summaryrefslogtreecommitdiff
path: root/_upload/arbitrary/index.php
blob: 22717800cb4cdf2c95b2c824ef2ca93cbf46fe7c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
<?php

require_once $_SERVER['DOCUMENT_ROOT'] . "/includes/session.php";
require_once $_SERVER['DOCUMENT_ROOT'] . "/includes/functions.php";

global $_PROFILE; global $_USER;

$id = $_GET['id'] ?? null;

header("Content-Type: text/plain");

if (isset($_POST["list"]) && is_array($_POST["list"])) {
    foreach ($_POST["list"] as $uuid) {
        if (trim($uuid) === "" || str_contains($uuid, "/") || !file_exists($_SERVER['DOCUMENT_ROOT'] . "/uploads/" . $uuid . ".webp")) continue;

        $requestID = uuid();
        file_put_contents($_SERVER['DOCUMENT_ROOT'] . "/includes/data/requests/" . $requestID . ".json", pf_utf8_encode(json_encode([
            "type" => "galleryupload",
            "author" => $_USER,
            "id" => $id,
            "uuid" => $uuid,
            "contents" => null,
            "summary" => $_POST["summary"],
            "date" => date('c')
        ])));

        $_PROFILE["requests"][$id . ":" . $uuid] = $requestID;
    }
}

$config = json_decode(file_get_contents($_SERVER['DOCUMENT_ROOT'] . "/includes/email.json"), true);
file_get_contents('https://notifications.equestria.dev/delta', false, stream_context_create([
    'http' => [
        'method' => 'POST',
        'header' =>
            "Content-Type: text/plain\r\n" .
            "Title: " . formatPonypush("New change request published") . "\r\n" .
            "Priority: default\r\n" .
            "Tags: requests\r\n" .
            "Actions: view, Open change requests, https://delta.equestria.dev/admin/requests/, clear=true\r\n" .
            "Authorization: Basic " . base64_encode($config["ntfyuser"] . ":" . $config["ntfypass"]),
        'content' => formatPonypush($_PROFILE['first_name'] . " " . $_PROFILE["last_name"] . " published a request to upload an image to " . getNameFromId($id) . (isset($_POST["summary"]) && trim($_POST["summary"]) !== "" ? ": " . $_POST["summary"] : ""))
    ]
]));
saveProfile();

header("Location: /upload/$id&success");
die();