]> git.immae.eu Git - github/wallabag/wallabag.git/blob - inc/poche/pochePictures.php
Security fix for Download Images
[github/wallabag/wallabag.git] / inc / poche / pochePictures.php
1 <?php
2 /**
3 * wallabag, self hostable application allowing you to not miss any content anymore
4 *
5 * @category wallabag
6 * @author Nicolas Lœuillet <nicolas@loeuillet.org>
7 * @copyright 2013
8 * @license http://www.wtfpl.net/ see COPYING file
9 */
10
11 /**
12 * On modifie les URLS des images dans le corps de l'article
13 */
14 function filtre_picture($content, $url, $id)
15 {
16 $matches = array();
17 preg_match_all('#<\s*(img)[^>]+src="([^"]*)"[^>]*>#Si', $content, $matches, PREG_SET_ORDER);
18 foreach($matches as $i => $link) {
19 $link[1] = trim($link[1]);
20 if (!preg_match('#^(([a-z]+://)|(\#))#', $link[1])) {
21 $absolute_path = get_absolute_link($link[2],$url);
22 $filename = basename(parse_url($absolute_path, PHP_URL_PATH));
23 $directory = create_assets_directory($id);
24 $fullpath = $directory . '/' . $filename;
25 download_pictures($absolute_path, $fullpath);
26 $content = str_replace($matches[$i][2], $fullpath, $content);
27 }
28
29 }
30
31 return $content;
32 }
33
34 /**
35 * Retourne le lien absolu
36 */
37 function get_absolute_link($relative_link, $url) {
38 /* return if already absolute URL */
39 if (parse_url($relative_link, PHP_URL_SCHEME) != '') return $relative_link;
40
41 /* queries and anchors */
42 if ($relative_link[0]=='#' || $relative_link[0]=='?') return $url . $relative_link;
43
44 /* parse base URL and convert to local variables:
45 $scheme, $host, $path */
46 extract(parse_url($url));
47
48 /* remove non-directory element from path */
49 $path = preg_replace('#/[^/]*$#', '', $path);
50
51 /* destroy path if relative url points to root */
52 if ($relative_link[0] == '/') $path = '';
53
54 /* dirty absolute URL */
55 $abs = $host . $path . '/' . $relative_link;
56
57 /* replace '//' or '/./' or '/foo/../' with '/' */
58 $re = array('#(/\.?/)#', '#/(?!\.\.)[^/]+/\.\./#');
59 for($n=1; $n>0; $abs=preg_replace($re, '/', $abs, -1, $n)) {}
60
61 /* absolute URL is ready! */
62 return $scheme.'://'.$abs;
63 }
64
65 /**
66 * Téléchargement des images
67 */
68 function download_pictures($absolute_path, $fullpath)
69 {
70 $rawdata = Tools::getFile($absolute_path);
71
72 if(file_exists($fullpath)) {
73 unlink($fullpath);
74 }
75
76 // check extension
77 $file_ext = strrchr($fullpath, '.');
78 $whitelist = array(".jpg",".jpeg",".gif",".png");
79 if (!(in_array($file_ext, $whitelist))) {
80 Tools::logm('processed image with not allowed extension. Skipping ' . $fullpath);
81 } else {
82 // check headers
83 $imageinfo = getimagesize($absolute_path);
84 if ($imageinfo['mime'] != 'image/gif' && $imageinfo['mime'] != 'image/jpeg'&& $imageinfo['mime'] != 'image/jpg'&& $imageinfo['mime'] != 'image/png') {
85 Tools::logm('processed image with bad header. Skipping ' . $fullpath);
86 } else {
87 // regenerate image
88 $im = imagecreatefromstring($rawdata);
89 if ($im) {
90 switch ($imageinfo['mime']) {
91 case 'image/gif':
92 imagegif($im, $fullpath);
93 break;
94 case 'image/jpeg':
95 case 'image/jpg':
96 imagejpeg($im, $fullpath); // default quality is 75%
97 break;
98 case 'image/png':
99 imagepng($im, $fullpath);
100 break;
101 }
102 imagedestroy($im);
103 } else {
104 Tools::logm('error while regenerating image ' . $fullpath);
105 }
106 }
107 }
108 }
109
110 /**
111 * Crée un répertoire de médias pour l'article
112 */
113 function create_assets_directory($id)
114 {
115 $assets_path = ABS_PATH;
116 if(!is_dir($assets_path)) {
117 mkdir($assets_path, 0715);
118 }
119
120 $article_directory = $assets_path . $id;
121 if(!is_dir($article_directory)) {
122 mkdir($article_directory, 0715);
123 }
124
125 return $article_directory;
126 }
127
128 /**
129 * Suppression du répertoire d'images
130 */
131 function remove_directory($directory)
132 {
133 if(is_dir($directory)) {
134 $files = array_diff(scandir($directory), array('.','..'));
135 foreach ($files as $file) {
136 (is_dir("$directory/$file")) ? remove_directory("$directory/$file") : unlink("$directory/$file");
137 }
138 return rmdir($directory);
139 }
140 }