DropBox is a PHP-developed system which allows users to upload and download files from it's web interface. When password protected, this proves to be a useful tool to store and move files at will from multiple locations.
highly? .... no. *crucially* recommended.
A bug fix release of Dropbox was made available this morning. This should get rid of an issue when deleting files (some users were seeing a foreach() php error).
ChangeLog: Version 0.0.8Beta 2007-10-01 Ian Bezanson <irb@ianbezanson.ca> * Fixed bug reported in Bug Ticket #1760213, when we tried to go through a loop on an uninitialized variable. Version 0.0.7Beta 2007-03-13 Ian Bezanson <irb@ianbezanson.ca> * Another note described in the email with bug #42, for Version 0.0.6Beta was the inability to upload/delete a file with an odd character in it, as I would preface said character with a slash: i.e. [foo.txt] would try to come in as \[foo.txt\] This caused a lot of issues, as the file would have to be manually deleted and was not viewable. Where the files come in relatively securely, vs. other methods (read $_GET, $_POST), I have changed the upload methods to not slash out said filenames. Version 0.0.6Beta 2007-03-09 Ian Bezanson <irb@ianbezanson.ca> * bug #42 describes an issue where the public flag doesn't get shown. I've determined that we are not pulling that flag from $_POST, which has been resolved. Version 0.0.5Beta 2007-02-02 Ian Bezanson <irb@ianbezanson.ca> * Fixed how ./configure.pl handles arrays. * Please note that this release never actually made it to release :) Version 0.0.4Beta 2007-01-31 Ian Bezanson <irb@ianbezanson.ca> * Whoops! $dbVer variable in ./configure.pl wasn't being written properly. I had it (a) commented out in the resultant config, and (b) forgot the semi-colon at the end of that line. No big deal, v0.0.3Beta will just be missing "dropbox 0.0.3beta" on the main page, without user intervention. 2007-02-01 Ian Bezanson <irb@ianbezanson.ca> * After receiving an email about some security issues with the app, I have changed my exec() call for deleting files to the less-intrusive unlink() command. * Moved contents of ./includes/fileInfo.inc to ./includes/functions.inc. The old file really only contained functions, so it might as well have been named accordingly. * Got rid of extract($_REQUEST) which was open to a multitude of security holes. * Added primitive form of input filtering with checkInput() function. This function basically determines whether the input variable is a string, and pumps it through the built-in php escapeshellcmd() function. It's a start, I gather. The major win out of this, however, is that I'm only looking for specific input variables, rather than grabbing anything the user throws at us, so we're a little harder to compromise the app. * Added a file upload status to confirm deleted files to user. * Fixing chmod instructions presented to the user after running ./configure.pl again. * Changed ./includes/mailMe.inc to send mail upon addition, or deletion of files. * Added checkForFile() function which looks to see if a candidate upload file already exists (by name). If it does, we mark the specific upload, do not upload it, and display a message back to the user. Version 0.0.3Beta 2007-01-31 Ian Bezanson <irb@ianbezanson.ca> * No major changes here. I'm fixing some package permissions, as well as chmod instructions presented to the user after running ./configure.pl. * Took the dropbox version definition out of ./index.php, and write it directly to the config file, based on the variable defined in the ./configure.pl file. Version 0.0.2Beta 2007-01-30 Ian Bezanson <irb@ianbezanson.ca> * Added ./fileData.dat, a flat file which will store information on user uploads. Previously, we did a straight read out of the uploads/ dir to get upload information, but now we store more detailed info into this flatfile. * Added ./includes/fileInfo.inc, with addFile and getFile functions. The former function will add information on any newly uploaded file to ./fileData.dat, such as the filename, filesize, user who uploaded the file, the date it was uploaded as well as whether all users can see the file. The latter function retrieves and builds output of available files from that same flat file. * Added ability to delete files, although only those which you have uploaded, from the web interface. * Added fileData option to configure.pl file, which will specify where the file data flat file exists. * Added ./scripts/populateFlatFile.php, a file mainly used as an upgrade tool, which will populate your flat file with information from files currently in your uploads directory. If you are starting with v0.0.2Beta, or later, you will not need this file. Version 0.0.1Beta 2007-01-29 Ian Bezanson <irb@ianbezanson.ca> * Added ./configure.pl script. * Completed installation notes in ./INSTALL * Made the app a little bit more generic. 2007-01-21 Ian Bezanson <irb@ianbezanson.ca> * Took original script, written in mid 2005, and made it a little more install-friendly.
