Prevent malicious users from supplying directories containing ".." etc. for path...

[recordtv.git] / playonwii / index.php

<?php

include_once( "functions.php" );

$extra_path = sanitise_filename( $_GET["path"] );
$excluded_preprepare = explode( ":", $_GET["exclude"] );

$excluded = array();

foreach( $excluded_preprepare as $ex )
{
    $excluded[] = sanitise_filename( $ex );
}

$full_videos_dir = $videos_dir;

if( $extra_path )
{
    $full_videos_dir .= "/$extra_path";
}

function is_video_dir( $full_path )
{
    if( substr_compare( $full_path, "/.", -2 ) == 0 or
        substr_compare( $full_path, "/..", -3 ) == 0 or
        substr_compare( $full_path, "/deleted", -8 ) == 0 or
        substr_compare( $full_path, "/tvguide", -8 ) == 0 )
    {
        return false;
    }

    return is_dir( $full_path );
}

function is_not_excluded( $filename )
{
    global $excluded;

    return !in_array( $filename, $excluded );
}

function get_filenames_recursive( &$filenames, $top_dir, $sub_dir = "" )
{
    $handle = opendir( "$top_dir/$sub_dir" );
    if( $handle )
    {
        while( ( $filename = readdir( $handle ) ) )
        {
            if( strlen( $sub_dir ) > 0 )
            {
                $filepath = "$sub_dir/$filename";
            }
            else
            {
                $filepath = $filename;
            }
            if( is_not_excluded( $filename ) &&
                is_video_dir( "$top_dir/$sub_dir/$filename" ) )
            {
                get_filenames_recursive( $filenames, $top_dir, $filepath );
            }
            else
            {
                $filenames[$filepath] = '';
            }
        }
        closedir($handle);
    }
}

function pretty_date( $date )
{
    global $num_to_month;

    $tm = mktime(
        (int)( substr( $date, 11, 2 ) ),
        (int)( substr( $date, 14, 2 ) ),
        0,
        (int)( substr( $date, 5, 2 ) ),
        (int)( substr( $date, 8, 2 ) ),
        (int)( substr( $date, 0, 4 ) ) );

    return date( "D d M, H:i", $tm );
}

function get_info_from_file( $fn )
{
    $title = "";
    $sub_title = "";
    $description = "";
    $date = "";
    $channel = "";

    $handle = fopen( $fn, "r" );

    if( $handle )
    {
        while ( !feof( $handle ) )
        {
            $line = fgets( $handle );
            $line = substr( $line, 0, -1 );

            list( $k, $v ) = split( "=", $line, 2 );

            switch( $k )
            {
                case "title":
                {
                    $title = $v;
                    break;
                }
                case "sub_title":
                {
                    $sub_title = $v;
                    break;
                }
                case "description":
                {
                    $description = $v;
                    break;
                }
                case "startTime":
                {
                    $date = $v;
                    break;
                }
                case "channel_pretty":
                {
                    $channel = $v;
                    break;
                }
            }
        }

        fclose( $handle );
    }

    return array( $title, $date, $channel, $sub_title, $description );
}

function get_info_from_filename( $fn )
{
    if( preg_match( '/^(.*?)-(.*)\\..*$/', $fn, $matches ) )
    {
        $title = $matches[1];
        $date = $matches[2];
    }
    else
    {
        $title = substr( $fn, 0, strlen( $fn ) - 4 );
        $date = "";
    }

    return array( $title, $date );
}

function get_info( $filename, $filenames )
{
    global $full_videos_dir;

    $title = Null;

    if( preg_match( '/^(.*)\\.flv$/', $filename, $matches ) )
    {

        $infofn = $matches[1] . ".rtvinfo";

        if( array_key_exists( $infofn, $filenames ) )
        {
            list( $title, $date, $channel, $sub_title, $description ) =
                get_info_from_file( $full_videos_dir . "/" . $infofn );
        }
        else
        {
            list( $title, $date ) = get_info_from_filename( $filename );
            $channel = "";
            $sub_title = "";
            $description = "";
        }
        $titles[$title][] = array( $num, $date, $channel, $sub_title,
            $description );
        $num++;
    }

    return array( $title, $date, $channel, $sub_title, $description );
}

// This is a hash filename -> nothing of all files in the videos directory
// and subdirectories
$filenames = array();
get_filenames_recursive( $filenames, $full_videos_dir );

// This is a hash filename -> nothing of all files in the deleted directory
$deleted_filenames = array();
$handle = opendir( $deleted_dir );
if( $handle )
{
    while( ( $filename = readdir( $handle ) ) )
    {
        $deleted_filenames[$filename] = '';
    }

    closedir($handle);
}


// This is a hash title->array( array( filenumber, date, filename, channel ) )
$titles = array();
$num = 0;

