root/releases/elgg0.8rc2/lib/phpthumb/phpThumb.php

<?php

die("no");

//////////////////////////////////////////////////////////////
///  phpThumb() by James Heinrich <info@silisoftware.com>   //
//        available at http://phpthumb.sourceforge.net     ///
//////////////////////////////////////////////////////////////
///                                                         //
// See: phpthumb.changelog.txt for recent changes           //
// See: phpthumb.readme.txt for usage instructions          //
//                                                         ///
//////////////////////////////////////////////////////////////

error_reporting(E_ALL);
ini_set('display_errors', '1');
if (!@ini_get('safe_mode')) {
    set_time_limit(60);  // shouldn't take nearly this long in most cases, but with many filter and/or a slow server...
}
ini_set('magic_quotes_runtime', '0');
if (@ini_get('magic_quotes_runtime')) {
    die('"magic_quotes_runtime" is set in php.ini, cannot run phpThumb with this enabled');
}
$starttime = array_sum(explode(' ', microtime()));

// this script relies on the superglobal arrays, fake it here for old PHP versions
if (phpversion() < '4.1.0') {
    $_SERVER = $HTTP_SERVER_VARS;
    $_GET    = $HTTP_GET_VARS;
}

// instantiate a new phpThumb() object
ob_start();
if (!include_once(dirname(__FILE__).'/phpthumb.class.php')) {
    ob_end_flush();
    die('failed to include_once("'.realpath(dirname(__FILE__).'/phpthumb.class.php').'")');
}
ob_end_clean();
$phpThumb = new phpThumb();
$phpThumb->DebugTimingMessage('phpThumb.php start', __FILE__, __LINE__, $starttime);

// phpThumbDebug[0] used to be here, but may reveal too much
// info when high_security_mode should be enabled (not set yet)

if (file_exists(dirname(__FILE__).'/phpThumb.config.php')) {
    ob_start();
    if (include_once(dirname(__FILE__).'/phpThumb.config.php')) {
        // great
    } else {
        ob_end_flush();
        $phpThumb->ErrorImage('failed to include_once('.dirname(__FILE__).'/phpThumb.config.php) - realpath="'.realpath(dirname(__FILE__).'/phpThumb.config.php').'"');
    }
    ob_end_clean();
} elseif (file_exists(dirname(__FILE__).'/phpThumb.config.php.default')) {
    $phpThumb->ErrorImage('Please rename "phpThumb.config.php.default" to "phpThumb.config.php"');
} else {
    $phpThumb->ErrorImage('failed to include_once('.dirname(__FILE__).'/phpThumb.config.php) - realpath="'.realpath(dirname(__FILE__).'/phpThumb.config.php').'"');
}

if (!@$PHPTHUMB_CONFIG['disable_pathinfo_parsing'] && (empty($_GET) || isset($_GET['phpThumbDebug'])) && !empty($_SERVER['PATH_INFO'])) {
    $_SERVER['PHP_SELF'] = str_replace($_SERVER['PATH_INFO'], '', @$_SERVER['PHP_SELF']);

    $args = explode(';', substr($_SERVER['PATH_INFO'], 1));
    $phpThumb->DebugMessage('PATH_INFO.$args set to ('.implode(')(', $args).')', __FILE__, __LINE__);
    if (!empty($args)) {
        $_GET['src'] = @$args[count($args) - 1];
        if (eregi('^new\=([a-z0-9]+)', $_GET['src'], $matches)) {
            unset($_GET['src']);
            $_GET['new'] = $matches[1];
        }
    }
    if (eregi('^([0-9]*)x?([0-9]*)$', @$args[count($args) - 2], $matches)) {
        $_GET['w'] = $matches[1];
        $_GET['h'] = $matches[2];
        $phpThumb->DebugMessage('PATH_INFO."w"x"h" set to "'.$_GET['w'].'"x"'.$_GET['h'].'"', __FILE__, __LINE__);
    }
    for ($i = 0; $i < count($args) - 2; $i++) {
        @list($key, $value) = explode('=', @$args[$i]);
        if (substr($key, -2) == '[]') {
            $array_key_name = substr($key, 0, -2);
            $_GET[$array_key_name][] = $value;
            $phpThumb->DebugMessage('PATH_INFO."'.$array_key_name.'[]" = "'.$value.'"', __FILE__, __LINE__);
        } else {
            $_GET[$key] = $value;
            $phpThumb->DebugMessage('PATH_INFO."'.$key.'" = "'.$value.'"', __FILE__, __LINE__);
        }
    }
}

