PortalArticles_Controller::action_sportal_attach()

Complexity

Conditions	28
Paths	596

Size

Total Lines	160
Code Lines	73

Duplication

Lines	0
Ratio	0 %

Importance

Changes	1
Bugs	0	Features	0

<?php
	public function action_sportal_attach()
	{
		global $txt, $modSettings, $context;

		// Some defaults that we need.
		$context['no_last_modified'] = true;

		// Make sure some attachment was requested and they can view them
		if (!isset($_GET['article'], $_GET['attach']))
		{
			throw new Elk_Exception('no_access', false);
		}

		// No funny business, you need to have access to the article to see its attachments
		if (sportal_article_access($_GET['article']) === false)
		{
			throw new Elk_Exception('no_access', false);
		}

		// We need to do some work on attachments.
		$id_article = (int) $_GET['article'];
		$id_attach = (int) $_GET['attach'];

		if (isset($_GET['thumb']))
			$attachment = sportal_get_attachment_thumb_from_article($id_article, $id_attach);
		else
			$attachment = sportal_get_attachment_from_article($id_article, $id_attach);

		if (empty($attachment))
		{
			throw new Elk_Exception('no_access', false);
		}

		list ($real_filename, $file_hash, $file_ext, $id_attach, $attachment_type, $mime_type, $width, $height) = $attachment;
		$filename = $modSettings['sp_articles_attachment_dir'] . '/' . $id_attach . '_' . $file_hash . '.elk';

		// This is done to clear any output that was made before now.
		while (ob_get_level() > 0)
		{
			@ob_end_clean();
		}

		ob_start();
		header('Content-Encoding: none');

		// No point in a nicer message, because this is supposed to be an attachment anyway...
		if (!file_exists($filename))
		{
			loadLanguage('Errors');

			header((preg_match('~HTTP/1\.[01]~i', $_SERVER['SERVER_PROTOCOL']) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0') . ' 404 Not Found');
			header('Content-Type: text/plain; charset=UTF-8');

			// We need to die like this *before* we send any anti-caching headers as below.
			die('404 - ' . $txt['attachment_not_found']);
		}

		// If it hasn't been modified since the last time this attachment was retrieved,
		// there's no need to display it again.
		if (!empty($_SERVER['HTTP_IF_MODIFIED_SINCE']))
		{
			list ($modified_since) = explode(';', $_SERVER['HTTP_IF_MODIFIED_SINCE']);
			if (strtotime($modified_since) >= filemtime($filename))
			{
				@ob_end_clean();

				// Answer the question - no, it hasn't been modified ;).
				header('HTTP/1.1 304 Not Modified');
			}
			exit(0);

Using exit here is not recommended.

		}

		// Check whether the ETag was sent back, and cache based on that...
		$eTag = '"' . substr($id_attach . $real_filename . filemtime($filename), 0, 64) . '"';
		if (!empty($_SERVER['HTTP_IF_NONE_MATCH']) && strpos($_SERVER['HTTP_IF_NONE_MATCH'], $eTag) !== false)
		{
			@ob_end_clean();

			header('HTTP/1.1 304 Not Modified');
			exit(0);
		}

		// Send the attachment headers.
		header('Content-Transfer-Encoding: binary');
		header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 525600 * 60) . ' GMT');
		header('Last-Modified: ' . gmdate('D, d M Y H:i:s', filemtime($filename)) . ' GMT');
		header('Accept-Ranges: bytes');
		header('Connection: close');
		header('ETag: ' . $eTag);

		// Make sure the mime type warrants an inline display.
		if (isset($_GET['image']) && !empty($mime_type) && strpos($mime_type, 'image/') !== 0)
		{
			unset($_GET['image']);
		}
		// Does this have a mime type?
		elseif (!empty($mime_type) && (isset($_GET['image']) || !in_array($file_ext, array('jpg', 'gif', 'jpeg', 'x-ms-bmp', 'png', 'psd', 'tiff', 'iff'))))
		{
			header('Content-Type: ' . strtr($mime_type, array('image/bmp' => 'image/x-ms-bmp')));
		}
		else
		{
			header('Content-Type: application/octet-stream');
		}

		$disposition = !isset($_GET['image']) ? 'attachment' : 'inline';
		$fileName = str_replace('"', '',  $filename);

		// Send as UTF-8 if the name requires that
		$altName = '';
		if (preg_match('~[\x80-\xFF]~', $fileName))
		{
			$altName = "; filename*=UTF-8''" . rawurlencode($fileName);
		}
		header('Content-Disposition: ' . $disposition . '; filename="' . $fileName . '"' . $altName);

		// If this has an "image extension" - but isn't actually an image - then ensure it isn't cached cause of silly IE.
		if (!isset($_GET['image']) && in_array($file_ext, array('gif', 'jpg', 'bmp', 'png', 'jpeg', 'tiff')))
		{
			header('Pragma: no-cache');
			header('Cache-Control: no-cache');
		}
		else
		{
			header('Cache-Control: max-age=' . (525600 * 60) . ', private');
		}

		if (empty($modSettings['enableCompressedOutput']) || filesize($filename) > 4194304)
		{
			header('Content-Length: ' . filesize($filename));
		}

		// Try to buy some time...
		@set_time_limit(600);

		// Since we don't do output compression for files this large...
		if (filesize($filename) > 4194304)
		{
			// Forcibly end any output buffering going on.
			while (ob_get_level() > 0)
			{
				@ob_end_clean();
			}

			$fp = fopen($filename, 'rb');
			while (!feof($fp))
			{
				echo fread($fp, 8192);

				flush();
			}
			fclose($fp);
		}
		// On some of the less-bright hosts, readfile() is disabled.  It's just a faster, more byte safe, version of what's in the if.
		elseif (@readfile($filename) === null)
		{
			echo file_get_contents($filename);
		}

		obExit(false);
	}