mirror_html/h5ai
1
0
Fork 0
mirror of https://github.com/lrsjng/h5ai.git synced 2025-03-19 12:00:01 +01:00
Code Issues Projects Releases Wiki Activity

Improves api security.

Browse Source
This commit is contained in:
Lars Jung 2012-08-11 22:05:29 +02:00
parent ff40e2129f
commit 71d22fb9e0
2 changed files with 23 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
src/_h5ai/css/inc/dropbox.less
View File

@ -2,12 +2,13 @@
#content {
border: 1px dashed #fff;
border-radius: 8px;
.transition(all 0.2s ease-in-out);
&.hint {
border-color: #ccc;
border-color: #ddd;
}
&.match {
border-style: solid;
border-color: #aaa;
}
}
@ -25,7 +26,6 @@
.name {
display: inline-block;
white-space: nowrap;
// width: 320px;
overflow: hidden;
&:before {

25
src/_h5ai/php/api.php
View File

@ -151,10 +151,14 @@ else if ($action === "upload") {
json_fail(4, "folders not supported", file_get_contents($userfile["tmp_name"]) === "null");
$upload_dir = $h5ai->getAbsPath($href);
$code = $h5ai->getHttpCode($href);
json_fail(5, "upload dir no h5ai folder or ignored", $code !== "h5ai" || $h5ai->is_ignored($upload_dir));
$dest = $upload_dir . "/" . $userfile["name"];
json_fail(5, "already exists", file_exists($dest));
json_fail(6, "can't move uploaded file", !move_uploaded_file($userfile["tmp_name"], $dest));
json_fail(6, "already exists", file_exists($dest));
json_fail(7, "can't move uploaded file", !move_uploaded_file($userfile["tmp_name"], $dest));
json_exit();
}
@ -170,10 +174,21 @@ else if ($action === "delete") {
$errors = array();
foreach ($hrefs as $href) {
$absPath = $h5ai->getAbsPath($href);
if (!unlink($absPath)) {
$errors[] = $href;
$d = H5ai::normalize_path(dirname($href), true);
$n = basename($href);
$code = $h5ai->getHttpCode($d);
if ($code == 401) {
}
if ($code == "h5ai" && !$h5ai->is_ignored($n)) {
$absPath = $h5ai->getAbsPath($href);
if (!unlink($absPath)) {
$errors[] = $href;
}
}
}