if (@$PHPTHUMB_CONFIG['high_security_enabled']) {
    if (!@$_GET['hash']) {
        $phpThumb->ErrorImage('ERROR: missing hash');
    } elseif (strlen($PHPTHUMB_CONFIG['high_security_password']) < 5) {
        $phpThumb->ErrorImage('ERROR: strlen($PHPTHUMB_CONFIG[high_security_password]) < 5');
    } elseif ($_GET['hash'] != md5(str_replace('&hash='.$_GET['hash'], '', $_SERVER['QUERY_STRING']).$PHPTHUMB_CONFIG['high_security_password'])) {
        $phpThumb->ErrorImage('ERROR: invalid hash');
    }
}

////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[0]', __FILE__, __LINE__);
if (@$_GET['phpThumbDebug'] == '0') {
    $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////

// returned the fixed string if the evil "magic_quotes_gpc" setting is on
if (get_magic_quotes_gpc()) {
    $RequestVarsToStripSlashes = array('src', 'wmf', 'file', 'err', 'goto', 'down');
    foreach ($RequestVarsToStripSlashes as $dummy => $key) {
        if (isset($_GET[$key])) {
            $_GET[$key] = stripslashes($_GET[$key]);
        }
    }
}

if (!@$_SERVER['PATH_INFO'] && !@$_SERVER['QUERY_STRING']) {
    echo 'phpThumb() v'.$phpThumb->phpthumb_version.'<br><a href="http://phpthumb.sourceforge.net">http://phpthumb.sourceforge.net</a><br><br>ERROR: no parameters specified';
    unset($phpThumb);
    exit;
}

if (@$_GET['src'] && isset($_GET['md5s']) && empty($_GET['md5s'])) {
    if (eregi('^(f|ht)tps?://', $_GET['src'])) {
        if ($rawImageData = phpthumb_functions::SafeURLread($_GET['src'], $error)) {
            $md5s = md5($rawImageData);
        }
    } else {
        $SourceFilename = $phpThumb->ResolveFilenameToAbsolute($_GET['src']);
        if (is_readable($SourceFilename)) {
            $md5s = phpthumb_functions::md5_file_safe($SourceFilename);
        } else {
            $phpThumb->ErrorImage('ERROR: "'.$SourceFilename.'" cannot be read');
        }
    }
    if (@$_SERVER['HTTP_REFERER']) {
        $phpThumb->ErrorImage('&md5s='.$md5s);
    } else {
        die('&md5s='.$md5s);
    }
}

if (!empty($PHPTHUMB_CONFIG)) {
    foreach ($PHPTHUMB_CONFIG as $key => $value) {
        $keyname = 'config_'.$key;
        $phpThumb->setParameter($keyname, $value);
        if (!eregi('password', $key)) {
            $phpThumb->DebugMessage('setParameter('.$keyname.', '.$phpThumb->phpThumbDebugVarDump($value).')', __FILE__, __LINE__);
        }
    }
} else {
    $phpThumb->DebugMessage('$PHPTHUMB_CONFIG is empty', __FILE__, __LINE__);
}

if (@$_GET['src'] && !@$PHPTHUMB_CONFIG['allow_local_http_src'] && eregi('^http://'.@$_SERVER['HTTP_HOST'].'(.+)', @$_GET['src'], $matches)) {
    $phpThumb->ErrorImage('It is MUCH better to specify the "src" parameter as "'.$matches[1].'" instead of "'.$matches[0].'".'."\n\n".'If you really must do it this way, enable "allow_local_http_src" in phpThumb.config.php');
}

////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[1]', __FILE__, __LINE__);
if (@$_GET['phpThumbDebug'] == '1') {
    $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////

$parsed_url_referer = parse_url(@$_SERVER['HTTP_REFERER']);
if ($phpThumb->config_nooffsitelink_require_refer && !in_array(@$parsed_url_referer['host'], $phpThumb->config_nohotlink_valid_domains)) {
    $phpThumb->ErrorImage('config_nooffsitelink_require_refer enabled and '.(@$parsed_url_referer['host'] ? '"'.$parsed_url_referer['host'].'" is not an allowed referer' : 'no HTTP_REFERER exists'));
}
$parsed_url_src = parse_url(@$_GET['src']);
if ($phpThumb->config_nohotlink_enabled && $phpThumb->config_nohotlink_erase_image && eregi('^(f|ht)tps?://', @$_GET['src']) && !in_array(@$parsed_url_src['host'], $phpThumb->config_nohotlink_valid_domains)) {
    $phpThumb->ErrorImage($phpThumb->config_nohotlink_text_message);
}

