download_file()   A
last analyzed

Complexity

Conditions 2
Paths 2

Size

Total Lines 7
Code Lines 5

Duplication

Lines 0
Ratio 0 %

Importance

Changes 0
Metric Value
cc 2
eloc 5
c 0
b 0
f 0
nc 2
nop 1
dl 0
loc 7
rs 10
1
<?php
2
// This file is part of BOINC.
3
// http://boinc.berkeley.edu
4
// Copyright (C) 2011 University of California
5
//
6
// BOINC is free software; you can redistribute it and/or modify it
7
// under the terms of the GNU Lesser General Public License
8
// as published by the Free Software Foundation,
9
// either version 3 of the License, or (at your option) any later version.
10
//
11
// BOINC is distributed in the hope that it will be useful,
12
// but WITHOUT ANY WARRANTY; without even the implied warranty of
13
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
14
// See the GNU Lesser General Public License for more details.
15
//
16
// You should have received a copy of the GNU Lesser General Public License
17
// along with BOINC.  If not, see <http://www.gnu.org/licenses/>.
18
19
// Per-user "file sandboxes".
20
// Files are stored in <project>/sandbox/<userid>/
21
// File infos (md5/size) are scored in a parallel dir
22
// <project>/sandbox/<userid>/.md5/
23
24
// NOTE: PHP's default max file upload size is 2MB.
25
// To increase this, edit /etc/php.ini, and change, e.g.
26
//
27
// upload_max_filesize = 64M
28
// post_max_size = 64M
29
30
require_once("../inc/sandbox.inc");
31
require_once("../inc/submit_util.inc");
32
33
display_errors();
34
35
function add_form() {
36
    page_head('Add files to your sandbox');
37
    echo "
38
        There are several ways to add files:
39
        <p>
40
        <hr>
41
        <h3>Upload files from this computer</h3>
42
        <p>
43
        NOTE: if you upload text files from Windows,
44
        they will be given CRLF line endings.
45
        If they are shell scripts, they won't work on Linux.
46
        Add shell scripts using 'Add text file' below.
47
    ";
48
    form_start('sandbox.php', 'post', 'ENCTYPE="multipart/form-data"');
49
    form_input_hidden('action', 'upload_file');
50
    form_general('',
51
        '<input size=80 type=file name="new_file[]" multiple="multiple">'
52
    );
53
    form_submit('Upload');
54
    form_end();
55
if (0) {
56
    echo "
57
        <form action=sandbox.php method=post ENCTYPE=\"multipart/form-data\">
58
        <input type=hidden name=action value=upload_file>
59
        <p><p><input size=80 type=file name=\"new_file[]\" multiple=\"multiple\">
60
        <p> <input class=\"btn btn-success\" type=submit value=Upload>
61
        </form>
62
    ";
63
}
64
    echo "
65
        <hr>
66
        <h3>Add text file</h3>
67
    ";
68
    form_start('sandbox.php', 'post');
69
    form_input_hidden('action', 'add_file');
70
    form_input_text('Name', 'name');
71
    form_input_textarea('Contents', 'contents');
72
    form_submit('OK');
73
    form_end();
74
    echo "
75
        <hr>
76
        <h3>Get web file</h3>
77
    ";
78
    form_start('sandbox.php', 'post');
79
    form_input_hidden('action', 'get_file');
80
    form_input_text('URL', 'url');
81
    form_submit('OK');
82
    form_end();
83
    page_tail();
84
}
85
86
function list_files($user, $notice=null) {
87
    $dir = sandbox_dir($user);
88
    if (!is_dir($dir)) error_page("Can't open sandbox directory");
89
    page_head("File sandbox");
90
    if ($notice) {
91
        echo "<p>$notice<hr>";
92
    }
93
    echo "<p>Click a column title to sort on that attribute.<p>\n";
94
    $fnames = array();
95
    foreach (scandir($dir) as $f) {
96
        if ($f[0] == '.') continue;
97
        $fnames[] = $f;
98
    }
99
    if (count($fnames) == 0) {
100
        echo "Your sandbox is currently empty.";
101
    } else {
102
        $files = [];
103
        foreach ($fnames as $fname) {
104
            [$md5, $size] = sandbox_parse_info_file($user, $fname);
105
            $f = new StdClass;
106
            $f->name = $fname;
107
            $f->size = $size;
108
            $f->md5 = $md5;
109
            $f->date = filemtime("$dir/$fname");
110
            $files[] = $f;
111
        }
112
        $sort_field = get_str('sort_field', true);
113
        if (!$sort_field) $sort_field = 'name';
114
        $sort_rev = get_str('sort_rev', true);
115
        column_sort($files, $sort_field, $sort_rev);
116
117
        start_table('table-striped');
118
        table_header(
119
            column_sort_header(
120
                'name',
121
                'Name',
122
                'sandbox.php?',
123
                $sort_field, $sort_rev
124
            ).'<br><small>(click to view text files)</small>',
125
            column_sort_header(
126
                'date',
127
                'Modified',
128
                'sandbox.php?',
129
                $sort_field, $sort_rev
130