ChangeLog: Version 0.0.8Beta 2007-10-01 Ian Bezanson <irb@ianbezanson.ca> * Fixed bug reported in Bug Ticket #1760213, when we tried to go through a loop on an uninitialized variable. Version 0.0.7Beta 2007-03-13 Ian Bezanson <irb@ianbezanson.ca> * Another note described in the email with bug #42, for Version 0.0.6Beta was the inability to upload/delete a file with an odd character in it, as I would preface said character with a slash: i.e. [foo.txt] would try to come in as \[foo.txt\] This caused a lot of issues, as the file would have to be manually deleted and was not viewable. Where the files come in relatively securely, vs. other methods (read $_GET, $_POST), I have changed the upload methods to not slash out said filenames. Version 0.0.6Beta 2007-03-09 Ian Bezanson <irb@ianbezanson.ca> * bug #42 describes an issue where the public flag doesn't get shown. I've determined that we are not pulling that flag from $_POST, which has been resolved. Version 0.0.5Beta 2007-02-02 Ian Bezanson <irb@ianbezanson.ca> * Fixed how ./configure.pl handles arrays. * Please note that this release never actually made it to release :) Version 0.0.4Beta 2007-01-31 Ian Bezanson <irb@ianbezanson.ca> * Whoops! $dbVer variable in ./configure.pl wasn't being written properly. I had it (a) commented out in the resultant config, and (b) forgot the semi-colon at the end of that line. No big deal, v0.0.3Beta will just be missing "dropbox 0.0.3beta" on the main page, without user intervention. 2007-02-01 Ian Bezanson <irb@ianbezanson.ca> * After receiving an email about some security issues with the app, I have changed my exec() call for deleting files to the less-intrusive unlink() command. * Moved contents of ./includes/fileInfo.inc to ./includes/functions.inc. The old file really only contained functions, so it might as well have been named accordingly. * Got rid of extract($_REQUEST) which was open to a multitude of security holes. * Added primitive form of input filtering with checkInput() function. This function basically determines whether the input variable is a string, and pumps it through the built-in php escapeshellcmd() function. It's a start, I gather. The major win out of this, however, is that I'm only looking for specific input variables, rather than grabbing anything the user throws at us, so we're a little harder to compromise the app. * Added a file upload status to confirm deleted files to user. * Fixing chmod instructions presented to the user after running ./configure.pl again. * Changed ./includes/mailMe.inc to send mail upon addition, or deletion of files. * Added checkForFile() function which looks to see if a candidate upload file already exists (by name). If it does, we mark the specific upload, do not upload it, and display a message back to the user. Version 0.0.3Beta 2007-01-31 Ian Bezanson <irb@ianbezanson.ca> * No major changes here. I'm fixing some package permissions, as well as chmod instructions presented to the user after running ./configure.pl. * Took the dropbox version definition out of ./index.php, and write it directly to the config file, based on the variable defined in the ./configure.pl file. Version 0.0.2Beta 2007-01-30 Ian Bezanson <irb@ianbezanson.ca> * Added ./fileData.dat, a flat file which will store information on user uploads. Previously, we did a straight read out of the uploads/ dir to get upload information, but now we store more detailed info into this flatfile. * Added ./includes/fileInfo.inc, with addFile and getFile functions. The former function will add information on any newly uploaded file to ./fileData.dat, such as the filename, filesize, user who uploaded the file, the date it was uploaded as well as whether all users can see the file. The latter function retrieves and builds output of available files from that same flat file. * Added ability to delete files, although only those which you have uploaded, from the web interface. * Added fileData option to configure.pl file, which will specify where the file data flat file exists. * Added ./scripts/populateFlatFile.php, a file mainly used as an upgrade tool, which will populate your flat file with information from files currently in your uploads directory. If you are starting with v0.0.2Beta, or later, you will not need this file. Version 0.0.1Beta 2007-01-29 Ian Bezanson <irb@ianbezanson.ca> * Added ./configure.pl script. * Completed installation notes in ./INSTALL * Made the app a little bit more generic. 2007-01-21 Ian Bezanson <irb@ianbezanson.ca> * Took original script, written in mid 2005, and made it a little more install-friendly.
Copyright © 2010 Geeknet, Inc. All rights reserved. Terms of Use
Thanks for your rating!
Would you also like to write a review?
Thanks for your review!
Get credit for your review by logging in via OpenID. Click your account provider: