CW Cyrix's Git Repository Mirror
Browse code

Fixed filtering with newtorrents.php dltorrent.php authentication behavior slightly changed batch_upload.php reverted

Clarissa Walker authored on 2015/09/14 08:55:30
Showing 1 changed files
newtorrents.php
History View file @ b9a33fe
... ... 
@@ -36,7 +36,7 @@ function addTorrent()
36 36 
 	require ("config.php");
37 37 
 	$tracker_url = $announce_url0 OR $announce_url1 OR $announce_url2 OR $announce_url3 OR $announce_url4;
38 38
39 
-	$hash = strtolower($_POST["hash"]);
39 
+	$hash = strtolower(htmlentities($_POST["hash"], ENT_QUOTES, "UTF-8"));
40 40
41 41 
 	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Couldn't connect to the database, contact the administrator</p>");
42 42 
 	mysql_select_db($database) or die(errorMessage() . "Can't open the database.</p>");
... ... 
@@ -184,7 +184,7 @@ function addTorrent()
184 184 
 	$filename = htmlspecialchars(clean($filename));
185 185 
 	$url = htmlspecialchars(mysql_real_escape_string($url));
186 186
187 
-	if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))
187 
+	if ((strlen($hash) != 40) || !verifyHash($hash))
188 188 
 	{
189 189 
 		echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
190 190 
 		endOutput();
Browse code

Continuation of reviewing filtering practices

Clarissa Walker authored on 2015/09/14 07:20:48
Showing 1 changed files
newtorrents.php
History View file @ 45c4ca1
... ... 
@@ -184,7 +184,7 @@ function addTorrent()
184 184 
 	$filename = htmlspecialchars(clean($filename));
185 185 
 	$url = htmlspecialchars(mysql_real_escape_string($url));
186 186
187 
-	if ((strlen($hash) != 40) || !verifyHash($hash))
187 
+	if ((strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40) || !verifyHash($hash))
188 188 
 	{
189 189 
 		echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
190 190 
 		endOutput();
Browse code

Checks added to some files: torrent_functions.php, tracker.php dltorrent.php's check changed to authenticate no matter what Some fixes and modifications from 2014: index.php, funcsv2.php, batch_upload.php, newtorrents.php, install.php, editconfig.php Version bumped up to 1.05

Clarissa Walker authored on 2015/08/30 00:06:28
Showing 1 changed files
newtorrents.php
History View file @ e0861e2
... ... 
@@ -22,7 +22,7 @@ if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
22 22 
 <body>
23 23
24 24 
 <?php
25 
-$tracker_url = $website_url . substr($_SERVER['PHP_SELF'], 0, -15) . $announceurl;
25 
+$tracker_url = $announce_url0 OR $announce_url1 OR $announce_url2 OR $announce_url3 OR $announce_url4;
26 26
27 27 
 if (isset($_FILES["torrent"]))
28 28 
 	addTorrent();
... ... 
@@ -34,7 +34,7 @@ endOutput();
34 34 
 function addTorrent()
35 35 
 {
36 36 
 	require ("config.php");
37 
-	$tracker_url = $website_url . substr($_SERVER['PHP_SELF'], 0, -15) . $announceurl;
37 
+	$tracker_url = $announce_url0 OR $announce_url1 OR $announce_url2 OR $announce_url3 OR $announce_url4;
38 38
39 39 
 	$hash = strtolower($_POST["hash"]);
40 40
... ... 
@@ -70,15 +70,16 @@ function addTorrent()
70 70 
 			}
71 71 
 			if ($found_tracker == false)
72 72 
 			{
73 
-				echo errorMessage() . "Error: Multiple trackers were found but none of them match the
74 
-					announce URL:<br>$tracker_url<br>Please re-create and re-upload the torrent.</p>\n";
73 
+				echo errorMessage() . "Error: Multiple trackers were found but none of them match the primary
74 
+					announce URL:<br>$tracker_url<br><br>or any alternate URLs:<br>$announce_url1<br>$announce_url2<br>$announce_url3<br>$announce_url4<br><br>Please re-create and re-upload the torrent.</p>\n";
75 75 
 				endOutput();
76 76 
 				exit;
77 77 
 			}
78 78 
 		} else {
79 79 
 			//a single tracker is listed
80 80 
 			if (strtolower($array["announce"]) != $tracker_url) {
81 
-				echo errorMessage() . "Error: The tracker announce URL does not match this:<br>$tracker_url<br>Please re-create and re-upload the torrent.</p>\n";
81 
+				echo errorMessage() . "Error: The tracker announce URL does not match the primary
82 
+					announce URL:<br>$tracker_url<br><br>or any alternate URLs:<br>$announce_url1<br>$announce_url2<br>$announce_url3<br>$announce_url4<br><br>Please re-create and re-upload the torrent.</p>\n";
82 83 
 				endOutput();
83 84 
 				exit;
84 85 
 			}
... ... 
