tim
e881ddb458
save_uploaded_file() read, and prune_images() deleted, any path in the "uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name that only the session knows.
43 lines
1.5 KiB
PHP
43 lines
1.5 KiB
PHP
<?php
|
|
$result = get_post_data(TRUE, TRUE);
|
|
extract($result[0], EXTR_OVERWRITE);
|
|
|
|
if (isset($_POST['g-recaptcha-response'])) {
|
|
$captcha = $_POST['g-recaptcha-response'];
|
|
if (! $captcha) {
|
|
$validate['captcha'] = 'Invalid captcha. Please try again.';
|
|
include('./write.inc.php');
|
|
return;
|
|
}
|
|
$captcha_resp = file_get_contents("https://www.google.com/recaptcha/api/siteverify?secret=".urlencode(config('RECAPTCHA_SECRET'))."&response=".
|
|
$captcha."&remoteip=".$_SERVER['REMOTE_ADDR']);
|
|
var_dump($captcha_resp);
|
|
// PHP 8 treats the bare word "success" as an undefined constant, so decode the JSON reply
|
|
$captcha_json = json_decode((string)$captcha_resp);
|
|
if (empty($captcha_json->success)) {
|
|
$validate['captcha'] = 'The words you typed in the captcha were not correct. Please try again.';
|
|
include('./write.inc.php');
|
|
return;
|
|
}
|
|
}
|
|
|
|
echo '<p>Please review your submission. Once you\'ve finished, please click "Submit" at the bottom of the page, or click "Preview" to check it again.</p>';
|
|
|
|
// Keep a new image outside the web root until the story is saved;
|
|
// display.php shows it to this session only.
|
|
if (is_uploaded_file($_FILES['upload']['tmp_name'] ?? '') && !isset($validate['upload'])) {
|
|
if (store_upload($_FILES['upload']['tmp_name']))
|
|
$file_src = pending_upload_url();
|
|
} else if (isset($uploaded) && $uploaded === 'pending' && pending_upload() && !$remove_img) {
|
|
$file_src = pending_upload_url();
|
|
}
|
|
|
|
echo display_stories();
|
|
|
|
echo "<br /><br />\n";
|
|
|
|
include('./write.inc.php');
|
|
|
|
return;
|
|
?>
|