marijo/movmaker-webui
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix PHP upload page quoting

Browse source
This commit is contained in:
hbrain 2026-05-25 17:33:32 +02:00
parent 7670a52350
commit 5f0a2a60ec
1 changed files with 29 additions and 86 deletions
Download patch file Download diff file Expand all files Collapse all files

115
index.php
View file

@ -2,110 +2,53 @@
$config = require __DIR__ . "/config.php"; $config = require __DIR__ . "/config.php";
foreach (["videos_dir", "thumbs_dir", "uploads_dir"] as $d) if (!is_dir($config[$d])) mkdir($config[$d], 0775, true); foreach (["videos_dir", "thumbs_dir", "uploads_dir"] as $d) if (!is_dir($config[$d])) mkdir($config[$d], 0775, true);
function h($s){ return htmlspecialchars((string)$s, ENT_QUOTES, "UTF-8"); } function h($s){ return htmlspecialchars((string)$s, ENT_QUOTES, "UTF-8"); }
function slugify($s){ $s = strtolower(trim($s)); $s = preg_replace(/[^a-z0-9]+/, -, $s); return trim($s, -) ?: movie; } function slugify($s){ $s = strtolower(trim($s)); $s = preg_replace('/[^a-z0-9]+/', '-', $s); return trim($s, '-') ?: 'movie'; }
function rrmdir($dir){ if(!is_dir($dir)) return; foreach(scandir($dir) as $f){ if($f===.||$f===..) continue; $p="$dir/$f"; is_dir($p)?rrmdir($p):unlink($p);} rmdir($dir); } function rrmdir($dir){ if(!is_dir($dir)) return; foreach(scandir($dir) as $f){ if($f==='.'||$f==='..') continue; $p="$dir/$f"; is_dir($p)?rrmdir($p):unlink($p);} rmdir($dir); }
function save_uploads($field, $dest, $allowed){ function save_uploads($field, $dest, $allowed){
if (empty($_FILES[$field])) return []; if (empty($_FILES[$field])) return [];
$files = $_FILES[$field]; $saved = []; $files = $_FILES[$field]; $saved = [];
$count = is_array($files[name]) ? count($files[name]) : 0; $count = is_array($files['name']) ? count($files['name']) : 0;
for ($i=0; $i<$count; $i++) { for ($i=0; $i<$count; $i++) {
if ($files[error][$i] === UPLOAD_ERR_NO_FILE) continue; if ($files['error'][$i] === UPLOAD_ERR_NO_FILE) continue;
if ($files[error][$i] !== UPLOAD_ERR_OK) throw new RuntimeException("Upload failed: ".$files[name][$i]); if ($files['error'][$i] !== UPLOAD_ERR_OK) throw new RuntimeException("Upload failed: ".$files['name'][$i]);
$ext = strtolower(pathinfo($files[name][$i], PATHINFO_EXTENSION)); $ext = strtolower(pathinfo($files['name'][$i], PATHINFO_EXTENSION));
if (!in_array($ext, $allowed, true)) throw new RuntimeException("File type not allowed: ".$files[name][$i]); if (!in_array($ext, $allowed, true)) throw new RuntimeException("File type not allowed: ".$files['name'][$i]);
$base = preg_replace(/[^A-Za-z0-9._-]+/, _, basename($files[name][$i])); $base = preg_replace('/[^A-Za-z0-9._-]+/', '_', basename($files['name'][$i]));
$target = $dest . / . sprintf(%03d_, count($saved)+1) . $base; $target = $dest . '/' . sprintf('%03d_', count($saved)+1) . $base;
if (!move_uploaded_file($files[tmp_name][$i], $target)) throw new RuntimeException("Cannot save upload"); if (!move_uploaded_file($files['tmp_name'][$i], $target)) throw new RuntimeException("Cannot save upload");
$saved[] = basename($target); $saved[] = basename($target);
} }
return $saved; return $saved;
} }
$msg = $err = null; $msg = $err = null;
if ($_SERVER[REQUEST_METHOD] === POST) { if ($_SERVER['REQUEST_METHOD'] === 'POST') {
try { try {
$title = trim($_POST[title] ?? ); $title = trim($_POST['title'] ?? '');
if ($title === ) throw new RuntimeException(Title is required.); if ($title === '') throw new RuntimeException('Title is required.');
$slug = date(Ymd_His) . _ . slugify($title); $slug = date('Ymd_His') . '_' . slugify($title);
$dir = $config[uploads_dir] . / . $slug; $dir = $config['uploads_dir'] . '/' . $slug;
if (!mkdir($dir, 0775, true)) throw new RuntimeException(Cannot create input directory.); if (!mkdir($dir, 0775, true)) throw new RuntimeException('Cannot create input directory.');
$media = save_uploads(media, $dir, [jpg,jpeg,png,webp,gif,mp4,mov,m4v,avi,mkv,webm]); $media = save_uploads('media', $dir, ['jpg','jpeg','png','webp','gif','mp4','mov','m4v','avi','mkv','webm']);
if (!$media) { rrmdir($dir); throw new RuntimeException(Upload at least one image or video.); } if (!$media) { rrmdir($dir); throw new RuntimeException('Upload at least one image or video.'); }
save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]); save_uploads('audio', $dir, ['mp3','wav','m4a','aac','ogg','flac']);
$lines = []; $lines = [];
foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) { foreach (['title'=>'Title','date'=>'Date','place'=>'Place','description'=>'Description'] as $k=>$label) {
$v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v"; $v = trim($_POST[$k] ?? ''); if ($v !== '') $lines[] = "$label: $v";
} }
file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n"); file_put_contents($dir . '/data.txt', implode("\n", $lines) . "\n");
$msg = "Created movmaker input directory: uploads/$slug"; $msg = "Created movmaker input directory: uploads/$slug";
} catch (Throwable $e) { $err = $e->getMessage(); } } catch (Throwable $e) { $err = $e->getMessage(); }
} }
$videos = glob($config[videos_dir]./*.mp4, GLOB_BRACE) ?: []; $videos = glob($config['videos_dir'].'/*.{mp4,webm,mov,m4v}', GLOB_BRACE) ?: [];
usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a)); usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per); $page=max(1,(int)($_GET['page']??1)); $per=$config['items_per_page']; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
?> ?>
