[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3   * MyBB 1.8
   4   * Copyright 2014 MyBB Group, All Rights Reserved
   5   *
   6   * Website: http://www.mybb.com
   7   * License: http://www.mybb.com/about/license
   8   *
   9   */
  10  
  11  define("IN_MYBB", 1);
  12  define('THIS_SCRIPT', 'attachment.php');
  13  
  14  require_once  "./global.php";
  15  
  16  if($mybb->settings['enableattachments'] != 1)
  17  {
  18      error($lang->attachments_disabled);
  19  }
  20  
  21  // Find the AID we're looking for
  22  if(isset($mybb->input['thumbnail']))
  23  {
  24      $aid = $mybb->get_input('thumbnail', MyBB::INPUT_INT);
  25  }
  26  else
  27  {
  28      $aid = $mybb->get_input('aid', MyBB::INPUT_INT);
  29  }
  30  
  31  $pid = $mybb->get_input('pid', MyBB::INPUT_INT);
  32  
  33  // Select attachment data from database
  34  if($aid)
  35  {
  36      $query = $db->simple_select("attachments", "*", "aid='{$aid}'");
  37  }
  38  else
  39  {
  40      $query = $db->simple_select("attachments", "*", "pid='{$pid}'");
  41  }
  42  $attachment = $db->fetch_array($query);
  43  
  44  $plugins->run_hooks("attachment_start");
  45  
  46  if(!$attachment)
  47  {
  48      error($lang->error_invalidattachment);
  49  }
  50  
  51  if($attachment['thumbnail'] == '' && isset($mybb->input['thumbnail']))
  52  {
  53      error($lang->error_invalidattachment);
  54  }
  55  
  56  $attachtypes = (array)$cache->read('attachtypes');
  57  $ext = get_extension($attachment['filename']);
  58  
  59  if(empty($attachtypes[$ext]))
  60  {
  61      error($lang->error_invalidattachment);
  62  }
  63  
  64  $attachtype = $attachtypes[$ext];
  65  
  66  $pid = $attachment['pid'];
  67  
  68  // Don't check the permissions on preview
  69  if($pid || $attachment['uid'] != $mybb->user['uid'])
  70  {
  71      $post = get_post($pid);
  72  
  73      if(!$post)
  74      {
  75          error($lang->error_invalidthread);
  76      }
  77  
  78      // Check permissions if the post is not a draft
  79      if($post['visible'] != -2)
  80      {
  81          $thread = get_thread($post['tid']);
  82  
  83          if(!$thread && !isset($mybb->input['thumbnail']))
  84          {
  85              error($lang->error_invalidthread);
  86          }
  87          $fid = $thread['fid'];
  88  
  89          // Get forum info
  90          $forum = get_forum($fid);
  91  
  92          // Permissions
  93          $forumpermissions = forum_permissions($fid);
  94  
  95          if($forumpermissions['canview'] == 0 || $forumpermissions['canviewthreads'] == 0 || (isset($forumpermissions['canonlyviewownthreads']) && $forumpermissions['canonlyviewownthreads'] != 0 && $thread['uid'] != $mybb->user['uid']) || ($forumpermissions['candlattachments'] == 0 && empty($mybb->input['thumbnail'])))
  96          {
  97              error_no_permission();
  98          }
  99  
 100          // Error if attachment is invalid or not visible
 101          if(!$attachment['attachname'] || (!is_moderator($fid, "canviewunapprove") && ($attachment['visible'] != 1 || $thread['visible'] != 1 || $post['visible'] != 1)))
 102          {
 103              error($lang->error_invalidattachment);
 104          }
 105  
 106          if($attachtype['forums'] != -1 && strpos(','.$attachtype['forums'].',', ','.$fid.',') === false)
 107          {
 108              error_no_permission();
 109          }
 110      }
 111      elseif(!$mybb->user['uid'] || $post['uid'] != $mybb->user['uid'])
 112      {
 113          error_no_permission();
 114      }
 115  }
 116  
 117  if(!isset($mybb->input['thumbnail'])) // Only increment the download count if this is not a thumbnail
 118  {
 119      if(!is_member($attachtype['groups']))
 120      {
 121          error_no_permission();
 122      }
 123  
 124      $attachupdate = array(
 125          "downloads" => $attachment['downloads']+1,
 126      );
 127      $db->update_query("attachments", $attachupdate, "aid='{$attachment['aid']}'");
 128  }
 129  
 130  // basename isn't UTF-8 safe. This is a workaround.
