- plugins can have full control over the path/url of the element/image/

thumbnail/high (it is possible now to have secure images, on the fly 
watermarking, mod download and media integrator plugins working together in 
any combination and without touching PWG core)

git-svn-id: http://piwigo.org/svn/trunk@1612 68402e56-0260-453c-a942-63ccdbb3a9ee

1 files changed, 109 insertions, 51 deletions

diff --git a/action.php b/action.php
index 7e853ed44..6b21b0fa1 100644
--- a/action.php
+++ b/action.php
@@ -31,69 +31,127 @@ include_once(PHPWG_ROOT_PATH.'include/common.inc.php');
 // Check Access and exit when user status is not ok
 check_status(ACCESS_GUEST);
 
-function force_download ($filename)
+function guess_mime_type($ext)
 {
-//TODO : messages in "lang"
-  if (!url_is_remote($filename))
+  switch ( strtolower($ext) )
   {
-    $filename = realpath($filename);
-    if (!file_exists($filename))
-    {
-      die("NO FILE HERE");
-    }
-    $file_size = @filesize($filename);
-  }
-  else
-  {
-    $file_size = 0;
+    case "jpe": case "jpeg":
+    case "jpg": $ctype="image/jpeg"; break;
+    case "png": $ctype="image/png"; break;
+    case "gif": $ctype="image/gif"; break;
+    case "tiff":
+    case "tif": $ctype="image/tiff"; break;
+    case "txt": $ctype="text/plain"; break;
+    case "html":
+    case "htm": $ctype="text/html"; break;
+    case "xml": $ctype="text/xml"; break;
+    case "pdf": $ctype="application/pdf"; break;
+    case "zip": $ctype="application/zip"; break;
+    case "ogg": $ctype="application/ogg"; break;
+    default: $ctype="application/octet-stream";
   }
+  return $ctype;
+}
 
-  $file_extension = strtolower(substr(strrchr($filename,"."),1));
-
-  switch ($file_extension) {
-      case "jpe": case "jpeg":
-      case "jpg": $ctype="image/jpg"; break;
-      case "png": $ctype="image/png"; break;
-      case "gif": $ctype="image/gif"; break;
-      case "pdf": $ctype="application/pdf"; break;
-      case "zip": $ctype="application/zip"; break;
-      case "php": 
-        // never allow download of php scripts to protect our conf files
-        die('Hacking attempt!'); break;
-      default: $ctype="application/octet-stream";
-  }
+function do_error( $code, $str )
+{
+  header("HTTP/1.1 $code ");
+  header("Status: $code ");
+  echo $str ;
+  exit();
+}
+
+
+if ( !isset($_GET['id']) or !is_numeric($_GET['id'])
+    or !isset($_GET['part'])
+    or !in_array($_GET['part'], array('t','e','i','h') ) )
+{
+  do_error(400, 'Invalid request - id/part');
+}
+
+$id = $_GET['id'];
+$query = '
+SELECT * FROM '. IMAGES_TABLE.'
+  WHERE id='.$id.'
+;';
+
+$result = pwg_query($query);
+$element_info = mysql_fetch_assoc($result);
+if ( empty($element_info) )
+{
+  do_error(404, 'Requested id not found');
+}
+
+// TODO - check permissions
+
+include_once(PHPWG_ROOT_PATH.'include/functions_picture.inc.php');
+$file='';
+switch ($_GET['part'])
+{
+  case 't':
+    $file = get_thumbnail_path($element_info);
+    break;
+  case 'e':
+    $file = get_element_path($element_info);
+    break;
+  case 'i':
+    $file = get_image_path($element_info);
+    break;
+  case 'h':
+    $file = get_high_path($element_info);
+    break;
+}
+
+if ( empty($file) )
+{
+  do_error(404, 'Requested file not found');
+}
+
+$http_headers = array();
 
-  header("Pragma: public");
-  header("Expires: 0");
-  header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
-  header("Cache-Control: private",false);
-  header("Content-Type: $ctype");
-  header("Content-Disposition: attachment; filename=\""
-         .basename($filename)."\";");
-  header("Content-Transfer-Encoding: binary");
-  if (isset($file_size) and ($file_size != 0))
+$ctype = null;
+if (!url_is_remote($file))
+{
+  if ( !@is_readable($file) )
   {
-    header("Content-Length: ".@filesize($filename));
+    do_error(404, "Requested file not found - $file");
   }
-
-  // Looking at the safe_mode configuration for execution time
-  if (ini_get('safe_mode') == 0)
+  $http_headers[] = 'Content-Length: '.@filesize($file);
+  if ( function_exists('mime_content_type') )
   {
-    @set_time_limit(0);
+    $ctype = mime_content_type($file);
   }
+}
+if (!isset($ctype))
+{ // give it a guess
+  $ctype = guess_mime_type( get_extension($file) );
+}
 
-  @readfile("$filename") or die("File not found.");
+$http_headers[] = 'Content-Type: '.$ctype;
+
+if (!isset($_GET['view']))
+{
+  $http_headers[] = 'Content-Disposition: attachment; filename="'
+            .basename($file).'";';
+  $http_headers[] = 'Content-Transfer-Encoding: binary';
 }
+$http_headers[] = 'Pragma: public';
+$http_headers[] = 'Expires: 0';
+$http_headers[] = 'Cache-Control: must-revalidate, post-check=0, pre-check=0';
 
-//--------------------------------------------------------- download big picture
-if ( isset( $_GET['dwn'] ) )
+
+foreach ($http_headers as $header)
 {
-//TODO : verify the path begins with something in galleries_url and that user has access rights to the picture
-// in order to avoid hacking atempts by forged url
-  if (preg_match('/\.\./',$_GET['dwn'])) {
-    die('Hacking attempt!');
-  }
-  force_download($_GET['dwn']);
+  header( $header );
 }
+header("Cache-Control: private",false); //???
+
+// Looking at the safe_mode configuration for execution time
+if (ini_get('safe_mode') == 0)
+{
+  @set_time_limit(0);
+}
+
+@readfile($file);
 
-?>
+?>
\ No newline at end of file