external-repos/pictshare
1
0
Fork 0
mirror of https://github.com/HaschekSolutions/pictshare.git synced 2025-11-11 18:56:21 +00:00
Code Issues Packages Projects Releases Wiki Activity

added client subnet filter

Browse Source
This commit is contained in:
Anton Mitsengendler
2019-02-20 17:12:06 +03:00
parent 5f5b836a22
commit 8da3573ffb
4 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
api/upload.php
View File

@@ -21,6 +21,10 @@ if(!isFolderWritable(ROOT.DS.'data'))
else if(!isFolderWritable(ROOT.DS.'tmp'))
exit(json_encode(array('status'=>'err','reason'=>'Temp directory not writable')));
// check if client has permission to upload
if(defined('ALLOWED_SUBNET') && !isIPInRange( getUserIP(), ALLOWED_SUBNET ))
exit(json_encode(array('status'=>'err','reason'=> 'Access denied')));
$hash = sanatizeString(trim($_REQUEST['hash']))?sanatizeString(trim($_REQUEST['hash'])):false;
// check for POST upload

27
inc/core.php
View File

@@ -24,6 +24,12 @@ function architect($url)
//just show the site
if( ( (!defined('UPLOAD_FORM_LOCATION') || (defined('UPLOAD_FORM_LOCATION') && !UPLOAD_FORM_LOCATION)) && count($u)==0) || (defined('UPLOAD_FORM_LOCATION') && UPLOAD_FORM_LOCATION && '/'.implode('/',$u)==UPLOAD_FORM_LOCATION) )
{
// check if client address is allowed
if(defined('ALLOWED_SUBNET') && !isIPInRange( getUserIP(), ALLOWED_SUBNET ))
{
header("HTTP/1.1 401 Unauthorized");
exit;
}
renderTemplate('main');
return;
}
@@ -500,4 +506,25 @@ function deleteHash($hash)
$c->deleteFile($hash);
}
}
}
/**
* Check if a given ip is in a network
* @param string $ip IP to check in IPV4 format eg. 127.0.0.1
* @param string $range IP/CIDR netmask eg. 127.0.0.0/24, also 127.0.0.1 is accepted and /32 assumed
* @return boolean true if the ip is in this range / false if not.
* via https://gist.github.com/tott/7684443
*/
function isIPInRange( $ip, $range ) {
if ( strpos( $range, '/' ) == false )
{
$range .= '/32';
}
// $range is in IP/CIDR format eg 127.0.0.1/24
list( $range, $netmask ) = explode( '/', $range, 2 );
$range_decimal = ip2long( $range );
$ip_decimal = ip2long( $ip );
$wildcard_decimal = pow( 2, ( 32 - $netmask ) ) - 1;
$netmask_decimal = ~ $wildcard_decimal;
return ( ( $ip_decimal & $netmask_decimal ) == ( $range_decimal & $netmask_decimal ) );
}

3
inc/example.config.inc.php
View File

@@ -11,4 +11,5 @@ define('URL','https://dev.pictshare.net/');
//define('JPEG_COMPRESSION', 90);
//define('FFMPEG_BINARY','');
//define('ALT_FOLDER','/ftp/pictshare');
//define('ALT_FOLDER','/ftp/pictshare');
//define('ALLOWED_SUBNET','192.168.0.0/24');

1
rtfm/CONFIG.md
View File

@@ -12,6 +12,7 @@
| MASTER_DELETE_CODE | string | If set, this code will be accepted to delete any image by adding "delete_yourmasterdeletecode" to any image |
| MASTER_DELETE_IP | IP addr | If set, allows deletion of image no matter what delete code you provided if request is coming from this single IP |
| UPLOAD_FORM_LOCATION | string | If set, will only show the upload form if this url is requested. eg if you set it to /secret/upload then you only see the form if you go to http://your.pictshare.server/secret/upload but bare in mind that the uploads [via API](/rtfm/API.md) will still work for anyone|
| ALLOWED_SUBNET | IP addr | If set, will only show the upload form and allow to upload via API if request is coming from this subnet |
| UPLOAD_QUOTA (NOT IMPLEMENTED) | int | Size in MB. If set, will only allow uploads if combined size of uploads on Server is smaller than this value. Does not account for ALT_FOLDER data and resized versions of original uploads won't be added to calculation |
| UPLOAD_CODE (NOT IMPLEMENTED | string | If set, all uploads require this code via GET or POST variable "uploadcode" or upload will fail |
| MAX_RESIZED_IMAGES (NOT IMPLEMENTED | string | If set, limits count of resized images/videos per file on server |