Menu
▾
▴
xoops-svn
|
From: <be...@us...> - 2014-07-22 12:18:21
|
Revision: 12722
http://sourceforge.net/p/xoops/svn/12722
Author: beckmi
Date: 2014-07-22 12:18:06 +0000 (Tue, 22 Jul 2014)
Log Message:
-----------
Updating phpThumb to latest version
Modified Paths:
--------------
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpThumb.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.bmp.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.class.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.filters.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.functions.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.gif.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.ico.php
XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpthumb.unsharp.php
Modified: XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpThumb.php
===================================================================
--- XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpThumb.php 2014-07-20 20:29:24 UTC (rev 12721)
+++ XoopsCore/branches/2.5.x/2.5.8/htdocs/modules/system/class/thumbs/phpThumb.php 2014-07-22 12:18:06 UTC (rev 12722)
@@ -1,7 +1,8 @@
<?php
//////////////////////////////////////////////////////////////
-/// phpThumb() by James Heinrich <in...@si...> //
-// available at http://phpthumb.sourceforge.net ///
+// phpThumb() by James Heinrich <in...@si...> //
+// available at http://phpthumb.sourceforge.net //
+// and/or https://github.com/JamesHeinrich/phpThumb //
//////////////////////////////////////////////////////////////
/// //
// See: phpthumb.changelog.txt for recent changes //
@@ -13,334 +14,340 @@
ini_set('display_errors', '1');
ini_set('magic_quotes_runtime', '0');
if (ini_get('magic_quotes_runtime')) {
- die('"magic_quotes_runtime" is set in php.ini, cannot run phpThumb with this enabled');
+ die('"magic_quotes_runtime" is set in php.ini, cannot run phpThumb with this enabled');
}
-$starttime = array_sum(explode(' ', microtime()));
+$starttime = array_sum(explode(' ', microtime())); // could be called as microtime(true) for PHP 5.0.0+
// this script relies on the superglobal arrays, fake it here for old PHP versions
if (phpversion() < '4.1.0') {
- $_SERVER = $HTTP_SERVER_VARS;
- $_GET = $HTTP_GET_VARS;
+ $_SERVER = $HTTP_SERVER_VARS;
+ $_GET = $HTTP_GET_VARS;
}
-function SendSaveAsFileHeaderIfNeeded()
-{
- if (headers_sent()) {
- return false;
- }
- global $phpThumb;
- $downloadfilename = phpthumb_functions::SanitizeFilename(@$_GET['sia'] ? $_GET['sia'] : (@$_GET['down'] ? $_GET['down'] : 'phpThumb_generated_thumbnail'.(@$_GET['f'] ? $_GET['f'] : 'jpg')));
- if (@$downloadfilename) {
- $phpThumb->DebugMessage('SendSaveAsFileHeaderIfNeeded() sending header: Content-Disposition: '.(@$_GET['down'] ? 'attachment' : 'inline').'; filename="'.$downloadfilename.'"', __FILE__, __LINE__);
- header('Content-Disposition: '.(@$_GET['down'] ? 'attachment' : 'inline').'; filename="'.$downloadfilename.'"');
- }
-
- return true;
+function SendSaveAsFileHeaderIfNeeded() {
+ if (headers_sent()) {
+ return false;
+ }
+ global $phpThumb;
+ $downloadfilename = phpthumb_functions::SanitizeFilename(!empty($_GET['sia']) ? $_GET['sia'] : (!empty($_GET['down']) ? $_GET['down'] : 'phpThumb_generated_thumbnail'.(!empty($_GET['f']) ? $_GET['f'] : 'jpg')));
+ if (!empty($downloadfilename)) {
+ $phpThumb->DebugMessage('SendSaveAsFileHeaderIfNeeded() sending header: Content-Disposition: '.(!empty($_GET['down']) ? 'attachment' : 'inline').'; filename="'.$downloadfilename.'"', __FILE__, __LINE__);
+ header('Content-Disposition: '.(!empty($_GET['down']) ? 'attachment' : 'inline').'; filename="'.$downloadfilename.'"');
+ }
+ return true;
}
-function PasswordStrength($password)
-{
- $strength = 0;
- $strength += strlen(preg_replace('#[^a-z]#', '', $password)) * 0.5; // lowercase characters are weak
