-
Notifications
You must be signed in to change notification settings - Fork 1
/
lib.php
74 lines (60 loc) · 1.61 KB
/
lib.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
<?php
// NOTE: The web server has to be configured to serve out of both of these
// dirs.
// TODO: Assert that they're both relative?
$UPLOAD_DIR = getenv('PICDIR_UPLOAD_DIR');
if ($UPLOAD_DIR === false) {
$UPLOAD_DIR = 'uploads';
}
$RESIZED_DIR = getenv('PICDIR_RESIZED_DIR');
if ($RESIZED_DIR === false) {
$RESIZED_DIR = 'resized';
}
// $HASHED_PASSWORD may be false. Suppress error.log warning.
$HASHED_PASSWORD = @file_get_contents('password');
// TODO: Password here to avoid DoS with disk space, or do it on the server
// level?
//
// Free Functions for Testing
//
function sanitize($filename) {
return preg_replace('/[^a-zA-Z0-9._-]/', '_', $filename);
}
function unique_id() {
// This isn't foolproof, but it should be enough to discourage attackers from
// trying to overwrite files.
//
// It also seems better than the builtin uniqid(), which can return the same
// value in a tight loop.
// https://www.php.net/manual/en/function.uniqid.php
//
// And the string is short (unlike an md5sum, which also isn't foolproof)
return base_convert(time() + rand(), 10, 36);
}
//
// Templates
//
function html_header() {
echo <<<EOF
<!DOCTYPE html>
<html>
<head>
<meta name="viewport" content="width=device-width, initial-scale=1">
<title>picdir</title>
<link rel="stylesheet" type="text/css" href="picdir.css" />
</head>
<body>
<p>
<span id="picdir-header"><a href=".">picdir</a></span>
serves dynamically resized images (<a href="https://github.com/oilshell/picdir">source code</a>)
</p>
<hr/>
EOF;
}
function html_footer() {
echo <<<EOF
</body>
</html>
EOF;
}
?>