@@ -235,12 +236,17 @@ function addTorrent()
235 236 
 function endOutput()
236 237 
 {
237 238 
 	require ("config.php");
238 
-	$tracker_url = $website_url . substr($_SERVER['PHP_SELF'], 0, -15) . $announceurl;
239 
+	$tracker_url = $announce_url0;
240 
+	$alt_tracker_url1 = $announce_url1;
241 
+	$alt_tracker_url2 = $announce_url2;
242 
+	$alt_tracker_url3 = $announce_url3;
243 
+	$alt_tracker_url4 = $announce_url4;
239 244 
 	?>
240 245 
 	<p align="right"><a href="./docs/help.html"><img src="images/help.png" border="0" class="icon" alt="Help" title="Help" /></a><a href="./docs/help.html">Help</a></p>
241 246 
 	<div class="center">
242 247 
 	<h1>Add Torrent to Tracker Database</h1>
243 
-	<h3>Tracker URL: <?php echo $tracker_url;?></h3>
248 
+	<h3>Tracker URL: <br> <?php echo $tracker_url;?></h3>
249 
+	<h4>Alternate Tracker URLs: <br> <?php echo $alt_tracker_url1;?> <br> <?php echo $alt_tracker_url2;?> <br> <?php echo $alt_tracker_url3;?> <br> <?php echo $alt_tracker_url4; ?> </h4>
244 250 
 	<form enctype="multipart/form-data" method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
245 251 
 	<table>
246 252 
 	<tr>
Browse code

Import from the old rivettracker git repository at sourceforge (amisaph/amisapphire branch)

Clarissa Walker (ami-sapphire) authored on 2014/01/24 14:02:23
Showing 1 changed files
newtorrents.php
History View file @ 1c8ad06
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,311 @@
1 
+<?php
2 
+require_once("config.php");
3 
+require_once("funcsv2.php");
4 
+//Check session
5 
+session_start();
6 
+
7 
+if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
8 
+{
9 
+	//check fails
10 
+	header("Location: authenticate.php?status=error");
11 
+	exit();
12 
+}
13 
+?>
14 
+
15 
+<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
16 
+<html>
17 
+<head>
18 
+	<title>Add Torrent to Tracker</title>
19 
+	<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1" />
20 
+	<link rel="stylesheet" type="text/css" href="./css/style.css" />
21 
+</head>
22 
+<body>
23 
+
24 
+<?php
25 
+$tracker_url = $website_url . substr($_SERVER['PHP_SELF'], 0, -15) . $announceurl;
26 
+
27 
+if (isset($_FILES["torrent"]))
28 
+	addTorrent();
29 
+
30 
+
31 
+endOutput();
32 
+
33 
+
34 
+function addTorrent()
35 
+{
36 
+	require ("config.php");
37 
+	$tracker_url = $website_url . substr($_SERVER['PHP_SELF'], 0, -15) . $announceurl;
38 
+
39 
+	$hash = strtolower($_POST["hash"]);
40 
+
41 
+	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Couldn't connect to the database, contact the administrator</p>");
42 
+	mysql_select_db($database) or die(errorMessage() . "Can't open the database.</p>");
43 
+
44 
+	require_once ("funcsv2.php");
45 
+	require_once ("BDecode.php");
46 
+	require_once ("BEncode.php");
47 
+
48 
+	if ($_FILES["torrent"]["error"] != 4)
49 
+	{
50 
+		$fd = fopen($_FILES["torrent"]["tmp_name"], "rb") or die(errorMessage() . "File upload error 1</p>\n");
51 
+		is_uploaded_file($_FILES["torrent"]["tmp_name"]) or die(errorMessage() . "File upload error 2</p>\n");
52 
+		$alltorrent = fread($fd, filesize($_FILES["torrent"]["tmp_name"]));
53 
+
54 
+		$array = BDecode($alltorrent);
55 
+		if (!$array)
56 
+		{
57 
+			echo errorMessage() . "Error: The parser was unable to load your torrent.  Please re-create and re-upload the torrent.</p>\n";
58 
+			endOutput();
59 
+			exit;
60 
+		}
61 
+
62 
+		if (isset($array["announce-list"])) {
