mirror/php-cimage
1
0
Fork 0
mirror of https://github.com/mosbth/cimage.git synced 2025-08-01 22:00:31 +02:00
Code Issues Releases Wiki Activity

Updated to reflect changes proposed in issue #127

Browse Source
This commit is contained in:
Anatolie Diordita
2015-11-29 15:23:39 -05:00
parent 3c22db4392
commit d7b34a6488
4 changed files with 130 additions and 172 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
webroot/img.php
View File

@@ -25,12 +25,6 @@ function errorPage($msg, $type = 500)
global $mode;
switch ($type) {
case 400:
$header = "400 Bad Request";
break;
case 401:
$header = "401 Unauthorized";
break;
case 403:
$header = "403 Forbidden";
break;
@@ -278,7 +272,7 @@ if ($pwd) {
}
if ($pwdAlways && $passwordMatch !== true) {
errorPage("Password required and does not match or exists.", 401);
errorPage("Password required and does not match or exists.", 403);
}
verbose("password match = $passwordMatch");
@@ -302,7 +296,7 @@ if (!$allowHotlinking) {
; // Always allow when password match
verbose("Hotlinking since passwordmatch");
} elseif ($passwordMatch === false) {
errorPage("Hotlinking/leeching not allowed when password missmatch.", 401);
errorPage("Hotlinking/leeching not allowed when password missmatch.", 403);
} elseif (!$referer) {
errorPage("Hotlinking/leeching not allowed and referer is missing.", 403);
} elseif (strcmp($serverName, $refererHost) == 0) {
@@ -393,7 +387,7 @@ if (isset($shortcut)
* src - the source image file.
*/
$srcImage = urldecode(get('src'))
or errorPage('Must set src-attribute.', 400);
or errorPage('Must set src-attribute.', 404);
// Check for valid/invalid characters
$imagePath = getConfig('image_path', __DIR__ . '/img/');
@@ -406,7 +400,7 @@ $dummyFilename = getConfig('dummy_filename', 'dummy');
$dummyImage = false;
preg_match($validFilename, $srcImage)
or errorPage('Filename contains invalid characters.', 400);
or errorPage('Filename contains invalid characters.', 404);
if ($dummyEnabled && $srcImage === $dummyFilename) {
@@ -433,7 +427,7 @@ if ($dummyEnabled && $srcImage === $dummyFilename) {
or errorPage(
'Security constraint: Source image is not below the directory "image_path"
as specified in the config file img_config.php.'
, 500);
, 404);
}
verbose("src = $srcImage");
@@ -482,11 +476,11 @@ if (isset($sizes[$newWidth])) {
// Support width as % of original width
if ($newWidth[strlen($newWidth)-1] == '%') {
is_numeric(substr($newWidth, 0, -1))
or errorPage('Width % not numeric.', 400);
or errorPage('Width % not numeric.', 404);
} else {
is_null($newWidth)
or ($newWidth > 10 && $newWidth <= $maxWidth)
or errorPage('Width out of range.', 400);
or errorPage('Width out of range.', 404);
}
verbose("new width = $newWidth");
@@ -507,11 +501,11 @@ if (isset($sizes[$newHeight])) {
// height
if ($newHeight[strlen($newHeight)-1] == '%') {
is_numeric(substr($newHeight, 0, -1))
or errorPage('Height % out of range.', 400);
or errorPage('Height % out of range.', 404);
} else {
is_null($newHeight)
or ($newHeight > 10 && $newHeight <= $maxHeight)
or errorPage('Height out of range.', 400);
or errorPage('Height out of range.', 404);
}
verbose("new height = $newHeight");
@@ -549,7 +543,7 @@ if ($negateAspectRatio) {
is_null($aspectRatio)
or is_numeric($aspectRatio)
or errorPage('Aspect ratio out of range', 400);
or errorPage('Aspect ratio out of range', 404);
verbose("aspect ratio = $aspectRatio");
@@ -671,7 +665,7 @@ $qualityDefault = getConfig('jpg_quality', null);
is_null($quality)
or ($quality > 0 and $quality <= 100)
or errorPage('Quality out of range', 400);
or errorPage('Quality out of range', 404);
if (is_null($quality) && !is_null($qualityDefault)) {
$quality = $qualityDefault;
@@ -689,7 +683,7 @@ $compressDefault = getConfig('png_compression', null);
is_null($compress)
or ($compress > 0 and $compress <= 9)
or errorPage('Compress out of range', 400);
or errorPage('Compress out of range', 404);
if (is_null($compress) && !is_null($compressDefault)) {
$compress = $compressDefault;
@@ -715,7 +709,7 @@ $scale = get(array('scale', 's'));
is_null($scale)
or ($scale >= 0 and $scale <= 400)
or errorPage('Scale out of range', 400);
