tim
3df88e0b4c
A new editor needs a username and a password of at least 12 characters. A persistent login needs an unexpired key and an existing account. Removing an account revokes its persistent logins, and its sessions end.
91 lines
2.4 KiB
PHP
91 lines
2.4 KiB
PHP
<?php
|
|
require_once('./open_db.lib.php');
|
|
open_db('open');
|
|
require_once('./get_data.lib.php');
|
|
$queue = get_queue();
|
|
if ($queue) session_cache_limiter('nocache');
|
|
else session_cache_limiter('none');
|
|
session_set_cookie_params(array('lifetime' => 0, 'path' => '/', 'domain' => cookie_domain(), 'secure' => TRUE, 'httponly' => TRUE, 'samesite' => 'Lax'));
|
|
session_start();
|
|
if (isset($_SESSION['editor']) && editor_exists($_SESSION['editor'])) {
|
|
$is_admin = TRUE;
|
|
$username = $_SESSION['editor'];
|
|
} else {
|
|
$is_admin = FALSE;
|
|
}
|
|
|
|
if (isset($_GET['pending']))
|
|
display_pending_img();
|
|
else
|
|
display_img(get_id());
|
|
|
|
// Show the image this session uploaded at the preview step
|
|
function display_pending_img() {
|
|
$file = pending_upload();
|
|
$info = $file ? getimagesize($file) : FALSE;
|
|
if (!$info) {
|
|
header("HTTP/1.1 404 Not Found");
|
|
return;
|
|
}
|
|
header("Content-type: ".$info['mime']);
|
|
header("Content-length: ".filesize($file));
|
|
header("X-Content-Type-Options: nosniff");
|
|
header("Cache-Control: private, no-store");
|
|
readfile($file);
|
|
}
|
|
|
|
function display_img($id) {
|
|
global $db, $is_admin, $queue;
|
|
$queue = get_queue();
|
|
|
|
if ((isset($_SESSION['allow_queue_image']) &&
|
|
$_SESSION['allow_queue_image'] == $id) ||
|
|
$is_admin) {
|
|
$allow_queue = TRUE;
|
|
} else {
|
|
$allow_queue = FALSE;
|
|
}
|
|
|
|
// Visitors can only see the image they submitted themselves, and no hidden stories
|
|
if ($queue) {
|
|
if (!$allow_queue) {
|
|
header("HTTP/1.1 401 Access Denied");
|
|
return;
|
|
}
|
|
$table = 'queue';
|
|
$hidden = "";
|
|
} else {
|
|
$table = 'xxx';
|
|
$hidden = $is_admin ? "" : " AND hidden IS NOT TRUE";
|
|
}
|
|
|
|
$query = "SELECT img, mime FROM $table WHERE 1 AND ID = ?".$hidden." LIMIT 0, 1";
|
|
$result = $db->execute_query($query, array((int)$id)) or db_fail();
|
|
|
|
$row = $result->fetch_assoc();
|
|
if ($row) {
|
|
$img_data = (string)$row['img'];
|
|
|
|
// Serve only real images, with the type found in the data itself (not
|
|
// the stored one), and stop browsers from guessing another type
|
|
$info = @getimagesizefromstring($img_data);
|
|
if (!$info) {
|
|
header("HTTP/1.1 404 Not Found");
|
|
$result->close();
|
|
return;
|
|
}
|
|
|
|
header("Content-type: ".$info['mime']);
|
|
header("Content-length: ".strlen($img_data));
|
|
header("X-Content-Type-Options: nosniff");
|
|
print $img_data;
|
|
|
|
} else {
|
|
header("HTTP/1.1 404 Not Found");
|
|
return;
|
|
}
|
|
$result->close();
|
|
}
|
|
open_db('close');
|
|
?>
|