You can't upload anything at the moment because $settings->sitename has uploads disabled. Try contacting $settings->admindetails_name, your site Administrator. Go back.
")); if(!$env->is_logged_in) exit(page_renderer::render("Upload Error - $settings->sitename", "You are not currently logged in, so you can't upload anything.
Try logging in first.
")); if($is_avatar) { exit(page_renderer::render("Upload avatar - $settings->sitename", "Select an image below, and then press upload. $settings->sitename currently supports the following file types (though not all of them may be suitable for an avatar): " . implode(", ", $settings->upload_allowed_file_types) . "
")); } exit(page_renderer::render("Upload - $settings->sitename", "Select an image or file below, and then type a name for it in the box. This server currently supports uploads up to " . human_filesize(get_max_upload_size()) . " in size.
$settings->sitename currently supports uploading of the following file types: " . implode(", ", $settings->upload_allowed_file_types) . ".
")); break; case "POST": // Recieve file if(!$settings->editing) { exit(page_renderer::render_main("Upload failed - $settings->sitename", "Your upload couldn't be processed because editing is currently disabled on $settings->sitename. Please contact $settings->admindetails_name, $settings->sitename's administrator for more information - their contact details can be found at the bottom of this page. Go back to the main page.")); } // Make sure uploads are enabled if(!$settings->upload_enabled) { if(!empty($_FILES["file"])) unlink($_FILES["file"]["tmp_name"]); http_response_code(412); exit(page_renderer::render("Upload failed - $settings->sitename", "
Your upload couldn't be processed because uploads are currently disabled on $settings->sitename. Go back to the main page.
")); } // Make sure that the user is logged in if(!$env->is_logged_in) { if(!empty($_FILES["file"])) unlink($_FILES["file"]["tmp_name"]); http_response_code(401); exit(page_renderer::render("Upload failed - $settings->sitename", "Your upload couldn't be processed because you are not logged in.
Try logging in first.")); } // Check for php upload errors if($_FILES["file"]["error"] > 0) { if(!empty($_FILES["file"])) unlink($_FILES["file"]["tmp_name"]); if($_FILES["file"]["error"] == 1 || $_FILES["file"]["error"] == 2) http_response_code(413); // file is too large else http_response_code(500); // something else went wrong exit(page_renderer::render("Upload failed - $settings->sitename", "
Your upload couldn't be processed because " . (($_FILES["file"]["error"] == 1 || $_FILES["file"]["error"] == 2) ? "the file is too large" : "an error occurred") . ".
Please contact $settings->admindetails_name, $settings->sitename's administrator for help.
")); } // Calculate the target name, removing any characters we // are unsure about. $target_name = makepathsafe($_POST["name"] ?? "Users/$env->user/Avatar"); $temp_filename = $_FILES["file"]["tmp_name"]; $mimechecker = finfo_open(FILEINFO_MIME_TYPE); $mime_type = finfo_file($mimechecker, $temp_filename); finfo_close($mimechecker); if(!in_array($mime_type, $settings->upload_allowed_file_types)) { http_response_code(415); exit(page_renderer::render("Unknown file type - Upload error - $settings->sitename", "$settings->sitename recieved the file you tried to upload successfully, but detected that the type of file you uploaded is not in the allowed file types list. The file has been discarded.
The file you tried to upload appeared to be of type $mime_type, but $settings->sitename currently only allows the uploading of the following file types: " . implode(", ", $settings->upload_allowed_file_types) . ".
Go back to the Main Page.
")); } // Perform appropriate checks based on the *real* filetype if($is_avatar && substr($mime_type, 0, strpos($mime_type, "/")) !== "image") { http_response_code(415); exit(page_renderer::render_main("Error uploading avatar - $settings->sitename", "That file appears to be unsuitable as an avatar, as $settings->sitename has detected it to be of type $mime_type, which doesn't appear to be an image. Please try uploading a different file to use as your avatar.