or errorPage('Scale out of range', 404);
verbose("scale = $scale");
@@ -764,7 +758,7 @@ $rotateBefore = get(array('rotateBefore', 'rotate-before', 'rb'));
is_null($rotateBefore)
or ($rotateBefore >= -360 and $rotateBefore <= 360)
or errorPage('RotateBefore out of range', 400);
or errorPage('RotateBefore out of range', 404);
verbose("rotateBefore = $rotateBefore");
@@ -777,7 +771,7 @@ $rotateAfter = get(array('rotateAfter', 'rotate-after', 'ra', 'rotate', 'r'));
is_null($rotateAfter)
or ($rotateAfter >= -360 and $rotateAfter <= 360)
or errorPage('RotateBefore out of range', 400);
or errorPage('RotateBefore out of range', 404);
verbose("rotateAfter = $rotateAfter");
@@ -926,13 +920,13 @@ if ($alias && $aliasPath && $passwordMatch) {
$useCache = false;
is_writable($aliasPath)
or errorPage("Directory for alias is not writable.", 500);
or errorPage("Directory for alias is not writable.", 403);
preg_match($validAliasname, $alias)
or errorPage('Filename for alias contains invalid characters. Do not add extension.', 500);
or errorPage('Filename for alias contains invalid characters. Do not add extension.', 404);
} elseif ($alias) {
errorPage('Alias is not enabled in the config file or password not matching.', 500);
errorPage('Alias is not enabled in the config file or password not matching.', 403);
}
verbose("alias = $alias");

74
webroot/imgd.php Normal file → Executable file
View File

@@ -3642,39 +3642,21 @@ $version = "v0.7.7 (2015-10-21)";
* Display error message.
*
* @param string $msg to display.
* @param int $type of HTTP error to display.
*
* @return void
*/
function errorPage($msg, $type = 500)
function errorPage($msg)
{
global $mode;
switch ($type) {
case 400:
$header = "400 Bad Request";
break;
case 401:
$header = "401 Unauthorized";
break;
case 403:
$header = "403 Forbidden";
break;
case 404:
$header = "404 Not Found";
break;
default:
$header = "500 Internal Server Error";
}
header("HTTP/1.0 $header");
header("HTTP/1.0 500 Internal Server Error");
if ($mode == 'development') {
die("[img.php] $msg");
}
error_log("[img.php] $msg");
die("HTTP/1.0 $header");
die("HTTP/1.0 500 Internal Server Error");
}
@@ -3689,7 +3671,7 @@ set_exception_handler(function ($exception) {
. "</p><pre>"
. $exception->getTraceAsString()
. "</pre>"
, 500);
);
});
@@ -3819,7 +3801,7 @@ set_time_limit(20);
ini_set('gd.jpeg_ignore_warning', 1);
if (!extension_loaded('gd')) {
errorPage("Extension gd is not loaded.", 500);
errorPage("Extension gd is nod loaded.");
}
// Specific settings for each mode
@@ -3855,7 +3837,7 @@ if ($mode == 'strict') {
ini_set('log_errors', 0);
} else {
errorPage("Unknown mode: $mode", 500);
errorPage("Unknown mode: $mode");
}
verbose("mode = $mode");
@@ -3904,7 +3886,7 @@ if ($pwd) {
}
if ($pwdAlways && $passwordMatch !== true) {
errorPage("Password required and does not match or exists.", 401);
errorPage("Password required and does not match or exists.");
}
verbose("password match = $passwordMatch");
@@ -3928,9 +3910,9 @@ if (!$allowHotlinking) {
; // Always allow when password match
verbose("Hotlinking since passwordmatch");
} elseif ($passwordMatch === false) {
errorPage("Hotlinking/leeching not allowed when password missmatch.", 401);
errorPage("Hotlinking/leeching not allowed when password missmatch.");
} elseif (!$referer) {
errorPage("Hotlinking/leeching not allowed and referer is missing.", 403);
errorPage("Hotlinking/leeching not allowed and referer is missing.");
} elseif (strcmp($serverName, $refererHost) == 0) {
; // Allow when serverName matches refererHost
verbose("Hotlinking disallowed but serverName matches refererHost.");
@@ -3941,11 +3923,11 @@ if (!$allowHotlinking) {
if ($allowedByWhitelist) {
verbose("Hotlinking/leeching allowed by whitelist.");
} else {
errorPage("Hotlinking/leeching not allowed by whitelist. Referer: $referer.", 403);
errorPage("Hotlinking/leeching not allowed by whitelist. Referer: $referer.");
}
} else {
errorPage("Hotlinking/leeching not allowed.", 403);
errorPage("Hotlinking/leeching not allowed.");
}
}
@@ -4019,7 +4001,7 @@ if (isset($shortcut)
* src - the source image file.
