Avatar.php 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141
  1. <?php
  2. /**
  3. * This file handles the avatar requests. The whole point of this file is to reduce the loaded stuff to show an image
  4. *
  5. * Simple Machines Forum (SMF)
  6. *
  7. * @package SMF
  8. * @author Simple Machines
  9. *
  10. * @copyright 2012 Simple Machines
  11. * @license http://www.simplemachines.org/about/smf/license.php BSD
  12. *
  13. * @version 2.1 Alpha 1
  14. */
  15. if (!defined('SMF'))
  16. die('No direct access...');
  17. function showAvatar()
  18. {
  19. global $smcFunc, $modSettings, $maintenance;
  20. // We need a valid ID
  21. if(empty($_GET['attach']) || (string)$_GET['attach'] != (string)(int)$_GET['attach'])
  22. die;
  23. // No access in strict maintenance mode
  24. if(!empty($maintenance) && $maintenance == 2)
  25. die;
  26. // This is done to clear any output that was made before now.
  27. if(!empty($modSettings['enableCompressedOutput']) && !headers_sent() && ob_get_length() == 0)
  28. {
  29. if(@ini_get('zlib.output_compression') == '1' || @ini_get('output_handler') == 'ob_gzhandler')
  30. $modSettings['enableCompressedOutput'] = 0;
  31. else
  32. ob_start('ob_gzhandler');
  33. }
  34. if(empty($modSettings['enableCompressedOutput']))
  35. {
  36. ob_start();
  37. header('Content-Encoding: none');
  38. }
  39. // Better handling
  40. $id_attach = (int) $_GET['attach'];
  41. // Use cache when possible
  42. if(($cache = cache_get_data('avatar_lookup_id-'. $id_attach)) != null)
  43. $file = $cache;
  44. // Get the info from the DB
  45. else
  46. {
  47. $request = $smcFunc['db_query']('', '
  48. SELECT id_folder, filename AS real_filename, file_hash, fileext, id_attach, attachment_type, mime_type, approved, id_member
  49. FROM {db_prefix}attachments
  50. WHERE id_attach = {int:id_attach}
  51. AND id_member > {int:blank_id_member}
  52. LIMIT 1',
  53. array(
  54. 'id_attach' => $id_attach,
  55. 'blank_id_member' => 0,
  56. )
  57. );
  58. $file = $smcFunc['db_fetch_assoc']($request);
  59. // Update the download counter (unless it's a thumbnail).
  60. if ($file['attachment_type'] != 3)
  61. $smcFunc['db_query']('attach_download_increase', '
  62. UPDATE LOW_PRIORITY {db_prefix}attachments
  63. SET downloads = downloads + 1
  64. WHERE id_attach = {int:id_attach}',
  65. array(
  66. 'id_attach' => $id_attach,
  67. )
  68. );
  69. $file['filename'] = getAttachmentFilename($file['real_filename'], $id_attach, $file['id_folder'], false, $file['file_hash']);
  70. // ETag time
  71. $file['etag'] = '"'. function_exists('md5_file') ? md5_file($file['filename']) : md5(file_get_contents($file['filename'])). '"';
  72. // Cache it... (Why do I randomly select a length at which to expire? Search around for RIP_JITTER :P)
  73. cache_put_data('avatar_lookup_id-'. $id_attach, $file, mt_rand(850, 900));
  74. }
  75. // The file does not exists
  76. if(!file_exists($file['filename']))
  77. {
  78. header('HTTP/1.0 404 File Not Found');
  79. die('404 File Not Found');
  80. }
  81. // If it hasn't been modified since the last time this attachement was retrieved, there's no need to display it again.
  82. if (!empty($_SERVER['HTTP_IF_MODIFIED_SINCE']))
  83. {
  84. list($modified_since) = explode(';', $_SERVER['HTTP_IF_MODIFIED_SINCE']);
  85. if (strtotime($modified_since) >= filemtime($file['filename']))
  86. {
  87. ob_end_clean();
  88. // Answer the question - no, it hasn't been modified ;).
  89. header('HTTP/1.1 304 Not Modified');
  90. exit;
  91. }
  92. }
  93. header('Pragma: ');
  94. header('Expires: '. gmdate('D, d M Y H:i:s', time() + 31536000). ' GMT');
  95. header('Last-Modified: '. gmdate('D, d M Y H:i:s', filemtime($file['filename'])). ' GMT');
  96. header('Accept-Ranges: bytes');
  97. header('Connection: close');
  98. header('ETag: '. $file['etag']);
  99. header('Content-Type: '. $file['mime_type']);
  100. // Since we don't do output compression for files this large...
  101. if (filesize($file['filename']) > 4194304)
  102. {
  103. // Forcibly end any output buffering going on.
  104. while (@ob_get_level() > 0)
  105. @ob_end_clean();
  106. $fp = fopen($file['filename'], 'rb');
  107. while (!feof($fp))
  108. {
  109. print fread($fp, 8192);
  110. flush();
  111. }
  112. fclose($fp);
  113. }
  114. // On some of the less-bright hosts, readfile() is disabled. It's just a faster, more byte safe, version of what's in the if.
  115. elseif (@readfile($file['filename']) === null)
  116. print file_get_contents($file['filename']);
  117. die();
  118. }