close rodber#107

keven1024 · Feb 28, 2022 · 9094540 · 9094540
1 parent e9f292e
commit 9094540
Show file tree

Hide file tree

Showing 30 changed files with 4,614 additions and 37 deletions.
diff --git a/app/lib/classes/class.upload.php b/app/lib/classes/class.upload.php
@@ -23,21 +23,60 @@ class Upload
     // file => /full/path/to/name.ext
     // name => name
 
+    const URL_SCHEMES = [
+        'http',
+        'https',
+        'ftp'
+    ];
+
     public $source;
     public $uploaded;
     public $detectFlood = true;
 
-    // Sets the type of resource being uploaded
-    public function setType($type)
+    public function checkValidUrl(string $url): void
     {
-        $this->type = $type;
+        $aux = strtolower($url);
+        $scheme = parse_url($aux, PHP_URL_SCHEME);
+        if(!in_array($scheme, self::URL_SCHEMES)) {
+            throw new UploadException(
+                strtr(
+                    "Unsupported URL scheme `%scheme%`", [
+                        '%scheme%' => $scheme
+                    ]
+                ),
+                400
+            );
+        }
+        $host = parse_url($aux, PHP_URL_HOST);
+        if(parse_url(G_HTTP_HOST, PHP_URL_HOST) === $host) {
+            throw new UploadException(
+                "Unsupported self host URL upload",
+                400
+            );
+        }
+        $ip = gethostbyname($host);
+        $typePub = \IPLib\Range\Type::getName(\IPLib\Range\Type::T_PUBLIC);
+        $address = \IPLib\Factory::parseAddressString($ip);
+        $type = $address->getRangeType();
+        $typeName = \IPLib\Range\Type::getName($type);
+        if($typeName !== $typePub) {
+            throw new UploadException(
+                "Unsupported non-public IP address for upload",
+                400
+            );
+        }
     }
 
     // Set source
     public function setSource($source)
     {
         $this->source = $source;
-        $this->type = (G\is_image_url($this->source) || G\is_url($this->source)) ? 'url' : 'file';
+        $this->type = (G\is_image_url($this->source) || G\is_url($this->source))
+            ? 'url'
+            : 'file';
+        if($this->type === 'url') {
+            $this->checkValidUrl($this->source);
+        }
     }
 
     // Set destination

diff --git a/app/vendor/composer/autoload_classmap.php b/app/vendor/composer/autoload_classmap.php
@@ -8,6 +8,22 @@
 return array(
     'Composer\\InstalledVersions' => $vendorDir . '/composer/InstalledVersions.php',
     'Detection\\MobileDetect' => $vendorDir . '/mobiledetect/mobiledetectlib/namespaced/Detection/MobileDetect.php',
+    'IPLib\\Address\\AddressInterface' => $vendorDir . '/mlocati/ip-lib/src/Address/AddressInterface.php',
+    'IPLib\\Address\\AssignedRange' => $vendorDir . '/mlocati/ip-lib/src/Address/AssignedRange.php',
+    'IPLib\\Address\\IPv4' => $vendorDir . '/mlocati/ip-lib/src/Address/IPv4.php',
+    'IPLib\\Address\\IPv6' => $vendorDir . '/mlocati/ip-lib/src/Address/IPv6.php',
+    'IPLib\\Address\\Type' => $vendorDir . '/mlocati/ip-lib/src/Address/Type.php',
+    'IPLib\\Factory' => $vendorDir . '/mlocati/ip-lib/src/Factory.php',
+    'IPLib\\ParseStringFlag' => $vendorDir . '/mlocati/ip-lib/src/ParseStringFlag.php',
+    'IPLib\\Range\\AbstractRange' => $vendorDir . '/mlocati/ip-lib/src/Range/AbstractRange.php',
+    'IPLib\\Range\\Pattern' => $vendorDir . '/mlocati/ip-lib/src/Range/Pattern.php',
+    'IPLib\\Range\\RangeInterface' => $vendorDir . '/mlocati/ip-lib/src/Range/RangeInterface.php',
+    'IPLib\\Range\\Single' => $vendorDir . '/mlocati/ip-lib/src/Range/Single.php',
+    'IPLib\\Range\\Subnet' => $vendorDir . '/mlocati/ip-lib/src/Range/Subnet.php',
+    'IPLib\\Range\\Type' => $vendorDir . '/mlocati/ip-lib/src/Range/Type.php',
+    'IPLib\\Service\\BinaryMath' => $vendorDir . '/mlocati/ip-lib/src/Service/BinaryMath.php',
+    'IPLib\\Service\\RangesFromBoundaryCalculator' => $vendorDir . '/mlocati/ip-lib/src/Service/RangesFromBoundaryCalculator.php',
+    'IPLib\\Service\\UnsignedIntegerMath' => $vendorDir . '/mlocati/ip-lib/src/Service/UnsignedIntegerMath.php',
     'Mobile_Detect' => $vendorDir . '/mobiledetect/mobiledetectlib/Mobile_Detect.php',
     'PHPMailer\\PHPMailer\\Exception' => $vendorDir . '/phpmailer/phpmailer/src/Exception.php',
     'PHPMailer\\PHPMailer\\OAuth' => $vendorDir . '/phpmailer/phpmailer/src/OAuth.php',