*/
$srcImage = urldecode(get('src'))
or errorPage('Must set src-attribute.', 400);
or errorPage('Must set src-attribute.');
// Check for valid/invalid characters
$imagePath = getConfig('image_path', __DIR__ . '/img/');
@@ -4032,7 +4014,7 @@ $dummyFilename = getConfig('dummy_filename', 'dummy');
$dummyImage = false;
preg_match($validFilename, $srcImage)
or errorPage('Filename contains invalid characters.', 400);
or errorPage('Filename contains invalid characters.');
if ($dummyEnabled && $srcImage === $dummyFilename) {
@@ -4053,13 +4035,13 @@ if ($dummyEnabled && $srcImage === $dummyFilename) {
or errorPage(
'Source image is not a valid file, check the filename and that a
matching file exists on the filesystem.'
, 404);
);
substr_compare($imageDir, $pathToImage, 0, strlen($imageDir)) == 0
or errorPage(
'Security constraint: Source image is not below the directory "image_path"
as specified in the config file img_config.php.'
, 500);
);
}
verbose("src = $srcImage");
@@ -4108,11 +4090,11 @@ if (isset($sizes[$newWidth])) {
// Support width as % of original width
if ($newWidth[strlen($newWidth)-1] == '%') {
is_numeric(substr($newWidth, 0, -1))
or errorPage('Width % not numeric.', 400);
or errorPage('Width % not numeric.');
} else {
is_null($newWidth)
or ($newWidth > 10 && $newWidth <= $maxWidth)
or errorPage('Width out of range.', 400);
or errorPage('Width out of range.');
}
verbose("new width = $newWidth");
@@ -4133,11 +4115,11 @@ if (isset($sizes[$newHeight])) {
// height
if ($newHeight[strlen($newHeight)-1] == '%') {
is_numeric(substr($newHeight, 0, -1))
or errorPage('Height % out of range.', 400);
or errorPage('Height % out of range.');
} else {
is_null($newHeight)
or ($newHeight > 10 && $newHeight <= $maxHeight)
or errorPage('Height out of range.', 400);
or errorPage('Hight out of range.');
}
verbose("new height = $newHeight");
@@ -4175,7 +4157,7 @@ if ($negateAspectRatio) {
is_null($aspectRatio)
or is_numeric($aspectRatio)
or errorPage('Aspect ratio out of range', 400);
or errorPage('Aspect ratio out of range');
verbose("aspect ratio = $aspectRatio");
@@ -4297,7 +4279,7 @@ $qualityDefault = getConfig('jpg_quality', null);
is_null($quality)
or ($quality > 0 and $quality <= 100)
or errorPage('Quality out of range', 400);
or errorPage('Quality out of range');
if (is_null($quality) && !is_null($qualityDefault)) {
$quality = $qualityDefault;
@@ -4315,7 +4297,7 @@ $compressDefault = getConfig('png_compression', null);
is_null($compress)
or ($compress > 0 and $compress <= 9)
or errorPage('Compress out of range', 400);
or errorPage('Compress out of range');
if (is_null($compress) && !is_null($compressDefault)) {
$compress = $compressDefault;
@@ -4341,7 +4323,7 @@ $scale = get(array('scale', 's'));
is_null($scale)
or ($scale >= 0 and $scale <= 400)
or errorPage('Scale out of range', 400);
or errorPage('Scale out of range');
verbose("scale = $scale");
@@ -4390,7 +4372,7 @@ $rotateBefore = get(array('rotateBefore', 'rotate-before', 'rb'));
is_null($rotateBefore)
or ($rotateBefore >= -360 and $rotateBefore <= 360)
or errorPage('RotateBefore out of range', 400);
or errorPage('RotateBefore out of range');
verbose("rotateBefore = $rotateBefore");
@@ -4403,7 +4385,7 @@ $rotateAfter = get(array('rotateAfter', 'rotate-after', 'ra', 'rotate', 'r'));
is_null($rotateAfter)
or ($rotateAfter >= -360 and $rotateAfter <= 360)
or errorPage('RotateBefore out of range', 400);
or errorPage('RotateBefore out of range');
verbose("rotateAfter = $rotateAfter");
@@ -4552,13 +4534,13 @@ if ($alias && $aliasPath && $passwordMatch) {
$useCache = false;
is_writable($aliasPath)
or errorPage("Directory for alias is not writable.", 500);
or errorPage("Directory for alias is not writable.");
preg_match($validAliasname, $alias)
or errorPage('Filename for alias contains invalid characters. Do not add extension.', 500);
or errorPage('Filename for alias contains invalid characters. Do not add extension.');
} elseif ($alias) {
errorPage('Alias is not enabled in the config file or password not matching.', 500);
errorPage('Alias is not enabled in the config file or password not matching.');
}
verbose("alias = $alias");

74
webroot/imgp.php Normal file → Executable file
View File

@@ -3642,39 +3642,21 @@ $version = "v0.7.7 (2015-10-21)";
* Display error message.
