Server response is ok {"status":"OK","type":"png","hash":"1ucq23hnr5.png","url":"http:\/\/192.168.99.100\/1ucq23hnr5.png","domain":"http:\/\/192.168.99.100"}

But image is not present in upload folder

Hi there thanks for this great piece of work I've uploaded all files working just fine. I have one question though I've tried to add the url for upload in my hybrid app in view to upload the image via cordova. you have mentioned in your readme file the following. UPLOAD_CODE If set, will show users a code field in the upload form. If it doesn't match your setting, files won't be uploaded. If enabled, the Upload API will need the variable upload_code via GET (eg: https://pictshare.net/backend.php?getimage=https://www.0xf.at/css/imgs/logo.png&upload_code=YourUploadCodeHere)

what if I am uploading the image from my phone there will be no url per se. in my file I have the path of the image only. Any help will be much appreciated

I'm getting really high CPU usage, and swap space being used up on my server all of the sudden from pictshare (I'm using the docker image). pictshare has about 5000 pictures, and has had no issues until now. Might be a memory leak?

7416  php-fpm        335072 kB
7415  php-fpm        334936 kB
7417  php-fpm        334376 kB
7428  php-fpm        334328 kB
7424  php-fpm        333968 kB
7426  php-fpm        231788 kB
7513  php-fpm        31904 kB
7422  php-fpm        12692 kB
7973  php-fpm        8356 kB
7396  php-fpm        3372 kB

I just checked and no new files are being added to the pictshare folder, so no uploads are taking place either.

Could you help me test this seemingly valid image with geturl.php?

https://MY_PICTSHARE.com/pictshare/api/geturl.php?url=https://i.guim.co.uk/img/media/4d908693e566fdd7f8cdeac559f6375b739887a3/356_37_3264_1958/master/3264.jpg?width=1200&height=630&quality=85&auto=format&fit=crop&overlay-align=bottom%2Cleft&overlay-width=100p&overlay-base64=L2ltZy9zdGF0aWMvb3ZlcmxheXMvdGctZGVmYXVsdC5wbmc&enable=upscale&s=3a70177dcc60673c606302d96fcbd9bc

Error:

filetype: "x-empty"
reason: "Unsupported filetype"
status: "err"

​

It would be beneficial if caching headers were part of the response when serving image files;

Cache-control: public, max-age=31536000

As these files should be pretty much immutable. I can submit a pull request for this, if you point me to suitable method where this should be handles.

Hello,

I would like to report for XSS vulnerability.

in api/info.php

function getInfoAboutHash

function getInfoAboutHash($hash)
{
    // ...
        
    return array('hash'=>$hash,'size_bytes'=>$size,'size_interpreted'=>$size_hr,'type'=>$type,'type_interpreted'=>getTypeOfFile($file));
}

line 15

$hash = $_REQUEST['hash'];
// ...
    $answer = getInfoAboutHash($hash);
    $answer['status'] = 'ok';
    exit(json_encode($answer));
// ...

exit function will terminate the script and print the message which has $_REQUEST['hash']. Then there is XSS vulnerability.

Hello,

I'm just getting in touch as we recently received some disclosures against this repository through our disclosure program. I tried looking for a contactable e-mail and security policy to send the details to, but could not find either.

You can find the details for the disclosures here:

https://huntr.dev/bounties/1-HaschekSolutions/pictshare/ https://huntr.dev/bounties/2-HaschekSolutions/pictshare/ https://huntr.dev/bounties/3-HaschekSolutions/pictshare/ https://huntr.dev/bounties/4-HaschekSolutions/pictshare/

They are private to yourself and the reporter. If you would prefer not to sign-up to view the disclosures, let me know, and I will be happy to share them with you over some other means.

Let me know if you have any questions.

-- Jamie from huntr.dev

Is there any interest in adding some form of access control to limit who can upload files? I'm interested in using this, but I would be the only person I'd want to be able to upload files.

An API key for the upload API would be simple. Some sort of login to limit the web interface would be a bit more work.

I am trying out v2 of pictshare and I noticed that upload page is not hidden if I enable

define('UPLOAD_FORM_LOCATION', 'secret/upload');

also I get this error, any idea what folder needs some modification or what kind of permission change is necessary?

Is there an example of how to upload images via regular form data ?

I've been trying to use pictashare, hoewver getting errors when uploading

Access has been blocked from origin by CORS policy

When I try to upload a file I'm getting cannot post error. Am I missing something?

curl -F "file=@/Users/apple/Desktop/dev/bethabit/marketing/logo.png" https://bethabit.com/api/upload.php

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Error</title>
</head>
<body>
<pre>Cannot POST /api/upload.php</pre>
</body>
</html>

this is the nginx block I use.

server {
        listen 80;
        server_name bethabit.com www.bethabit.com;

        client_max_body_size 50M; # Set the max file upload size. This needs to be equal or larger than the size you specified in your php.ini

        root /var/www/pictshare-master; # or where ever you put it
        index index.php;

    location / {
        try_files $uri $uri/ /index.php?url=$request_uri;
    }

    location ~ \.php {
        fastcgi_pass unix:/var/run/php/php7.3-fpm.sock; #may be slightly different depending on your php version
        fastcgi_index index.php;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        fastcgi_param PATH_INFO $fastcgi_script_name;
    }

    location ~ /(data|tmp|bin|content-controllers|inc|interfaces|storage-controllers|templates|tools) {
       deny all;
       return 404;
    } 
}

this is the pictshare config

<?php 
/**
 * All settings that are uncommented are mandatory
 * Others optional
 */

//Use a specific domain for links presented to the user
//Format: https://your.domain.name/
// MUST HAVE TAILING /
define('URL','https://bethabit.com/');

//define('JPEG_COMPRESSION', 90);
//define('FFMPEG_BINARY','');
//define('ALT_FOLDER','/ftp/pictshare');
//define('ALLOWED_SUBNET','192.168.0.0/24');

//S3 settings
//
//define('S3_BUCKET','bucketname');
//define('S3_ACCESS_KEY','');
//define('S3_SECRET_KEY','');
//define('S3_ENDPOINT','http://localhost:9000'); //optional, only if you're using S3 compatible storage like Minio

Probably smarter not (only) to allow conversion to WebP but rather always after upload convert an uploaded jpg image to WebP and then automatically serve it when the request header indicates that the browser supports WebP.

Now the codebase has been rewritten we can start and think about the problem with scaling pictshare: deleting content.

Imagine two Pictshare servers connected through a shared folder (ALT_FOLDER)

An image is requested frequently so both servers have a local copy and there is a copy in the shared folder.

If the user wants to delete the image, it's deleted off the server the user sent the request to and from the shared folder.

the second server never got any info about any deleted hash so they kept theirs.

Possible solutions:

• Keep a list of deleted hashes in all storage controllers
• Use some kind of centralized database that manages all hashes and stati
• Make all nodes somehow communicate with each other