Although the file that you uploaded appears to be an image, $settings->sitename has been unable to determine it's dimensions. The uploaded file has been discarded. Go back to try again.
You may wish to consider opening an issue against Pepperminty Wiki (the software that powers $settings->sitename) if this isn't the first time that you have seen this message.
")); } break; } $file_extension = system_mime_type_extension($mime_type); // Override the detected file extension if a file extension // is explicitly specified in the settings if(isset($settings->mime_mappings_overrides->$mime_type)) $file_extension = $settings->mime_mappings_overrides->$mime_type; if(in_array($file_extension, [ "php", ".htaccess", "asp", "aspx" ])) { http_response_code(415); exit(page_renderer::render("Upload Error - $settings->sitename", "The file you uploaded appears to be dangerous and has been discarded. Please contact $settings->sitename's administrator for assistance.
Additional information: The file uploaded appeared to be of type $mime_type, which mapped onto the extension $file_extension. This file extension has the potential to be executed accidentally by the web server.
A page or file has already been uploaded with the name '$new_filename'. Try deleting it first. If you do not have permission to delete things, try contacting one of the moderators.
")); // Delete the previously uploaded avatar, if it exists // In the future we _may_ not need this once we have // file history online. if($is_avatar && isset($pageindex->$new_pagepath) && $pageindex->$new_pagepath->uploadedfile) unlink($pageindex->$new_pagepath->uploadedfilepath); // Make sure that the palce we're uploading to exists if(!file_exists(dirname($env->storage_prefix . $new_filename))) mkdir(dirname($env->storage_prefix . $new_filename), 0775, true); if(!move_uploaded_file($temp_filename, $env->storage_prefix . $new_filename)) { http_response_code(409); exit(page_renderer::render("Upload Error - $settings->sitename", "The file you uploaded was valid, but $settings->sitename couldn't verify that it was tampered with during the upload process. This probably means that either is a configuration error, or that $settings->sitename has been attacked. Please contact " . $settings->admindetails_name . ", your $settings->sitename Administrator.
")); } $description = $_POST["description"] ?? "_(No description provided)_\n"; // Escape the raw html in the provided description if the setting is enabled if($settings->clean_raw_html) $description = htmlentities($description, ENT_QUOTES); file_put_contents($env->storage_prefix . $new_description_filename, $description); // Construct a new entry for the pageindex $entry = new stdClass(); // Point to the description's filepath since this property // should point to a markdown file $entry->filename = $new_description_filename; $entry->size = strlen($description ?? "(No description provided)"); $entry->lastmodified = time(); $entry->lasteditor = $env->user; $entry->uploadedfile = true; $entry->uploadedfilepath = $new_filename; $entry->uploadedfilemime = $mime_type; // Add the new entry to the pageindex // Assign the new entry to the image's filepath as that // should be the page name. $pageindex->$new_pagepath = $entry; // Generate a revision to keep the page history up to date if(module_exists("feature-history")) { $oldsource = ""; // Only variables can be passed by reference, not literals history_add_revision($entry, $description, $oldsource, false); } // Save the pageindex file_put_contents($paths->pageindex, json_encode($pageindex, JSON_PRETTY_PRINT)); if(module_exists("feature-recent-changes")) { add_recent_change([ "type" => "upload", "timestamp" => time(), "page" => $new_pagepath, "user" => $env->user, "filesize" => filesize($env->storage_prefix . $entry->uploadedfilepath) ]); } header("location: ?action=view&page=$new_pagepath&upload=success"); break; } }); /** * @api {get} ?action=preview&page={pageName}[&size={someSize}] Get a preview of a file * @apiName PreviewFile * @apiGroup Upload * @apiPermission Anonymous * * @apiParam {string} page The name of the file to preview. * @apiParam {number} size Optional. The size fo the resulting preview. Will be clamped to fit within the bounds specified in the wiki's settings. May also be set to the keyword 'original', which will cause the original file to be returned with it's appropriate mime type instead. * * @apiError PreviewNoFileError No file was found associated with the specified page. * @apiError PreviewUnknownFileTypeError Pepperminty Wiki was unable to generate a preview for the requested file's type. */ /* * ██████ ██████ ███████ ██ ██ ██ ███████ ██ ██ * ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ * ██████ ██████ █████ ██ ██ ██ █████ ██ █ ██ * ██ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██ * ██ ██ ██ ███████ ████ ██ ███████ ███ ███ */ add_action("preview", function() { global $settings, $env, $pageindex, $start_time; if(empty($pageindex->{$env->page}->uploadedfilepath)) { $im = errorimage("The page '$env->page' doesn't have an associated file."); header("content-type: image/png"); imagepng($im); exit(); } $filepath = realpath($env->storage_prefix . $pageindex->{$env->page}->uploadedfilepath); $mime_type = $pageindex->{$env->page}->uploadedfilemime; $shortFilename = substr($filepath, 1 + (strrpos($filepath, '/') !== false ? strrpos($filepath, '/') : -1)); header("content-disposition: inline; filename=\"$shortFilename\""); header("last-modified: " . gmdate('D, d M Y H:i:s T', $pageindex->{$env->page}->lastmodified)); // If the size is set to original, then send (or redirect to) the original image // Also do the same for SVGs if svg rendering is disabled. if(isset($_GET["size"]) and $_GET["size"] == "original" or (empty($settings->render_svg_previews) && $mime_type == "image/svg+xml")) { // Get the file size $filesize = filesize($filepath); // Send some headers header("content-length: $filesize"); header("content-type: $mime_type"); // Open the file and send it to the user $handle = fopen($filepath, "rb"); fpassthru($handle); fclose($handle); exit(); } // Determine the target size of the image $target_size = 512; if(isset($_GET["size"])) $target_size = intval($_GET["size"]); if($target_size < $settings->min_preview_size) $target_size = $settings->min_preview_size; if($target_size > $settings->max_preview_size) $target_size = $settings->max_preview_size; // Determine the output file type $output_mime = $settings->preview_file_type; if(isset($_GET["type"]) and in_array($_GET["type"], [ "image/png", "image/jpeg", "image/webp" ])) $output_mime = $_GET["type"]; /// ETag handling /// // Generate the etag and send it to the client $preview_etag = sha1("$output_mime|$target_size|$filepath|$mime_type"); $allheaders = getallheaders(); $allheaders = array_change_key_case($allheaders, CASE_LOWER); if(!isset($allheaders["if-none-match"])) { header("etag: $preview_etag"); } else { if($allheaders["if-none-match"] === $preview_etag) { http_response_code(304); header("x-generation-time: " . (microtime(true) - $start_time)); exit(); } } /// ETag handling end /// /* Disabled until we work out what to do about caching previews * $previewFilename = "$filepath.preview.$outputFormat"; if($target_size === $settings->default_preview_size) { // The request is for the default preview size // Check to see if we have a preview pre-rendered } */ $preview = new Imagick(); switch(substr($mime_type, 0, strpos($mime_type, "/"))) { case "image": $preview->readImage($filepath); break; case "application": if($mime_type == "application/pdf") { $preview = new imagick(); $preview->readImage("{$filepath}[0]"); $preview->setResolution(300,300); $preview->setImageColorspace(255); break; } case "video": case "audio": if($settings->data_storage_dir == ".") { // The data storage directory is the current directory // Redirect to the