- $strength += strlen(preg_replace('#[^A-Z]#', '', $password)) * 0.8; // uppercase characters are somewhat better
- $strength += strlen(preg_replace('#[^0-9]#', '', $password)) * 1.0; // numbers are somewhat better
- $strength += strlen(preg_replace('#[a-zA-Z0-9]#', '', $password)) * 2.0; // other non-alphanumeric characters are best
-
- return $strength;
+function PasswordStrength($password) {
+ $strength = 0;
+ $strength += strlen(preg_replace('#[^a-z]#', '', $password)) * 0.5; // lowercase characters are weak
+ $strength += strlen(preg_replace('#[^A-Z]#', '', $password)) * 0.8; // uppercase characters are somewhat better
+ $strength += strlen(preg_replace('#[^0-9]#', '', $password)) * 1.0; // numbers are somewhat better
+ $strength += strlen(preg_replace('#[a-zA-Z0-9]#', '', $password)) * 2.0; // other non-alphanumeric characters are best
+ return $strength;
}
-function RedirectToCachedFile()
-{
- global $phpThumb, $PHPTHUMB_CONFIG;
+function RedirectToCachedFile() {
+ global $phpThumb;
- $nice_cachefile = str_replace(DIRECTORY_SEPARATOR, '/', $phpThumb->cache_filename);
- $nice_docroot = str_replace(DIRECTORY_SEPARATOR, '/', rtrim($PHPTHUMB_CONFIG['document_root'], '/\\'));
+ $nice_cachefile = str_replace(DIRECTORY_SEPARATOR, '/', $phpThumb->cache_filename);
+ $nice_docroot = str_replace(DIRECTORY_SEPARATOR, '/', rtrim($phpThumb->config_document_root, '/\\'));
- $parsed_url = phpthumb_functions::ParseURLbetter(@$_SERVER['HTTP_REFERER']);
+ $parsed_url = phpthumb_functions::ParseURLbetter(@$_SERVER['HTTP_REFERER']);
- $nModified = filemtime($phpThumb->cache_filename);
+ $nModified = filemtime($phpThumb->cache_filename);
- if ($phpThumb->config_nooffsitelink_enabled && @$_SERVER['HTTP_REFERER'] && !in_array(@$parsed_url['host'], $phpThumb->config_nooffsitelink_valid_domains)) {
+ if ($phpThumb->config_nooffsitelink_enabled && !empty($_SERVER['HTTP_REFERER']) && !in_array(@$parsed_url['host'], $phpThumb->config_nooffsitelink_valid_domains)) {
- $phpThumb->DebugMessage('Would have used cached (image/'.$phpThumb->thumbnailFormat.') file "'.$phpThumb->cache_filename.'" (Last-Modified: '.gmdate('D, d M Y H:i:s', $nModified).' GMT), but skipping because $_SERVER[HTTP_REFERER] ('.@$_SERVER['HTTP_REFERER'].') is not in $phpThumb->config_nooffsitelink_valid_domains ('.implode(';', $phpThumb->config_nooffsitelink_valid_domains).')', __FILE__, __LINE__);
+ $phpThumb->DebugMessage('Would have used cached (image/'.$phpThumb->thumbnailFormat.') file "'.$phpThumb->cache_filename.'" (Last-Modified: '.gmdate('D, d M Y H:i:s', $nModified).' GMT), but skipping because $_SERVER[HTTP_REFERER] ('.@$_SERVER['HTTP_REFERER'].') is not in $phpThumb->config_nooffsitelink_valid_domains ('.implode(';', $phpThumb->config_nooffsitelink_valid_domains).')', __FILE__, __LINE__);
- } elseif ($phpThumb->phpThumbDebug) {
+ } elseif ($phpThumb->phpThumbDebug) {
- $phpThumb->DebugTimingMessage('skipped using cached image', __FILE__, __LINE__);
- $phpThumb->DebugMessage('Would have used cached file, but skipping due to phpThumbDebug', __FILE__, __LINE__);
- $phpThumb->DebugMessage('* Would have sent headers (1): Last-Modified: '.gmdate('D, d M Y H:i:s', $nModified).' GMT', __FILE__, __LINE__);
- if ($getimagesize = @GetImageSize($phpThumb->cache_filename)) {
- $phpThumb->DebugMessage('* Would have sent headers (2): Content-Type: '.phpthumb_functions::ImageTypeToMIMEtype($getimagesize[2]), __FILE__, __LINE__);
- }
- if (preg_match('#^'.preg_quote($nice_docroot).'(.*)$#', $nice_cachefile, $matches)) {
- $phpThumb->DebugMessage('* Would have sent headers (3): Location: '.dirname($matches[1]).'/'.urlencode(basename($matches[1])), __FILE__, __LINE__);
- } else {
- $phpThumb->DebugMessage('* Would have sent data: readfile('.$phpThumb->cache_filename.')', __FILE__, __LINE__);
- }
+ $phpThumb->DebugTimingMessage('skipped using cached image', __FILE__, __LINE__);
