From 5f0a2a60ecd7c2bd55a77e726f62aee1908e7882 Mon Sep 17 00:00:00 2001
From: hbrain <hbrain@piagent.local>
Date: Mon, 25 May 2026 17:33:32 +0200
Subject: [PATCH] Fix PHP upload page quoting

---
 index.php | 115 ++++++++++++++----------------------------------------
 1 file changed, 29 insertions(+), 86 deletions(-)

diff --git a/index.php b/index.php
index 7e4d8ce..ee9e987 100644
--- a/index.php
+++ b/index.php
@@ -2,110 +2,53 @@
 $config = require __DIR__ . "/config.php";
 foreach (["videos_dir", "thumbs_dir", "uploads_dir"] as $d) if (!is_dir($config[$d])) mkdir($config[$d], 0775, true);
 function h($s){ return htmlspecialchars((string)$s, ENT_QUOTES, "UTF-8"); }
-function slugify($s){ $s = strtolower(trim($s)); $s = preg_replace(/[^a-z0-9]+/, -, $s); return trim($s, -) ?: movie; }
-function rrmdir($dir){ if(!is_dir($dir)) return; foreach(scandir($dir) as $f){ if($f===.||$f===..) continue; $p="$dir/$f"; is_dir($p)?rrmdir($p):unlink($p);} rmdir($dir); }
+function slugify($s){ $s = strtolower(trim($s)); $s = preg_replace('/[^a-z0-9]+/', '-', $s); return trim($s, '-') ?: 'movie'; }
+function rrmdir($dir){ if(!is_dir($dir)) return; foreach(scandir($dir) as $f){ if($f==='.'||$f==='..') continue; $p="$dir/$f"; is_dir($p)?rrmdir($p):unlink($p);} rmdir($dir); }
 function save_uploads($field, $dest, $allowed){
     if (empty($_FILES[$field])) return [];
     $files = $_FILES[$field]; $saved = [];
-    $count = is_array($files[name]) ? count($files[name]) : 0;
+    $count = is_array($files['name']) ? count($files['name']) : 0;
     for ($i=0; $i<$count; $i++) {
-        if ($files[error][$i] === UPLOAD_ERR_NO_FILE) continue;
-        if ($files[error][$i] !== UPLOAD_ERR_OK) throw new RuntimeException("Upload failed: ".$files[name][$i]);
-        $ext = strtolower(pathinfo($files[name][$i], PATHINFO_EXTENSION));
-        if (!in_array($ext, $allowed, true)) throw new RuntimeException("File type not allowed: ".$files[name][$i]);
-        $base = preg_replace(/[^A-Za-z0-9._-]+/, _, basename($files[name][$i]));
-        $target = $dest . / . sprintf(%03d_, count($saved)+1) . $base;
-        if (!move_uploaded_file($files[tmp_name][$i], $target)) throw new RuntimeException("Cannot save upload");
+        if ($files['error'][$i] === UPLOAD_ERR_NO_FILE) continue;
+        if ($files['error'][$i] !== UPLOAD_ERR_OK) throw new RuntimeException("Upload failed: ".$files['name'][$i]);
+        $ext = strtolower(pathinfo($files['name'][$i], PATHINFO_EXTENSION));
+        if (!in_array($ext, $allowed, true)) throw new RuntimeException("File type not allowed: ".$files['name'][$i]);
+        $base = preg_replace('/[^A-Za-z0-9._-]+/', '_', basename($files['name'][$i]));
+        $target = $dest . '/' . sprintf('%03d_', count($saved)+1) . $base;
+        if (!move_uploaded_file($files['tmp_name'][$i], $target)) throw new RuntimeException("Cannot save upload");
         $saved[] = basename($target);
     }
     return $saved;
 }
 $msg = $err = null;
-if ($_SERVER[REQUEST_METHOD] === POST) {
+if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     try {
-        $title = trim($_POST[title] ?? );
-        if ($title === ) throw new RuntimeException(Title is required.);
-        $slug = date(Ymd_His) . _ . slugify($title);
-        $dir = $config[uploads_dir] . / . $slug;
-        if (!mkdir($dir, 0775, true)) throw new RuntimeException(Cannot create input directory.);
-        $media = save_uploads(media, $dir, [jpg,jpeg,png,webp,gif,mp4,mov,m4v,avi,mkv,webm]);
-        if (!$media) { rrmdir($dir); throw new RuntimeException(Upload at least one image or video.); }
-        save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]);
+        $title = trim($_POST['title'] ?? '');
+        if ($title === '') throw new RuntimeException('Title is required.');
+        $slug = date('Ymd_His') . '_' . slugify($title);
+        $dir = $config['uploads_dir'] . '/' . $slug;
+        if (!mkdir($dir, 0775, true)) throw new RuntimeException('Cannot create input directory.');
+        $media = save_uploads('media', $dir, ['jpg','jpeg','png','webp','gif','mp4','mov','m4v','avi','mkv','webm']);
+        if (!$media) { rrmdir($dir); throw new RuntimeException('Upload at least one image or video.'); }
+        save_uploads('audio', $dir, ['mp3','wav','m4a','aac','ogg','flac']);
         $lines = [];
-        foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
-            $v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
+        foreach (['title'=>'Title','date'=>'Date','place'=>'Place','description'=>'Description'] as $k=>$label) {
+            $v = trim($_POST[$k] ?? ''); if ($v !== '') $lines[] = "$label: $v";
         }
-        file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
+        file_put_contents($dir . '/data.txt', implode("\n", $lines) . "\n");
         $msg = "Created movmaker input directory: uploads/$slug";
     } catch (Throwable $e) { $err = $e->getMessage(); }
 }
-$videos = glob($config[videos_dir]./*.mp4, GLOB_BRACE) ?: [];
+$videos = glob($config['videos_dir'].'/*.{mp4,webm,mov,m4v}', GLOB_BRACE) ?: [];
 usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
