Refs #6 image upload

api.php

@@ -41,16 +41,38 @@ if (isset($_GET["command"])) {
     case "ping":
         require_once("./.htconfig.php");
         require_once("inc/servers.php");
+
         if (!isset($_GET["key"]) || $_GET["key"] !== API_KEY) {
             $state = getServersState();
             if (!$state) {
-                header("HTTP/0.0 500 Internal Server Error");
+                header("HTTP/1.0 500 Internal Server Error");
                 die;
             }
             echo json_encode($state);
             die;
         }
-        require_once("./inc/servers.php");
+        // Clean uploaded files
+        $dirname = getcwd() ."/uploads/";
+        $dir = opendir($dirname);
+        $now = time();
+        if ($dir !== FALSE) {
+            while ($entry = readdir($dir)) {
+                if (is_dir($dirname.$entry))
+                    continue;
+                $stats = stat($dirname.$entry);
+                if ($stats === FALSE) {
+                    error_log("Cannot stat uploaded file " .$dirname.$entry);
+                    continue;
+                }
+                if (($now -$stats["mtime"]) / 60 > 5)
+                    unlink($dirname.$entry);
+            }
+            closedir($dir);
+        } else {
+            error_log("Cannot open upload dir for cleaning");
+        }
+
+        // Ping servers
         $result = [];
         foreach (getServers() as $i => $attrs) {
             $success = false;
@@ -67,6 +89,35 @@ if (isset($_GET["command"])) {
             "date" => time()
         );
         writeServersState($result);
+        break;
+
+    case "file":
+        require_once(".htconfig.php");
+
+        if (!isset($_GET["from"]) || strlen($_GET["from"]) == 0 || !isset($_FILES["file"])) {
+            header("HTTP/1.0 400 Bad Request");
+            die("Bad Request");
+        }
+        $extensionLocal = strrpos($_FILES["file"]["name"], '.');
+        $extension = strtolower(substr($_FILES["file"]["name"], $extensionLocal === FALSE ? 0 : $extensionLocal));
+        if (strpos($_FILES["file"]["type"], "image/") !== 0 || !in_array($extension, array(
+                ".png", ".jpg", ".jpeg", ".ico"))) {
+            header("HTTP/1.0 400 Bad Request");
+            die("Unrecognized file type");
+        }
+        if ($_FILES["file"]["size"] > MAX_ALLOWED_UPLOAD_SIZE) {
+            header("HTTP/1.0 400 Bad Request");
+            die("File is too large");
+        }
+        $filename = md5($_GET["from"].time()) .$extension;
+        if (move_uploaded_file($_FILES["file"]["tmp_name"], getcwd()."/uploads/".$filename) === FALSE) {
+            header("HTTP/1.0 500 Internal Server Error");
+            die("Internal Server Error");
+        }
+        // Log info
+        error_log($_GET["from"] ." uploaded file " .$filename ." " .print_r($_FILES["file"], true) ." from " .$_SERVER["REMOTE_ADDR"]);
+        echo "/uploads/" .$filename;
+        break;
     }
 }