From c3b9a781eb6d7c7151d824314ea15138ddc0ca39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=B8nstantine=20Kovalensky?= <45331093+kovalensky@users.noreply.github.com> Date: Fri, 24 Nov 2023 11:40:57 +0400 Subject: [PATCH] Tighten registration requirements for torrent files (#1165) --- library/includes/file_list_v2.php | 12 ++++++------ src/Legacy/Torrent.php | 9 +++++---- src/Legacy/TorrentFileList.php | 7 +++---- 3 files changed, 14 insertions(+), 14 deletions(-) diff --git a/library/includes/file_list_v2.php b/library/includes/file_list_v2.php index b6282065a..c0759348c 100644 --- a/library/includes/file_list_v2.php +++ b/library/includes/file_list_v2.php @@ -20,7 +20,7 @@ if ($bb_cfg['bt_disable_dht'] && IS_GUEST) { $topic_id = !empty($_GET['topic']) ? (int)$_GET['topic'] : (http_response_code(404) && die($lang['INVALID_TOPIC_ID'])); -$sql = 'SELECT t.attach_id, t.info_hash_v2, ad.physical_filename +$sql = 'SELECT t.attach_id, t.info_hash_v2, t.size, ad.physical_filename FROM ' . BB_BT_TORRENTS . ' t LEFT JOIN ' . BB_ATTACHMENTS_DESC . ' ad ON t.attach_id = ad.attach_id @@ -58,18 +58,18 @@ if (isset($torrent['info']['private']) && IS_GUEST) { die($lang['BT_PRIVATE_TORRENT']); } -header('Cache-Control: public, max-age=3600'); - $files = (new TorrentPier\Legacy\TorrentFileList($torrent)) -> fileTreeTable($torrent['info']['file tree']); $data = [ - 'name' => htmlCHR($torrent['info']['name'] ?? ''), - 'client' => htmlCHR(substr($torrent['created by'] ?? 'unknown client', 0, 20)), - 'size' => humn_size($files['size']), + 'name' => isset($torrent['info']['name']) ? htmlCHR(substr($torrent['info']['name'], 0, 255)) : 'undefined', + 'client' => isset($torrent['created by']) ? htmlCHR(substr($torrent['created by'], 0, 20)) : 'unknown client', 'date' => (isset($torrent['creation date']) && is_numeric($torrent['creation date'])) ? delta_time($torrent['creation date']) : 'unknown', + 'size' => humn_size($row['size']), 'site_url' => FULL_URL ]; +header('Cache-Control: public, max-age=3600'); + echo << diff --git a/src/Legacy/Torrent.php b/src/Legacy/Torrent.php index 08f82a34c..0e26b1ce9 100644 --- a/src/Legacy/Torrent.php +++ b/src/Legacy/Torrent.php @@ -390,22 +390,23 @@ class Torrent if (isset($info['length'])) { $totallen = (float)$info['length']; - } elseif (isset($bt_v1, $info['files']) && \is_array($info['files'])) { + } elseif (isset($bt_v1, $info['files']) && !isset($bt_v2) && \is_array($info['files'])) { foreach ($info['files'] as $fn => $f) { // Exclude padding files if (($f['attr'] ?? null) !== 'p') { - $totallen += (float)$f['length']; + $totallen += (isset($f['length']) && is_numeric($f['length'])) ? (float)$f['length'] : self::torrent_error_exit($lang['TORFILE_INVALID']); } } } elseif (isset($bt_v2)) { $fileTreeSize = function (array $array, string $name = '') use (&$fileTreeSize) { - $size = 0; + global $lang; + $size = 0; foreach ($array as $key => $value) { if (!isset($value[''])) { $size += $fileTreeSize($value); } else { - $size += (int)$value['']['length']; + $size += (isset($value['']['length']) && is_numeric($value['']['length'])) ? (float)$value['']['length'] : self::torrent_error_exit($lang['TORFILE_INVALID']); } } diff --git a/src/Legacy/TorrentFileList.php b/src/Legacy/TorrentFileList.php index 1c7dfa4f8..19e997f71 100644 --- a/src/Legacy/TorrentFileList.php +++ b/src/Legacy/TorrentFileList.php @@ -147,7 +147,7 @@ class TorrentFileList $html_v2 = $this->fileTreeList($value); $allItems .= "
  • $key
    • "; } else { - $length = (int)$value['']['length']; + $length = (float)$value['']['length']; $root = bin2hex($value['']['pieces root'] ?? ''); $allItems .= "
  • $key$length

    $root

    • "; } @@ -165,16 +165,15 @@ class TorrentFileList */ public function fileTreeTable(array $array, string $parent = ''): array { - static $filesList = ['list' => '', 'size' => 0, 'count' => 0]; + static $filesList = ['list' => '', 'count' => 0]; foreach ($array as $key => $value) { $key = htmlCHR($key); $current = "$parent/$key"; if (!isset($value[''])) { $this->fileTreeTable($value, $current); } else { - $length = (int)$value['']['length']; + $length = (float)$value['']['length']; $root = bin2hex($value['']['pieces root'] ?? ''); - $filesList['size'] += $length; $filesList['list'] .= '' . $current . '' . humn_size($length, 2) . '' . $root . ''; $filesList['count']++; }