$nondeleted_filenames = array();

foreach ( $filenames as $fn => $blank )
{
    $modified_fn = str_replace( "/", "_", $fn );
    if( !array_key_exists( $modified_fn, $deleted_filenames ) )
    {
        $nondeleted_filenames[$fn] = '';
    }
}
#array_diff_key( $filenames, $deleted_filenames );

$sorted_fns = array_keys( $nondeleted_filenames );
sort( $sorted_fns );

foreach( $sorted_fns as $filename )
{
    list( $title, $date, $channel, $sub_title, $description ) = get_info(
        $filename, $nondeleted_filenames );

    if( $title != Null )
    {
        $titles[$title][] = array( $num, $date, $channel, $sub_title,
            $description, $filename );
        $num++;
    }
}

?>

<html>

<head>
<title>Recorded programmes</title>
<style type="text/css">
    body {
        font-family: verdana, sans-serif;
        text-align: center;
    }
    a {
        text-decoration: none;
        color: black;
    }
    a:hover {
        color: red;
    }
    a.deletelink {
        color:red;
        font-size: xx-small;
    }
    a.title {
        color: blue;
    }
    span.smalltime {
        font-size: smaller;
        color: gray;
    }
    span.smalltime:hover {
        color: red;
    }
    h2 {
        font-size: x-large;
        font-weight: normal;
        color: blue;
        margin: 2px;
    }
    td.dates {
        font-size: small;
    }
</style>
<script language="JavaScript">

function makeRequest( url, arg )
{
    var httpRequest;

    if( window.XMLHttpRequest )  // Mozilla, Safari etc.
    {
        httpRequest = new XMLHttpRequest();
    }
    else if( window.ActiveXObject )  // IE
    {
        try
        {
            httpRequest = new ActiveXObject( "Msxml2.XMLHTTP" );
        }
        catch( e )
        {
            try
            {
                httpRequest = new ActiveXObject( "Microsoft.XMLHTTP" );
            }
            catch( e )
            {
            }
        }
    }

    if( !httpRequest )
    {
        return false;
    }

    httpRequest.onreadystatechange = function()
    {
        receiveAnswer( httpRequest, arg );
    };

    httpRequest.open('GET', url, true);
    httpRequest.send('');
}

function receiveAnswer( httpRequest, prog_filename )
{
    if( httpRequest.readyState == 4 )
    {
        if( httpRequest.status != 200 )
        {
            document.location = "delete_error.php?filename=" + prog_filename
        }
    }
}


function mouse_over( tr_id )
{
    tr_el = document.getElementById( tr_id );
    tr_el.style.backgroundColor = '#ffaaaa';
}

function mouse_out( tr_id )
{
    tr_el = document.getElementById( tr_id );
    tr_el.style.backgroundColor = 'transparent';
}

function title_click( table_id )
{
    table_el = document.getElementById( table_id );
    if( table_el.style.display == 'inline' )
    {
        table_el.style.display = 'none';
    }
    else
    {
        table_el.style.display = 'inline';
    }
}


function delete_prog( prog_filename )
{
    makeRequest( 'delete.php?filename=' + prog_filename, prog_filename );
    tr_el = document.getElementById( 'tr_' + prog_filename );
    tr_el.style.display = 'none';
}

</script>
</head>

<body>
<h1>Recorded programmes</h1>

<center>
<?php
        ksort( $titles );
        $table_counter = 0;
        foreach( $titles as $title => $arr )
        {
            list( $num, $date, $channel, $sub_title ) = $arr[0];
            print "<h2><a class='title' href='javascript: title_click( \"table_$table_counter\" )'>$title</a></h2>\n";

            print "<table id='table_$table_counter' style='display: none' width='90%' cellpadding='0' cellspacing='0' border='0'>";
            foreach( $arr as $lst )
            {
                list( $num, $date, $channel, $sub_title, $description,
                    $filename ) = $lst;
                print "<tr id='tr_$filename'><td><a href='play.php?filename=$filename' style='padding-right: 10px'";

                print " title='$description'";

                print ">";

                if( $sub_title )
                {
                    print $sub_title . " <span class='smalltime'>(";
                }

                print pretty_date( $date );

                if( $channel )
                {
                    print " on $channel";
                }

                if( $sub_title )
                {
                    print ")</span>";
                }

                print "</a></td>";
                print "<td><a class='deletelink' onmouseover='mouse_over(\"tr_$filename\")' onmouseout='mouse_out(\"tr_$filename\")' href='javascript: delete_prog( \"$filename\" )'>[DELETE]</a></td></tr>\n";
            }
            print "</table>\n";
            $table_counter += 1;
        }
?>
</center>

</body>

</html>