63 
+			//multiple trackers are listed
64 
+			$found_tracker = false;
65 
+			for ($i = 0; $i < count($array["announce-list"]); $i++) {
66 
+				if (strtolower($array["announce-list"][$i][0]) == $tracker_url) {
67 
+					$found_tracker = true;
68 
+					break;
69 
+				}
70 
+			}
71 
+			if ($found_tracker == false)
72 
+			{
73 
+				echo errorMessage() . "Error: Multiple trackers were found but none of them match the
74 
+					announce URL:<br>$tracker_url<br>Please re-create and re-upload the torrent.</p>\n";
75 
+				endOutput();
76 
+				exit;
77 
+			}
78 
+		} else {
79 
+			//a single tracker is listed
80 
+			if (strtolower($array["announce"]) != $tracker_url) {
81 
+				echo errorMessage() . "Error: The tracker announce URL does not match this:<br>$tracker_url<br>Please re-create and re-upload the torrent.</p>\n";
82 
+				endOutput();
83 
+				exit;
84 
+			}
85 
+		}
86 
+
87 
+		if (isset($_POST["httpseed"]) && $_POST["httpseed"] == "enabled" && $_POST["relative_path"] == "")
88 
+		{
89 
+			echo errorMessage() . "Error: HTTP seeding was checked however no relative path was given.</p>\n";
90 
+			endOutput();
91 
+			exit;
92 
+		}
93 
+		if (isset($_POST["httpseed"]) && $_POST["httpseed"] == "enabled" && $_POST["relative_path"] != "")
94 
+		{
95 
+			if (Substr($_POST["relative_path"], -1) == "/")
96 
+			{
97 
+				if (!is_dir($_POST["relative_path"]))
98 
+				{
99 
+					echo errorMessage() . "Error: HTTP seeding relative path ends in / but is not a valid directory.</p>\n";
100 
+					endOutput();
101 
+					exit;
102 
+				}
103 
+			}
104 
+			else
105 
+			{
106 
+				if (!is_file($_POST["relative_path"]))
107 
+				{
108 
+					echo errorMessage() . "Error: HTTP seeding relative path is not a valid file.</p>\n";
109 
+					endOutput();
110 
+					exit;
111 
+				}
112 
+			}
113 
+		}
114 
+		if (isset($_POST["getrightseed"]) && $_POST["getrightseed"] == "enabled" && $_POST["httpftplocation"] == "")
115 
+		{
116 
+			echo errorMessage() . "Error: GetRight HTTP seeding was checked however no URL was given.</p>\n";
117 
+			endOutput();
118 
+			exit;
119 
+		}
120 
+		if (isset($_POST["getrightseed"]) && $_POST["getrightseed"] == "enabled" &&
121 
+			(Substr($_POST["httpftplocation"], 0, 7) != "http://" && Substr($_POST["httpftplocation"], 0, 6) != "ftp://")
122 
+		)
123 
+		{
124 
+			echo errorMessage() . "Error: GetRight HTTP seeding URL must start with http:// or ftp://</p>\n";
125 
+			endOutput();
126 
+			exit;
127 
+		}
128 
+		$hash = @sha1(BEncode($array["info"]));
129 
+		fclose($fd);
130 
+
131 
+		$target_path = "torrents/";
132 
+		$target_path = $target_path . basename( clean($_FILES['torrent']['name']));
133 
+		$move_torrent = move_uploaded_file($_FILES["torrent"]["tmp_name"], $target_path);
134 
+		if ($move_torrent == false)
135 
+		{
136 
+			echo errorMessage() . "Unable to move " . $_FILES["torrent"]["tmp_name"] . " to torrents/</p>\n";
137 
+		}
138 
+	}
139 
+
140 
+
141 
+	if (isset($_POST["title"]))
142 
+		$title = clean($_POST["title"]);
143 
+	else
144 
+		$title = "";
145 
+
146 
+	if (isset($_POST["filename"]))
147 
+		$filename = clean($_POST["filename"]);
148 
+	else
149 
+		$filename = "";
150 
+
151 
+	if (isset($_POST["url"]))
152 
+		$url = clean($_POST["url"]);
153 
+	else
154 
+		$url = "";
155 
+
156 
+	if (isset($_POST["autoset"]))
157 
+	if (strcmp($_POST["autoset"], "enabled") == 0)
158 
+	{
159 