-$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
+$page=max(1,(int)($_GET['page']??1)); $per=$config['items_per_page']; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
 ?>
-<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
-<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
+<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config['site_name'])?></title><link rel="stylesheet" href="style.css"></head><body>
+<header><h1><?=h($config['site_name'])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
 <?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
 <section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
-<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
-<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d video.); }
-        save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]);
-        $lines = [];
-        foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
-            $v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
-        }
-        file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
-        $msg = "Created movmaker input directory: uploads/$slug";
-    } catch (Throwable $e) { $err = $e->getMessage(); }
-}
-$videos = glob($config[videos_dir]./*.webm, GLOB_BRACE) ?: [];
-usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
-$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
-?>
-<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
-<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
-<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
-<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
-<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
-<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d video.); }
-        save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]);
-        $lines = [];
-        foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
-            $v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
-        }
-        file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
-        $msg = "Created movmaker input directory: uploads/$slug";
-    } catch (Throwable $e) { $err = $e->getMessage(); }
-}
-$videos = glob($config[videos_dir]./*.mov, GLOB_BRACE) ?: [];
-usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
-$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
-?>
-<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
-<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
-<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
-<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
-<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
-<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d video.); }
-        save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]);
-        $lines = [];
-        foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
-            $v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
-        }
-        file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
-        $msg = "Created movmaker input directory: uploads/$slug";
-    } catch (Throwable $e) { $err = $e->getMessage(); }
-}
-$videos = glob($config[videos_dir]./*.m4v, GLOB_BRACE) ?: [];
-usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
-$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
-?>
-<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
-<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
-<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
-<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
-<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
-<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d H:i,filemtime($v)))?> · <?=h(round($size/1048576,1))?> MB</p><a href="<?=h($url)?>" download>Download</a></article>
-<?php endforeach; ?></div><div class="pages"><?php for($i=1;$i<=$pages;$i++): ?><a class="<?=$i===$page?active:?>" href="?page=<?=$i?>#videos"><?=$i?></a><?php endfor; ?></div></section>
+<?php foreach($slice as $v): $name=basename($v); $url=$config['public_videos'].'/'.rawurlencode($name); $size=filesize($v); ?>
+<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date('Y-m-d H:i',filemtime($v)))?> · <?=h(round($size/1048576,1))?> MB</p><a href="<?=h($url)?>" download>Download</a></article>
+<?php endforeach; ?></div><div class="pages"><?php for($i=1;$i<=$pages;$i++): ?><a class="<?=$i===$page?'active':''?>" href="?page=<?=$i?>#videos"><?=$i?></a><?php endfor; ?></div></section>
 <section id="new"><h2>Add new movie input</h2><form method="post" enctype="multipart/form-data"><label>Title*<input name="title" required></label><label>Date<input name="date" placeholder="2026-05-25"></label><label>Place<input name="place"></label><label>Description<textarea name="description"></textarea></label><label>Images / videos*<input type="file" name="media[]" multiple required accept="image/*,video/*"></label><label>Audio (optional)<input type="file" name="audio[]" multiple accept="audio/*"></label><button type="submit">Create input-dir</button></form></section>
 </main><footer>Input dirs are saved under <code>uploads/</code>; generated videos are listed from <code>videos/</code>.</footer></body></html>