+ $phpThumb->DebugMessage('Would have used cached file, but skipping due to phpThumbDebug', __FILE__, __LINE__);
+ $phpThumb->DebugMessage('* Would have sent headers (1): Last-Modified: '.gmdate('D, d M Y H:i:s', $nModified).' GMT', __FILE__, __LINE__);
+ if ($getimagesize = @GetImageSize($phpThumb->cache_filename)) {
+ $phpThumb->DebugMessage('* Would have sent headers (2): Content-Type: '.phpthumb_functions::ImageTypeToMIMEtype($getimagesize[2]), __FILE__, __LINE__);
+ }
+ if (preg_match('#^'.preg_quote($nice_docroot).'(.*)$#', $nice_cachefile, $matches)) {
+ $phpThumb->DebugMessage('* Would have sent headers (3): Location: '.dirname($matches[1]).'/'.urlencode(basename($matches[1])), __FILE__, __LINE__);
+ } else {
+ $phpThumb->DebugMessage('* Would have sent data: readfile('.$phpThumb->cache_filename.')', __FILE__, __LINE__);
+ }
- } else {
+ } else {
- if (headers_sent()) {
- $phpThumb->ErrorImage('Headers already sent ('.basename(__FILE__).' line '.__LINE__.')');
- exit;
- }
- SendSaveAsFileHeaderIfNeeded();
+ if (headers_sent()) {
+ $phpThumb->ErrorImage('Headers already sent ('.basename(__FILE__).' line '.__LINE__.')');
+ exit;
+ }
+ SendSaveAsFileHeaderIfNeeded();
- header('Last-Modified: '.gmdate('D, d M Y H:i:s', $nModified).' GMT');
- if (@$_SERVER['HTTP_IF_MODIFIED_SINCE'] && ($nModified == strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE'])) && @$_SERVER['SERVER_PROTOCOL']) {
- header($_SERVER['SERVER_PROTOCOL'].' 304 Not Modified');
- exit;
- }
+ header('Cache-Control: private');
+ header('Pragma: private');
+ header('Expires: '.date(DATE_RFC822, strtotime(' 1 day')));
+ if (!empty($_SERVER['HTTP_IF_MODIFIED_SINCE']) && ($nModified == strtotime($_SERVER['HTTP_IF_MODIFIED_SINCE'])) && !empty($_SERVER['SERVER_PROTOCOL'])) {
+ header('Last-Modified: '.gmdate('D, d M Y H:i:s', $nModified).' GMT', true, 304);
+ exit;
+ }
+ if ($getimagesize = @GetImageSize($phpThumb->cache_filename)) {
+ header('Content-Type: '.phpthumb_functions::ImageTypeToMIMEtype($getimagesize[2]));
+ } elseif (preg_match('#\\.ico$#i', $phpThumb->cache_filename)) {
+ header('Content-Type: image/x-icon');
+ }
+ header('Content-Length: '.filesize($phpThumb->cache_filename));
+ if (empty($phpThumb->config_cache_force_passthru) && preg_match('#^'.preg_quote($nice_docroot).'(.*)$#', $nice_cachefile, $matches)) {
+ header('Location: '.dirname($matches[1]).'/'.urlencode(basename($matches[1])));
+ } else {
+ @readfile($phpThumb->cache_filename);
+ }
+ exit;
- if ($getimagesize = @GetImageSize($phpThumb->cache_filename)) {
- header('Content-Type: '.phpthumb_functions::ImageTypeToMIMEtype($getimagesize[2]));
- } elseif (preg_match('#\\.ico$#i', $phpThumb->cache_filename)) {
- header('Content-Type: image/x-icon');
- }
- if (!@$PHPTHUMB_CONFIG['cache_force_passthru'] && preg_match('#^'.preg_quote($nice_docroot).'(.*)$#', $nice_cachefile, $matches)) {
- header('Location: '.dirname($matches[1]).'/'.urlencode(basename($matches[1])));
- } else {
- @readfile($phpThumb->cache_filename);
- }
- exit;
+ }
+ return true;
+}
- }
- return true;
-}
// instantiate a new phpThumb() object
ob_start();
-if (!include_once(__DIR__.'/phpthumb.class.php')) {
- ob_end_flush();
- die('failed to include_once("'.realpath(__DIR__.'/phpthumb.class.php').'")');
+if (!include_once(dirname(__FILE__).'/phpthumb.class.php')) {
+ ob_end_flush();
+ die('failed to include_once("'.realpath(dirname(__FILE__).'/phpthumb.class.php').'")');
}
ob_end_clean();
-
$phpThumb = new phpThumb();
$phpThumb->DebugTimingMessage('phpThumb.php start', __FILE__, __LINE__, $starttime);
$phpThumb->SetParameter('config_error_die_on_error', true);
if (!phpthumb_functions::FunctionIsDisabled('set_time_limit')) {
- set_time_limit(60); // shouldn't take nearly this long in most cases, but with many filters and/or a slow server...
