PHP file upload script for Prosody mod_http_upload_external

..readme.md

This script is based on https://hg.prosody.im/prosody-modules/file/f86478a02b25/mod_http_upload_external/share.php

It also supports using the file as index.php to allow stripping the php file from urls:

https://files.xmpp.msg.lol/6186af39-cc50-486e-9bc6-7f40143a62f7/pexels-photo-126407.jpeg
or
https://files.xmpp.msg.lol/index.php/6186af39-cc50-486e-9bc6-7f40143a62f7/pexels-photo-126407.jpeg

It has been changed to include proper caching headers (working with the cronjob below) to allow caching a file until it gets deleted. It also sends files with their mime type to allow displaying supported formats directly in the browser or inline in xmpp clients.

I'm using it in combination with a cronjob that automatically removes old files after a while. This is the same path I have configured in $CONFIG_STORE_DIR (which you shouldn't use /tmp for in this setup):

0 */2 * * * find /www/xmppfiles -type f -mmin +10080 -delete

If you adjust the deletion time please also adjust the times in the php script for the Cache-Control header.

.htaccess

RewriteEngine on
RewriteCond %{REQUEST_FILENAME} !-d
RewriteCond %{REQUEST_FILENAME} !-f
RewriteRule . /index.php [L]

index.php

<?php

/*
  PHP script to handle file uploads and downloads for Prosody's mod_http_upload_external

  Tested with Apache 2.2+ and PHP 5.3+

  ** Why this script?

  This script only allows uploads that have been authorized by mod_http_upload_external. It
  attempts to make the upload/download as safe as possible, considering that there are *many*
  security concerns involved with allowing arbitrary file upload/download on a web server.

  With that said, I do not consider myself a PHP developer, and at the time of writing, this
  code has had no external review. Use it at your own risk. I make no claims that this code
  is secure.

  ** How to use?

  Drop this file somewhere it will be served by your web server. Edit the config options below.

  In Prosody set:

    http_upload_external_base_url = "https://your.example.com/path/to/share.php/"
    or (requires mod_rewrite in apache and the .htaccess file)
    http_upload_external_base_url = "https://your.example.com/"
    http_upload_external_secret = "this is your secret string"

  ** License

  (C) 2016 Matthew Wild <[email protected]>

  Permission is hereby granted, free of charge, to any person obtaining a copy of this software
  and associated documentation files (the "Software"), to deal in the Software without restriction,
  including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense,
  and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so,
  subject to the following conditions:

  The above copyright notice and this permission notice shall be included in all copies or substantial
  portions of the Software.

  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING
  BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND
  NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
  DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

*/

/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
/*         CONFIGURATION OPTIONS                   */
/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/

/* Change this to a directory that is writable by your web server, but is outside your web root */
$CONFIG_STORE_DIR = '/tmp';

/* This must be the same as 'http_upload_external_secret' that you set in Prosody's config file */
$CONFIG_SECRET = 'changeme';

/* For people who need options to tweak that they don't understand... here you are */
$CONFIG_CHUNK_SIZE = 4096;

/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/
/*         END OF CONFIGURATION                    */
/*\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\/\*/

/* Do not edit below this line unless you know what you are doing (spoiler: nobody does) */

//$upload_file_name = substr($_SERVER['PHP_SELF'], strlen($_SERVER['SCRIPT_NAME'])+1);


if(isset($_SERVER["REDIRECT_URL"])) {
	$upload_file_name = substr($_SERVER["REDIRECT_URL"], 1);
} else {
	$upload_file_name = substr($_SERVER['PHP_SELF'], strlen($_SERVER['SCRIPT_NAME'])+1);
}

$store_file_name = $CONFIG_STORE_DIR . '/store-' . hash('sha256', $upload_file_name);

$request_method = $_SERVER['REQUEST_METHOD'];

if(array_key_exists('v', $_GET) === TRUE && $request_method === 'PUT') {
	$headers = getallheaders();

	$upload_file_size = $headers['Content-Length'];
	$upload_token = $_GET['v'];

	$calculated_token = hash_hmac('sha256', "$upload_file_name $upload_file_size", $CONFIG_SECRET);
	if($upload_token !== $calculated_token) {
		header('HTTP/1.0 403 Forbidden');
		exit;
	}

	/* Open a file for writing */
	$store_file = fopen($store_file_name, 'x');

	if($store_file === FALSE) {
		header('HTTP/1.0 409 Conflict');
		exit;
	}

	/* PUT data comes in on the stdin stream */
	$incoming_data = fopen('php://input', 'r');

	/* Read the data a chunk at a time and write to the file */
	while ($data = fread($incoming_data, $CONFIG_CHUNK_SIZE)) {
		fwrite($store_file, $data);
	}

	/* Close the streams */
	fclose($incoming_data);
	fclose($store_file);
} else if($request_method === 'GET' || $request_method === 'HEAD') {
	// Send file (using X-Sendfile would be nice here...)
	if(file_exists($store_file_name)) {
		$finfo = finfo_open(FILEINFO_MIME_TYPE);
		header('Content-Type: ' . finfo_file($finfo, $store_file_name));
		finfo_close($finfo);

		header('Cache-Control: max-age=' . (filemtime($store_file_name) + 604800 - time()));
		header('Content-Length: '.filesize($store_file_name));
		if($request_method !== 'HEAD') {
			readfile($store_file_name);
		}
	} else {
		header('HTTP/1.0 404 Not Found');
	}
} else {
	header('HTTP/1.0 400 Bad Request');
}

exit;