+		if (strlen($filename) == 0 && isset($array["info"]["name"]))
160 
+			$filename = $array["info"]["name"];
161 
+	}
162 
+
163 
+
164 
+	//figure out total size of all files in torrent
165 
+	$info = $array["info"];
166 
+	$total_size = 0;
167 
+	if (isset($info["files"]))
168 
+	{
169 
+		foreach ($info["files"] as $file)
170 
+		{
171 
+			$total_size = $total_size + $file["length"];
172 
+		}
173 
+	}
174 
+	else
175 
+	{
176 
+		$total_size = $info["length"];
177 
+	}
178 
+
179 
+	//Validate torrent file, make sure everything is correct
180 
+
181 
+	$filename = mysql_real_escape_string($filename);
182 
+	$filename = stripslashes($filename);
183 
+	$filename = htmlspecialchars(clean($filename));
184 
+	$url = htmlspecialchars(mysql_real_escape_string($url));
185 
+
186 
+	if ((strlen($hash) != 40) || !verifyHash($hash))
187 
+	{
188 
+		echo errorMessage() . "Error: Info hash must be exactly 40 hex bytes.</p>\n";
189 
+		endOutput();
190 
+	}
191 
+
192 
+	if (Substr($url, 0, 7) != "http://" && $url != "")
193 
+	{
194 
+		echo errorMessage() . "Error: The Torrent URL does not start with http:// Make sure you entered a correct URL.</p>\n";
195 
+		endOutput();
196 
+	}
197 
+
198 
+	if ($GLOBALS["customtitle"] == "true")
199 
+	$query = "INSERT INTO ".$prefix."namemap (info_hash, title, filename, url, size, pubDate) VALUES (\"$hash\", \"$title\", \"$filename\", \"$url\", \"$total_size\", \"" . date("$dateformat") . "\")";
200 
+	else $query = "INSERT INTO ".$prefix."namemap (info_hash, title, filename, url, size, pubDate) VALUES (\"$hash\", \"$filename\", \"$filename\", \"$url\", \"$total_size\", \"" . date("$dateformat") . "\")";
201 
+	$status = makeTorrent($hash, true);
202 
+	quickQuery($query);
203 
+	if ($status)
204 
+	{
205 
+		echo "<p class=\"success\">Torrent was added successfully.</p>\n";
206 
+		echo "<a href=\"newtorrents.php\"><img src=\"images/add.png\" border=\"0\" class=\"icon\" alt=\"Add Torrent\" title=\"Add Torrent\" /></a><a href=\"newtorrents.php\">Add Another Torrent</a><br>\n";
207 
+		//rename torrent file to match filename
208 
+		rename("torrents/" . clean($_FILES['torrent']['name']), "torrents/" . $filename . ".torrent");
209 
+		//make torrent file readable by all
210 
+		chmod("torrents/" . $filename . ".torrent", 0644);
211 
+
212 
+		//run RSS generator
213 
+		require_once("rss_generator.php");
214 
+		//Display information from DumpTorrentCGI.php
215 
+		require_once("torrent_functions.php");
216 
+	}
217 
+	else
218 
+	{
219 
+		echo errorMessage() . "There were some errors. Check if this torrent has been added previously.</p>\n";
220 
+		//delete torrent file if it doesn't exist in database
221 
+		$query = "SELECT COUNT(*) FROM ".$prefix."summary WHERE info_hash = '$hash'";
222 
+		$results = mysql_query($query) or die(errorMessage() . "Can't do SQL query - " . mysql_error() . "</p>");
223 
+		$data = mysql_fetch_row($results);
224 
+		if ($data[0] == 0)
225 
+		{
226 
+			if (file_exists("torrents/" . $_FILES['torrent']['name']))
227 
+				unlink("torrents/" . $_FILES['torrent']['name']);
228 
+		}
229 
+		//make torrent file readable by all
230 
+		chmod("torrents/" . $filename . ".torrent", 0644);
231 
+		endOutput();
232 
+	}
233 
+}
234 
+
235 
+function endOutput()
236 
+{
237 
+	require ("config.php");
238 
+	$tracker_url = $website_url . substr($_SERVER['PHP_SELF'], 0, -15) . $announceurl;
239 
+	?>
240 