file isntead http_response_code(307); header("location: " . $pageindex->{$env->page}->uploadedfilepath); exit(); } // TODO: Add support for ranges here. // Get the file size $filesize = filesize($filepath); // Send some headers header("content-length: $filesize"); header("content-type: $mime_type"); // Open the file and send it to the user $handle = fopen($filepath, "rb"); fpassthru($handle); fclose($handle); exit(); break; default: http_response_code(501); $preview = errorimage("Unrecognised file type '$mime_type'.", $target_size); header("content-type: image/png"); imagepng($preview); exit(); } // Scale the image down to the target size $preview->resizeImage($target_size, $target_size, imagick::FILTER_LANCZOS, 1, true); // Send the completed preview image to the user header("content-type: $output_mime"); header("x-generation-time: " . (microtime(true) - $start_time) . "s"); $outputFormat = substr($output_mime, strpos($output_mime, "/") + 1); $preview->setImageFormat($outputFormat); echo($preview->getImageBlob()); /* Disabled while we work out what to do about caching previews * // Save a preview file if there isn't one alreaddy if(!file_exists($previewFilename)) file_put_contents($previewFilename, $preview->getImageBlob()); */ }); /* * ██████ ██████ ███████ ██ ██ ██ ███████ ██ ██ * ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ * ██████ ██████ █████ ██ ██ ██ █████ ██ █ ██ * ██ ██ ██ ██ ██ ██ ██ ██ ██ ███ ██ * ██ ██ ██ ███████ ████ ██ ███████ ███ ███ * * ██████ ██ ███████ ██████ ██ █████ ██ ██ ███████ ██████ * ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ * ██ ██ ██ ███████ ██████ ██ ███████ ████ █████ ██████ * ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ ██ * ██████ ██ ███████ ██ ███████ ██ ██ ██ ███████ ██ ██ */ page_renderer::register_part_preprocessor(function(&$parts) { global $pageindex, $env, $settings; // Don't do anything if the action isn't view if($env->action !== "view") return; if(isset($pageindex->{$env->page}->uploadedfile) and $pageindex->{$env->page}->uploadedfile == true) { // We are looking at a page that is paired with an uploaded file $filepath = $pageindex->{$env->page}->uploadedfilepath; $mime_type = $pageindex->{$env->page}->uploadedfilemime; $dimensions = $mime_type !== "image/svg+xml" ? getimagesize($env->storage_prefix . $filepath) : getsvgsize($env->storage_prefix . $filepath); $fileTypeDisplay = substr($mime_type, 0, strpos($mime_type, "/")); $previewUrl = "?action=preview&size=$settings->default_preview_size&page=" . rawurlencode($env->page); $preview_html = ""; switch($fileTypeDisplay) { case "application": case "image": if($mime_type == "application/pdf") $fileTypeDisplay = "file"; $preview_sizes = [ 256, 512, 768, 1024, 1440, 1920 ]; $preview_html .= "\t\t\t| $displayName | $displayValue |
|---|
$settings->sitename supports the uploading of files, though it is up to " . $settings->admindetails_name . ", $settings->sitename's administrator as to whether it is enabled or not (uploads are currently " . (($settings->upload_enabled) ? "enabled" : "disabled") . ").
Currently Pepperminty Wiki (the software that $settings->sitename uses) only supports the uploading of images, although more file types should be supported in the future (open an issue on GitHub if you are interested in support for more file types).
Uploading a file is actually quite simple. Click the "Upload" option in the "More..." menu to go to the upload page. The upload page will tell you what types of file $settings->sitename allows, and the maximum supported filesize for files that you upload (this is usually set by the web server that the wiki is running on).
Use the file chooser to select the file that you want to upload, and then decide on a name for it. Note that the name that you choose should not include the file extension, as this will be determined automatically. Enter a description that will appear on the file's page, and then click upload.
