updates - mostly adding filename to urls and switch to sha512/256

2 files changed, 47 insertions, 17 deletions

diff --git a/index.html b/index.html
index 4b3ae6c..cbd7121 100644
--- a/index.html
+++ b/index.html
@@ -41,11 +41,16 @@ curl -Ffile[]=@file1.jpg -Ffile[]=@file2.jpg https://www.hostfil.es
 			<br>If you don't use multipart/form-data then the whole request body must be the single file you wish to upload.
 		</dd>
 
+		<dt>How else can I download files?</dt>
+		<dd>
+			Via Tor or, coming soon, I2P. Replace `https://g.hostfil.es` with `http://hostfilesgsjk66vqu6yw67iz6mn4uwnwoel4fp7d4weahht6l6ruqid.onion`.
+		</dd>
+
 		<dt>Are my files private?</dt>
-		<dd>Mostly. Anyone who knows the SHA-512 sum of the contents can probably find them. Any of our staff (admins and moderators) can find them. And our server host (OVH) could also access our server and find them.</dd>
+		<dd>Mostly. Anyone who knows the SHA-512/256 sum of the contents can probably find them. Any of our staff (admins and moderators) can find them. And our server host (OVH) could also access our server and find them.</dd>
 
 		<dt>Do you keep logs?</dt>
-		<dd>Of uploads only. File downloads are not logged, and will be supported via Tor Hidden Service and I2P eep-site in the near future. The only statistics we retain are related to aggregate, server-wide resource usage.</dd>
+		<dd>Of uploads only. File downloads are not logged, and will additionally be supported via I2P eep-site in the near future. The only statistics we retain are related to aggregate, server-wide resource usage.</dd>
 
 		<dt>How do I report abuse?</dt>
 		<dd>Email abuse@hostfil.es</dd>
diff --git a/upload.php b/upload.php
index 01e3c92..e82af6d 100644
--- a/upload.php
+++ b/upload.php
@@ -19,17 +19,24 @@ if ($c_t == 'multipart/form-data' || 0 === strpos($c_t, 'multipart/form-data;'))
 		if (!is_uploaded_file($file['tmp_name'])) {
 			die_error("Not an uploaded file: $file[tmp_name]");
 		}
-		$hash = hash_file("sha512", $file['tmp_name']);
-		if (FALSE === $hash) {
+		$hash_str = hash_file(HASH_ALGO, $file['tmp_name']);
+		if (FALSE === $hash_str) {
 			die_error("Unable to hash uploaded file?!");
 		}
-		$filename = $hash . get_extension($file['name']);
+		$filename = $hash_str . get_extension($file['name']);
 		$filepath = UPLOAD_DIR . '/' . $filename;
-		if (FALSE === move_uploaded_file($file['tmp_name'], $filepath)) {
-			die_error("Renaming uploaded file $file[tmp_name] to $filepath failed");
+		$real_filepath = UPLOAD_DIR . '/' . $hash_str . '/.realfile';
+		if (!is_dir(UPLOAD_DIR . '/' . $hash_str)) {
+			if (!mkdir(UPLOAD_DIR . '/' . $hash_str)) {
+				die_error("Making folder $hash_str failed");
+			}
+		}
+		if (FALSE === move_uploaded_file($file['tmp_name'], $real_filepath)) {
+			die_error("Renaming uploaded file $file[tmp_name] to $real_filepath failed");
 		}
+		symlink($real_filepath, $filepath);
 		echo UPLOAD_URL . $filename . "\n";
-		send_notification("[hostfil.es] $_SERVER[REMOTE_ADDR] uploaded $file[full_path] $file[type] -> $filename");
+		send_notification("[hostfil.es] $_SERVER[REMOTE_ADDR] uploaded $file[full_path] $file[type] -> https://g.hostfil.es/$filename");
 	}
 } else {
 	$in_fh = fopen('php://input', 'r');
@@ -38,7 +45,7 @@ if ($c_t == 'multipart/form-data' || 0 === strpos($c_t, 'multipart/form-data;'))
 	if (FALSE === $out_fh) {
 		die_error("Couldn't open temporary file $tmp_path");
 	}
-	$hash = hash_init("sha512");
+	$hash = hash_init(HASH_ALGO);
 	$size = 0;
 	while (!feof($in_fh) && FALSE !== ($data = fread($in_fh, 1024*1024))) {
 		hash_update($hash, $data);
@@ -52,17 +59,25 @@ if ($c_t == 'multipart/form-data' || 0 === strpos($c_t, 'multipart/form-data;'))
 	if (FALSE === fclose($out_fh)) {
 		die_error("Closing temporary file $tmp_path failed");
 	}
-	$filename = hash_final($hash) . get_extension($_SERVER['PATH_INFO']);
+	$hash_str = hash_final($hash);
+	$filename = $hash_str . get_extension($_SERVER['PATH_INFO']);
 	$filepath = UPLOAD_DIR . '/' . $filename;
-	if (file_exists($filepath)) {
+	$real_filepath = UPLOAD_DIR . '/' . $hash_str . '/.realfile';
+	if (file_exists($real_filepath)) {
 		unlink($tmp_path);
 	} else {
-		if (FALSE === rename($tmp_path, $filepath)) {
-			die_error("Renaming temporary file $tmp_path to $filepath failed");
+		if (!is_dir(UPLOAD_DIR . '/' . $hash_str)) {
+			if (!mkdir(UPLOAD_DIR . '/' . $hash_str)) {
+				die_error("Making folder $hash_str failed");
+			}
+		}
+		if (FALSE === rename($tmp_path, $real_filepath)) {
+			die_error("Renaming temporary file $tmp_path to $real_filepath failed");
 		}
 	}
+	symlink($real_filepath, $filepath);
 	echo UPLOAD_URL . $filename . "\n";
-	send_notification("[hostfil.es] $_SERVER[REMOTE_ADDR] uploaded $_SERVER[PATH_INFO] $c_t -> $filename");
+	send_notification("[hostfil.es] $_SERVER[REMOTE_ADDR] uploaded $_SERVER[PATH_INFO] $c_t -> https://g.hostfil.es/$filename");
 }
 
 
@@ -85,10 +100,20 @@ function die_error($s) {
 }
 
 
-function get_extension($file) {
-	$ext = strrchr($file, '.');
+function unsafe_get_extension($file) {
+	if ($file === '') {
+		return '/file';
+	}
+	$ext = strrchr($file, '/');
 	if (FALSE === $ext) {
-		return '';
+		return '/'.$file;
+	}
+	return $ext;
+}
+function get_extension($file) {
+	$ext = unsafe_get_extension($file);
+	if (preg_match('@^/\\.|^[^/]@', $ext)) {
+		return '/file';
 	}
 	return $ext;
 }