+	<p align="right"><a href="./docs/help.html"><img src="images/help.png" border="0" class="icon" alt="Help" title="Help" /></a><a href="./docs/help.html">Help</a></p>
241 
+	<div class="center">
242 
+	<h1>Add Torrent to Tracker Database</h1>
243 
+	<h3>Tracker URL: <?php echo $tracker_url;?></h3>
244 
+	<form enctype="multipart/form-data" method="post" action="<?php echo htmlentities($_SERVER['PHP_SELF']); ?>">
245 
+	<table>
246 
+	<tr>
247 
+		<?php
248 
+		if ($GLOBALS["customtitle"] == "true")
249 
+		echo "<td class=\"right\">Title:</td>
250 
+		<td class=\"left\"><input type=\"title\" name=\"title\" size=\"50\"/></td>";
251 
+		else ($GLOBALS["customtitle"] != "true");
252 
+		?>
253 
+	</tr>
254 
+	<tr>
255 
+		<td class="right">Torrent file:</td>
256 
+		<td class="left"><?php
257 
+		if (function_exists("sha1"))
258 
+			echo "<input type=\"file\" name=\"torrent\" size=\"50\"/>";
259 
+		else
260 
+			echo '<i>File uploading not available - no SHA1 function.</i>';
261 
+		?></td>
262 
+	</tr>
263 
+	<tr><td colspan="2"><hr></td></tr>
264 
+	<tr>
265 
+	<td class="center" colspan="2"><input type="checkbox" name="httpseed" value="enabled">Use BitTornado HTTP seeding specification (optional)</td>
266 
+	</tr>
267 
+	<tr>
268 
+	<td class="right">Relative location of file or directory:<br>e.g. ../../files/file.zip</td>
269 
+	<td class="left"><input type="text" name="relative_path" size="70"/></td>
270 
+	</tr>
271 
+	<tr><td colspan="2"><hr></td></tr>
272 
+	<tr>
273 
+	<td class="center" colspan="2"><input type="checkbox" name="getrightseed" value="enabled">Use GetRight HTTP seeding specification (optional)</td>
274 
+	</tr>
275 
+	<tr>
276 
+	<td class="right">FTP/HTTP URL of file or directory:<br>e.g. http://yourwebsite.com/file.zip</td>
277 
+	<td class="left"><input type="text" name="httpftplocation" size="70"/></td>
278 
+	</tr>
279 
+	<tr><td colspan="2"><hr></td></tr>
280 
+	<?php if (function_exists("sha1"))
281 
+		echo "<tr><td class=\"center\" colspan=\"2\"><input type=\"checkbox\" name=\"autoset\" value=\"enabled\" checked=\"checked\" /> Fill in fields below automatically using data from the torrent file.</td></tr>\n";
282 
+	?>
283 
+	<tr>
284 
+		<td class="right">Info Hash:</td>
285 
+		<td class="left"><input type="text" name="hash" size="40"/></td>
286 
+	</tr>
287 
+	<tr>
288 
+		<td class="right">File name (optional): </td>
289 
+		<td class="left"><input type="text" name="filename" size="60" maxlength="200"/></td>
290 
+	</tr>
291 
+	<tr>
292 
+		<td class="right">Torrent's URL (optional): </td>
293 
+		<td class="left"><input type="text" name="url" size="60" maxlength="200"/></td>
294 
+	</tr>
295 
+	<tr><td colspan="2"><hr></td></tr>
296 
+	<tr>
297 
+		<td class="center" colspan="2"><input type="submit" value="Add Torrent to Database"/> - <input type="reset" value="Clear Settings"/></td>
298 
+	</tr>
299 
+	</table>
300 
+	<br>
301 
+	<input type="hidden" name="username" value="<?php echo $_POST['username']; ?>"/>
302 
+	<input type="hidden" name="password" value="<?php echo $_POST['password']; ?>"/>
303 
+	</form>
304 
+	<a href="index.php"><img src="images/stats.png" border="0" class="icon" alt="Tracker Statistics" title="Tracker Statistics" /></a><a href="index.php">Return to Statistics Page</a><br>
305 
+	</div>
306 
+	</body></html>
307 
+	<?php
308 
+	// Still in function endOutput()
309 
+	exit;
310 
+}
311 
+?>
0 312 
\ No newline at end of file