don't use /index/eoiruer urls but /index.php/eorieur

[bizou.git] / index.php

diff --git a/index.php b/index.php
index 1d72e79..2265857 100644 (file)
--- a/index.php
+++ b/index.php
@@ -9,7 +9,11 @@ function getPreview($imgFile, $maxSize = THUMB_SIZE)
        
        if (! is_file($newImgFile))
        {
-               $img = imagecreatefromjpeg($imgFile);
+               $ext = strtolower(substr($imgFile, -4));
+               if ($ext == ".jpg")
+                       $img = imagecreatefromjpeg($imgFile);
+               else
+                       $img = imagecreatefrompng($imgFile);
 
                $w = imagesx($img);
                $h = imagesy($img);
@@ -34,7 +38,10 @@ function getPreview($imgFile, $maxSize = THUMB_SIZE)
 
                imagecopyresampled($newImg, $img, 0, 0, 0, 0, $newW, $newH, $w, $h);
 
-               imagejpeg($newImg, $newImgFile); 
+               if ($ext == ".jpg")
+                       imagejpeg($newImg, $newImgFile);
+               else
+                       imagepng($newImg, $newImgFile);
                
                imagedestroy($img);
                imagedestroy($newImg);
@@ -46,14 +53,15 @@ function getPreview($imgFile, $maxSize = THUMB_SIZE)
 function getAlbumPreview($dir)
 {
        foreach (scandir($dir) as $file) if ($file != '.' and $file != '..') {
-               if (strtolower(substr($file, -4)) == ".jpg")
+               $ext = strtolower(substr($file, -4));
+               if ($ext == ".jpg" or $ext == ".png")
                        return getPreview("$dir/$file");
        }
 
        return '';
 }
 
-$scriptUrlPath = substr($_SERVER["SCRIPT_NAME"], 0, -4); // trim .php
+$scriptUrlPath = $_SERVER["SCRIPT_NAME"];
 
 // if url == http://localhost/photos/index/toto/titi, path_info == /toto/titi
 // if url == http://localhost/photos/index, path_info is not set
@@ -66,6 +74,8 @@ if (! isset($_SERVER["PATH_INFO"])) {
 
 $shortPath = $_SERVER["PATH_INFO"];
 if ($shortPath == '/') $shortPath = '';
+// extra security check to avoid /photos/index/../.. like urls, maybe useless but..
+if (strpos($shortPath, '..') !== false) die(".. found in url");
 
 $folders = array();
 $imageFiles = array();
@@ -82,8 +92,8 @@ foreach (scandir($realDir) as $file) if ($file != '.' and $file != '..')
        else
        {
                $ext = strtolower(substr($file, -4));
-               if ($ext == ".jpg")
-                       $imageFiles[] = array( "name" => $file, "url" => getPreview("$realDir/$file"), "link" => dirname($scriptUrlPath)."/view/$shortPath/$file" );
+               if ($ext == ".jpg" or $ext == ".png")
+                       $imageFiles[] = array( "name" => $file, "url" => getPreview("$realDir/$file"), "link" => dirname($scriptUrlPath)."/view.php$shortPath/$file" );
                else
                        $otherFiles[] = array( "name" => $file, "link" => dirname($scriptUrlPath)."/$realDir/$file" );
        }