diff --git a/app/vendor/composer/autoload_psr4.php b/app/vendor/composer/autoload_psr4.php
@@ -7,4 +7,5 @@
 
 return array(
     'PHPMailer\\PHPMailer\\' => array($vendorDir . '/phpmailer/phpmailer/src'),
+    'IPLib\\' => array($vendorDir . '/mlocati/ip-lib/src'),
 );
diff --git a/app/vendor/composer/autoload_real.php b/app/vendor/composer/autoload_real.php
@@ -22,8 +22,6 @@ public static function getLoader()
             return self::$loader;
         }
 
-        require __DIR__ . '/platform_check.php';
-
         spl_autoload_register(array('ComposerAutoloaderInit5ebab6dc32ca006b1a67a63e20c04846', 'loadClassLoader'), true, true);
         self::$loader = $loader = new \Composer\Autoload\ClassLoader(\dirname(\dirname(__FILE__)));
         spl_autoload_unregister(array('ComposerAutoloaderInit5ebab6dc32ca006b1a67a63e20c04846', 'loadClassLoader'));

diff --git a/app/vendor/composer/autoload_static.php b/app/vendor/composer/autoload_static.php
@@ -11,13 +11,21 @@ class ComposerStaticInit5ebab6dc32ca006b1a67a63e20c04846
         array (
             'PHPMailer\\PHPMailer\\' => 20,
         ),
+        'I' => 
+        array (
+            'IPLib\\' => 6,
+        ),
     );
 
     public static $prefixDirsPsr4 = array (
         'PHPMailer\\PHPMailer\\' => 
         array (
             0 => __DIR__ . '/..' . '/phpmailer/phpmailer/src',
         ),
+        'IPLib\\' => 
+        array (
+            0 => __DIR__ . '/..' . '/mlocati/ip-lib/src',
+        ),
     );
 
     public static $prefixesPsr0 = array (
@@ -40,6 +48,22 @@ class ComposerStaticInit5ebab6dc32ca006b1a67a63e20c04846
     public static $classMap = array (
         'Composer\\InstalledVersions' => __DIR__ . '/..' . '/composer/InstalledVersions.php',
         'Detection\\MobileDetect' => __DIR__ . '/..' . '/mobiledetect/mobiledetectlib/namespaced/Detection/MobileDetect.php',
+        'IPLib\\Address\\AddressInterface' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Address/AddressInterface.php',
+        'IPLib\\Address\\AssignedRange' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Address/AssignedRange.php',
+        'IPLib\\Address\\IPv4' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Address/IPv4.php',
+        'IPLib\\Address\\IPv6' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Address/IPv6.php',
+        'IPLib\\Address\\Type' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Address/Type.php',
+        'IPLib\\Factory' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Factory.php',
+        'IPLib\\ParseStringFlag' => __DIR__ . '/..' . '/mlocati/ip-lib/src/ParseStringFlag.php',
+        'IPLib\\Range\\AbstractRange' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Range/AbstractRange.php',
+        'IPLib\\Range\\Pattern' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Range/Pattern.php',
+        'IPLib\\Range\\RangeInterface' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Range/RangeInterface.php',
+        'IPLib\\Range\\Single' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Range/Single.php',
+        'IPLib\\Range\\Subnet' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Range/Subnet.php',
+        'IPLib\\Range\\Type' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Range/Type.php',
+        'IPLib\\Service\\BinaryMath' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Service/BinaryMath.php',
+        'IPLib\\Service\\RangesFromBoundaryCalculator' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Service/RangesFromBoundaryCalculator.php',
+        'IPLib\\Service\\UnsignedIntegerMath' => __DIR__ . '/..' . '/mlocati/ip-lib/src/Service/UnsignedIntegerMath.php',
         'Mobile_Detect' => __DIR__ . '/..' . '/mobiledetect/mobiledetectlib/Mobile_Detect.php',
         'PHPMailer\\PHPMailer\\Exception' => __DIR__ . '/..' . '/phpmailer/phpmailer/src/Exception.php',
         'PHPMailer\\PHPMailer\\OAuth' => __DIR__ . '/..' . '/phpmailer/phpmailer/src/OAuth.php',

