archive-ccc8458/video/api/chunked/init.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
<?php
declare(strict_types=1);
header('Content-Type: application/json');
require_once __DIR__ . '/../../lib/auth.php';
require_once __DIR__ . '/../../lib/chunked.php';
require_https();
if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
http_response_code(405);
echo json_encode(['error' => 'method not allowed']);
exit;
}
if (!rate_limit_check()) {
http_response_code(429);
echo json_encode(['error' => 'too many failed attempts, try again later']);
exit;
}
$pw = password_from_request();
if ($pw === null || $pw === '' || !verify_password($pw)) {
rate_limit_fail();
http_response_code(401);
echo json_encode(['error' => 'invalid password']);
exit;
}
rate_limit_reset();
// Accept JSON body or form-encoded.
$payload = $_POST;
if (str_starts_with($_SERVER['CONTENT_TYPE'] ?? '', 'application/json')) {
$body = json_decode((string) file_get_contents('php://input'), true);
if (is_array($body)) $payload = $body;
}
$filename = trim((string)($payload['filename'] ?? ''));
$declaredMime = (string)($payload['mime'] ?? '');
$totalSize = (int)($payload['total_size'] ?? 0);
$chunkSize = (int)($payload['chunk_size'] ?? 0);
if ($filename === '' || strlen($filename) > 255 || preg_match('#[/\\\\\\0]#', $filename)) {
http_response_code(400);
echo json_encode(['error' => 'invalid filename']);
exit;
}
if (!isset(ALLOWED_TYPES[$declaredMime])) {
http_response_code(415);
echo json_encode(['error' => 'unsupported declared video type', 'declared' => $declaredMime]);
exit;
}
if ($totalSize <= 0 || $totalSize > MAX_CHUNKED_BYTES) {
http_response_code(413);
echo json_encode(['error' => 'invalid or too-large total_size', 'max' => MAX_CHUNKED_BYTES]);
exit;
}
if ($chunkSize <= 0 || $chunkSize > MAX_CHUNK_BYTES) {
http_response_code(400);
echo json_encode(['error' => 'invalid chunk_size', 'max' => MAX_CHUNK_BYTES]);
exit;
}
$expectedChunks = (int) ceil($totalSize / $chunkSize);
if ($expectedChunks > MAX_CHUNKS) {
http_response_code(400);
echo json_encode(['error' => 'too many chunks', 'max' => MAX_CHUNKS]);
exit;
}
ensure_uploads_dir();
gc_orphan_uploads();
$id = bin2hex(random_bytes(16));
if (!write_meta($id, [
'filename' => $filename,
'declared_mime' => $declaredMime,
'total_size' => $totalSize,
'chunk_size' => $chunkSize,
'expected_chunks' => $expectedChunks,
'created' => time(),
])) {
http_response_code(500);
echo json_encode(['error' => 'could not create upload session']);
exit;
}
echo json_encode([
'upload_id' => $id,
'chunk_size' => $chunkSize,
'expected_chunks' => $expectedChunks,
'put_url' => SITE_BASE . '/video/api/chunked/put',
'finalize_url' => SITE_BASE . '/video/api/chunked/finalize',
'abort_url' => SITE_BASE . '/video/api/chunked/abort',
]);