+ set_time_limit(60); // shouldn't take nearly this long in most cases, but with many filters and/or a slow server...
}
// phpThumbDebug[0] used to be here, but may reveal too much
// info when high_security_mode should be enabled (not set yet)
-if (file_exists(__DIR__.'/phpThumb.config.php')) {
- ob_start();
- if (include_once(__DIR__.'/phpThumb.config.php')) {
- // great
- } else {
- ob_end_flush();
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('failed to include_once('.__DIR__.'/phpThumb.config.php) - realpath="'.realpath(__DIR__.'/phpThumb.config.php').'"');
- }
- ob_end_clean();
-} elseif (file_exists(__DIR__.'/phpThumb.config.php.default')) {
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('Please rename "phpThumb.config.php.default" to "phpThumb.config.php"');
+if (file_exists(dirname(__FILE__).'/phpThumb.config.php')) {
+ ob_start();
+ if (include_once(dirname(__FILE__).'/phpThumb.config.php')) {
+ // great
+ } else {
+ ob_end_flush();
+ $phpThumb->config_disable_debug = false; // otherwise error message won't print
+ $phpThumb->ErrorImage('failed to include_once('.dirname(__FILE__).'/phpThumb.config.php) - realpath="'.realpath(dirname(__FILE__).'/phpThumb.config.php').'"');
+ }
+ ob_end_clean();
+} elseif (file_exists(dirname(__FILE__).'/phpThumb.config.php.default')) {
+ $phpThumb->config_disable_debug = false; // otherwise error message won't print
+ $phpThumb->ErrorImage('Please rename "phpThumb.config.php.default" to "phpThumb.config.php"');
} else {
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('failed to include_once('.__DIR__.'/phpThumb.config.php) - realpath="'.realpath(__DIR__.'/phpThumb.config.php').'"');
+ $phpThumb->config_disable_debug = false; // otherwise error message won't print
+ $phpThumb->ErrorImage('failed to include_once('.dirname(__FILE__).'/phpThumb.config.php) - realpath="'.realpath(dirname(__FILE__).'/phpThumb.config.php').'"');
}
-if (empty($PHPTHUMB_CONFIG['disable_pathinfo_parsing']) && (empty($_GET) || isset($_GET['phpThumbDebug'])) && !empty($_SERVER['PATH_INFO'])) {
- $_SERVER['PHP_SELF'] = str_replace($_SERVER['PATH_INFO'], '', @$_SERVER['PHP_SELF']);
+if (!empty($PHPTHUMB_CONFIG)) {
+ foreach ($PHPTHUMB_CONFIG as $key => $value) {
+ $keyname = 'config_'.$key;
+ $phpThumb->setParameter($keyname, $value);
+ if (!preg_match('#(password|mysql)#i', $key)) {
+ $phpThumb->DebugMessage('setParameter('.$keyname.', '.$phpThumb->phpThumbDebugVarDump($value).')', __FILE__, __LINE__);
+ }
+ }
+ if (!$phpThumb->config_disable_debug) {
+ // if debug mode is enabled, force phpThumbDebug output, do not allow normal thumbnails to be generated
+ $_GET['phpThumbDebug'] = (!empty($_GET['phpThumbDebug']) ? max(1, intval($_GET['phpThumbDebug'])) : 9);
+ $phpThumb->setParameter('phpThumbDebug', $_GET['phpThumbDebug']);
+ }
+} else {
+ $phpThumb->DebugMessage('$PHPTHUMB_CONFIG is empty', __FILE__, __LINE__);
+}
- $args = explode(';', substr($_SERVER['PATH_INFO'], 1));
- $phpThumb->DebugMessage('PATH_INFO.$args set to ('.implode(')(', $args).')', __FILE__, __LINE__);
- if (!empty($args)) {
- $_GET['src'] = @$args[count($args) - 1];
- $phpThumb->DebugMessage('PATH_INFO."src" = "'.$_GET['src'].'"', __FILE__, __LINE__);
