array(
"path" => "./uploadz",
"real_filename" => false, // Files will be saved with original filenames instead of random generated ones. Lowers security.
"size_limit" => 52428800, // Maximum size of files
"replace" => false, // Replace the file if it exist
"extension_check_mode" => "whitelist", // 'whitelist' is recommended for best security. Use 'blacklist' at your own risk. Disable using "disable"
"whitelist" => array("xyz", "yxzz"),
"blacklist" => array("html", "php", "svg")
),
"access" => array(
"direct" => false, // Show direct links to files on files list. Lowers security.
"force_download" => true, // Force download. Increase security.
"allow_delete" => false
),
"view" => array(
"date_format" => "Y-m-d h:i"
)
);
// ===============================================================
// Code
// ===============================================================
function handleUpload(){
global $config;
if(!isset($_FILES["file"])){
if(isset($_GET['upload'])){
echo "Uploaded file exceeds the php max file size".$file['name']." : File already exists".$file['name']." : File is too large".$file['name']." : Invalid file format".$file['name']." : File uploadedUploaded: ".implode(",", $uploaded);
}
}
$alerts = "";
function handleView(){
global $config;
global $alerts;
if(isset($_GET['file'])){
$filename = basename($_GET['file']);
if(!file_exists($config['upload']['path']."/".$filename)){
$files = array();
foreach(scandir($config['upload']['path'], SCANDIR_SORT_NONE) as $file) {
$files[$file] = filemtime($config['upload']['path']."/".$file);
}
asort($files);
$files = array_keys($files);
foreach($files as $file) {
if(startsWith($file, $filename."##HIDDEN##")){
$filename = basename($file);
}
}
}
if(empty($filename)){
return;
}
if(!file_exists($config['upload']['path'].'/'.$filename)){
$alerts .= "";
return;
}
$mimetype = mime_content_type($config['upload']['path'].'/'.$filename);
$filenameDownload = $filename;
$hpos = strpos($filename, "##HIDDEN##");
if($hpos){
$filenameDownload = substr($filename, 0, $hpos);
}
if(empty($filenameDownload)){
$alerts .= "";
return;
}
if($config['access']['force_download']){
header('Content-Type: application/octet-stream');
header('X-Content-Type-Options: nosniff');
header("Content-Transfer-Encoding: Binary");
header('Content-Disposition: attachment; filename="'.$filenameDownload.'"');
}else{
header('Content-Type: '.$mimetype);
header('Content-Disposition: inline; filename="'.$filenameDownload.'"');
}
echo file_get_contents($config['upload']['path'].'/'.$filename);
die();
}
}
function handleDelete(){
global $config;
if(isset($_POST['delete'])){
$filename = getFileName(basename($_POST['delete']));
$path = $config['upload']['path']."/".$filename;
if(empty($filename)){
echo "File not found";
die();
}
if(!unlink($path)){
echo "Error";
}else{
echo "Deleted";
}
die();
}
}
function orderBy($data, $field, $mode = "asc"){
if($mode == "asc"){
$code = "return strnatcmp(\$a['$field'], \$b['$field']);";
}else{
$code = "return -1 * strnatcmp(\$a['$field'], \$b['$field']);";
}
usort($data, @create_function('$a,$b', $code));
return $data;
}
function printFiles(){
global $config;
global $orderCategory;
global $orderDirection;
$files = array();
foreach(scandir($config['upload']['path'], SCANDIR_SORT_NONE) as $file) {
$path = $config['upload']['path']."/".$file;
$files[] = array("name" => $file, "date" => filemtime($path), "size" => filesize($path));
}
$modes = array(
"N" => "name",
"D" => "date",
"S" => "size"
);
if($orderDirection == "A"){
$files = orderBy($files, $modes[$orderCategory], "asc");
}elseif($orderDirection == "D"){
$files = orderBy($files, $modes[$orderCategory], "dsc");
}
foreach($files as $file) {
if($file['name'][0] == ".") continue;
if(startsWith($file['name'], "##HIDDEN##")){
continue;
}
$path = $config['upload']['path']."/".$file['name'];
$size = formatSizeUnits(filesize($path));
$date = date($config['view']['date_format'], filemtime($path));
$hpos = strpos($file['name'], "##HIDDEN##");
if($hpos){
$file['name'] = substr($file['name'], 0, $hpos);
}
if(!$config['access']['direct']){
$path = '?file='.urlencode($file['name']);
}
echo sprintf('
%s
%s
%s
'.($config['access']['allow_delete'] ? '
Delete
' : "").'
',"file_".htmlspecialchars($file['name']) ,$path, htmlspecialchars($file['name']), $size, $date, urlencode($file['name']));
}
}
function getFileName($filename){
global $config;
$found = true;
if(!file_exists($config['upload']['path']."/".$filename)){
$found = false;
$files = array();
foreach(scandir($config['upload']['path'], SCANDIR_SORT_NONE) as $file) {
$files[$file] = filemtime($config['upload']['path']."/".$file);
}
asort($files);
$files = array_keys($files);
foreach($files as $file) {
if(startsWith($file, $filename."##HIDDEN##")){
$filename = basename($file);
$found = true;
}
}
}
if(!$found){
return "";
}
return $filename;
}
function checkFormat($file){
global $config;
$fileType = pathinfo($file["name"], PATHINFO_EXTENSION);
if($config['upload']['extension_check_mode'] == "whitelist"){
return in_array($fileType, $config['upload']['whitelist']);
}else if($config['upload']['extension_check_mode'] == "blacklist"){
return !in_array($fileType, $config['upload']['blacklist']);
}
return false;
}
function reArrayFiles(&$file_post) {
$file_ary = array();
$file_count = count($file_post['name']);
$file_keys = array_keys($file_post);
for ($i=0; $i<$file_count; $i++) {
foreach ($file_keys as $key) {
$file_ary[$i][$key] = $file_post[$key][$i];
}
}
return $file_ary;
}
function startsWith($haystack, $needle) {
return $needle === "" || strrpos($haystack, $needle, -strlen($haystack)) !== false;
}
function formatSizeUnits($bytes){
if ($bytes >= 1073741824){
$bytes = number_format($bytes / 1073741824, 2) . ' GB';
}elseif ($bytes >= 1048576){
$bytes = number_format($bytes / 1048576, 2) . ' MB';
}elseif ($bytes >= 1024){
$bytes = number_format($bytes / 1024, 2) . ' kB';
}elseif ($bytes > 1){
$bytes = $bytes . ' bytes';
}elseif ($bytes == 1){
$bytes = $bytes . ' byte';
}else{
$bytes = '0 bytes';
}
return $bytes;
}
function generateRandomString($length = 30) {
$characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
$charactersLength = strlen($characters);
$randomString = '';
for ($i = 0; $i < $length; $i++) {
$randomString .= $characters[rand(0, $charactersLength - 1)];
}
return $randomString;
}
$uploadStatus = handleUpload();
if($uploadStatus != "none"){
die();
}
$orderCategory = "N";
$orderDirection = "A";
if(isset($_GET['C'])){
$orderCategory = $_GET['C'];
}
if(isset($_GET['O'])){
$orderDirection = $_GET['O'];
}
handleView();
if($config['access']['allow_delete']){
handleDelete();
}
?>
if file type ^ ?
A few tech things: change file type (18, 444 ) and .xyz files can be downloaded and viewed in any text editor.
More details about the practice?
general details about
ifxyz.xyz
for specific notes to do with if zqzness ^ ? - see links bellow, scroll past the chat bit..