phpBB

<?php

/**

*

* @package phpBB3

* @version $Id$

* @copyright (c) 2005 phpBB Group

* @license http://opensource.org/licenses/gpl-license.php GNU Public License

*

*/

/**

*/

define('IN_PHPBB', true);

$phpbb_root_path = './';

$phpEx = substr(strrchr(__FILE__, '.'), 1);

include($phpbb_root_path . 'common.'.$phpEx);

$download_id = request_var('id', 0);

// Thumbnails are not handled by this file by default - but for modders this should be interesting. ;)

$thumbnail = request_var('t', false);

// Start session management

$user->session_begin();

$auth->acl($user->data);

$user->setup('viewtopic');

if (!$download_id)

{

        trigger_error('NO_ATTACHMENT_SELECTED');

}

if (!$config['allow_attachments'] && !$config['allow_pm_attach'])

{

        trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');

}

$sql = 'SELECT attach_id, in_message, post_msg_id, extension

        FROM ' . ATTACHMENTS_TABLE . "

        WHERE attach_id = $download_id";

$result = $db->sql_query_limit($sql, 1);

if (!($attachment = $db->sql_fetchrow($result)))

{

        trigger_error('ERROR_NO_ATTACHMENT');

}

$db->sql_freeresult($result);

if ((!$attachment['in_message'] && !$config['allow_attachments']) || ($attachment['in_message'] && !$config['allow_pm_attach']))

{

        trigger_error('ATTACHMENT_FUNCTIONALITY_DISABLED');

}

$row = array();

if (!$attachment['in_message'])

{

        //

        $sql = 'SELECT p.forum_id, f.forum_password, f.parent_id

                FROM ' . POSTS_TABLE . ' p, ' . FORUMS_TABLE . ' f

                WHERE p.post_id = ' . $attachment['post_msg_id'] . '

                        AND p.forum_id = f.forum_id';

        $result = $db->sql_query_limit($sql, 1);

        $row = $db->sql_fetchrow($result);

        $db->sql_freeresult($result);

        if ($auth->acl_gets('f_download', 'u_download', $row['forum_id']))

        {

                if ($row['forum_password'])

                {

                        // Do something else ... ?

                        login_forum_box($row);

                }

        }

        else

        {

                trigger_error('SORRY_AUTH_VIEW_ATTACH');

        }

}

else

{

        $row['forum_id'] = 0;

        if (!$auth->acl_get('u_pm_download') || !$config['auth_download_pm'])

        {

                trigger_error('SORRY_AUTH_VIEW_ATTACH');

        }

}

// disallowed ?

$extensions = array();

if (!extension_allowed($row['forum_id'], $attachment['extension'], $extensions))

{

        trigger_error(sprintf($user->lang['EXTENSION_DISABLED_AFTER_POSTING'], $attachment['extension']));

}

if (!download_allowed())

{

        trigger_error($user->lang['LINKAGE_FORBIDDEN']);

}

$download_mode = (int) $extensions[$attachment['extension']]['download_mode'];

// Fetching filename here to prevent sniffing of filename

$sql = 'SELECT attach_id, in_message, post_msg_id, extension, physical_filename, real_filename, mimetype

        FROM ' . ATTACHMENTS_TABLE . "

        WHERE attach_id = $download_id";

$result = $db->sql_query_limit($sql, 1);

if (!($attachment = $db->sql_fetchrow($result)))

{

        trigger_error('ERROR_NO_ATTACHMENT');

}

$db->sql_freeresult($result);

$attachment['physical_filename'] = basename($attachment['physical_filename']);

if ($thumbnail)

{

        $attachment['physical_filename'] = 'thumb_' . $attachment['physical_filename'];

}

else

{

        // Update download count

        $sql = 'UPDATE ' . ATTACHMENTS_TABLE . '

                SET download_count = download_count + 1

                WHERE attach_id = ' . $attachment['attach_id'];

        $db->sql_query($sql);

}

// Determine the 'presenting'-method

if ($download_mode == PHYSICAL_LINK)

{

        if (!@is_dir($phpbb_root_path . $config['upload_path']))

        {

                trigger_error($user->lang['PHYSICAL_DOWNLOAD_NOT_POSSIBLE']);

        }

        redirect($phpbb_root_path . $config['upload_path'] . '/' . $attachment['physical_filename']);

}

else

{

        send_file_to_browser($attachment, $config['upload_path'], $extensions[$attachment['extension']]['display_cat']);

        exit;

}

/**

* Send file to browser

*/

function send_file_to_browser($attachment, $upload_dir, $category)

{

        global $user, $db, $config, $phpbb_root_path;

        $filename = $phpbb_root_path . $upload_dir . '/' . $attachment['physical_filename'];

        if (!@file_exists($filename))

        {

                trigger_error($user->lang['ERROR_NO_ATTACHMENT'] . '<br /><br />' . sprintf($user->lang['FILE_NOT_FOUND_404'], $filename));

        }

        // Determine the Browser the User is using, because of some nasty incompatibilities.

