Allow to keep and reclaim uploads without being logged in

If a user keeps the browser open until his session expires and then
tries to upload something we now add it to the database, add the ID to
the new session and when someone logs in with that session the ID is
assigned. Until then even if you guess it correctly, you won't be able
to download it.

If the user still manages to let the 2nd session expire because he can't
find his password, the upload will be lost. Shit happens.

Signed-off-by: Florian Pritz <bluewind@xinu.at>

1 files changed, 27 insertions, 2 deletions

diff --git a/application/models/file_mod.php b/application/models/file_mod.php
index 26d384fa9..e65529971 100644
--- a/application/models/file_mod.php
+++ b/application/models/file_mod.php
@@ -83,8 +83,6 @@ class File_mod extends CI_Model {
 	// TODO: Should only update not insert; see new_id()
 	function add_file($hash, $id, $filename)
 	{
-		$this->muser->require_access();
-
 		$userid = $this->muser->get_userid();
 
 		$mimetype = exec("perl ".FCPATH.'scripts/mimetype '.escapeshellarg($filename).' '.escapeshellarg($this->file($hash)));
@@ -95,10 +93,31 @@ class File_mod extends CI_Model {
 			array($hash, $id, $filename, $userid, time(), $mimetype, $filesize));
 	}
 
+	function adopt($id)
+	{
+		$userid = $this->muser->get_userid();
+
+		$this->db->query("
+			UPDATE files
+			SET user = ?
+			WHERE id = ?
+			", array($userid, $id));
+	}
+
 	function show_url($id, $mode)
 	{
 		$redirect = false;
 
+		if (!$this->muser->logged_in()) {
+			// keep the upload but require the user to login
+			$this->session->set_userdata("last_upload", array(
+				"id" => $id,
+				"mode" => $mode
+			));
+			$this->session->set_flashdata("uri", "file/claim_id");
+			$this->muser->require_access();
+		}
+
 		if ($mode) {
 			$this->data['url'] = site_url($id).'/'.$mode;
 		} else {
@@ -191,6 +210,12 @@ class File_mod extends CI_Model {
 			return;
 		}
 
+		// don't allow unowned files to be downloaded
+		if ($filedata["user"] == 0) {
+			$this->non_existent();
+			return;
+		}
+
 		// MODIFIED SINCE SUPPORT -- START
 		// helps to keep traffic low when reloading
 		$etag = strtolower($filedata["hash"]."-".$filedata["date"]);