- if (preg_match('#^new\=([a-z0-9]+)#i', $_GET['src'], $matches)) {
- unset($_GET['src']);
- $_GET['new'] = $matches[1];
- }
- }
- if (preg_match('#^([0-9]*)x?([0-9]*)$#i', @$args[count($args) - 2], $matches)) {
- $_GET['w'] = $matches[1];
- $_GET['h'] = $matches[2];
- $phpThumb->DebugMessage('PATH_INFO."w"x"h" set to "'.$_GET['w'].'"x"'.$_GET['h'].'"', __FILE__, __LINE__);
- }
- for ($i = 0; $i < count($args) - 2; $i++) {
- @list($key, $value) = explode('=', @$args[$i]);
- if (substr($key, -2) == '[]') {
- $array_key_name = substr($key, 0, -2);
- $_GET[$array_key_name][] = $value;
- $phpThumb->DebugMessage('PATH_INFO."'.$array_key_name.'[]" = "'.$value.'"', __FILE__, __LINE__);
- } else {
- $_GET[$key] = $value;
- $phpThumb->DebugMessage('PATH_INFO."'.$key.'" = "'.$value.'"', __FILE__, __LINE__);
- }
- }
+if (empty($phpThumb->config_disable_pathinfo_parsing) && (empty($_GET) || isset($_GET['phpThumbDebug'])) && !empty($_SERVER['PATH_INFO'])) {
+ $_SERVER['PHP_SELF'] = str_replace($_SERVER['PATH_INFO'], '', @$_SERVER['PHP_SELF']);
+
+ $args = explode(';', substr($_SERVER['PATH_INFO'], 1));
+ $phpThumb->DebugMessage('PATH_INFO.$args set to ('.implode(')(', $args).')', __FILE__, __LINE__);
+ if (!empty($args)) {
+ $_GET['src'] = @$args[count($args) - 1];
+ $phpThumb->DebugMessage('PATH_INFO."src" = "'.$_GET['src'].'"', __FILE__, __LINE__);
+ if (preg_match('#^new\=([a-z0-9]+)#i', $_GET['src'], $matches)) {
+ unset($_GET['src']);
+ $_GET['new'] = $matches[1];
+ }
+ }
+ if (preg_match('#^([0-9]*)x?([0-9]*)$#i', @$args[count($args) - 2], $matches)) {
+ $_GET['w'] = $matches[1];
+ $_GET['h'] = $matches[2];
+ $phpThumb->DebugMessage('PATH_INFO."w"x"h" set to "'.$_GET['w'].'"x"'.$_GET['h'].'"', __FILE__, __LINE__);
+ }
+ for ($i = 0; $i < count($args) - 2; $i++) {
+ @list($key, $value) = explode('=', @$args[$i]);
+ if (substr($key, -2) == '[]') {
+ $array_key_name = substr($key, 0, -2);
+ $_GET[$array_key_name][] = $value;
+ $phpThumb->DebugMessage('PATH_INFO."'.$array_key_name.'[]" = "'.$value.'"', __FILE__, __LINE__);
+ } else {
+ $_GET[$key] = $value;
+ $phpThumb->DebugMessage('PATH_INFO."'.$key.'" = "'.$value.'"', __FILE__, __LINE__);
+ }
+ }
}
-if (!empty($PHPTHUMB_CONFIG['high_security_enabled'])) {
- if (empty($_GET['hash'])) {
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('ERROR: missing hash');
- } elseif (PasswordStrength($PHPTHUMB_CONFIG['high_security_password']) < 20) {
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('ERROR: $PHPTHUMB_CONFIG[high_security_password] is not complex enough');
- } elseif ($_GET['hash'] != md5(str_replace('&hash='.$_GET['hash'], '', $_SERVER['QUERY_STRING']).$PHPTHUMB_CONFIG['high_security_password'])) {
- sleep(10); // deliberate delay to discourage password-guessing
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('ERROR: invalid hash');
- }
+if (!empty($phpThumb->config_high_security_enabled)) {
+ if (empty($_GET['hash'])) {
+ $phpThumb->config_disable_debug = false; // otherwise error message won't print
+ $phpThumb->ErrorImage('ERROR: missing hash');
+ } elseif (PasswordStrength($phpThumb->config_high_security_password) < 20) {
+ $phpThumb->config_disable_debug = false; // otherwise error message won't print