            ),
131
            column_sort_header(
132
                'size',
133
                "Size (bytes)",
134
                'sandbox.php?',
135
                $sort_field, $sort_rev
136
            ),
137
            "MD5",
138
            "Delete",
139
            "Download"
140
        );
141
        foreach ($files as $f) {
142
            $ct = time_str($f->date);
143
            table_row(
144
                "<a href=sandbox.php?action=view_file&name=$f->name>$f->name</a>",
145
                $ct,
146
                $f->size,
147
                $f->md5,
148
                button_text_small(
149
                    "sandbox.php?action=delete_file&name=$f->name",
150
                    "Delete"
151
                ),
152
                button_text_small(
153
                    "sandbox.php?action=download_file&name=$f->name",
154
                    "Download"
155
                )
156
            );
157
        }
158
        end_table();
159
    }
160
    show_button('sandbox.php?action=add_form', 'Add files');
161
    page_tail();
162
}
163
164
// upload one or more files
165
166
function upload_file($user) {
167
    $notice = "";
168
    $dir = sandbox_dir($user);
169
    $count = count($_FILES['new_file']['tmp_name']);
170
    for ($i=0; $i<$count; $i++) {
171
        $tmp_name = $_FILES['new_file']['tmp_name'][$i];
172
        if (!is_uploaded_file($tmp_name)) {
173
            error_page("$tmp_name is not uploaded file");
174
        }
175
        $name = $_FILES['new_file']['name'][$i];
176
        if (!is_valid_filename($name)) {
177
            error_page('Invalid filename. '.filename_rules());
178
        }
179
        if (file_exists("$dir/$name")) {
180
            $notice .= "can't upload $name; file exists.<br>";
181
            continue;
182
        }
183
        move_uploaded_file($tmp_name, "$dir/$name");
184
185
        // write info file
186
        //
187
        [$md5, $size] = get_file_info("$dir/$name");
188
        write_info_file("$dir/.md5/$name", $md5, $size);
189
190
        $notice .= "Uploaded file <strong>$name</strong><br/>";
191
    }
192
    list_files($user, $notice);
193
}
194
195
function add_file($user) {
196
    $dir = sandbox_dir($user);
197
    $name = post_str('name');
198
    if (!is_valid_filename($name)) {
199
        error_page('Invalid filename. '.filename_rules());
200
    }
201
    if (!$name) error_page('No name given');
202
    if (file_exists("$dir/$name")) {
203
        error_page("file $name exists");
204
    }
205
    $contents = post_str('contents');
206
    $contents = str_replace("\r\n", "\n", $contents);
207
    file_put_contents("$dir/$name", $contents);
208
209
    [$md5, $size] = get_file_info("$dir/$name");
210
    write_info_file("$dir/.md5/$name", $md5, $size);
211
212
    $notice = "Added file <strong>$name</strong> ($size bytes)";
213
    list_files($user, $notice);
214
}
215
216
function get_file($user) {
217
    $dir = sandbox_dir($user);
218
    $url = post_str('url');
219
    if (filter_var($url, FILTER_VALIDATE_URL) === FALSE) {
220
        error_page('Not a valid URL');
221
    }
222
    $fname = basename($url);
223
    if (!is_valid_filename($fname)) {
224
        error_page('Invalid filename. '.filename_rules());
225
    }
226
    $path = "$dir/$fname";
227
    if (file_exists($path)) {
228
        error_page("File $fname exists; delete it first.");
229
    }
230
    copy($url, $path);
231
    $notice = "Fetched file from <strong>$url</strong><br/>";
232
    list_files($user, $notice);
233
}
234
235
// delete a sandbox file.
236
//
237
function delete_file($user) {
238
    $name = get_str('name');
239
    if (!is_valid_filename($name)) {
240
        error_page('Invalid filename. '.filename_rules());
241
    }
242
    $dir = sandbox_dir($user);
243
    unlink("$dir/$name");
244
    unlink("$dir/.md5/$name");
245
    $notice = "<strong>$name</strong> was deleted from your sandbox<br/>";
246
    list_files($user, $notice);
247
}
248
249
function download_file($user) {
250
    $name = get_str('name');
251
    if (!is_valid_filename($name)) {
252
        error_page('Invalid filename. '.filename_rules());
253
    }
254
    $dir = sandbox_dir($user);
255
    do_download("$dir/$name");
256
}
257
258
function view_file($user) {
259
    $name = get_str('name');
260
    if (!is_valid_filename($name)) {
261
        error_page('Invalid filename. '.filename_rules());
262
    }
263
    $dir = sandbox_dir($user);
264
    $path = "$dir/$name";
265
    if (!is_file($path)) {
266
        error_page("no such file");
267
    }
268
    echo "<pre>\n";
269
    readfile($path);
270
    echo "</pre>\n";
271
}
272
273
$user = get_logged_in_user();
0 ignored issues
show
Bug introduced by
Are you sure the assignment to $user is correct as get_logged_in_user() seems to always return null.

