<?php

// freefile, a free file host
// (C) 2008 Innova and Kristopher Windsor

$alert = "";
$refresh = false;
$login = "";
$members = array();

function initialize ()
	{
	global $members, $login;

	// load member list
	$c = file_get_contents("data/members.dat");
	$members = explode(';', $c);

	// see if member is logged in

	if (isset($_COOKIE['name']) || isset($_COOKIE['password']))
		{
		$cn = $_COOKIE['name'];
		$cp = $_COOKIE['password'];

		for ($i = 0; $i < count($members); $i += 2)
			{
			if ($members[$i] == $cn && $members[$i + 1] == $cp)
				{$login = $members[$i];}
			}
		}
	}

function append ($file, $text)
	{
	$f = fopen($file, 'a');
	fputs($f, $text);
	fclose($f);
	}

function vt (&$t, $allowthistoo = "")
	{
	for ($i = 0; $i < strlen($t); $i ++)
		{
		if (strpos("abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789_-" . $allowthistoo, $t[$i]) === false)
			{$t[$i] = "_";}
		}
	}

function register ()
	{
	global $alert, $members;

	if (isset($_GET['register']) && isset($_POST['name']) && isset($_POST['password']) && isset($_POST['spamcheck']))
		{
		$name = $_POST['name'];
		$password = $_POST['password'];
		$spamcheck = $_POST['spamcheck'];

		// spam check
		if ($spamcheck != "FreeBasic is great!")
			{$alert = "You have failed the spam check!"; return;}

		// validate name and password

		if ($name == "" || $password == "")
			{$alert = "The name or password is blank!"; return;}

		vt($name);
		vt($password);

		for ($i = 0; $i < count($members); $i += 2)
			{
			if ($name == $members[$i])
				{$alert = "This account has already been registered!"; return;}
			}

		// append member data to file and make folder
		append("data/members.dat", ';' . $name . ';' . hash('sha384', $password));
		mkdir("uploads/" . $name);
		chmod("uploads/" . $name, 0777);

		$alert = "Member " . $name . " is now registered!";
		}
	}

function login ()
	{
	global $alert, $refresh, $members;

	if (isset($_GET['login']) && isset($_POST['name']) && isset($_POST['password']))
		{
		$name = $_POST['name'];
		$password = $_POST['password'];

		if ($name == "")
			{
			if (isset($_COOKIE['name']) && $password == "")
				{
				setcookie('name');
				setcookie('password');
				$alert = "You have been logged out!";
				$refresh = true;
				}
			else
				{
				$alert = "No name was entered!";
				}
			}
		else
			{
			if ($password == "")
				{
				$alert = "No password was entered!";
				return;
				}

			$cp = ""; // the password (must match the cookie); if blank, the user does not exist

			// find member in list to see what his password should be
			for ($i = 0; $i < count($members); $i += 2)
				{
				if ($name == $members[$i])
					{$cp = $members[$i + 1];}
				}

			if ($cp == "")
				{
				$alert = "This member does not exist!";
				return;
				}

			if (hash('sha384', $password) == $cp)
				{
				setcookie('name', $name, time() + 3600 * 24 * 3650);
				setcookie('password', hash('sha384', $password), time() + 3600 * 24 * 3650);
				$alert = "You are now logged in!";
				$refresh = true;
				return;
				}
			else
				{
				$alert = "This password is incorrect!";
				return;
				}
			}
		}
	}

function upload ()
	{
	global $alert, $login, $refresh;

	if (isset($_GET['upload']) && isset($_POST['filename']) && isset($_FILES['file']))
		{
		$filename = $_POST['filename'];

		if ($login == "")
			{$alert = "You are not logged in!"; return;}		

		if ($filename == "")
			{$alert = "No filename was entered!"; return;}		
		vt($filename, '.');

		if ($_FILES['file']['error'] != 0)
			{$alert = "Upload error #" . $_FILES['file']['error'] . " has occured!"; return;}
		if ($_FILES['file']['size'] > 2097152)
			{$alert = "The file is too big!"; return;}