+ $phpThumb->ErrorImage('ERROR: $PHPTHUMB_CONFIG[high_security_password] is not complex enough');
+ } elseif ($_GET['hash'] != md5(str_replace($phpThumb->config_high_security_url_separator.'hash='.$_GET['hash'], '', $_SERVER['QUERY_STRING']).$phpThumb->config_high_security_password)) {
+ header('HTTP/1.0 403 Forbidden');
+ sleep(10); // deliberate delay to discourage password-guessing
+ $phpThumb->ErrorImage('ERROR: invalid hash');
+ }
}
////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[0]', __FILE__, __LINE__);
if (isset($_GET['phpThumbDebug']) && ($_GET['phpThumbDebug'] == '0')) {
- $phpThumb->phpThumbDebug();
+ $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////
// returned the fixed string if the evil "magic_quotes_gpc" setting is on
if (get_magic_quotes_gpc()) {
- // deprecated: 'err', 'file', 'goto',
- $RequestVarsToStripSlashes = array('src', 'wmf', 'down');
- foreach ($RequestVarsToStripSlashes as $key) {
- if (isset($_GET[$key])) {
- if (is_string($_GET[$key])) {
- $_GET[$key] = stripslashes($_GET[$key]);
- } else {
- unset($_GET[$key]);
- }
- }
- }
+ // deprecated: 'err', 'file', 'goto',
+ $RequestVarsToStripSlashes = array('src', 'wmf', 'down');
+ foreach ($RequestVarsToStripSlashes as $key) {
+ if (isset($_GET[$key])) {
+ if (is_string($_GET[$key])) {
+ $_GET[$key] = stripslashes($_GET[$key]);
+ } else {
+ unset($_GET[$key]);
+ }
+ }
+ }
}
if (empty($_SERVER['PATH_INFO']) && empty($_SERVER['QUERY_STRING'])) {
- $phpThumb->config_disable_debug = false; // otherwise error message won't print
- $phpThumb->ErrorImage('ERROR: no parameters specified');
+ $phpThumb->config_disable_debug = false; // otherwise error message won't print
+ $phpThumb->ErrorImage('ERROR: no parameters specified');
}
-if (@$_GET['src'] && isset($_GET['md5s']) && empty($_GET['md5s'])) {
- if (preg_match('#^(f|ht)tps?://#i', $_GET['src'])) {
- if ($rawImageData = phpthumb_functions::SafeURLread($_GET['src'], $error, $phpThumb->config_http_fopen_timeout, $phpThumb->config_http_follow_redirect)) {
- $md5s = md5($rawImageData);
- }
- } else {
- $SourceFilename = $phpThumb->ResolveFilenameToAbsolute($_GET['src']);
- if (is_readable($SourceFilename)) {
- $md5s = phpthumb_functions::md5_file_safe($SourceFilename);
- } else {
- $phpThumb->ErrorImage('ERROR: "'.$SourceFilename.'" cannot be read');
- }
- }
- if (@$_SERVER['HTTP_REFERER']) {
- $phpThumb->ErrorImage('&md5s='.$md5s);
- } else {
- die('&md5s='.$md5s);
- }
+if (!empty($_GET['src']) && isset($_GET['md5s']) && empty($_GET['md5s'])) {
+ if (preg_match('#^([a-z0-9]+)://#i', $_GET['src'], $protocol_matches)) {
+ if (preg_match('#^(f|ht)tps?://#i', $_GET['src'])) {
+ if ($rawImageData = phpthumb_functions::SafeURLread($_GET['src'], $error, $phpThumb->config_http_fopen_timeout, $phpThumb->config_http_follow_redirect)) {
+ $md5s = md5($rawImageData);
+ }
+ } else {
+ $phpThumb->ErrorImage('only FTP and HTTP/HTTPS protocols are allowed, "'.$protocol_matches[1].'" is not');
+ }
+ } else {
+ $SourceFilename = $phpThumb->ResolveFilenameToAbsolute($_GET['src']);
+ if (is_readable($SourceFilename)) {
+ $md5s = phpthumb_functions::md5_file_safe($SourceFilename);
+ } else {
+ $phpThumb->ErrorImage('ERROR: "'.$SourceFilename.'" cannot be read');