*
* @param string $msg to display.
* @param int $type of HTTP error to display.
*
* @return void
*/
function errorPage($msg, $type = 500)
function errorPage($msg)
{
global $mode;
switch ($type) {
case 400:
$header = "400 Bad Request";
break;
case 401:
$header = "401 Unauthorized";
break;
case 403:
$header = "403 Forbidden";
break;
case 404:
$header = "404 Not Found";
break;
default:
$header = "500 Internal Server Error";
}
header("HTTP/1.0 $header");
header("HTTP/1.0 500 Internal Server Error");
if ($mode == 'development') {
die("[img.php] $msg");
}
error_log("[img.php] $msg");
die("HTTP/1.0 $header");
die("HTTP/1.0 500 Internal Server Error");
}
@@ -3689,7 +3671,7 @@ set_exception_handler(function ($exception) {
. "</p><pre>"
. $exception->getTraceAsString()
. "</pre>"
, 500);
);
});
@@ -3819,7 +3801,7 @@ set_time_limit(20);
ini_set('gd.jpeg_ignore_warning', 1);
if (!extension_loaded('gd')) {
errorPage("Extension gd is not loaded.", 500);
errorPage("Extension gd is nod loaded.");
}
// Specific settings for each mode
@@ -3855,7 +3837,7 @@ if ($mode == 'strict') {
ini_set('log_errors', 0);
} else {
errorPage("Unknown mode: $mode", 500);
errorPage("Unknown mode: $mode");
}
verbose("mode = $mode");
@@ -3904,7 +3886,7 @@ if ($pwd) {
}
if ($pwdAlways && $passwordMatch !== true) {
errorPage("Password required and does not match or exists.", 401);
errorPage("Password required and does not match or exists.");
}
verbose("password match = $passwordMatch");
@@ -3928,9 +3910,9 @@ if (!$allowHotlinking) {
; // Always allow when password match
verbose("Hotlinking since passwordmatch");
} elseif ($passwordMatch === false) {
errorPage("Hotlinking/leeching not allowed when password missmatch.", 401);
errorPage("Hotlinking/leeching not allowed when password missmatch.");
} elseif (!$referer) {
errorPage("Hotlinking/leeching not allowed and referer is missing.", 403);
errorPage("Hotlinking/leeching not allowed and referer is missing.");
} elseif (strcmp($serverName, $refererHost) == 0) {
; // Allow when serverName matches refererHost
verbose("Hotlinking disallowed but serverName matches refererHost.");
@@ -3941,11 +3923,11 @@ if (!$allowHotlinking) {
if ($allowedByWhitelist) {
verbose("Hotlinking/leeching allowed by whitelist.");
} else {
errorPage("Hotlinking/leeching not allowed by whitelist. Referer: $referer.", 403);
errorPage("Hotlinking/leeching not allowed by whitelist. Referer: $referer.");
}
} else {
errorPage("Hotlinking/leeching not allowed.", 403);
errorPage("Hotlinking/leeching not allowed.");
}
}
@@ -4019,7 +4001,7 @@ if (isset($shortcut)
* src - the source image file.