This check looks for function or method calls that always return null and whose return value is assigned to a variable.

class A
{
    function getObject()
    {
        return null;
    }

}

$a = new A();
$object = $a->getObject();

The method getObject() can return nothing but null, so it makes no sense to assign that value to a variable.

The reason is most likely that a function or method is imcomplete or has been reduced for debug purposes.

Loading history...
274
if (!has_file_access($user)) error_page("no job submission access");
275
276
$action = get_str('action', true);
277
if (!$action) $action = post_str('action', true);
278
279
switch ($action) {
280
case '': list_files($user); break;
281
case 'upload_file': upload_file($user); break;
282
case 'add_file': add_file($user); break;
283
case 'get_file': get_file($user); break;
284
case 'delete_file': delete_file($user); break;
285
case 'download_file': download_file($user); break;
286
case 'view_file': view_file($user); break;
0 ignored issues
show
Unused Code introduced by
The call to view_file() has too many arguments starting with $user. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

286
case 'view_file': /** @scrutinizer ignore-call */ view_file($user); break;

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.

Loading history...
287
case 'add_form': add_form($user); break;
0 ignored issues
show
Unused Code introduced by
The call to add_form() has too many arguments starting with $user. ( Ignorable by Annotation )

If this is a false-positive, you can also ignore this issue in your code via the ignore-call  annotation

287
case 'add_form': /** @scrutinizer ignore-call */ add_form($user); break;

This check compares calls to functions or methods with their respective definitions. If the call has more arguments than are defined, it raises an issue.

If a function is defined several times with a different number of parameters, the check may pick up the wrong definition and report false positives. One codebase where this has been known to happen is Wordpress. Please note the @ignore annotation hint above.

Loading history...
288
default: error_page("no such action: ".htmlspecialchars($action));
0 ignored issues
show
Coding Style introduced by
DEFAULT keyword must be indented 4 spaces from SWITCH keyword
Loading history...
Coding Style introduced by
DEFAULT case must have a breaking statement
Loading history...
289
}
290
291
?>
292