th/hyprcrd
3
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

bak

Browse Source
This commit is contained in:
th committed 2026-04-07 08:20:48 +02:00
1 parent 69a3a27348
commit 03f57cbaee
8 files changed
+136 -46
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

public/index.php
+12 -5
View File
@@ -204,7 +204,7 @@ if (str_starts_with($route, '/api/')) {
$dir = __DIR__ . '/uploads';
$files = [];
if (is_dir($dir)) {
foreach (glob($dir . '/*.{png,jpg,gif,webp}', GLOB_BRACE) as $f) {
foreach (glob($dir . '/*.{png,jpg,gif,webp,mp3,ogg,wav,m4a}', GLOB_BRACE) as $f) {
$name = basename($f);
$files[] = ['name' => $name, 'url' => 'uploads/' . $name, 'size' => filesize($f), 'modified' => filemtime($f)];
}
@@ -245,14 +245,20 @@ if (str_starts_with($route, '/api/')) {
exit;
}
// Check real MIME via finfo, not client-supplied type
$allowed = ['image/png' => 'png', 'image/jpeg' => 'jpg', 'image/gif' => 'gif', 'image/webp' => 'webp'];
// Check MIME — finfo first, fallback to extension for audio
$mimeMap = ['image/png' => 'png', 'image/jpeg' => 'jpg', 'image/gif' => 'gif', 'image/webp' => 'webp', 'audio/mpeg' => 'mp3', 'audio/ogg' => 'ogg', 'audio/wav' => 'wav', 'audio/x-wav' => 'wav', 'audio/mp4' => 'm4a', 'application/ogg' => 'ogg'];
$extMap = ['mp3' => 'mp3', 'ogg' => 'ogg', 'wav' => 'wav', 'm4a' => 'm4a'];
$finfo = new finfo(FILEINFO_MIME_TYPE);
$realMime = $finfo->file($file['tmp_name']);
$ext = $allowed[$realMime] ?? null;
$ext = $mimeMap[$realMime] ?? null;
// Fallback: trust extension for audio when finfo returns octet-stream
if (!$ext && ($realMime === 'application/octet-stream' || str_starts_with($realMime, 'audio/'))) {
$origExt = strtolower(pathinfo($file['name'], PATHINFO_EXTENSION));
$ext = $extMap[$origExt] ?? null;
}
if (!$ext) {
http_response_code(400);
echo json_encode(['error' => 'invalid image type']);
echo json_encode(['error' => 'invalid file type', 'detected' => $realMime]);
exit;
}
@@ -470,6 +476,7 @@ if (str_starts_with($route, '/api/')) {
</div>
</div>
</div>
<div id="footer-count" class="font-pixel text-[10px] text-t-dim whitespace-nowrap absolute left-1/2 -translate-x-1/2"></div>
<div class="font-pixel text-[10px] text-t-dim whitespace-nowrap">© <?= date('Y') ?> hyprcrd</div>
</footer>