+ }
+ }
+ if (!empty($_SERVER['HTTP_REFERER'])) {
+ $phpThumb->ErrorImage('&md5s='.$md5s);
+ } else {
+ die('&md5s='.$md5s);
+ }
}
-if (!empty($PHPTHUMB_CONFIG)) {
- foreach ($PHPTHUMB_CONFIG as $key => $value) {
- $keyname = 'config_'.$key;
- $phpThumb->setParameter($keyname, $value);
- if (!preg_match('#(password|mysql)#i', $key)) {
- $phpThumb->DebugMessage('setParameter('.$keyname.', '.$phpThumb->phpThumbDebugVarDump($value).')', __FILE__, __LINE__);
- }
- }
-} else {
- $phpThumb->DebugMessage('$PHPTHUMB_CONFIG is empty', __FILE__, __LINE__);
+if (!empty($_GET['src']) && empty($phpThumb->config_allow_local_http_src) && preg_match('#^http://'.@$_SERVER['HTTP_HOST'].'(.+)#i', $_GET['src'], $matches)) {
+ $phpThumb->ErrorImage('It is MUCH better to specify the "src" parameter as "'.$matches[1].'" instead of "'.$matches[0].'".'."\n\n".'If you really must do it this way, enable "allow_local_http_src" in phpThumb.config.php');
}
-if (@$_GET['src'] && !@$PHPTHUMB_CONFIG['allow_local_http_src'] && preg_match('#^http://'.@$_SERVER['HTTP_HOST'].'(.+)#i', @$_GET['src'], $matches)) {
- $phpThumb->ErrorImage('It is MUCH better to specify the "src" parameter as "'.$matches[1].'" instead of "'.$matches[0].'".'."\n\n".'If you really must do it this way, enable "allow_local_http_src" in phpThumb.config.php');
-}
-
////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[1]', __FILE__, __LINE__);
if (isset($_GET['phpThumbDebug']) && ($_GET['phpThumbDebug'] == '1')) {
- $phpThumb->phpThumbDebug();
+ $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////
$parsed_url_referer = phpthumb_functions::ParseURLbetter(@$_SERVER['HTTP_REFERER']);
if ($phpThumb->config_nooffsitelink_require_refer && !in_array(@$parsed_url_referer['host'], $phpThumb->config_nohotlink_valid_domains)) {
- $phpThumb->ErrorImage('config_nooffsitelink_require_refer enabled and '.(@$parsed_url_referer['host'] ? '"'.$parsed_url_referer['host'].'" is not an allowed referer' : 'no HTTP_REFERER exists'));
+ $phpThumb->ErrorImage('config_nooffsitelink_require_refer enabled and '.(@$parsed_url_referer['host'] ? '"'.$parsed_url_referer['host'].'" is not an allowed referer' : 'no HTTP_REFERER exists'));
}
$parsed_url_src = phpthumb_functions::ParseURLbetter(@$_GET['src']);
if ($phpThumb->config_nohotlink_enabled && $phpThumb->config_nohotlink_erase_image && preg_match('#^(f|ht)tps?://#i', @$_GET['src']) && !in_array(@$parsed_url_src['host'], $phpThumb->config_nohotlink_valid_domains)) {
- $phpThumb->ErrorImage($phpThumb->config_nohotlink_text_message);
+ $phpThumb->ErrorImage($phpThumb->config_nohotlink_text_message);
}
if ($phpThumb->config_mysql_query) {
- if ($cid = @mysql_connect($phpThumb->config_mysql_hostname, $phpThumb->config_mysql_username, $phpThumb->config_mysql_password)) {
- if (@mysql_select_db($phpThumb->config_mysql_database, $cid)) {
- if ($result = @mysql_query($phpThumb->config_mysql_query, $cid)) {
- if ($row = @mysql_fetch_array($result)) {
+ if ($cid = @mysql_connect($phpThumb->config_mysql_hostname, $phpThumb->config_mysql_username, $phpThumb->config_mysql_password)) {
+ if (@mysql_select_db($phpThumb->config_mysql_database, $cid)) {
+ if ($result = @mysql_query($phpThumb->config_mysql_query, $cid)) {