"); } ]); /** * Calculates the actual maximum upload size supported by the server * Returns a file size limit in bytes based on the PHP upload_max_filesize and * post_max_size * @package feature-upload * @author Lifted from Drupal by @meustrus from Stackoverflow * @see http://stackoverflow.com/a/25370978/1460422 Source Stackoverflow answer * @return integer The maximum upload size supported bythe server, in bytes. */ function get_max_upload_size() { static $max_size = -1; if ($max_size < 0) { // Start with post_max_size. $max_size = parse_size(ini_get('post_max_size')); // If upload_max_size is less, then reduce. Except if upload_max_size is // zero, which indicates no limit. $upload_max = parse_size(ini_get('upload_max_filesize')); if ($upload_max > 0 && $upload_max < $max_size) { $max_size = $upload_max; } } return $max_size; } /** * Parses a PHP size to an integer * @package feature-upload * @author Lifted from Drupal by @meustrus from Stackoverflow * @see http://stackoverflow.com/a/25370978/1460422 Source Stackoverflow answer * @param string $size The size to parse. * @return integer The number of bytees represented by the specified * size string. */ function parse_size($size) { $unit = preg_replace('/[^bkmgtpezy]/i', '', $size); // Remove the non-unit characters from the size. $size = preg_replace('/[^0-9\.]/', '', $size); // Remove the non-numeric characters from the size. if ($unit) { // Find the position of the unit in the ordered string which is the power of magnitude to multiply a kilobyte by. return round($size * pow(1024, stripos('bkmgtpezy', $unit[0]))); } else { return round($size); } } /** * Checks an uploaded SVG file to make sure it's (at least somewhat) safe. * Sends an error to the client if a problem is found. * @package feature-upload * @param string $temp_filename The filename of the SVG file to check. * @return int[] The size of the SVG image. */ function upload_check_svg($temp_filename) { global $settings; // Check for script tags if(strpos(file_get_contents($temp_filename), "$settings->sitename detected that you uploaded an SVG image and performed some extra security checks on your file. Whilst performing these checks it was discovered that the file you uploaded contains some Javascript, which could be dangerous. The uploaded file has been discarded. Go back to try again.
You may wish to consider opening an issue against Pepperminty Wiki (the software that powers $settings->sitename) if this isn't the first time that you have seen this message.
")); } // Find and return the size of the SVG image return getsvgsize($temp_filename); } /** * Calculates the size of the specified SVG file. * @package feature-upload * @param string $svgFilename The filename to calculate the size of. * @return int[] The width and height respectively of the * specified SVG file. */ function getsvgsize($svgFilename) { global $settings; libxml_disable_entity_loader(true); // Ref: XXE Billion Laughs Attack, issue #152 $rawSvg = file_get_contents($svgFilename); $svg = simplexml_load_string($rawSvg); // Load it as XML unset($rawSvg); if($svg === false) { http_response_code(415); exit(page_renderer::render("Upload Error - $settings->sitename", "When $settings->sitename tried to open your SVG file for checking, it found some invalid syntax. The uploaded file has been discarded. Go back to try again.
")); } $rootAttrs = $svg->attributes(); $imageSize = false; if(isset($rootAttrs->width) and isset($rootAttrs->height)) $imageSize = [ intval($rootAttrs->width), intval($rootAttrs->height) ]; else if(isset($rootAttrs->viewBox)) $imageSize = array_map("intval", array_slice(explode(" ", $rootAttrs->viewBox), -2, 2)); return $imageSize; } /** * Creates an images containing the specified text. * Useful for sending errors back to the client. * @package feature-upload * @param string $text The text to include in the image. * @param integer $target_size The target width to aim for when creating * the image. * @return image The handle to the generated GD image. */ function errorimage($text, $target_size = null) { $width = 640; $height = 480; if(!empty($target_size)) { $width = $target_size; $height = $target_size * (2 / 3); } $image = imagecreatetruecolor($width, $height); imagefill($image, 0, 0, imagecolorallocate($image, 238, 232, 242)); // Set the background to #eee8f2 $fontwidth = imagefontwidth(3); imagestring($image, 3, ($width / 2) - (($fontwidth * strlen($text)) / 2), ($height / 2) - (imagefontheight(3) / 2), $text, imagecolorallocate($image, 17, 17, 17) // #111111 ); return $image; } ?>