tuttogare/public_html/allegati/servers/resumable.php

<?
$configPath = substr(__DIR__, 0, strpos(__DIR__, "/public_html")) . "/config.php";
include_once($configPath);
if (isset($_SESSION["utente"]) && (!empty($_GET["checksum"]) && !empty($_GET["uploaderId"]))) {
	function rrmdir($dir)
	{
		if (is_dir($dir)) {
			$objects = scandir($dir);
			foreach ($objects as $object) {
				if ($object != "." && $object != "..") {
					if (filetype($dir . "/" . $object) == "dir") {
						rrmdir($dir . "/" . $object);
					} else {
						unlink($dir . "/" . $object);
					}
				}
			}
			reset($objects);
			rmdir($dir);
		}
	}

	/**
	 *
	 * Check if all the parts exist, and
	 * gather all the parts of the file together
	 * @param string $dir - the temporary directory holding all the parts of the file
	 * @param string $fileName - the original file name
	 * @param string $chunkSize - each chunk size (in bytes)
	 * @param string $totalSize - original file size (in bytes)
	 */
	function createFileFromChunks($temp_dir, $fileName, $chunkSize, $totalSize, $checksum)
	{
		$return = false;
		if (!empty($checksum)) {
			// count all the parts of this file
			$total_files = 0;
			foreach (scandir($temp_dir) as $file) {
				if (stripos($file, $fileName) !== false) {
					$total_files++;
				}
			}

			// check that all the parts are present
			// the size of the last part is between chunkSize and 2*$chunkSize
			if ($total_files * $chunkSize >=  ($totalSize - $chunkSize + 1)) {
				$folder = filesManager::tempDirUploadPath();
				if (($fp = fopen($folder . "/" . $fileName, 'w')) !== false) {
					for ($i = 1; $i <= $total_files; $i++) {
						if (file_exists($temp_dir . "/" . $fileName . '.part' . $i)) {
							fwrite($fp, file_get_contents($temp_dir . "/" . $fileName . '.part' . $i));
						}
					}
					fclose($fp);
					if (hash_file("sha256",$folder . "/" . $fileName) === $checksum) {
						$return = true;
					} 
				}
			
				// rename the temporary directory (to avoid access from other
				// concurrent chunks uploads) and than delete it
				if (rename($temp_dir, $temp_dir . '_UNUSED')) {
					rrmdir($temp_dir . '_UNUSED');
					
				} else {
					rrmdir($temp_dir);
				}
			} else {
				$return = true;
			}
		}
		return $return;
	}

	function checkFileName($name)
	{
		$return = false;
		$ext = explode(".", $name);
		$ext = end($ext);
		if (strpos($name, "..") === false) {
			$ext = ".".strtolower($ext);
			$permitted = filesManager::acceptedFilesExtensions();
			if (in_array($ext, $permitted) !== false) {
				$return = true;
			}
		}
		return $return;
	}
	////////////////////////////////////////////////////////////////////
	// THE SCRIPT
	////////////////////////////////////////////////////////////////////

	$folder = filesManager::tempDirUploadPath();
	$folder .= "/" . sanitize_string($_GET["uploaderId"]);
	//check if request is GET and the requested chunk exists or not. this makes testChunks work
	if ($_SERVER['REQUEST_METHOD'] === 'GET') {
		$_GET['resumableFilename'] = sanitize_string($_GET['resumableFilename']);
		if (isset($_GET['resumableFilename']) && checkFileName($_GET['resumableFilename'])) {
			$temp_dir = $folder . '/' . $_GET['resumableIdentifier'];
			$chunk_file = $temp_dir . '/' . $_GET['resumableFilename'] . '.part' . $_GET['resumableChunkNumber'];
			if (file_exists($chunk_file)) {
				header("HTTP/1.0 200 Ok");
			} else {
				header("HTTP/1.0 404 Not Found");
			}
		} else {
			header("HTTP/1.0 500 Server error");
			die();
		}
	} else {
		// loop through files and move the chunks to a temporarily created directory
		if (!empty($_FILES)) {
			foreach ($_FILES as $file) {
				// init the destination file (format <filename.ext>.part<#chunk>
				// the file is stored in a temporary directory
				$_POST['resumableFilename'] = sanitize_string(html_entity_decode($_POST['resumableFilename']));
				if (checkFileName($_POST['resumableFilename'])) {
					$temp_dir = $folder . '/' . $_POST['resumableIdentifier'];
					$dest_file = $temp_dir . '/' . $_POST['resumableFilename'] . '.part' . $_POST['resumableChunkNumber'];
					// create the temporary directory
					if (!is_dir($temp_dir)) {
						mkdir($temp_dir, 0777, true);
					}
					if (!empty($file['tmp_name'])) {
						// move the temporary file
						if (move_uploaded_file($file['tmp_name'], $dest_file)) {
							// check if all the parts present, and create the final destination file
							if (!createFileFromChunks($temp_dir, $_POST['resumableFilename'], $_POST['resumableChunkSize'], $_POST['resumableTotalSize'], $_POST["checksum"] ?? $_GET["checksum"])) {
								header("HTTP/1.0 400 Bad Request");
								die();
							}
						} else {
							header("HTTP/1.0 418 I'm a teapot");
							die();
						}
					} else {
						header("HTTP/1.0 400 Bad Request");
						die();
					}
				} else {
					header("HTTP/1.0 500 Server error");
					die();
				}
			}
		} else {
			header("HTTP/1.0 400 Bad Request");
			die();
		}
	}
} else {
	header("HTTP/1.0 500 Server error");
	die();
}