+ if ($row = @mysql_fetch_array($result)) {
- mysql_free_result($result);
- mysql_close($cid);
- $phpThumb->setSourceData($row[0]);
- unset($row);
+ mysql_free_result($result);
+ mysql_close($cid);
+ $phpThumb->setSourceData($row[0]);
+ unset($row);
- } else {
- mysql_free_result($result);
- mysql_close($cid);
- $phpThumb->ErrorImage('no matching data in database.');
- }
- } else {
- mysql_close($cid);
- $phpThumb->ErrorImage('Error in MySQL query: "'.mysql_error($cid).'"');
- }
- } else {
- mysql_close($cid);
- $phpThumb->ErrorImage('cannot select MySQL database: "'.mysql_error($cid).'"');
- }
- } else {
- $phpThumb->ErrorImage('cannot connect to MySQL server');
- }
- unset($_GET['id']);
+ } else {
+ mysql_free_result($result);
+ mysql_close($cid);
+ $phpThumb->ErrorImage('no matching data in database.');
+ }
+ } else {
+ mysql_close($cid);
+ $phpThumb->ErrorImage('Error in MySQL query: "'.mysql_error($cid).'"');
+ }
+ } else {
+ mysql_close($cid);
+ $phpThumb->ErrorImage('cannot select MySQL database: "'.mysql_error($cid).'"');
+ }
+ } else {
+ $phpThumb->ErrorImage('cannot connect to MySQL server');
+ }
+ unset($_GET['id']);
}
////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[2]', __FILE__, __LINE__);
if (isset($_GET['phpThumbDebug']) && ($_GET['phpThumbDebug'] == '2')) {
- $phpThumb->phpThumbDebug();
+ $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////
-$PHPTHUMB_DEFAULTS_DISABLEGETPARAMS = (bool) (@$PHPTHUMB_CONFIG['cache_default_only_suffix'] && (strpos($PHPTHUMB_CONFIG['cache_default_only_suffix'], '*') !== false));
+$PHPTHUMB_DEFAULTS_DISABLEGETPARAMS = (bool) ($phpThumb->config_cache_default_only_suffix && (strpos($phpThumb->config_cache_default_only_suffix, '*') !== false));
-if (!empty($PHPTHUMB_DEFAULTS) && is_array($PHPTHUMB_DEFAULTS)) {
- $phpThumb->DebugMessage('setting $PHPTHUMB_DEFAULTS['.implode(';', array_keys($PHPTHUMB_DEFAULTS)).']', __FILE__, __LINE__);
- foreach ($PHPTHUMB_DEFAULTS as $key => $value) {
- if ($PHPTHUMB_DEFAULTS_GETSTRINGOVERRIDE || !isset($_GET[$key])) {
- $_GET[$key] = $value;
- $phpThumb->DebugMessage('PHPTHUMB_DEFAULTS assigning ('.$value.') to $_GET['.$key.']', __FILE__, __LINE__);
- }
- }
-}
-
// deprecated: 'err', 'file', 'goto',
$allowedGETparameters = array('src', 'new', 'w', 'h', 'wp', 'hp', 'wl', 'hl', 'ws', 'hs', 'f', 'q', 'sx', 'sy', 'sw', 'sh', 'zc', 'bc', 'bg', 'bgt', 'fltr', 'xto', 'ra', 'ar', 'aoe', 'far', 'iar', 'maxb', 'down', 'phpThumbDebug', 'hash', 'md5s', 'sfn', 'dpi', 'sia', 'nocache');
foreach ($_GET as $key => $value) {
- if (!empty($PHPTHUMB_DEFAULTS_DISABLEGETPARAMS) && ($key != 'src')) {
- // disabled, do not set parameter
- $phpThumb->DebugMessage('ignoring $_GET['.$key.'] because of $PHPTHUMB_DEFAULTS_DISABLEGETPARAMS', __FILE__, __LINE__);
- } elseif (in_array($key, $allowedGETparameters)) {
- $phpThumb->DebugMessage('setParameter('.$key.', '.$phpThumb->phpThumbDebugVarDump($value).')', __FILE__, __LINE__);
- $phpThumb->setParameter($key, $value);
- } else {
- $phpThumb->ErrorImage('Forbidden parameter: '.$key);
- }
+ if (!empty($PHPTHUMB_DEFAULTS_DISABLEGETPARAMS) && ($key != 'src')) {
+ // disabled...
[truncated message content] |
Thanks for helping keep SourceForge clean.
X