		// avoid server-side scripting
		$whitelist = array('.zip', '.rar', '.7z', '.jpg', '.gif', '.png', '.bmp', '.txt', '.exe', '.doc', '.xls');
		$iswhite = false;
		foreach ($whitelist as $item)
			{
			if (strpos(strtolower($filename), $item) + strlen($item) == strlen($filename))
				{$iswhite = true;}
			}
		if (!$iswhite)
			{$filename .= '.txt';}

		$filer = "uploads/$login/$filename";
		$download_destination = getcwd() . "/$filer";

		if (move_uploaded_file($_FILES['file']['tmp_name'], $download_destination))
			{
			chmod($download_destination, 0777);
			append("data/files.dat", ";$filer");
			$alert = "The file $filer was successfully uploaded!";
			$refresh = true;
			}
		else
			{
			$alert = "This file cannot be uploaded!";
			}
		}
	}

function sidebar ()
	{
	global $login;

	if ($login != "")
		{
		echo "<p class=\"paragraph\">Welcome, <a href=\"uploads/$login\">$login</a>!</p><br>";
		}

	// load file list
	$c = file_get_contents("data/files.dat");
	$files = explode(';', $c);

	$end = count($files) - 11;
	if ($end < 0)
		{$end = 0;}

	echo "<p class=\"paragraph\">Recent files:</p>";
	echo "<ul class=\"recent\">";
	for ($i = count($files) - 1; $i >= $end; $i --)
		{
		$path = explode('/', $files[$i]);

		$filename = $path[count($path) - 1];
		if (strlen($filename) > 12)
			{$filename = substr($filename, 0, 12) . '...';}

		echo "<li class=\"recent_item\"><a href=\"" . $files[$i] . "\">$filename</a></li>";
		}
	echo "<li class=\"recent_item\"><a href=\"uploads/\">Browse all...</a></li>";
	echo "</ul>";
	}

function refresh ()
	{
	global $alert, $refresh;

	if ($alert != "")
		{echo "<script>alert('" . $alert . "');</script>";}

	if ($refresh)
		{echo "<script>location.href = '?done';</script>";}
	}

// load member list, attempt login validation, etc.
initialize();

// register a member
register();

// log a member in or out (set cookie)
login();

// upload a file
upload();
?>

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
	<title>Free File Hosting</title>
	<link href="style.css" rel="stylesheet" type="text/css">
	<script type="text/javascript" language="JavaScript1.2">
		var islogged = <?php if ($login == "") echo "false"; else echo "true"; ?>;

		function initialize ()
			{
			document.getElementById('content_home').style.display = "block";
			}

		function show (content)
			{
			var content_home, content_upload, content_register, content_login, content_about;

			if (content == "upload" && islogged == false)
				{
				alert("You cannot upload files because you are not logged in!");
				return;
				}

			content_home = document.getElementById('content_home');
			content_upload = document.getElementById('content_upload');
			content_register = document.getElementById('content_register');
			content_login = document.getElementById('content_login');
			content_about = document.getElementById('content_about');

			content_home.style.display = "none";
			content_upload.style.display = "none";
			content_register.style.display = "none";
			content_login.style.display = "none";
			content_about.style.display = "none";

			switch (content)
				{
				case "home": content_home.style.display = "block"; break;
				case "upload": content_upload.style.display = "block"; break;
				case "register": content_register.style.display = "block"; break;
				case "login": content_login.style.display = "block"; break;
				case "about": content_about.style.display = "block"; break;
				}
			}

		function changefilename ()
			{
			var file_element, filename_element, fn;

			file_element = document.getElementById('file');
			filename_element = document.getElementById('filename');

			fn = file_element.value.toLowerCase();

			filename_element.value = fn.substr(fn.lastIndexOf("\\") + 1, fn.length);
			}

		function clearlogin ()
			{
			var name_element, password_element;

			name_element = document.getElementById('name');
			password_element = document.getElementById('password');

			name_element.value = '';
			password_element.value = '';
			}
	</script>
</head>

<body class="body" onLoad="initialize();">
	<div class="container">
		<h1 class="heading">Free File Hosting</h1>