if ($phpThumb->config_mysql_query) {
    if ($cid = @mysql_connect($phpThumb->config_mysql_hostname, $phpThumb->config_mysql_username, $phpThumb->config_mysql_password)) {
        if (@mysql_select_db($phpThumb->config_mysql_database, $cid)) {
            if ($result = @mysql_query($phpThumb->config_mysql_query, $cid)) {
                if ($row = @mysql_fetch_array($result)) {

                    mysql_free_result($result);
                    mysql_close($cid);
                    $phpThumb->setSourceData($row[0]);
                    unset($row);

                } else {
                    mysql_free_result($result);
                    mysql_close($cid);
                    $phpThumb->ErrorImage('no matching data in database.');
                }
            } else {
                mysql_close($cid);
                $phpThumb->ErrorImage('Error in MySQL query: "'.mysql_error($cid).'"');
            }
        } else {
            mysql_close($cid);
            $phpThumb->ErrorImage('cannot select MySQL database: "'.mysql_error($cid).'"');
        }
    } else {
        $phpThumb->ErrorImage('cannot connect to MySQL server');
    }
    unset($_GET['id']);
}

////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[2]', __FILE__, __LINE__);
if (@$_GET['phpThumbDebug'] == '2') {
    $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////

if (@$PHPTHUMB_CONFIG['cache_default_only_suffix'] && (strpos($PHPTHUMB_CONFIG['cache_default_only_suffix'], '*') !== false)) {
    $PHPTHUMB_DEFAULTS_DISABLEGETPARAMS = true;
}
$allowedGETparameters = array('src', 'new', 'w', 'h', 'wp', 'hp', 'wl', 'hl', 'ws', 'hs', 'f', 'q', 'sx', 'sy', 'sw', 'sh', 'zc', 'bc', 'bg', 'bgt', 'fltr', 'file', 'goto', 'err', 'xto', 'ra', 'ar', 'aoe', 'far', 'iar', 'maxb', 'down', 'phpThumbDebug', 'hash', 'md5s');
if (!empty($PHPTHUMB_DEFAULTS) && is_array($PHPTHUMB_DEFAULTS)) {
    $phpThumb->DebugMessage('setting $PHPTHUMB_DEFAULTS['.implode(';', array_keys($PHPTHUMB_DEFAULTS)).']', __FILE__, __LINE__);
    foreach ($PHPTHUMB_DEFAULTS as $key => $value) {
        if ($PHPTHUMB_DEFAULTS_GETSTRINGOVERRIDE || !isset($_GET[$key])) {
            $_GET[$key] = $value;
            $phpThumb->DebugMessage('PHPTHUMB_DEFAULTS assigning ('.$value.') to $_GET['.$key.']', __FILE__, __LINE__);
            //$phpThumb->DebugMessage('PHPTHUMB_DEFAULTS.setParameter('.$key.', '.$phpThumb->phpThumbDebugVarDump($value).')', __FILE__, __LINE__);
            //$phpThumb->setParameter($key, $value);
        }
    }
}
foreach ($_GET as $key => $value) {
    if (@$PHPTHUMB_DEFAULTS_DISABLEGETPARAMS && ($key != 'src')) {
        // disabled, do not set parameter
        $phpThumb->DebugMessage('ignoring $_GET['.$key.'] because of $PHPTHUMB_DEFAULTS_DISABLEGETPARAMS', __FILE__, __LINE__);
    } elseif (in_array($key, $allowedGETparameters)) {
        $phpThumb->DebugMessage('setParameter('.$key.', '.$phpThumb->phpThumbDebugVarDump($value).')', __FILE__, __LINE__);
        $phpThumb->setParameter($key, $value);
    } else {
        $phpThumb->ErrorImage('Forbidden parameter: '.$key);
    }
}

////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[3]', __FILE__, __LINE__);
if (@$_GET['phpThumbDebug'] == '3') {
    $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////

