Keep uploads outside the web root.

save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.

publish/post.lib.php

@@ -152,44 +152,32 @@ function get_mimetype($image_file) {
 }
 
 function save_uploaded_file() {
-  // Save uploaded file to new, temporary location
+  // A new upload in this request
   if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '')) {
-    $tmp_file = $_FILES['upload']['tmp_name'];
-    $new_file = $_SERVER['DOCUMENT_ROOT'] . "/graphics" . $tmp_file;
-    $end_dir  = dirname($new_file);
-    if (!is_dir($end_dir)) 
-      mkdir($end_dir, "0644", 1);
-    $image_file = $new_file;
-    move_uploaded_file($tmp_file, $image_file);
-
-  // File has already been uploaded, get location
-  } else if (isset($_POST['uploaded']) && 
-             is_file($_SERVER['DOCUMENT_ROOT'] . $_POST['uploaded'])) {
-    $image_file = realpath($_SERVER['DOCUMENT_ROOT'] . $_POST['uploaded']);
+    return store_upload($_FILES['upload']['tmp_name']);
   }
-
-  if (isset($image_file)) {
-    return $image_file;
-  } else {
-    return FALSE;
+  // An image uploaded at the preview step; the session knows which one
+  if (($_POST['uploaded'] ?? '') === 'pending') {
+    return pending_upload();
   }
+  return FALSE;
 }
 
 function prune_images($image_file) {
-  // Delete image from filesystem, and cleanup anything older than $age
-  $age = '86400'; // a day old
-  $cleanup_dir =  dirname($image_file);
-  unlink($image_file);
+  // Delete the saved image, and anything older than $age.
+  // Only ever touch upload files inside the upload directory.
+  $age = 86400; // a day old
+  $dir = upload_dir();
+  if (dirname($image_file) === $dir && is_upload_name(basename($image_file))) {
+    @unlink($image_file);
+  }
+  unset($_SESSION['pending_upload']);
 
-  if ( $dir_handle = @opendir($cleanup_dir) ) {
-    while (($cleanup_file = readdir ($dir_handle)) !== FALSE) {
-      if ($cleanup_file == '.' || $cleanup_file == '..') continue;
-      $cleanup_file = $cleanup_dir . "/". $cleanup_file;
-      if (@filemtime($cleanup_file) < (time() - $age)) {
-        @unlink($cleanup_file);
-      }
+  foreach (glob($dir . '/*') as $cleanup_file) {
+    if (is_upload_name(basename($cleanup_file)) &&
+        @filemtime($cleanup_file) < (time() - $age)) {
+      @unlink($cleanup_file);
     }
-    closedir($dir_handle);
   }
 }