		<div class="center">
			<ul class="navigation">
				<li class="navigation_item"><a href="javascript:show('home');">Home</a></li>
				<li class="navigation_item"><a href="javascript:show('upload');">Upload</a></li>
				<li class="navigation_item"><a href="javascript:show('register');">Register</a></li>
				<li class="navigation_item"><a href="javascript:show('login');">Login</a></li>
				<li class="navigation_item"><a href="javascript:show('about');">About</a></li>
			</ul>
		</div>

		<table class="organizer">
			<tr class="organizer">
				<td class="organizer">
					<div class="sidebar">
						<?php sidebar(); ?>
					</div>
				</td>
				<td class="organizer">
					<div class="content" id="content_home">
						<p class="paragraph">
							Welcome to <em>Free File</em>! We offer free file hosting for files up to 2MB!<br>
							Instant registration only asks for a name and password!
						</p>
					</div>

					<div class="content" id="content_upload">
						<p class="paragraph">
							You can upload any clean file here, up to 2MB.<br>
							Files will typically remain on the server until we need to free some space for new files.<br>
							Only letters, numbers, hyphens, periods, and underscores are allowed for the filename.<br>
							You have to be logged in to upload files.
						</p>
						<fieldset class="fieldset">
							<legend class="legend">Upload a file</legend>
							<form action="?upload" method="post" enctype="multipart/form-data">
								<input type="hidden" name="MAX_FILE_SIZE" value="2097152">
								File<br>
								<input type="file" id="file" name="file" onChange="changefilename();"><br>
								Filename<br>
								<input type="text" id="filename" name="filename"><br>
								<br>
								<input type="submit" value="Upload">
							</form>
						</fieldset>
					</div>

					<div class="content" id="content_register">
						<p class="paragraph">
							You can register instantly, for free.<br>
							Only letters, numbers, hyphens, and underscores are allowed for the username and password.<br>
							You can register multiple accounts.
						</p>
						<fieldset class="fieldset">
							<legend class="legend">Register an account</legend>
							<form action="?register" method="post">
								Name<br>
								<input type="text" name="name"><br>
								Password<br>
								<input type="password" name="password"><br>
								Spam check<br>
								<select name="spamcheck">
									<option>Free Basic is bad!</option>
									<option>FreeBasic is great!</option>
									<option>I'm a spam bot!</option>
								</select><br>
								<br>
								<input type="submit" value="Register">
							</form>
						</fieldset>
					</div>

					<div class="content" id="content_login">
						<p class="paragraph">
							You can log in after you have registered.<br>
							Leave the form blank to log out.
						</p>
						<fieldset class="fieldset">
							<legend class="legend">Log into an account</legend>
							<form action="?login" method="post">
								Name<br>
								<input type="text" id="name" name="name"><br>
								Password<br>
								<input type="password" id="password" name="password"><br>
								<br>
								<input type="submit" value="Login"><input type="submit" value="Logout" onClick="clearlogin()">
							</form>
						</fieldset>
					</div>

					<div class="content" id="content_about">
						<p class="paragraph">
							<em>Free File</em> is a file host created due to the death of file-pasta.com.<br>
							It is dedicated to programmers at FreeBasic.net who have been subjected to mediafire ads.<br>
							It is hosted by free web hosts, so it may have to move frequently, but it is good for temporary file storage.<br>
							If you need help or want to see the source code, you can <a href="mailto:kristopherwindsor@yahoo.com">email</a> the admin.
						</p>
					</div>
				</td>
			</tr>
		</table>

		<div class="copyright">
			&copy; 2008 Innova and Kristopher Windsor
		</div>
	</div>

	<?php refresh(); ?>
<!-- </body> -->
</html>