//if (!@$_GET['phpThumbDebug'] && !$phpThumb->sourceFilename && !function_exists('ImageJPEG') && !function_exists('ImagePNG') && !function_exists('ImageGIF')) {
if (!@$_GET['phpThumbDebug'] && !is_file($phpThumb->sourceFilename) && !phpthumb_functions::gd_version()) {
    if (!headers_sent()) {
        // base64-encoded error image in GIF format
        $ERROR_NOGD = 'R0lGODlhIAAgALMAAAAAABQUFCQkJDY2NkZGRldXV2ZmZnJycoaGhpSUlKWlpbe3t8XFxdXV1eTk5P7+/iwAAAAAIAAgAAAE/vDJSau9WILtTAACUinDNijZtAHfCojS4W5H+qxD8xibIDE9h0OwWaRWDIljJSkUJYsN4bihMB8th3IToAKs1VtYM75cyV8sZ8vygtOE5yMKmGbO4jRdICQCjHdlZzwzNW4qZSQmKDaNjhUMBX4BBAlmMywFSRWEmAI6b5gAlhNxokGhooAIK5o/pi9vEw4Lfj4OLTAUpj6IabMtCwlSFw0DCKBoFqwAB04AjI54PyZ+yY3TD0ss2YcVmN/gvpcu4TOyFivWqYJlbAHPpOntvxNAACcmGHjZzAZqzSzcq5fNjxFmAFw9iFRunD1epU6tsIPmFCAJnWYE0FURk7wJDA0MTKpEzoWAAskiAAA7';
        header('Content-Type: image/gif');
        echo base64_decode($ERROR_NOGD);
    } else {
        echo '*** ERROR: No PHP-GD support available ***';
    }
    exit;
}

// check to see if file can be output from source with no processing or caching
$CanPassThroughDirectly = true;
if ($phpThumb->rawImageData) {
    // data from SQL, should be fine
} elseif (eregi('^(f|ht)tp\://', $phpThumb->src)) {
    $phpThumb->DebugMessage('$CanPassThroughDirectly=false because eregi("^(f|ht)tp\://", '.$phpThumb->src.')', __FILE__, __LINE__);
    $CanPassThroughDirectly = false;
} elseif (!@is_file($phpThumb->sourceFilename)) {
    $phpThumb->DebugMessage('$CanPassThroughDirectly=false because !@is_file('.$phpThumb->sourceFilename.')', __FILE__, __LINE__);
    $CanPassThroughDirectly = false;
} elseif (!@is_readable($phpThumb->sourceFilename)) {
    $phpThumb->DebugMessage('$CanPassThroughDirectly=false because !@is_readable('.$phpThumb->sourceFilename.')', __FILE__, __LINE__);
    $CanPassThroughDirectly = false;
}
foreach ($_GET as $key => $value) {
    switch ($key) {
        case 'src':
            // allowed
            break;

        case 'w':
        case 'h':
            // might be OK if exactly matches original
            break;

        case 'phpThumbDebug':
            // handled in direct-passthru code
            break;

        default:
            // all other parameters will cause some processing,
            // therefore cannot pass through original image unmodified
            $CanPassThroughDirectly = false;
            $UnAllowedGET[] = $key;
            break;
    }
}
if (!empty($UnAllowedGET)) {
    $phpThumb->DebugMessage('$CanPassThroughDirectly=false because $_GET['.implode(';', array_unique($UnAllowedGET)).'] are set', __FILE__, __LINE__);
}

////////////////////////////////////////////////////////////////
// Debug output, to try and help me diagnose problems
$phpThumb->DebugTimingMessage('phpThumbDebug[4]', __FILE__, __LINE__);
if (@$_GET['phpThumbDebug'] == '4') {
    $phpThumb->phpThumbDebug();
}
////////////////////////////////////////////////////////////////

function SendSaveAsFileHeaderIfNeeded() {
    if (headers_sent()) {
        return false;
    }
    global $phpThumb;
    if (@$_GET['down']) {
        $downloadfilename = ereg_replace('[/\\:\*\?"<>|]', '_', $_GET['down']);
        if (phpthumb_functions::version_compare_replacement(phpversion(), '4.1.0', '>=')) {
            $downloadfilename = trim($downloadfilename, '.');
        }
        if (@$downloadfilename) {
            $phpThumb->DebugMessage('SendSaveAsFileHeaderIfNeeded() sending header: Content-Disposition: attachment; filename="'.$downloadfilename.'"', __FILE__, __LINE__);
            header('Content-Disposition: attachment; filename="'.$downloadfilename.'"');
            return true;
        }
    }
    $phpThumb->DebugMessage('SendSaveAsFileHeaderIfNeeded() sending header: Content-Disposition: inline', __FILE__, __LINE__);
    header('Content-Disposition: inline');
    return true;
}

