94 lines
2.5 KiB
PHP
Executable File
94 lines
2.5 KiB
PHP
Executable File
<?php
|
|
|
|
###
|
|
# @name API
|
|
# @author Tobias Reich
|
|
# @copyright 2014 by Tobias Reich
|
|
###
|
|
|
|
@ini_set('max_execution_time', '200');
|
|
@ini_set('post_max_size', '200M');
|
|
@ini_set('upload_max_size', '200M');
|
|
@ini_set('upload_max_filesize', '20M');
|
|
@ini_set('max_file_uploads', '100');
|
|
|
|
if (!empty($_POST['function'])||!empty($_GET['function'])) {
|
|
|
|
session_start();
|
|
define('LYCHEE', true);
|
|
date_default_timezone_set('UTC');
|
|
|
|
# Load autoload
|
|
require(__DIR__ . '/autoload.php');
|
|
|
|
# Load modules
|
|
require(__DIR__ . '/modules/misc.php');
|
|
|
|
if (file_exists(__DIR__ . '/../data/config.php')) require(__DIR__ . '/../data/config.php');
|
|
else {
|
|
|
|
/**
|
|
* Installation Access
|
|
* Limited access to configure Lychee. Only available when the config.php file is missing.
|
|
*/
|
|
|
|
define('LYCHEE_ACCESS_INSTALLATION', true);
|
|
require(__DIR__ . '/access/installation.php');
|
|
exit();
|
|
|
|
}
|
|
|
|
# Connect to database
|
|
$database = Database::connect($dbHost, $dbUser, $dbPassword, $dbName);
|
|
|
|
# Load settings
|
|
$settings = new Settings($database);
|
|
$settings = $settings->get();
|
|
|
|
# Init plugins
|
|
$plugins = explode(';', $settings['plugins']);
|
|
$plugins = new Plugins($plugins, $database);
|
|
|
|
# Escape
|
|
foreach(array_keys($_POST) as $key) $_POST[$key] = mysqli_real_escape_string($database, urldecode($_POST[$key]));
|
|
foreach(array_keys($_GET) as $key) $_GET[$key] = mysqli_real_escape_string($database, urldecode($_GET[$key]));
|
|
|
|
# Validate parameters
|
|
if (isset($_POST['albumIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['albumIDs'])!==1) exit('Error: Wrong parameter type for albumIDs!');
|
|
if (isset($_POST['photoIDs'])&&preg_match('/^[0-9\,]{1,}$/', $_POST['photoIDs'])!==1) exit('Error: Wrong parameter type for photoIDs!');
|
|
if (isset($_POST['albumID'])&&preg_match('/^[0-9sf]{1,}$/', $_POST['albumID'])!==1) exit('Error: Wrong parameter type for albumID!');
|
|
if (isset($_POST['photoID'])&&preg_match('/^[0-9]{14}$/', $_POST['photoID'])!==1) exit('Error: Wrong parameter type for photoID!');
|
|
|
|
# Fallback for switch statement
|
|
if (!isset($_POST['function'])) $_POST['function'] = '';
|
|
if (!isset($_GET['function'])) $_GET['function'] = '';
|
|
|
|
if (isset($_SESSION['login'])&&$_SESSION['login']==true) {
|
|
|
|
/**
|
|
* Admin Access
|
|
* Full access to Lychee. Only with correct password/session.
|
|
*/
|
|
|
|
define('LYCHEE_ACCESS_ADMIN', true);
|
|
require(__DIR__ . '/access/admin.php');
|
|
|
|
} else {
|
|
|
|
/**
|
|
* Guest Access
|
|
* Access to view all public folders and photos in Lychee.
|
|
*/
|
|
|
|
define('LYCHEE_ACCESS_GUEST', true);
|
|
require(__DIR__ . '/access/guest.php');
|
|
|
|
}
|
|
|
|
} else {
|
|
|
|
exit('Error: No permission!');
|
|
|
|
}
|
|
|
|
?>
|