WebOrbiton
v1.0.0.0

StocketBase

← Changes All versions
74 lines · 2.1 KB
  1. <?php
  2. ​
  3. declare(strict_types=1);
  4. ​
  5. require_once __DIR__ . '/includes/config.php';
  6. require_once __DIR__ . '/includes/database.php';
  7. require_once __DIR__ . '/includes/auth.php';
  8. require_once __DIR__ . '/includes/csrf.php';
  9. ​
  10. Auth::boot();
  11. Auth::requireLogin();
  12. ​
  13. header('Content-Type: application/json');
  14. ​
  15. if ($_SERVER['REQUEST_METHOD'] !== 'POST' || !Csrf::verify($_POST['csrf_token'] ?? null)) {
  16. http_response_code(403);
  17. echo json_encode(['success' => false, 'error' => 'Invalid request.']);
  18. exit;
  19. }
  20. ​
  21. if (!isset($_FILES['file']) || $_FILES['file']['error'] !== UPLOAD_ERR_OK) {
  22. http_response_code(400);
  23. echo json_encode(['success' => false, 'error' => 'Upload failed.']);
  24. exit;
  25. }
  26. ​
  27. $file = $_FILES['file'];
  28. $maxBytes = 25 * 1024 * 1024;
  29. ​
  30. if ($file['size'] > $maxBytes) {
  31. http_response_code(400);
  32. echo json_encode(['success' => false, 'error' => 'File too large (max 25MB).']);
  33. exit;
  34. }
  35. ​
  36. $allowedTypes = [
  37. 'image/jpeg' => ['ext' => 'jpg', 'folder' => 'img'],
  38. 'image/png' => ['ext' => 'png', 'folder' => 'img'],
  39. 'image/gif' => ['ext' => 'gif', 'folder' => 'img'],
  40. 'image/webp' => ['ext' => 'webp', 'folder' => 'img'],
  41. 'video/mp4' => ['ext' => 'mp4', 'folder' => 'videos'],
  42. 'video/webm' => ['ext' => 'webm', 'folder' => 'videos'],
  43. ];
  44. ​
  45. $finfo = finfo_open(FILEINFO_MIME_TYPE);
  46. $mimeType = finfo_file($finfo, $file['tmp_name']);
  47. ​
  48. if (!isset($allowedTypes[$mimeType])) {
  49. http_response_code(400);
  50. echo json_encode(['success' => false, 'error' => 'Unsupported file type.']);
  51. exit;
  52. }
  53. ​
  54. $typeInfo = $allowedTypes[$mimeType];
  55. $targetDir = __DIR__ . '/media/' . $typeInfo['folder'];
  56. ​
  57. if (!is_dir($targetDir)) {
  58. mkdir($targetDir, 0750, true);
  59. }
  60. ​
  61. $fileName = bin2hex(random_bytes(16)) . '.' . $typeInfo['ext'];
  62. $targetPath = $targetDir . '/' . $fileName;
  63. ​
  64. if (!move_uploaded_file($file['tmp_name'], $targetPath)) {
  65. http_response_code(500);
  66. echo json_encode(['success' => false, 'error' => 'Could not save file.']);
  67. exit;
  68. }
  69. ​
  70. echo json_encode([
  71. 'success' => true,
  72. 'url' => 'media/' . $typeInfo['folder'] . '/' . $fileName,
  73. ]);
  74. ​