v4.2 update

VeeamHub · Oct 20, 2020 · 060f2f7 · 060f2f7
1 parent 0233494
commit 060f2f7
Show file tree

Hide file tree

Showing 9 changed files with 3,333 additions and 1,663 deletions.
diff --git a/download.php b/download.php
@@ -72,15 +72,15 @@ function get_mime_type($filename) {
 	if (isset($_POST['ext'])) { $ext = $_POST['ext']; }
 	if (isset($_POST['name'])) { $name = $_POST['name']; }
 
-	if (isset($_POST['file'])) { 
-		$file =  str_replace('..', '', isset($_POST['file'])?$_POST['file']:'');
-		$filename = basename($name);
+	if (isset($_POST['file'])) {
+		$file = sys_get_temp_dir() . '/' . basename($_POST['file']);
+		$filename = htmlspecialchars(basename($name));
 
 		if ($ext != 'plain')
 			$filename .= '.' . $ext;
 
 		if(!is_file($file))
-			exit();
+			exit('File not found');
 
 		header('Pragma: public');
 		header('Expires: 0');
@@ -96,12 +96,15 @@ function get_mime_type($filename) {
 		} else {
 			header('Last-Modified: ' . gmdate ('D, d M Y H:i:s', filemtime ($file)).' GMT');
 			header('Cache-Control: private', false);
-			if ($ext == "plain") {
+
+			if ($ext == 'plain') {
 				$mime = get_mime_type($filename);
+
 				header('Content-Type: ' . $mime);
 			} else {
 				header('Content-Type: application/zip');
 			}
+
 			header('Content-Transfer-Encoding: binary');
 			header('Content-Length: ' . filesize($file));
 			header('Content-Disposition: attachment; filename=" ' . $filename . '"');
@@ -110,8 +113,6 @@ function get_mime_type($filename) {
 
 		readfile($file);
 		unlink($file);
-
-
 	} else {
 		header('Location: index.php');
 	}