { $_POST['subject'] = ''; } + if ($config['allow_upload_by_url'] && isset($_POST['file_url']) && !empty($_POST['file_url'])) { + $post['file_url'] = $_POST['file_url']; + if (!preg_match($config['url_regex'], $post['file_url'])) + error($config['error']['invalidimg']); + + + $post['extension'] = strtolower(mb_substr($post['file_url'], mb_strrpos($post['file_url'], '.') + 1)); + if (!in_array($post['extension'], $config['allowed_ext']) && !in_array($post['extension'], $config['allowed_ext_files'])) + error($config['error']['unknownext']); + + $post['file_tmp'] = tempnam($config['tmp'], 'url'); + register_shutdown_function('unlink', $post['file_tmp']); + + $fp = fopen($post['file_tmp'], 'w'); + + $curl = curl_init(); + curl_setopt($curl, CURLOPT_URL, $post['file_url']); + curl_setopt($curl, CURLOPT_FAILONERROR, true); + curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false); + curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); + curl_setopt($curl, CURLOPT_TIMEOUT, 15); + curl_setopt($curl, CURLOPT_USERAGENT, 'Tinyboard'); + curl_setopt($curl, CURLOPT_BINARYTRANSFER, true); + curl_setopt($curl, CURLOPT_FILE, $fp); + + if (curl_exec($curl) === false) + error($config['error']['nomove']); + + curl_close($curl); + + fclose($fp); + + $_FILES['file'] = array( + 'name' => basename($post['file_url']), + 'tmp_name' => $post['file_tmp'], + 'error' => 0, + 'size' => filesize($post['file_tmp']) + ); + } + // Check for a file if ($post['op'] && !isset($post['no_longer_require_an_image_for_op'])) { if (!isset($_FILES['file']['tmp_name']) || $_FILES['file']['tmp_name'] == '' && $config['force_image_op']) @@ -545,7 +585,10 @@ if (isset($_POST['delete'])) { } if (!isset($dont_copy_file) || !$dont_copy_file) { - if (!@move_uploaded_file($upload, $post['file'])) + if (isset($post['file_tmp'])) { + if (!@rename($upload, $post['file'])) + error($config['error']['nomove']); + } elseif (!@move_uploaded_file($upload, $post['file'])) error($config['error']['nomove']); } } -- cgit v1.3 From 6a1e8e834bd1d0ea1c0f557ae0c54d8b2ae44d61 Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 12 Aug 2013 23:06:58 +1000 Subject: Fix last commit: add chmod() to fix some permissions derping --- post.php | 1 + 1 file changed, 1 insertion(+) (limited to 'post.php') diff --git a/post.php b/post.php index cfec5430..c55b8bc5 100644 --- a/post.php +++ b/post.php @@ -588,6 +588,7 @@ if (isset($_POST['delete'])) { if (isset($post['file_tmp'])) { if (!@rename($upload, $post['file'])) error($config['error']['nomove']); + chmod($post['file'], 0755); } elseif (!@move_uploaded_file($upload, $post['file'])) error($config['error']['nomove']); } -- cgit v1.3 From 6fdbe76f7b7b69ca6bfbff65af8096734e46233d Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Mon, 12 Aug 2013 23:35:27 +1000 Subject: bugfix: sometimes this acts weird --- post.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) (limited to 'post.php') diff --git a/post.php b/post.php index c55b8bc5..6bed96e1 100644 --- a/post.php +++ b/post.php @@ -279,7 +279,10 @@ if (isset($_POST['delete'])) { error($config['error']['unknownext']); $post['file_tmp'] = tempnam($config['tmp'], 'url'); - register_shutdown_function('unlink', $post['file_tmp']); + function unlink_tmp_file($file) { + @unlink($file); + } + register_shutdown_function('unlink_tmp_file', $post['file_tmp']); $fp = fopen($post['file_tmp'], 'w'); -- cgit v1.3 From 60b3cfc539392d5b760244e21b69136895e938cb Mon Sep 17 00:00:00 2001 From: Michael Foster Date: Tue, 13 Aug 2013 00:07:23 +1000 Subject: Upload via URL: Make sure we're not vulnerable to this buffer overflow exploit. http://www.exploit-db.com/exploits/24487/ --- post.php | 1 + 1 file changed, 1 insertion(+) (limited to 'post.php') diff --git a/post.php b/post.php index 6bed96e1..8a8487e8 100644 --- a/post.php +++ b/post.php @@ -295,6 +295,7 @@ if (isset($_POST['delete'])) { curl_setopt($curl, CURLOPT_USERAGENT, 'Tinyboard'); curl_setopt($curl, CURLOPT_BINARYTRANSFER, true); curl_setopt($curl, CURLOPT_FILE, $fp); + curl_setopt($curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS); if (curl_exec($curl) === false) error($config['error']['nomove']); -- cgit v1.3