 131  $attachment['filename'] = ltrim(basename(' '.$attachment['filename']));
 132  
 133  // prevent header omission by PHP's header()
 134  $attachment['filename'] = str_replace(
 135      array("\r", "\n", "\0"),
 136      '',
 137      $attachment['filename'],
 138  );
 139  
 140  $uploadspath_abs = mk_path_abs($mybb->settings['uploadspath']);
 141  
 142  header("Content-Security-Policy: default-src 'none'; form-action 'none'; base-uri 'none'");
 143  
 144  $plugins->run_hooks("attachment_end");
 145  
 146  if(isset($mybb->input['thumbnail']))
 147  {
 148      if(!file_exists($uploadspath_abs."/".$attachment['thumbnail']))
 149      {
 150          error($lang->error_invalidattachment);
 151      }
 152  
 153      $ext = get_extension($attachment['thumbnail']);
 154      switch($ext)
 155      {
 156          case "gif":
 157              $type = "image/gif";
 158              break;
 159          case "bmp":
 160              $type = "image/bmp";
 161              break;
 162          case "png":
 163              $type = "image/png";
 164              break;
 165          case "jpg":
 166          case "jpeg":
 167          case "jpe":
 168              $type = "image/jpeg";
 169              break;
 170          default:
 171              $type = "image/unknown";
 172              break;
 173      }
 174  
 175      header("Content-disposition: filename=\"{$attachment['filename']}\"");
 176      header("Content-type: ".$type);
 177      $thumb = $uploadspath_abs."/".$attachment['thumbnail'];
 178      header("Content-length: ".@filesize($thumb));
 179      $handle = fopen($thumb, 'rb');
 180      while(!feof($handle))
 181      {
 182          echo fread($handle, 8192);
 183      }
 184      fclose($handle);
 185  }
 186  else
 187  {
 188      if(!file_exists($uploadspath_abs."/".$attachment['attachname']))
 189      {
 190          error($lang->error_invalidattachment);
 191      }
 192  
 193      $ext = get_extension($attachment['filename']);
 194  
 195      switch($attachment['filetype'])
 196      {
 197          case "application/pdf":
 198          case "image/bmp":
 199          case "image/gif":
 200          case "image/jpeg":
 201          case "image/pjpeg":
 202          case "image/png":
 203          case "text/plain":
 204              header("Content-type: {$attachment['filetype']}");
 205              if(!empty($attachtypes[$ext]['forcedownload']))
 206              {
 207                  $disposition = "attachment";
 208              }
 209              else
 210              {
 211                  $disposition = "inline";
 212              }
 213              break;
 214  
 215          default:
 216              $filetype = $attachment['filetype'];
 217  
 218              if(!$filetype)
 219              {
 220                  $filetype = 'application/force-download';
 221              }
 222  
 223              header("Content-type: {$filetype}");
 224              $disposition = "attachment";
 225      }
 226  
 227      if(strpos(strtolower($_SERVER['HTTP_USER_AGENT']), "msie") !== false)
 228      {
 229          header("Content-disposition: attachment; filename=\"{$attachment['filename']}\"");
 230      }
 231      else
 232      {
 233          header("Content-disposition: {$disposition}; filename=\"{$attachment['filename']}\"");
 234      }
 235  
 236      if(strpos(strtolower($_SERVER['HTTP_USER_AGENT']), "msie 6.0") !== false)
 237      {
 238          header("Expires: -1");
 239      }
 240  
 241      header("Content-length: {$attachment['filesize']}");
 242      header("Content-range: bytes=0-".($attachment['filesize']-1)."/".$attachment['filesize']);
 243      $handle = fopen($uploadspath_abs."/".$attachment['attachname'], 'rb');
 244      while(!feof($handle))
 245      {
 246          echo fread($handle, 8192);
 247      }
 248      fclose($handle);
 249  }