98 lines
2.7 KiB
PHP
98 lines
2.7 KiB
PHP
<?php
|
|
require_once('./open_db.lib.php');
|
|
open_db('open');
|
|
require_once('./get_data.lib.php');
|
|
$queue = get_queue();
|
|
if ($queue) session_cache_limiter('nocache');
|
|
else session_cache_limiter('none');
|
|
// Refuse a session id that PHP did not make, so nobody can plant one
|
|
ini_set('session.use_strict_mode', '1');
|
|
session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
|
|
session_start();
|
|
if (isset($_SESSION['editor']) && editor_exists($_SESSION['editor'])) {
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} else {
|
|
$is_admin = FALSE;
|
|
}
|
|
|
|
if (isset($_GET['pending']))
|
|
display_pending_img();
|
|
else
|
|
display_img(get_id());
|
|
|
|
// Show the image this session uploaded at the preview step
|
|
function display_pending_img() {
|
|
$file = pending_upload();
|
|
$info = $file ? getimagesize($file) : FALSE;
|
|
if (!$info) {
|
|
header("HTTP/1.1 404 Not Found");
|
|
return;
|
|
}
|
|
header("Content-type: ".$info['mime']);
|
|
header("Content-length: ".filesize($file));
|
|
header("X-Content-Type-Options: nosniff");
|
|
header("Cache-Control: private, no-store");
|
|
readfile($file);
|
|
}
|
|
|
|
function display_img($id) {
|
|
global $db, $is_admin, $queue;
|
|
$queue = get_queue();
|
|
|
|
if ((isset($_SESSION['allow_queue_image']) &&
|
|
$_SESSION['allow_queue_image'] == $id) ||
|
|
$is_admin) {
|
|
$allow_queue = TRUE;
|
|
} else {
|
|
$allow_queue = FALSE;
|
|
}
|
|
|
|
// Visitors can only see the image they submitted themselves, and no hidden stories
|
|
if ($queue) {
|
|
if (!$allow_queue) {
|
|
header("HTTP/1.1 401 Access Denied");
|
|
return;
|
|
}
|
|
$table = 'queue';
|
|
$hidden = "";
|
|
} else {
|
|
$table = 'xxx';
|
|
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
|
|
}
|
|
|
|
$columns = $queue ? "img, mime" : "img, mime, hidden";
|
|
$query = "SELECT $columns FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
|
|
$result = $db->execute_query($query, array((int)$id)) or db_fail();
|
|
|
|
$row = $result->fetch_assoc();
|
|
if ($row) {
|
|
$img_data = (string)$row['img'];
|
|
|
|
// Serve only real images, with the type found in the data itself (not
|
|
// the stored one), and stop browsers from guessing another type
|
|
$info = @getimagesizefromstring($img_data);
|
|
if (!$info) {
|
|
header("HTTP/1.1 404 Not Found");
|
|
$result->close();
|
|
return;
|
|
}
|
|
|
|
header("Content-type: ".$info['mime']);
|
|
header("Content-length: ".strlen($img_data));
|
|
header("X-Content-Type-Options: nosniff");
|
|
// Only this session can see a queued or hidden image: no cache may keep it
|
|
if ($queue || !empty($row['hidden'])) {
|
|
header("Cache-Control: private, no-store");
|
|
}
|
|
print $img_data;
|
|
|
|
} else {
|
|
header("HTTP/1.1 404 Not Found");
|
|
return;
|
|
}
|
|
$result->close();
|
|
}
|
|
open_db('close');
|
|
?>
|