diff options
Diffstat (limited to 'ncp-web/upload.php')
-rw-r--r-- | ncp-web/upload.php | 47 |
1 files changed, 47 insertions, 0 deletions
diff --git a/ncp-web/upload.php b/ncp-web/upload.php new file mode 100644 index 00000000..38b47cb7 --- /dev/null +++ b/ncp-web/upload.php @@ -0,0 +1,47 @@ +<?php +/// +// NextCloudPi Web Panel backend +// +// Copyleft 2019 by Ignacio Nunez Hernanz <nacho _a_t_ ownyourbits _d_o_t_ com> +// GPL licensed (see end of file) * Use at your own risk! +// +// More at https://nextcloudpi.com +/// + +include ('csrf.php'); +session_start(); + +// CSRF check +$token = isset($_POST['csrf_token']) ? $_POST['csrf_token'] : ''; +if ( empty($token) || !validateCSRFToken($token) ) + exit( '{ "output": "Unauthorized request. Try reloading the page" }' ); + +isset($_FILES['backup']) or exit( '{ "output": "no upload" }' ); + +$error=$_FILES['backup']['error']; +if ($error !== 0) + exit( '{ "output": "upload error ' . $error . '" }' ); + +$file_name = $_POST['csrf_token'] . basename($_FILES['backup']['name']); +$file_name = str_replace('/', '', $file_name); +$file_size = $_FILES['backup']['size']; +$file_tmp = $_FILES['backup']['tmp_name']; +$file_type = $_FILES['backup']['type']; + +preg_match( '/\.\./' , $file_name, $matches ) + and exit( '{ "output": "Invalid input" , "token": "' . getCSRFToken() . '" }' ); + +if($file_size === 0) + $errors[]='No file'; + +$extension = pathinfo($file_name, PATHINFO_EXTENSION); +if ($extension !== "tar" and $extension !== "gz") + exit( '{ "output": "invalid file" }' ); + +if (!move_uploaded_file($file_tmp, sys_get_temp_dir() . '/' . $file_name)) + exit('{ "output": "upload denied" }'); + +// return JSON +echo '{ "token": "' . getCSRFToken() . '",'; // Get new token +echo ' "ret": "0" }'; +?> |