<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body> <!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config['site_name'])?></title><link rel="stylesheet" href="style.css"></head><body>
<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main> <header><h1><?=h($config['site_name'])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?> <?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid"> <section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?> <?php foreach($slice as $v): $name=basename($v); $url=$config['public_videos'].'/'.rawurlencode($name); $size=filesize($v); ?>
<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d video.); } <article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date('Y-m-d H:i',filemtime($v)))?> · <?=h(round($size/1048576,1))?> MB</p><a href="<?=h($url)?>" download>Download</a></article>
save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]); <?php endforeach; ?></div><div class="pages"><?php for($i=1;$i<=$pages;$i++): ?><a class="<?=$i===$page?'active':''?>" href="?page=<?=$i?>#videos"><?=$i?></a><?php endfor; ?></div></section>
$lines = [];
foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
$v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
}
file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
$msg = "Created movmaker input directory: uploads/$slug";
} catch (Throwable $e) { $err = $e->getMessage(); }
}
$videos = glob($config[videos_dir]./*.webm, GLOB_BRACE) ?: [];
usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
?>
<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d video.); }
save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]);
$lines = [];
foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
$v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
}
file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
$msg = "Created movmaker input directory: uploads/$slug";
} catch (Throwable $e) { $err = $e->getMessage(); }
}
$videos = glob($config[videos_dir]./*.mov, GLOB_BRACE) ?: [];
usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
?>
<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d video.); }
save_uploads(audio, $dir, [mp3,wav,m4a,aac,ogg,flac]);
$lines = [];
foreach ([title=>Title,date=>Date,place=>Place,description=>Description] as $k=>$label) {
$v = trim($_POST[$k] ?? ); if ($v !== ) $lines[] = "$label: $v";
}
file_put_contents($dir . /data.txt, implode("\n", $lines) . "\n");
$msg = "Created movmaker input directory: uploads/$slug";
} catch (Throwable $e) { $err = $e->getMessage(); }
}
$videos = glob($config[videos_dir]./*.m4v, GLOB_BRACE) ?: [];
usort($videos, fn($a,$b)=>filemtime($b)<=>filemtime($a));
$page=max(1,(int)($_GET[page]??1)); $per=$config[items_per_page]; $total=count($videos); $pages=max(1,(int)ceil($total/$per)); $page=min($page,$pages); $slice=array_slice($videos,($page-1)*$per,$per);
?>
<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title><?=h($config[site_name])?></title><link rel="stylesheet" href="style.css"></head><body>
<header><h1><?=h($config[site_name])?></h1><nav><a href="#videos">Videos</a><a class="button" href="#new">Add new</a></nav></header><main>
<?php if($msg): ?><div class="ok"><?=h($msg)?></div><?php endif; ?><?php if($err): ?><div class="err"><?=h($err)?></div><?php endif; ?>
<section id="videos"><h2>Videos</h2><?php if(!$slice): ?><p>No videos yet. Put generated movies in <code>videos/</code>.</p><?php endif; ?><div class="grid">
<?php foreach($slice as $v): $name=basename($v); $url=$config[public_videos]./.rawurlencode($name); $size=filesize($v); ?>
<article class="card"><video controls preload="metadata" src="<?=h($url)?>"></video><h3><?=h(pathinfo($name,PATHINFO_FILENAME))?></h3><p><?=h(date(Y-m-d H:i,filemtime($v)))?> · <?=h(round($size/1048576,1))?> MB</p><a href="<?=h($url)?>" download>Download</a></article>
<?php endforeach; ?></div><div class="pages"><?php for($i=1;$i<=$pages;$i++): ?><a class="<?=$i===$page?active:?>" href="?page=<?=$i?>#videos"><?=$i?></a><?php endfor; ?></div></section>
<section id="new"><h2>Add new movie input</h2><form method="post" enctype="multipart/form-data"><label>Title*<input name="title" required></label><label>Date<input name="date" placeholder="2026-05-25"></label><label>Place<input name="place"></label><label>Description<textarea name="description"></textarea></label><label>Images / videos*<input type="file" name="media[]" multiple required accept="image/*,video/*"></label><label>Audio (optional)<input type="file" name="audio[]" multiple accept="audio/*"></label><button type="submit">Create input-dir</button></form></section> <section id="new"><h2>Add new movie input</h2><form method="post" enctype="multipart/form-data"><label>Title*<input name="title" required></label><label>Date<input name="date" placeholder="2026-05-25"></label><label>Place<input name="place"></label><label>Description<textarea name="description"></textarea></label><label>Images / videos*<input type="file" name="media[]" multiple required accept="image/*,video/*"></label><label>Audio (optional)<input type="file" name="audio[]" multiple accept="audio/*"></label><button type="submit">Create input-dir</button></form></section>
</main><footer>Input dirs are saved under <code>uploads/</code>; generated videos are listed from <code>videos/</code>.</footer></body></html> </main><footer>Input dirs are saved under <code>uploads/</code>; generated videos are listed from <code>videos/</code>.</footer></body></html>