Show HN: Mejiro – single-file photo hosting PHP app

There's a bit of code to try and stop path traversal, but it doesn't account for passing d=.. as a url param.

A shortened test case using the same code as the app to try and thwart traversal:

  <?php
    $_GET['d']='..';
    $photo_dir='photos/';
    $sub_photo_dir = basename($_GET['d']).'/';
    $photo_dir = str_replace("//",
      "/",$photo_dir.$sub_photo_dir);
    print "photo_dir: [$photo_dir]";
  ?>

That would allow you to upload a file one directory above the intended $photo_dir.

I'm not a coder by any stretch of imagination, but I've managed to cobble together this simple PHP app for hosting my photos. Constructive feedback will be greatly appreciated.

Looks like a good start and seems to do its job.

A suggestion -- you mention "Automatic thumbnail generation" in the feature list but the thumbnails in the demo have massive file sizes (~80-100KB each at 800px width).

Thumbnails should generally be <20KB and <320px width. You could re-use the `createTim()` function you have to generate an additional, proper thumbnail instead of the 800px preview image squashed down via HTML as you do now.

I would also suggest to add some validation to your file upload. Currently you are allowing arbitrary files to be uploaded. Even though it is password protected, it is still trivial to brute force even with your sleep(3). The danger with allowing arbitrary file upload is someone can upload a script (PHP file for example) and run it basically allowing arbitrary code execution. This can lead to a whole slew of other issues.

To get started, I would suggest:

1. Generating your own file names w/extension instead of relying on $_FILES['filetoupload']['name']

2. After move_uploaded_file(), change file permissions to 644 to help mitigate possibility of file execution

3. Use getimagesize() to determine if file is indeed an image. It is still possible to embed code into a validate image to bypass getimagesize(), but #1 will help prevent Apache/etc from interpreting the file as PHP.

4. Ideally you would also strip metadata from the image file and only keep resized images and delete the originals.

Also would suggest that you do not use the same password on your demo site as you have posted on Github.

looks pretty cool! have you thought about integrating the php app into other projects?

I know for example that ownCloud has great problems to efficiently display images and something like what you created looks a lot better than what they have so far. Keep it up :)!

I like your coding style, it's very organized.

Look like pasteboard?

How can "single dirty file mixing PHP HTML CSS" can be showcased as a feature in 2016...