From cdc0ba4549f2652f6b35abdb71dc33f6f0cb2182 Mon Sep 17 00:00:00 2001 From: Matt Brooks Date: Thu, 19 Jan 2023 13:17:38 -0500 Subject: [PATCH 01/13] Move index functions into include file. --- includes/index_functions.php | 27 +++++++++++++++++++++++++++ index.php | 26 ++------------------------ 2 files changed, 29 insertions(+), 24 deletions(-) create mode 100644 includes/index_functions.php diff --git a/includes/index_functions.php b/includes/index_functions.php new file mode 100644 index 0000000..47b2bd6 --- /dev/null +++ b/includes/index_functions.php @@ -0,0 +1,27 @@ +', $_SESSION['output']); + } + + $_SESSION['output'] = []; +} + + +// Prints link to current report. +function print_report_link() { + if(isset($_SESSION['reportPath']) && $_SESSION['reportPath']) { + echo 'Download Report'; + } + + unset($_SESSION['reportPath']); +} + + +// Sets the CSRF token in session. +function set_csrf_token() { + if(!isset($_SESSION['csrfToken'])) { + $_SESSION['csrfToken'] = bin2hex(random_bytes(32)); + } +} diff --git a/index.php b/index.php index d7c612b..878cd8f 100644 --- a/index.php +++ b/index.php @@ -1,31 +1,9 @@ ', $_SESSION['output']); - } - - $_SESSION['output'] = []; -} - - -// Prints link to current report. -function print_report_link() { - if(isset($_SESSION['reportPath']) && $_SESSION['reportPath']) { - echo 'Download Report'; - } - - unset($_SESSION['reportPath']); -} - - -if(!isset($_SESSION['csrfToken'])) { - $_SESSION['csrfToken'] = bin2hex(random_bytes(32)); -} +set_csrf_token(); ?> From fff21ba68e61035d3c511a99302af4d518252eb5 Mon Sep 17 00:00:00 2001 From: Matt Brooks Date: Mon, 23 Jan 2023 16:48:20 -0500 Subject: [PATCH 02/13] Function move in progress. --- includes/functions.php | 1 + includes/submit_functions.php | 78 +++++++++++++++++++++++++++++++++++ submit.php | 77 +++------------------------------- 3 files changed, 85 insertions(+), 71 deletions(-) create mode 100644 includes/submit_functions.php diff --git a/includes/functions.php b/includes/functions.php index 726473c..473fc57 100644 --- a/includes/functions.php +++ b/includes/functions.php @@ -1,5 +1,6 @@ 0) { + // Sort by last modified ascending. + usort($files, function($x, $y) { + return filemtime($x) > filemtime($y); + }); + + for($i = 0; $i < $extraFiles; $i++) { + unlink($files[$i]); + } + } +} + + +// Returns a valid file name. +function find_file_name($fileName) { + if(!file_exists($fileName)) { + return $fileName; + } + + $fileParts = pathinfo($fileName); + $fileCount = count(glob($fileParts['dirname'] . DIRECTORY_SEPARATOR . "*")); + + for($i = 1; $i <= $fileCount; $i++) { + $tempName = $fileParts['dirname'] . DIRECTORY_SEPARATOR . $fileParts['filename'] . " ($i)." . $fileParts['extension']; + + if(!file_exists($tempName)) { + return $tempName; + } + } + + return null; +} + + +// Check for PHP cURL. +// TODO: Add more checks here (file write, etc.) +function check_capabilities() { + if(!function_exists('curl_init')) { + array_push($_SESSION['output'], 'Please install/enable the PHP cURL library.'); + go_home(); + } +} + + +// Validate CSRF token. +function validate_csrf_token() { + if(!DEBUG) { + if(!isset($_POST['csrfToken']) || !isset($_SESSION['csrfToken'])) { + array_push($_SESSION['output'], 'CSRF token not found.'); + go_home(); + } + else { + if($_POST['csrfToken'] !