File Upload and Media Handling

1. environment

• upload_max_filesize
• post_max_size
• max_input_time
• max_execution_time
• max_file_uploads
• session.gc_maxlifetime

1. file system
   1. global
   2. perpage
2. database

1.1. settings

1. upload
   • [0, 1, Admins] - refactor, last value is actually just the allowed user group
2. upload_max_size
3. upload_quota
4. upload_quota_per_user
5. upload_banned_exts
6. upload_images_only

1. check_mimetype
2. img_create_thumbnail
3. img_max_thumb_width
4. upload_translit
5. upload_translit_lower
6. upload_allowed_exts

1. const THUMB_DIR = 'file/thumb';
2. const THUMB_LOCAL_DIR = 'file/thumb_local';
3. const UPLOAD_GLOBAL_DIR = 'file/global';
4. const UPLOAD_LOCAL_DIR = 'file/perpage';

• $this->has_access('upload')

1.2. chmod

1. User can read, write and execute
2. Group can read and execute
3. World can read and execute

1.3. MIME type and file extensions

# Allowed uploadable file extensions and mimetypes

$extension_map	= [
	// application
	'bz'		=> ['application', 'application/x-bzip'],
	'bz2'		=> ['application', 'application/x-bzip2'],
	'doc'		=> ['application', 'application/msword'],
	'exe'		=> ['application', 'application/octet-stream'],
	'latex'		=> ['application', 'application/x-latex'],
	'gtar'		=> ['application', 'application/x-gtar'],
	'gz'		=> ['application', 'application/x-gzip'],
	'gzip'		=> ['application', 'application/x-gzip'],
	'pdf'		=> ['application', 'application/pdf'],
	'ppt'		=> ['application', 'application/mspowerpoint'],
	'ps'		=> ['application', 'application/postscript'],
	'tar'		=> ['application', 'application/x-tar'],
	'tgz'		=> ['application', 'application/x-compressed'],
	'torrent'	=> ['application', 'application/x-bittorrent'],
	'xls'		=> ['application', 'application/excel'],
	'zip'		=> ['application', 'application/x-zip-compressed'],
	'7z'		=> ['application', 'application/x-7z-compressed'],

	'odc'		=> ['application', 'application/vnd.oasis.opendocument.chart'],
	'odb'		=> ['application', 'application/vnd.oasis.opendocument.database'],
	'odf'		=> ['application', 'application/vnd.oasis.opendocument.formula'],
	'odg'		=> ['application', 'application/vnd.oasis.opendocument.graphics'],
	'odi'		=> ['application', 'application/vnd.oasis.opendocument.image'],
	'odp'		=> ['application', 'application/vnd.oasis.opendocument.presentation'],
	'ods'		=> ['application', 'application/vnd.oasis.opendocument.spreadsheet'],
	'odt'		=> ['application', 'application/vnd.oasis.opendocument.text'],


	// (legacy)
	'pptx'		=> ['application', 'application/vnd.openxmlformats-officedocument.presentationml.presentation'],
	'xlsx'		=> ['application', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet'],
	'docx'		=> ['application', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document'],

	// audio
	'm4a'		=> ['audio', 'audio/mp4'],
	'mp3'		=> ['audio', 'audio/x-mpeg-3'],
	'ogg'		=> ['audio', 'audio/ogg'],
	'opus'		=> ['audio', 'audio/ogg'],

	// image
	'avif'		=> ['image', 'image/avif'],
	'gif'		=> ['image', 'image/gif'],
	'ico'		=> ['image', 'image/x-icon'],
	'jpe'		=> ['image', 'image/jpeg'],
	'jpeg'		=> ['image', 'image/jpeg'],
	'jpg'		=> ['image', 'image/jpeg'],
	'jxl'		=> ['image', 'image/jxl'],
	'png'		=> ['image', 'image/png'],
	'svg'		=> ['image', 'image/svg+xml'],
	'webp'		=> ['image', 'image/webp'],

	// text
	'conf'		=> ['text', 'text/plain'],
	'css'		=> ['text', 'text/css'],
	'htm'		=> ['text', 'text/html'],
	'html'		=> ['text', 'text/html'],
	'rtf'		=> ['text', 'text/richtext'],
	'txt'		=> ['text', 'text/plain'],
	'xml'		=> ['text', 'text/xml'],

	// video
	'mp4'		=> ['video', 'video/mp4'],
	'ogv'		=> ['video', 'video/ogg'],
	'webm'		=> ['video', 'video/webm'],
];	

1.4. HTML5

• accept attribute^[link1]

1.5. File APIs

• File API specification^[link2]
• Reading files in JavaScript using the File APIs^[link3]

• http://filedropjs.org/
• http://resumablejs.com/
• https://www.dropzonejs.com/

1.6. Fetch API

• https://developer.mozilla.org/[...]tch#Uploading_a_file^[link4]
• How to Upload Files to a Server with Plain JavaScript and PHP^[link5]

1.7. PHP

• $_FILES['uploadedfile']['name']: The original name of the file on the client machine
• $_FILES['uploadedfile']['type']: The mime type of the file
• $_FILES['uploadedfile']['size']: The size of the file in bytes
• $_FILES['uploadedfile']['tmp_name']: The temporary filename in which the uploaded file was stored on the server.

