CW Cyrix's Git Repository Mirror
Browse code

Fixed filtering with newtorrents.php dltorrent.php authentication behavior slightly changed batch_upload.php reverted

Clarissa Walker authored on 2015/09/14 08:55:30
Showing 1 changed files
dltorrent.php
History View file @ b9a33fe
... ... 
@@ -7,7 +7,7 @@ session_start();
7 7 
 if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
8 8 
 {
9 9 
 	//check fails
10 
-	header("Location: authenticate.php?status=session");
10 
+	header("Location: authenticate.php?status=error");
11 11 
 	exit();
12 12 
 }
13 13
Browse code

End of reviewing filtering practices. Final change to this file as of: http://www.osvdb.org/79805

Clarissa Walker authored on 2015/09/14 07:39:24
Showing 1 changed files
dltorrent.php
History View file @ 7b17afc
... ... 
@@ -27,7 +27,7 @@ if ($GLOBALS["persist"])
27 27 
 else
28 28 
 	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Tracker error: can't connect to database - " . mysql_error() . "</p>");
29 29 
 mysql_select_db($database) or die(errorMessage() . "Tracker error: can't open database $database - " . mysql_error() . "</p>");
30 
-$query = "SELECT filename FROM ".$prefix."namemap WHERE info_hash = '" . $_GET['hash'] . "'";
30 
+$query = "SELECT filename FROM ".$prefix."namemap WHERE info_hash = '" . htmlentities($_GET['hash'], ENT_QUOTES, UTF-8) . "'";
31 31 
 $results = mysql_query($query) or die(errorMessage() . "Can't do SQL query - " . mysql_error() . "</p>");
32 32 
 $row = mysql_fetch_row($results);
33 33
Browse code

Start of reviewing filtering practices. Also fixed hash filtering in dltorrent as referenced here: http://www.osvdb.org/79805

Clarissa Walker authored on 2015/09/14 04:19:18
Showing 1 changed files
dltorrent.php
History View file @ f9be7aa
... ... 
@@ -13,7 +13,7 @@ if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
13 13
14 14
15 15 
 //if hash isn't of length 40, don't even bother connecting to database
16 
-if (strlen($_GET['hash']) != 40)
16 
+if (strlen(htmlentities($_GET['hash'], ENT_QUOTES, UTF-8)) != 40)
17 17 
 {
18 18 
 	header("index.php");
19 19 
   	exit();
Browse code

Checks added to some files: torrent_functions.php, tracker.php dltorrent.php's check changed to authenticate no matter what Some fixes and modifications from 2014: index.php, funcsv2.php, batch_upload.php, newtorrents.php, install.php, editconfig.php Version bumped up to 1.05

Clarissa Walker authored on 2015/08/30 00:06:28
Showing 1 changed files
dltorrent.php
History View file @ e0861e2
... ... 
@@ -2,21 +2,12 @@
2 2
3 3 
 require_once ("config.php");
4 4
5 
-//Check session only if hiddentracker is TRUE
6 
-if ($hiddentracker == true)
7 
-{
8 
-	session_start();
9 
-
10 
-	if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
11 
-	{
12 
-		//check fails
13 
-		header("Location: authenticate.php?status=error");
14 
-		exit();
15 
-	}
16 
-}
17 
-else
5 
+session_start();
6 
+
7 
+if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
18 8 
 {
19 
-	//don't run
9 
+	//check fails
10 
+	header("Location: authenticate.php?status=session");
20 11 
 	exit();
21 12 
 }
22 13
Browse code

Import from the old rivettracker git repository at sourceforge (amisaph/amisapphire branch)

Clarissa Walker (ami-sapphire) authored on 2014/01/24 14:02:23
Showing 1 changed files
dltorrent.php
History View file @ 1c8ad06
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,77 @@
1 
+<?php
2 
+
3 
+require_once ("config.php");
4 
+
5 
+//Check session only if hiddentracker is TRUE
6 
+if ($hiddentracker == true)
7 
+{
8 
+	session_start();
9 
+
10 
+	if (!$_SESSION['admin_logged_in'] && !$_SESSION['upload_logged_in'])
11 
+	{
12 
+		//check fails
13 
+		header("Location: authenticate.php?status=error");
14 
+		exit();
15 
+	}
16 
+}
17 
+else
18 
+{
19 
+	//don't run
20 
+	exit();
21 
+}
22 
+
23 
+
24 
+//if hash isn't of length 40, don't even bother connecting to database
25 
+if (strlen($_GET['hash']) != 40)
26 
+{
27 
+	header("index.php");
28 
+  	exit();
29 
+}
30 
+
31 
+require_once ("funcsv2.php"); //required for errorMessage()
32 
+
33 
+//connect to database and turn hash value into a filename
34 
+if ($GLOBALS["persist"])
35 
+	$db = mysql_pconnect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Tracker error: can't connect to database - " . mysql_error() . "</p>");
36 
+else
37 
+	$db = mysql_connect($dbhost, $dbuser, $dbpass) or die(errorMessage() . "Tracker error: can't connect to database - " . mysql_error() . "</p>");
38 
+mysql_select_db($database) or die(errorMessage() . "Tracker error: can't open database $database - " . mysql_error() . "</p>");
39 
+$query = "SELECT filename FROM ".$prefix."namemap WHERE info_hash = '" . $_GET['hash'] . "'";
40 
+$results = mysql_query($query) or die(errorMessage() . "Can't do SQL query - " . mysql_error() . "</p>");
41 
+$row = mysql_fetch_row($results);
42 
+
43 
+if ($row[0] == null)
44 
+{
45 
+	//hash doesn't exist in database, error out
46 
+	header("Location: index.php");
47 
+  	exit();
48 
+}
49 
+else
50 
+	$filename = $row[0];
51 
+
52 
+if (!file_exists("./torrents/" . $filename . ".torrent"))
53 
+{
54 
+  	header("Location: index.php");
55 
+  	exit();
56 
+}
57 
+
58 
+//you have be referred from the main website URL then you can download
59 
+if (strpos($_SERVER['HTTP_REFERER'], $website_url . "/") === 0 && strpos($_SERVER['HTTP_REFERER'], "http") === 0)
60 
+{
61 
+  	$stat = stat("./torrents/" . $filename . ".torrent");
62 
+  	header("Content-Type: application/x-bittorrent");
63 
+  	header("Content-Length: " . $stat[7]);
64 
+  	header("Last-Modified: " . gmdate("D, d M Y H:i:s", $stat[9]) . " GMT");
65 
+  	header("Content-Disposition: attachment; filename=\"" . $filename . ".torrent\"");
66 
+  	readfile("./torrents/" . $filename . ".torrent");
67 
+  	exit();
68 
+}
69 
+else
70 
+{
71 
+	header("Location: index.php");
72 
+	exit();
73 
+}
74 
+
75 
+header('Pragma: no-cache');
76 
+header('Cache-Control: no-cache, no-store, must-revalidate');
77 
+?>
0 78 
\ No newline at end of file