== $_SESSION['csrfToken']) { + array_push($_SESSION['output'], 'The CSRF token is invalid.'); + go_home(); + } + else { + unset($_SESSION['csrfToken']); + } + } + } +} diff --git a/submit.php b/submit.php index 7380cbe..3980626 100644 --- a/submit.php +++ b/submit.php @@ -1,84 +1,17 @@ 0) { - // Sort by last modified ascending. - usort($files, function($x, $y) { - return filemtime($x) > filemtime($y); - }); - - for($i = 0; $i < $extraFiles; $i++) { - unlink($files[$i]); - } - } -} - - -// Returns a valid file name. -function find_file_name($fileName) { - if(!file_exists($fileName)) { - return $fileName; - } - - $fileParts = pathinfo($fileName); - $fileCount = count(glob($fileParts['dirname'] . DIRECTORY_SEPARATOR . "*")); - - for($i = 1; $i <= $fileCount; $i++) { - $tempName = $fileParts['dirname'] . DIRECTORY_SEPARATOR . $fileParts['filename'] . " ($i)." . $fileParts['extension']; - - if(!file_exists($tempName)) { - return $tempName; - } - } - - return null; -} - - -// Check CSRF token. -if(!DEBUG) { - if(!isset($_POST['csrfToken']) || !isset($_SESSION['csrfToken'])) { - array_push($_SESSION['output'], 'CSRF token not found.'); - go_home(); - } - else { - if($_POST['csrfToken'] !== $_SESSION['csrfToken']) { - array_push($_SESSION['output'], 'The CSRF token is invalid.'); - go_home(); - } - else { - unset($_SESSION['csrfToken']); - } - } -} +check_capabilities(); +validate_csrf_token(); -// Check for PHP cURL. -if(!function_exists('curl_init')) { - array_push($_SESSION['output'], 'Please install/enable the PHP cURL library.'); - go_home(); -} // Check upload and move it to folder. if($uploadFileName = $_FILES['fileUpload']['name'] ?? null) { @@ -92,6 +25,7 @@ function find_file_name($fileName) { go_home(); } + //TODO: remove? echo '
'.print_r($_FILES['fileUpload'], true).'
'; move_uploaded_file($_FILES['fileUpload']['tmp_name'], $uploadFullFilePath); @@ -161,6 +95,7 @@ function find_file_name($fileName) { $ch = curl_init(); curl_setopt_array($ch, [ + CURLOPT_SSL_VERIFYPEER => false, // for dev only CURLOPT_URL => CONFIG['url'], CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, From 385695225cd252aab01b6d58519b64c8207de3c6 Mon Sep 17 00:00:00 2001 From: Matt Brooks Date: Mon, 23 Jan 2023 16:49:12 -0500 Subject: [PATCH 03/13] Add todo. --- submit.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/submit.php b/submit.php index 3980626..a3f6f8d 100644 --- a/submit.php +++ b/submit.php @@ -95,7 +95,7 @@ $ch = curl_init(); curl_setopt_array($ch, [ - CURLOPT_SSL_VERIFYPEER => false, // for dev only + CURLOPT_SSL_VERIFYPEER => false, //TODO: for dev only CURLOPT_URL => CONFIG['url'], CURLOPT_POST => true, CURLOPT_RETURNTRANSFER => true, From 28b776932dae64811f519e6bdc8101e3ad8c30cc Mon Sep 17 00:00:00 2001 From: Matt Brooks Date: Tue, 24 Jan 2023 09:27:07 -0500 Subject: [PATCH 04/13] Update comments to docblock. --- includes/functions.php | 38 ++++++++++++++++++++++++++++------ includes/index_functions.php | 18 +++++++++++++--- includes/submit_functions.php | 39 +++++++++++++++++++++++++++++------ 3 files changed, 80 insertions(+), 15 deletions(-) diff --git a/includes/functions.php b/includes/functions.php index 473fc57..737d464 100644 --- a/includes/functions.php +++ b/includes/functions.php @@ -1,19 +1,36 @@ @@ -90,7 +112,11 @@ function print_header($currentPage) { } -// Prints the footer. +/** + * Prints the footer. + * + * @return void + */ function print_footer() { echo '