SHARE
TWEET

Untitled

a guest Aug 23rd, 2019 89 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. if (isset($_GET['avatar']))
  2. {
  3.     require($phpbb_root_path . 'includes/startup.' . $phpEx);
  4.  
  5.     require($phpbb_root_path . 'phpbb/class_loader.' . $phpEx);
  6.     $phpbb_class_loader = new \phpbb\class_loader('phpbb\\', "{$phpbb_root_path}phpbb/", $phpEx);
  7.     $phpbb_class_loader->register();
  8.  
  9.     $phpbb_config_php_file = new \phpbb\config_php_file($phpbb_root_path, $phpEx);
  10.     extract($phpbb_config_php_file->get_all());
  11.  
  12.     if (!defined('PHPBB_ENVIRONMENT'))
  13.     {
  14.         @define('PHPBB_ENVIRONMENT', 'production');
  15.     }
  16.  
  17.     if (!defined('PHPBB_INSTALLED') || empty($dbms) || empty($acm_type))
  18.     {
  19.         exit;
  20.     }
  21.  
  22.     require($phpbb_root_path . 'includes/constants.' . $phpEx);
  23.     require($phpbb_root_path . 'includes/functions.' . $phpEx);
  24.     require($phpbb_root_path . 'includes/functions_download' . '.' . $phpEx);
  25.     require($phpbb_root_path . 'includes/utf/utf_tools.' . $phpEx);
  26.  
  27.     // Setup class loader first
  28.     $phpbb_class_loader_ext = new \phpbb\class_loader('\\', "{$phpbb_root_path}ext/", $phpEx);
  29.     $phpbb_class_loader_ext->register();
  30.  
  31.     // Set up container
  32.     $phpbb_container_builder = new \phpbb\di\container_builder($phpbb_root_path, $phpEx);
  33.     $phpbb_container = $phpbb_container_builder->with_config($phpbb_config_php_file)->get_container();
  34.  
  35.     $phpbb_class_loader->set_cache($phpbb_container->get('cache.driver'));
  36.     $phpbb_class_loader_ext->set_cache($phpbb_container->get('cache.driver'));
  37.  
  38.     // set up caching
  39.     /* @var $cache \phpbb\cache\service */
  40.     $cache = $phpbb_container->get('cache');
  41.  
  42.     /* @var $phpbb_dispatcher \phpbb\event\dispatcher */
  43.     $phpbb_dispatcher = $phpbb_container->get('dispatcher');
  44.  
  45.     /* @var $request \phpbb\request\request_interface */
  46.     $request    = $phpbb_container->get('request');
  47.  
  48.     /* @var $db \phpbb\db\driver\driver_interface */
  49.     $db         = $phpbb_container->get('dbal.conn');
  50.  
  51.     /* @var $phpbb_log \phpbb\log\log_interface */
  52.     $phpbb_log  = $phpbb_container->get('log');
  53.  
  54.     unset($dbpasswd);
  55.  
  56.     /* @var $config \phpbb\config\config */
  57.     $config = $phpbb_container->get('config');
  58.  
  59.     // load extensions
  60.     /* @var $phpbb_extension_manager \phpbb\extension\manager */
  61.     $phpbb_extension_manager = $phpbb_container->get('ext.manager');
  62.  
  63.     // worst-case default
  64.     $browser = strtolower($request->header('User-Agent', 'msie 6.0'));
  65.  
  66.     /* @var $phpbb_avatar_manager \phpbb\avatar\manager */
  67.     $phpbb_avatar_manager = $phpbb_container->get('avatar.manager');
  68.  
  69.     $filename = $request->variable('avatar', '');
  70.     $avatar_group = false;
  71.     $exit = false;
  72.  
  73.     if (isset($filename[0]) && $filename[0] === 'g')
  74.     {
  75.         $avatar_group = true;
  76.         $filename = substr($filename, 1);
  77.     }
  78.  
  79.     // '==' is not a bug - . as the first char is as bad as no dot at all
  80.     if (strpos($filename, '.') == false)
  81.     {
  82.         send_status_line(403, 'Forbidden');
  83.         $exit = true;
  84.     }
  85.  
  86.     if (!$exit)
  87.     {
  88.         $ext        = substr(strrchr($filename, '.'), 1);
  89.         $stamp      = (int) substr(stristr($filename, '_'), 1);
  90.         $filename   = (int) $filename;
  91.         $exit = set_modified_headers($stamp, $browser);
  92.     }
  93.     if (!$exit && !in_array($ext, array('png', 'gif', 'jpg', 'jpeg')))
  94.     {
  95.         // no way such an avatar could exist. They are not following the rules, stop the show.
  96.         send_status_line(403, 'Forbidden');
  97.         $exit = true;
  98.     }
  99.  
  100.  
  101.     if (!$exit)
  102.     {
  103.         if (!$filename)
  104.         {
  105.             // no way such an avatar could exist. They are not following the rules, stop the show.
  106.             send_status_line(403, 'Forbidden');
  107.         }
  108.         else
  109.         {
  110.             send_avatar_to_browser(($avatar_group ? 'g' : '') . $filename . '.' . $ext, $browser);
  111.         }
  112.     }
  113.     file_gc();
  114. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top