*/
$srcImage = urldecode(get('src'))
or errorPage('Must set src-attribute.', 400);
or errorPage('Must set src-attribute.');
// Check for valid/invalid characters
$imagePath = getConfig('image_path', __DIR__ . '/img/');
@@ -4032,7 +4014,7 @@ $dummyFilename = getConfig('dummy_filename', 'dummy');
$dummyImage = false;
preg_match($validFilename, $srcImage)
or errorPage('Filename contains invalid characters.', 400);
or errorPage('Filename contains invalid characters.');
if ($dummyEnabled && $srcImage === $dummyFilename) {
@@ -4053,13 +4035,13 @@ if ($dummyEnabled && $srcImage === $dummyFilename) {
or errorPage(
'Source image is not a valid file, check the filename and that a
matching file exists on the filesystem.'
, 404);
);
substr_compare($imageDir, $pathToImage, 0, strlen($imageDir)) == 0
or errorPage(
'Security constraint: Source image is not below the directory "image_path"
as specified in the config file img_config.php.'
, 500);
);
}
verbose("src = $srcImage");
@@ -4108,11 +4090,11 @@ if (isset($sizes[$newWidth])) {
// Support width as % of original width
if ($newWidth[strlen($newWidth)-1] == '%') {
is_numeric(substr($newWidth, 0, -1))
or errorPage('Width % not numeric.', 400);
or errorPage('Width % not numeric.');
} else {
is_null($newWidth)
or ($newWidth > 10 && $newWidth <= $maxWidth)
or errorPage('Width out of range.', 400);
or errorPage('Width out of range.');
}
verbose("new width = $newWidth");
@@ -4133,11 +4115,11 @@ if (isset($sizes[$newHeight])) {
// height
if ($newHeight[strlen($newHeight)-1] == '%') {
is_numeric(substr($newHeight, 0, -1))
or errorPage('Height % out of range.', 400);
or errorPage('Height % out of range.');
} else {
is_null($newHeight)
or ($newHeight > 10 && $newHeight <= $maxHeight)
or errorPage('Height out of range.', 400);
or errorPage('Hight out of range.');
}
verbose("new height = $newHeight");
@@ -4175,7 +4157,7 @@ if ($negateAspectRatio) {
is_null($aspectRatio)
or is_numeric($aspectRatio)
or errorPage('Aspect ratio out of range', 400);
or errorPage('Aspect ratio out of range');
verbose("aspect ratio = $aspectRatio");
@@ -4297,7 +4279,7 @@ $qualityDefault = getConfig('jpg_quality', null);
is_null($quality)
or ($quality > 0 and $quality <= 100)
or errorPage('Quality out of range', 400);
or errorPage('Quality out of range');
if (is_null($quality) && !is_null($qualityDefault)) {
$quality = $qualityDefault;
@@ -4315,7 +4297,7 @@ $compressDefault = getConfig('png_compression', null);
is_null($compress)
or ($compress > 0 and $compress <= 9)
or errorPage('Compress out of range', 400);
or errorPage('Compress out of range');
if (is_null($compress) && !is_null($compressDefault)) {
$compress = $compressDefault;
@@ -4341,7 +4323,7 @@ $scale = get(array('scale', 's'));
is_null($scale)
or ($scale >= 0 and $scale <= 400)
or errorPage('Scale out of range', 400);
or errorPage('Scale out of range');
verbose("scale = $scale");
@@ -4390,7 +4372,7 @@ $rotateBefore = get(array('rotateBefore', 'rotate-before', 'rb'));
is_null($rotateBefore)
or ($rotateBefore >= -360 and $rotateBefore <= 360)
or errorPage('RotateBefore out of range', 400);
or errorPage('RotateBefore out of range');
verbose("rotateBefore = $rotateBefore");
@@ -4403,7 +4385,7 @@ $rotateAfter = get(array('rotateAfter', 'rotate-after', 'ra', 'rotate', 'r'));
is_null($rotateAfter)
or ($rotateAfter >= -360 and $rotateAfter <= 360)
or errorPage('RotateBefore out of range', 400);
or errorPage('RotateBefore out of range');
verbose("rotateAfter = $rotateAfter");
@@ -4552,13 +4534,13 @@ if ($alias && $aliasPath && $passwordMatch) {
$useCache = false;
is_writable($aliasPath)
or errorPage("Directory for alias is not writable.", 500);
or errorPage("Directory for alias is not writable.");
preg_match($validAliasname, $alias)
or errorPage('Filename for alias contains invalid characters. Do not add extension.', 500);
or errorPage('Filename for alias contains invalid characters. Do not add extension.');
} elseif ($alias) {
errorPage('Alias is not enabled in the config file or password not matching.', 500);
errorPage('Alias is not enabled in the config file or password not matching.');
}
verbose("alias = $alias");

0
webroot/imgs.php Normal file → Executable file
View File