diff --git a/app/vendor/composer/installed.json b/app/vendor/composer/installed.json
@@ -60,6 +60,80 @@
             ],
             "install-path": "../jbroadway/urlify"
         },
+        {
+            "name": "mlocati/ip-lib",
+            "version": "1.17.0",
+            "version_normalized": "1.17.0.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/mlocati/ip-lib.git",
+                "reference": "db9552c3460d5fa19a4c8183767fe89da7752a4e"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/mlocati/ip-lib/zipball/db9552c3460d5fa19a4c8183767fe89da7752a4e",
+                "reference": "db9552c3460d5fa19a4c8183767fe89da7752a4e",
+                "shasum": ""
+            },
+            "require": {
+                "php": ">=5.3.3"
+            },
+            "require-dev": {
+                "ext-pdo_sqlite": "*",
+                "phpunit/phpunit": "^4.8 || ^5.7 || ^6.5 || ^7.5 || ^8.5 || ^9.5"
+            },
+            "time": "2021-08-03T15:42:09+00:00",
+            "type": "library",
+            "installation-source": "dist",
+            "autoload": {
+                "psr-4": {
+                    "IPLib\\": "src/"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "MIT"
+            ],
+            "authors": [
+                {
+                    "name": "Michele Locati",
+                    "email": "mlocati@gmail.com",
+                    "homepage": "https://github.com/mlocati",
+                    "role": "Author"
+                }
+            ],
+            "description": "Handle IPv4, IPv6 addresses and ranges",
+            "homepage": "https://github.com/mlocati/ip-lib",
+            "keywords": [
+                "IP",
+                "address",
+                "addresses",
+                "ipv4",
+                "ipv6",
+                "manage",
+                "managing",
+                "matching",
+                "network",
+                "networking",
+                "range",
+                "subnet"
+            ],
+            "support": {
+                "issues": "https://github.com/mlocati/ip-lib/issues",
+                "source": "https://github.com/mlocati/ip-lib/tree/1.17.0"
+            },
+            "funding": [
+                {
+                    "url": "https://github.com/sponsors/mlocati",
+                    "type": "github"
+                },
+                {
+                    "url": "https://paypal.me/mlocati",
+                    "type": "other"
+                }
+            ],
+            "install-path": "../mlocati/ip-lib"
+        },
         {
             "name": "mobiledetect/mobiledetectlib",
             "version": "2.8.37",

diff --git a/app/vendor/composer/installed.php b/app/vendor/composer/installed.php
@@ -5,7 +5,7 @@
         'type' => 'project',
         'install_path' => __DIR__ . '/../../../',
         'aliases' => array(),
-        'reference' => 'a4468798feb807c275da22f7e27791d86e157e2f',
+        'reference' => '4c577af004a6a2463d0dcfce078bcb2ff18457f4',
         'name' => 'chevereto/chevereto-free',
         'dev' => true,
     ),
@@ -16,7 +16,7 @@
             'type' => 'project',
             'install_path' => __DIR__ . '/../../../',
             'aliases' => array(),
-            'reference' => 'a4468798feb807c275da22f7e27791d86e157e2f',
+            'reference' => '4c577af004a6a2463d0dcfce078bcb2ff18457f4',
             'dev_requirement' => false,
         ),
         'jbroadway/urlify' => array(
@@ -28,6 +28,15 @@
             'reference' => '37fe4e7680a1c8cd68ac43a27dac7ef4be476300',
             'dev_requirement' => false,
         ),
+        'mlocati/ip-lib' => array(
+            'pretty_version' => '1.17.0',
+            'version' => '1.17.0.0',
+            'type' => 'library',
+            'install_path' => __DIR__ . '/../mlocati/ip-lib',
+            'aliases' => array(),
+            'reference' => 'db9552c3460d5fa19a4c8183767fe89da7752a4e',
+            'dev_requirement' => false,
+        ),
         'mobiledetect/mobiledetectlib' => array(
             'pretty_version' => '2.8.37',
             'version' => '2.8.37.0',

diff --git a/app/vendor/composer/platform_check.php b/app/vendor/composer/platform_check.php
diff --git a/app/vendor/mlocati/ip-lib/LICENSE.txt b/app/vendor/mlocati/ip-lib/LICENSE.txt
@@ -0,0 +1,20 @@
+The MIT License (MIT)
+Copyright (c) 2016 Michele Locati
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished
+to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.