1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
|
#!/bin/bash
host=0.0.0.0
port=1111
out="$(mktemp /tmp/tmp-upload-php.XXXXXXXX)"
cleanup() {
rm -v "$out"
}
trap cleanup EXIT
# wrap
startline=$(grep -hn -F -m 1 "# stuff ""below" "$0" | cut -d: -f1)
tail -n+$((startline+1)) "$0" > "$out"
php -d post_max_size=128M -d upload_max_filesize=128M \
-S "$host:$port" "$out"
exit
# stuff below
<?php
function get_mime_type($file) {
$finfo = new finfo(FILEINFO_MIME_TYPE | FILEINFO_MIME_ENCODING);
if (!is_resource($finfo)) {
return $finfo->file($file);
}
return false;
}
$url = $_SERVER['REQUEST_URI'];
if ($url != '/') {
/* Simply returning false causes PHP to parse (index).php. Unwanted,
* therefore serve it here. First check whether the path is within the
* current working directory, then whether the file exists or not. */
$cwdir = realpath(".");
if ($cwdir === FALSE) {
http_response_code(500);
exit;
}
$path = realpath("." . $url);
if ($path === FALSE) {
http_response_code(404);
exit;
}
if (strpos($path, $cwdir . DIRECTORY_SEPARATOR) !== 0) {
http_response_code(403);
exit;
}
/* determine content type and size in bytes */
$filesize = filesize($path);
$mimetype = get_mime_type($path);
if (!$mimetype) {
http_response_code(500);
exit;
}
header("Content-Type: $mimetype");
if ($filesize !== false) {
header("Content-Length: $filesize");
}
readfile($path);
exit;
}
$msg = NULL;
if (isset($_FILES["file"]["name"])) {
$name = trim(basename($_FILES["file"]["name"]), ".");
if (!$name) {
$msg = "No filename is given!";
} else if (!$_FILES["file"]["size"]) {
$msg = "I do not accept empty files!";
} else {
$filename = $name;
for ($i=1; file_exists($filename); $i++) {
$filename = "$filename.$i";
}
if (move_uploaded_file($_FILES["file"]["tmp_name"], $filename)) {
$msg = "File is saved as " . htmlspecialchars($filename);
} else {
$msg = "File could not be saved.";
}
}
}
?>
<!doctype html>
<meta charset="UTF-8">
<meta name="viewport" content="initial-scale=1">
<form action="/" method="POST" enctype="multipart/form-data">
<input type="file" name="file">
<input type="submit" value="Upload">
</form>
<?php
if ($msg) echo "<p>$msg</p>";
?>
<hr>
<pre>
<?php
mb_internal_encoding('UTF-8');
date_default_timezone_set('Europe/Amsterdam');
$dir = new DirectoryIterator('.');
foreach ($dir as $f) {
if ($f->isDot()) {
continue;
}
$filename = $f->getFilename();
$len = mb_strlen($filename);
if ($len > 50) {
$dispName = mb_substr($filename, 0, 47) . '..>';
} else {
$dispName = $filename;
}
printf('<a href="%s">%s</a>%s %s %20d' . "\n",
htmlspecialchars($filename),
htmlspecialchars($dispName),
str_repeat(' ', max(0, 50 - $len)),
date('d-M-Y H:i', $f->getMTime()),
$f->getSize()
);
}
?>
</pre>
|
