<?php
require_once('./open_db.lib.php');
open_db('open');
require_once('./get_data.lib.php');
$queue = get_queue();
if ($queue) session_cache_limiter('nocache');
else session_cache_limiter('none');
session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
session_start();
if (isset($_SESSION['editor'])) {
  $is_admin = TRUE;
  $username = $_SESSION['editor'];
} else {
  $is_admin = FALSE;
}

if (isset($_GET['pending']))
  display_pending_img();
else
  display_img(get_id());

// Show the image this session uploaded at the preview step
function display_pending_img() {
  $file = pending_upload();
  $info = $file ? getimagesize($file) : FALSE;
  if (!$info) {
    header("HTTP/1.1 404 Not Found");
    return;
  }
  header("Content-type: ".$info['mime']);
  header("Content-length: ".filesize($file));
  header("X-Content-Type-Options: nosniff");
  header("Cache-Control: private, no-store");
  readfile($file);
}

function display_img($id) {
  global $db, $is_admin, $queue;
  $queue = get_queue();

  if ((isset($_SESSION['allow_queue_image']) && 
       $_SESSION['allow_queue_image'] == $id) ||
      $is_admin) {
    $allow_queue = TRUE;
  } else {
    $allow_queue = FALSE;
  }

  // Visitors can only see the image they submitted themselves, and no hidden stories
  if ($queue) {
    if (!$allow_queue) {
      header("HTTP/1.1 401 Access Denied");
      return;
    }
    $table = 'queue';
    $hidden = "";
  } else {
    $table = 'xxx';
    $hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
  }

  $query = "SELECT img, mime FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
  $result = $db->execute_query($query, array((int)$id)) or db_fail();

  $row = $result->fetch_assoc();
  if ($row) {
    $img_data = (string)$row['img'];

    // Serve only real images, with the type found in the data itself (not
    // the stored one), and stop browsers from guessing another type
    $info = @getimagesizefromstring($img_data);
    if (!$info) {
      header("HTTP/1.1 404 Not Found");
      $result->close();
      return;
    }

    header("Content-type: ".$info['mime']);
    header("Content-length: ".strlen($img_data));
    header("X-Content-Type-Options: nosniff");
    print $img_data;

  } else {
    header("HTTP/1.1 404 Not Found");
    return;
  }
  $result->close();
}
open_db('close');
?>