[985] | 1 | <?php |
---|
| 2 | // +-----------------------------------------------------------------------+ |
---|
[2297] | 3 | // | Piwigo - a PHP based picture gallery | |
---|
| 4 | // +-----------------------------------------------------------------------+ |
---|
[3049] | 5 | // | Copyright(C) 2008-2009 Piwigo Team http://piwigo.org | |
---|
[2297] | 6 | // | Copyright(C) 2003-2008 PhpWebGallery Team http://phpwebgallery.net | |
---|
| 7 | // | Copyright(C) 2002-2003 Pierrick LE GALL http://le-gall.net/pierrick | |
---|
| 8 | // +-----------------------------------------------------------------------+ |
---|
| 9 | // | This program is free software; you can redistribute it and/or modify | |
---|
| 10 | // | it under the terms of the GNU General Public License as published by | |
---|
| 11 | // | the Free Software Foundation | |
---|
| 12 | // | | |
---|
| 13 | // | This program is distributed in the hope that it will be useful, but | |
---|
| 14 | // | WITHOUT ANY WARRANTY; without even the implied warranty of | |
---|
| 15 | // | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
---|
| 16 | // | General Public License for more details. | |
---|
| 17 | // | | |
---|
| 18 | // | You should have received a copy of the GNU General Public License | |
---|
| 19 | // | along with this program; if not, write to the Free Software | |
---|
| 20 | // | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, | |
---|
| 21 | // | USA. | |
---|
| 22 | // +-----------------------------------------------------------------------+ |
---|
[985] | 23 | |
---|
[1560] | 24 | define('PHPWG_ROOT_PATH','./'); |
---|
| 25 | include_once(PHPWG_ROOT_PATH.'include/common.inc.php'); |
---|
| 26 | |
---|
| 27 | // Check Access and exit when user status is not ok |
---|
| 28 | check_status(ACCESS_GUEST); |
---|
| 29 | |
---|
[1612] | 30 | function guess_mime_type($ext) |
---|
[985] | 31 | { |
---|
[1612] | 32 | switch ( strtolower($ext) ) |
---|
[1560] | 33 | { |
---|
[1612] | 34 | case "jpe": case "jpeg": |
---|
| 35 | case "jpg": $ctype="image/jpeg"; break; |
---|
| 36 | case "png": $ctype="image/png"; break; |
---|
| 37 | case "gif": $ctype="image/gif"; break; |
---|
| 38 | case "tiff": |
---|
| 39 | case "tif": $ctype="image/tiff"; break; |
---|
| 40 | case "txt": $ctype="text/plain"; break; |
---|
| 41 | case "html": |
---|
| 42 | case "htm": $ctype="text/html"; break; |
---|
| 43 | case "xml": $ctype="text/xml"; break; |
---|
| 44 | case "pdf": $ctype="application/pdf"; break; |
---|
| 45 | case "zip": $ctype="application/zip"; break; |
---|
| 46 | case "ogg": $ctype="application/ogg"; break; |
---|
| 47 | default: $ctype="application/octet-stream"; |
---|
[1560] | 48 | } |
---|
[1612] | 49 | return $ctype; |
---|
| 50 | } |
---|
[985] | 51 | |
---|
[1612] | 52 | function do_error( $code, $str ) |
---|
| 53 | { |
---|
[1643] | 54 | set_status_header( $code ); |
---|
[1612] | 55 | echo $str ; |
---|
| 56 | exit(); |
---|
| 57 | } |
---|
[985] | 58 | |
---|
| 59 | |
---|
[1817] | 60 | if (!isset($_GET['id']) |
---|
| 61 | or !is_numeric($_GET['id']) |
---|
[1612] | 62 | or !isset($_GET['part']) |
---|
| 63 | or !in_array($_GET['part'], array('t','e','i','h') ) ) |
---|
| 64 | { |
---|
| 65 | do_error(400, 'Invalid request - id/part'); |
---|
| 66 | } |
---|
| 67 | |
---|
| 68 | $query = ' |
---|
| 69 | SELECT * FROM '. IMAGES_TABLE.' |
---|
[1817] | 70 | WHERE id='.$_GET['id'].' |
---|
[1612] | 71 | ;'; |
---|
| 72 | |
---|
| 73 | $result = pwg_query($query); |
---|
| 74 | $element_info = mysql_fetch_assoc($result); |
---|
| 75 | if ( empty($element_info) ) |
---|
| 76 | { |
---|
| 77 | do_error(404, 'Requested id not found'); |
---|
| 78 | } |
---|
[1678] | 79 | |
---|
| 80 | // $filter['visible_categories'] and $filter['visible_images'] |
---|
[1677] | 81 | // are not used because it's not necessary (filter <> restriction) |
---|
[1616] | 82 | $query=' |
---|
[1817] | 83 | SELECT id |
---|
| 84 | FROM '.CATEGORIES_TABLE.' |
---|
| 85 | INNER JOIN '.IMAGE_CATEGORY_TABLE.' ON category_id = id |
---|
| 86 | WHERE image_id = '.$_GET['id'].' |
---|
| 87 | '.get_sql_condition_FandF( |
---|
[2084] | 88 | array( |