$phpThumb->DebugMessage('$CanPassThroughDirectly="'.intval($CanPassThroughDirectly).'" && $phpThumb->src="'.$phpThumb->src.'"', __FILE__, __LINE__);
while ($CanPassThroughDirectly && $phpThumb->src) {
    // no parameters set, passthru
    $SourceFilename = $phpThumb->ResolveFilenameToAbsolute($phpThumb->src);

    // security and size checks
    if ($phpThumb->getimagesizeinfo = @GetImageSize($SourceFilename)) {
        $phpThumb->DebugMessage('Direct passthru GetImageSize() returned [w='.$phpThumb->getimagesizeinfo[0].';h='.$phpThumb->getimagesizeinfo[1].';t='.$phpThumb->getimagesizeinfo[2].']', __FILE__, __LINE__);

        if (!@$_GET['w'] && !@$_GET['wp'] && !@$_GET['wl'] && !@$_GET['ws'] && !@$_GET['h'] && !@$_GET['hp'] && !@$_GET['hl'] && !@$_GET['hs']) {
            // no resizing needed
            $phpThumb->DebugMessage('Passing "'.$SourceFilename.'" through directly, no resizing required ("'.$phpThumb->getimagesizeinfo[0].'"x"'.$phpThumb->getimagesizeinfo[1].'")', __FILE__, __LINE__);
        } elseif (($phpThumb->getimagesizeinfo[0] <= @$_GET['w']) && ($phpThumb->getimagesizeinfo[1] <= @$_GET['h']) && ((@$_GET['w'] == $phpThumb->getimagesizeinfo[0]) || (@$_GET['h'] == $phpThumb->getimagesizeinfo[1]))) {
            // image fits into 'w'x'h' box, and at least one dimension matches exactly, therefore no resizing needed
            $phpThumb->DebugMessage('Passing "'.$SourceFilename.'" through directly, no resizing required ("'.$phpThumb->getimagesizeinfo[0].'"x"'.$phpThumb->getimagesizeinfo[1].'" fits inside "'.@$_GET['w'].'"x"'.@$_GET['h'].'")', __FILE__, __LINE__);
        } else {
            $phpThumb->DebugMessage('Not passing "'.$SourceFilename.'" through directly because resizing required (from "'.$phpThumb->getimagesizeinfo[0].'"x"'.$phpThumb->getimagesizeinfo[1].'" to "'.@$_GET['w'].'"x"'.@$_GET['h'].'")', __FILE__, __LINE__);
            break;
        }
        switch ($phpThumb->getimagesizeinfo[2]) {
            case 1: // GIF
            case 2: // JPG
            case 3: // PNG
                // great, let it through
                break;
            default:
                // browser probably can't handle format, remangle it to JPEG/PNG/GIF
                $phpThumb->DebugMessage('Not passing "'.$SourceFilename.'" through directly because $phpThumb->getimagesizeinfo[2] = "'.$phpThumb->getimagesizeinfo[2].'"', __FILE__, __LINE__);
                break 2;
        }

        $ImageCreateFunctions = array(1=>'ImageCreateFromGIF', 2=>'ImageCreateFromJPEG', 3=>'ImageCreateFromPNG');
        $theImageCreateFunction = @$ImageCreateFunctions[$phpThumb->getimagesizeinfo[2]];
        if ($phpThumb->config_disable_onlycreateable_passthru || (function_exists($theImageCreateFunction) && ($dummyImage = @$theImageCreateFunction($SourceFilename)))) {

            // great
            if (@is_resource($dummyImage)) {
                unset($dummyImage);
            }

            if (headers_sent()) {
                $phpThumb->ErrorImage('Headers already sent ('.basename(__FILE__).' line '.__LINE__.')');
                exit;
            }
            if (@$_GET['phpThumbDebug']) {
                $phpThumb->DebugTimingMessage('skipped direct $SourceFilename passthru', __FILE__, __LINE__);
                $phpThumb->DebugMessage('Would have passed "'.$SourceFilename.'" through directly, but skipping due to phpThumbDebug', __FILE__, __LINE__);
                break;
            }

            SendSaveAsFileHeaderIfNeeded();
            header('Last-Modified: '.gmdate('D, d M Y H:i:s', @filemtime($SourceFilename)).' GMT');
            if ($contentType = phpthumb_functions::ImageTypeToMIMEtype(@$phpThumb->getimagesizeinfo[2])) {
                header('Content-Type: '.$contentType);
            }
            @readfile($SourceFilename);
            exit;

        } else {
            $phpThumb->