1. mime_content_type
2. pathinfo
3. hash_file

1.8. Image processing

1. GD Graphics Library
2. ImageMagick

if (extension_loaded('gd'))
{
    print_r(gd_info());
}
else
{
    echo 'GD is not available.';
}

if (extension_loaded('imagick'))
{
    $imagick = new Imagick();
    print_r($imagick->queryFormats());
}
else
{
    echo 'ImageMagick is not available.';
}	

2. WackoWiki file model

2.1. File name sanitization

<?php

$sanitize_filename = function($name)
{
    // prepare for translit
    $name    = str_replace(['@', '%20', '+'], '_', $name);
    $name    = preg_replace('/[\r\n\t ]+/u', '_', $name);

    // remove multi full stop, spacing underscore and hyphen-minus
    $name    = preg_replace('/(-{2,})/u', '-', $name);
    $name    = preg_replace('/(_{2,})/u', '_', $name);
    $name    = preg_replace('/(\.{2,})/u', '.', $name);

    // remove consecutive occurrences (.- / -.)
    $name    = str_replace(['.-', '-.'], '', $name);
    $name    = utf8_trim($name, ' .-_');

    $name    = Ut::normalize($name);
    $name    = preg_replace('/[^' . self::PATTERN['ALPHANUM_P'] . '\.]/u', '', $name);

    // file name transliteration
    if ($this->db->upload_translit)
    {
        $t_name    = Ut::translit($name, $this->db->upload_translit_lower);
        $t_name    = preg_replace('/[\p{Z}]+/u', '_', $t_name);
    }
    else
    {
        $t_name    = $name;
    }

    return $t_name;
};
	

1. global
   1. [file_name . extension]
   2. UPLOAD_GLOBAL_DIR
   3. direct file access
2. local
   1. [@ . page_id . @ . file_name . extension]
   2. UPLOAD_LOCAL_DIR
   3. file access via file hadler
      1. checks page ACLs against user permissions

3. Database

1. file_name
2. author (user_id)
3. file_description
4. caption
5. views
6. uploaded_dt
7. modified_dt
8. credit
9. exif
10. context use (file_link)
11. page_id
12. categories
13. access, viewing privacy
14. file_lang
15. file_size
16. picture_w
17. picture_h
18. file_ext
19. mime_type

4. Workflow

1. extension
2. mime type
3. size

"Content-Disposition: Attachment"
"X-Content-Type-Options: nosniff"	

1. https://developer.mozilla.org/[...]/Content-Disposition^[link7]
2. https://developer.mozilla.org/[...]Content-Type-Options^[link8]

1. mimetype (127+1+127 = 255)

1. files
2. upload

1. upload
2. file
3. attachments
4. filemeta

• wacko -> link
• wackoformatter

5. File Usage

<figure>
  <img src="https://wackowiki.org/doc/file/global/lotus_flower.jpg" alt="Lotus Flower" title="Lotus Flower (105 KiB)" width="640" height="427">
  <figcaption>Shinobazu Pond at Ueno Park at Ueno, Taito-ku in Tokyo. Original by <a href="https://www.flickr.com/photos/yoshikazut/">Yoshikazu TAKADA</a></figcaption>
</figure>	

figure { display: table; }
figcaption { display: table-caption; caption-side:bottom; } 	

5.1. Supported Media

• https://developer.mozilla.org/[...]/Formats/Image_types^[link10]
• https://developer.mozilla.org/[...]Formats/Audio_codecs^[link11]
• https://developer.mozilla.org/[...]Formats/Video_codecs^[link12]

5.1.1. Audio

5.1.2. Video

5.2. Embedding

5.3. Media Parameters

5.3.1. Alignment

5.3.2. Resizing

5.3.3. Linking

• ((file:/image.png some text))
• ((/Page/Link file:/image.png))

5.3.4. Caching

5.3.5. Others

6. Bad Behavior strict mode issue

strict = true	

Range: bytes=0-
Referer: https://wackowiki.org/doc/Dev/Release/R5.5/FileUpload
Accept-Language: en-US,en;q=0.5
Accept: video/webm,video/ogg,video/*;q=0.9,application/ogg;q=0.7,audio/*;q=0.6,*/*;q=0.5
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Host: wackowiki.org
Mod-Rewrite: on
Mod-Env: on	

Host:localhost
Range:bytes=0-	

7. Search

1. file name
2. description
3. title
4. cation

1. size
2. name
3. date
4. type

1. lang
2. category
3. user
4. location

8. Links

1. http://www.php.net/manual/en/features.file-upload.php
2. https://www.owasp.org/index.ph[...]stricted_File_Upload^[link16]
3. https://www.acunetix.com/websi[...]upload-forms-threat/^[link17]
4. https://en.wikipedia.org/wiki/Media_type
5. https://www.dokuwiki.org/images