---|
| 89 | 'forbidden_categories' => 'category_id', |
---|
| 90 | 'forbidden_images' => 'image_id', |
---|
| 91 | ), |
---|
[1817] | 92 | ' AND' |
---|
| 93 | ).' |
---|
[1616] | 94 | LIMIT 1 |
---|
| 95 | ;'; |
---|
| 96 | if ( mysql_num_rows(pwg_query($query))<1 ) |
---|
| 97 | { |
---|
| 98 | do_error(401, 'Access denied'); |
---|
| 99 | } |
---|
[1612] | 100 | |
---|
| 101 | include_once(PHPWG_ROOT_PATH.'include/functions_picture.inc.php'); |
---|
| 102 | $file=''; |
---|
| 103 | switch ($_GET['part']) |
---|
| 104 | { |
---|
| 105 | case 't': |
---|
| 106 | $file = get_thumbnail_path($element_info); |
---|
| 107 | break; |
---|
| 108 | case 'e': |
---|
| 109 | $file = get_element_path($element_info); |
---|
| 110 | break; |
---|
| 111 | case 'i': |
---|
| 112 | $file = get_image_path($element_info); |
---|
| 113 | break; |
---|
| 114 | case 'h': |
---|
[1616] | 115 | if ( $user['enabled_high']!='true' ) |
---|
| 116 | { |
---|
| 117 | do_error(401, 'Access denied h'); |
---|
| 118 | } |
---|
[1612] | 119 | $file = get_high_path($element_info); |
---|
| 120 | break; |
---|
| 121 | } |
---|
| 122 | |
---|
| 123 | if ( empty($file) ) |
---|
| 124 | { |
---|
| 125 | do_error(404, 'Requested file not found'); |
---|
| 126 | } |
---|
| 127 | |
---|
[1817] | 128 | if ($_GET['part'] == 'h') { |
---|
[1844] | 129 | pwg_log($_GET['id'], 'high'); |
---|
[1817] | 130 | } |
---|
[1844] | 131 | else if ($_GET['part'] == 'e') |
---|
| 132 | { |
---|
| 133 | pwg_log($_GET['id'], 'other'); |
---|
| 134 | } |
---|
[1817] | 135 | |
---|
[1612] | 136 | $http_headers = array(); |
---|
| 137 | |
---|
| 138 | $ctype = null; |
---|
| 139 | if (!url_is_remote($file)) |
---|
| 140 | { |
---|
| 141 | if ( !@is_readable($file) ) |
---|
[1560] | 142 | { |
---|
[1612] | 143 | do_error(404, "Requested file not found - $file"); |
---|
[1560] | 144 | } |
---|
[1612] | 145 | $http_headers[] = 'Content-Length: '.@filesize($file); |
---|
| 146 | if ( function_exists('mime_content_type') ) |
---|
[1552] | 147 | { |
---|
[1612] | 148 | $ctype = mime_content_type($file); |
---|
[1552] | 149 | } |
---|
[1616] | 150 | |
---|
| 151 | $gmt_mtime = gmdate('D, d M Y H:i:s', filemtime($file)).' GMT'; |
---|
| 152 | $http_headers[] = 'Last-Modified: '.$gmt_mtime; |
---|
| 153 | |
---|
| 154 | // following lines would indicate how the client should handle the cache |
---|
| 155 | /* $max_age=300; |
---|
| 156 | $http_headers[] = 'Expires: '.gmdate('D, d M Y H:i:s', time()+$max_age).' GMT'; |
---|
| 157 | // HTTP/1.1 only |
---|
| 158 | $http_headers[] = 'Cache-Control: private, must-revalidate, max-age='.$max_age;*/ |
---|
| 159 | |
---|
| 160 | if ( isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) ) |
---|
| 161 | { |
---|
[1643] | 162 | set_status_header(304); |
---|
[1616] | 163 | foreach ($http_headers as $header) |
---|
| 164 | { |
---|
| 165 | header( $header ); |
---|
| 166 | } |
---|
| 167 | exit(); |
---|
| 168 | } |
---|
[1612] | 169 | } |
---|
[1616] | 170 | |
---|
[1612] | 171 | if (!isset($ctype)) |
---|
| 172 | { // give it a guess |
---|
| 173 | $ctype = guess_mime_type( get_extension($file) ); |
---|
| 174 | } |
---|
[1552] | 175 | |
---|
[1612] | 176 | $http_headers[] = 'Content-Type: '.$ctype; |
---|
| 177 | |
---|
| 178 | if (!isset($_GET['view'])) |
---|
| 179 | { |
---|
| 180 | $http_headers[] = 'Content-Disposition: attachment; filename="' |
---|
| 181 | .basename($file).'";'; |
---|
| 182 | $http_headers[] = 'Content-Transfer-Encoding: binary'; |
---|
[985] | 183 | } |
---|
[1616] | 184 | else |
---|
| 185 | { |
---|
| 186 | $http_headers[] = 'Content-Disposition: inline; filename="' |
---|
| 187 | .basename($file).'";'; |
---|
| 188 | } |
---|
[985] | 189 | |
---|
[1612] | 190 | foreach ($http_headers as $header) |
---|
[985] | 191 | { |
---|
[1612] | 192 | header( $header ); |
---|
[985] | 193 | } |
---|
| 194 | |
---|
[1612] | 195 | // Looking at the safe_mode configuration for execution time |
---|
| 196 | if (ini_get('safe_mode') == 0) |
---|
| 197 | { |
---|
| 198 | @set_time_limit(0); |
---|
| 199 | } |
---|
| 200 | |
---|
| 201 | @readfile($file); |
---|
| 202 | |
---|
| 203 | ?> |
---|