        // borrowed from phpMyAdmin. :)

        $user_agent = (!empty($_SERVER['HTTP_USER_AGENT'])) ? $_SERVER['HTTP_USER_AGENT'] : '';

        if (ereg('Opera(/| )([0-9].[0-9]{1,2})', $user_agent, $log_version))

        {

                $browser_version = $log_version[2];

                $browser_agent = 'opera';

        }

        else if (ereg('MSIE ([0-9].[0-9]{1,2})', $user_agent, $log_version))

        {

                $browser_version = $log_version[1];

                $browser_agent = 'ie';

        }

        else if (ereg('OmniWeb/([0-9].[0-9]{1,2})', $user_agent, $log_version))

        {

                $browser_version = $log_version[1];

                $browser_agent = 'omniweb';

        }

        else if (ereg('(Konqueror/)(.*)(;)', $user_agent, $log_version))

        {

                $browser_version = $log_version[2];

                $browser_agent = 'konqueror';

        }

        else if (ereg('Mozilla/([0-9].[0-9]{1,2})', $user_agent, $log_version) && ereg('Safari/([0-9]*)', $user_agent, $log_version2))

        {

                $browser_version = $log_version[1] . '.' . $log_version2[1];

                $browser_agent = 'safari';

        }

        else if (ereg('Mozilla/([0-9].[0-9]{1,2})', $user_agent, $log_version))

        {

                $browser_version = $log_version[1];

                $browser_agent = 'mozilla';

        }

        else

        {

                $browser_version = 0;

                $browser_agent = 'other';

        }

        // Correct the mime type - we force application/octetstream for all files, except images

        // Please do not change this, it is a security precaution

        if ($category == ATTACHMENT_CATEGORY_NONE && strpos($attachment['mimetype'], 'image') === false)

        {

                $attachment['mimetype'] = ($browser_agent == 'ie' || $browser_agent == 'opera') ? 'application/octetstream' : 'application/octet-stream';

        }

        if (@ob_get_length())

        {

                @ob_end_clean();

        }

        // Now the tricky part... let's dance

        header('Pragma: public');

        // Send out the Headers

        header('Content-Type: ' . $attachment['mimetype'] . '; name="' . $attachment['real_filename'] . '"');

        header('Content-Disposition: inline; filename="' . $attachment['real_filename'] . '"');

        // Now send the File Contents to the Browser

        $size = @filesize($filename);

        if ($size)

        {

                header("Content-length: $size");

        }

        $result = @readfile($filename);

        if (!$result)

        {

                trigger_error('Unable to deliver file.<br />Error was: ' . $php_errormsg, E_USER_WARNING);

        }

        flush();

        exit;

}

/**

* Check if downloading item is allowed

*/

function download_allowed()

{

        global $config, $user, $db;

        if (!$config['secure_downloads'])

        {

                return true;

        }

        $url = (getenv('HTTP_REFERER')) ? trim(getenv('HTTP_REFERER')) : trim($_SERVER['HTTP_REFERER']);

        if (!$url)

        {

                return ($config['secure_allow_empty_referer']) ? true : false;

        }

        // Split URL into domain and script part

        $url = explode('?', str_replace(array('http://', 'https://'), array('', ''), $url));

        $hostname = trim($url[0]);

        unset($url);

        $allowed = ($config['secure_allow_deny']) ? false : true;

        $iplist = array();

        $ip_ary = gethostbynamel($hostname);

        foreach ($ip_ary as $ip)

        {

                if ($ip)

                {

                        $iplist[] = $ip;

                }

        }

        // Check for own server...

        if (preg_match('#^.*?' . $config['server_name'] . '.*?$#i', $hostname))

        {

                $allowed = true;

        }

        // Get IP's and Hostnames

        if (!$allowed)

        {

                $sql = 'SELECT site_ip, site_hostname, ip_exclude

                        FROM ' . SITELIST_TABLE;

                $result = $db->sql_query($sql);

                while ($row = $db->sql_fetchrow($result))

                {

                        $site_ip = trim($row['site_ip']);

                        $site_hostname = trim($row['site_hostname']);

                        if ($site_ip)

                        {

                                foreach ($iplist as $ip)

                                {

                                        if (preg_match('#^' . str_replace('*', '.*?', $site_ip) . '$#i', $ip))

                                        {

                                                if ($row['ip_exclude'])

                                                {

                                                        $allowed = ($config['secure_allow_deny']) ? false : true;

                                                        break 2;

                                                }

                                                else

                                                {

                                                        $allowed = ($config['secure_allow_deny']) ? true : false;

                                                }

                                        }

                                }

                        }

                        if ($site_hostname)

                        {

                                if (preg_match('#^' . str_replace('*', '.*?', $site_hostname) . '$#i', $hostname))

                                {

                                        if ($row['ip_exclude'])

                                        {

                                                $allowed = ($config['secure_allow_deny']) ? false : true;

                                                break;

                                        }

                                        else

                                        {

                                                $allowed = ($config['secure_allow_deny']) ? true : false;

                                        }

                                }

                        }

                }

                $db->sql_freeresult($result);

        }

        return $allowed;

}

?>