revise backend

Web/content/ftp/view.php

@@ -1,16 +1,7 @@
 <?php
-session_start();
+require_once __DIR__ . '/../../includes/auth.php';
+requireLogin('../../index.php');
 
-if(!isset($_SESSION['uname'])){
-    header("location: ../../index.php");
-    session_destroy();
-    exit;
-}
-
-// Include this at the top to see potential errors
-// Comment out in production
-ini_set('display_errors', 1);
-error_reporting(E_ALL);
 ini_set('memory_limit', '512M');
 
 require_once __DIR__ . '/../../config/config.php';
@@ -24,7 +15,7 @@ if (!isset($_GET['file'])) {
 if (isset($_POST['createShare'])) {
     $duration = intval($_POST['duration']);
     $downloadAllowed = isset($_POST['downloadAllowed']) ? 1 : 0;
-    $filePath = $_POST['filePath'];
+    $filePath = requireRemotePath($_POST['filePath'], $defaultPath);
 
     $token = bin2hex(random_bytes(16));
 
@@ -32,11 +23,15 @@ if (isset($_POST['createShare'])) {
 
     $expiration = date('Y-m-d H:i:s', strtotime("+$duration hours"));
 
-    $conn = getDatabaseConnection();
-    $stmt = $conn->prepare("INSERT INTO share (token, file_path, expiration, download_allowed) VALUES (?, ?, ?, ?)");
-    $stmt->bind_param("sssi", $token, $filePath, $expiration, $downloadAllowed);
+    $database = getDatabaseConnection();
+    $statement = $database->prepare("INSERT INTO share (token, file_path, expiration, download_allowed) VALUES (?, ?, ?, ?)");
+    $statement->bind_param("sssi", $token, $filePath, $expiration, $downloadAllowed);
 
-    if ($stmt->execute()) {
+    $shareSaved = $statement->execute();
+    $statement->close();
+    $database->close();
+
+    if ($shareSaved) {
         $shareUrl = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on' ? "https" : "http") . "://$_SERVER[HTTP_HOST]" .
                     remoteDirname($_SERVER['PHP_SELF']) . "/shared.php?token=$token";
 
@@ -47,13 +42,11 @@ if (isset($_POST['createShare'])) {
         header("Location: view.php?file=" . urlencode($filePath) . "&shared=1");
         exit;
     } else {
-        $_SESSION['shareError'] = "Failed to create share: " . $conn->error;
+        $_SESSION['shareError'] = 'Failed to create share. Please try again.';
         header("Location: view.php?file=" . urlencode($filePath) . "&shared=0");
         exit;
     }
 
-    $stmt->close();
-    $conn->close();
 }
 
 $shareCreated = false;
@@ -71,7 +64,7 @@ if (isset($_GET['shared'])) {
     }
 }
 
-$filePath = $_GET['file'];
+$filePath = requireRemotePath($_GET['file'], $defaultPath);
 $fileName = basename($filePath);
 $fileExtension = strtolower(pathinfo($fileName, PATHINFO_EXTENSION));
 
@@ -79,13 +72,13 @@ if (!$sftp->stat($filePath)) {
     die("File not found: $filePath");
 }
 
-$imageTypes = ['jpg', 'jpeg', 'png', 'gif', 'bmp', 'webp', 'svg'];
-$videoTypes = ['mp4', 'webm', 'ogg', 'mov', 'avi', 'mkv'];
-$audioTypes = ['mp3', 'wav', 'ogg', 'm4a', 'flac', 'aac'];
+$imageExtensions = ['jpg', 'jpeg', 'png', 'gif', 'bmp', 'webp', 'svg'];
+$videoExtensions = ['mp4', 'webm', 'ogg', 'mov', 'avi', 'mkv'];
+$audioExtensions = ['mp3', 'wav', 'ogg', 'm4a', 'flac', 'aac'];
 
-$isImage = in_array($fileExtension, $imageTypes);
-$isVideo = in_array($fileExtension, $videoTypes);
-$isAudio = in_array($fileExtension, $audioTypes);
+$isImage = in_array($fileExtension, $imageExtensions);
+$isVideo = in_array($fileExtension, $videoExtensions);
+$isAudio = in_array($fileExtension, $audioExtensions);
 
 if (!$isImage && !$isVideo && !$isAudio) {
     die("Unsupported file type");
@@ -238,10 +231,10 @@ if (isset($_GET['stream'])) {
             // Throttle to prevent CPU overload
             usleep(100000); // 100ms
         }
-    } catch (Exception $e) {
-        error_log("Streaming error: " . $e->getMessage());
+    } catch (Exception $exception) {
+        error_log("Streaming error: " . $exception->getMessage());
         if (isset($_GET['debug'])) {
-            header("X-Stream-Error: " . $e->getMessage());
+            header("X-Stream-Error: " . $exception->getMessage());
         }
     }
 
@@ -252,7 +245,6 @@ if (isset($_GET['stream'])) {
 }
 ?>
 
-
 <!DOCTYPE html>
 <html lang="en">
 <head>
@@ -278,7 +270,6 @@ if (isset($_GET['stream'])) {
     'class' => 'media-page',
 ]); ?>
 
-
     <section class="content-panel media-panel">
         <article class="col-12">
             <div class="media-container position-relative">
@@ -301,7 +292,7 @@ if (isset($_GET['stream'])) {
                     </audio>
                 <?php endif; ?>
 
-                <?php if (isset($_SESSION["downPer"]) && $_SESSION["downPer"] == true) : ?>
+                <?php if (hasPermission('downPer')) : ?>
                 <a href="download.php?file=<?= urlencode($filePath) ?>" class="btn btn-success m-3">Download</a>
                 <?php endif; ?>
 
@@ -412,8 +403,6 @@ function copyShareUrl() {
 }
 </script>
 
-
-
 <script>
 document.addEventListener('DOMContentLoaded', () => {
     const mediaElement = document.querySelector('video, audio');
@@ -444,4 +433,4 @@ function formatBytes($bytes, $precision = 2) {
     $bytes /= (1 << (10 * $pow));
     return round($bytes, $precision) . ' ' . $units[$pow];
 }
-?>
+?>