<?php
/**
 *  Copyright (C) 2022, 2024  Double Bastion LLC
 *
 *  This file is part of Roundpin, which is licensed under the
 *  GNU Affero General Public License Version 3.0. The license terms
 *  are detailed in the "LICENSE.txt" file located in the root directory.
 */

session_start();

if (isset($_POST['sipusername']) && $_POST['sipusername'] != '' && isset($_POST['encextenpass']) && $_POST['encextenpass'] != '' && isset($_POST['conferenceext']) && 
    $_POST['conferenceext'] != '' && isset($_POST['vcextensionpm']) && $_POST['vcextensionpm'] != '') {

    define('ACCESSCONST', TRUE);

    require('db-connect.php');

    $vconfExtension = $_POST['sipusername'];
    $extenPassEnc = $_POST['encextenpass'];
    $videoConfExt = $_POST['conferenceext'];

    $vcExtensionpm = $_POST['vcextensionpm'];
    $resmessage = '';

    // Check if the received external user extension, the corresponding encrypted password and the extension of the conference, match the data in the 'external_users' table
    $query = $mysqli->prepare("SELECT id, exten_for_external, exten_for_ext_pass, conf_extension FROM external_users WHERE exten_for_external = ? AND exten_for_ext_pass = ? AND conf_extension = ?");
    $query->bind_param("sss", $vconfExtension, $extenPassEnc, $videoConfExt);
    $query->execute();
    $extqueryres = $query->get_result()->fetch_array();

    if (!$extqueryres) {

        http_response_code(400);
        exit();

    } else {

	  try {

	    // Check for undefined error, multiple files, $_FILES corruption
	    if (!isset($_FILES['uploadedFileVCPM']['error']) || is_array($_FILES['uploadedFileVCPM']['error'])) {
		throw new RuntimeException('Invalid parameters.');
	    }

	    // Check $_FILES['upfile']['error'] value
	    switch ($_FILES['uploadedFileVCPM']['error']) {
		case UPLOAD_ERR_OK:
		     break;
		case UPLOAD_ERR_NO_FILE:
		     throw new RuntimeException('No file sent.');
		case UPLOAD_ERR_INI_SIZE:
		     throw new RuntimeException('The file size limit was exceeded! Please choose a file with a smaller size!');
		case UPLOAD_ERR_FORM_SIZE:
		     throw new RuntimeException('The file size limit was exceeded! Please choose a file with a smaller size!');
		default:
		     throw new RuntimeException('Unknown error.');
	    }

	    // Check file size (in bytes)
	    if ($_FILES['uploadedFileVCPM']['size'] > 786432000) {
		throw new RuntimeException('Uploaded file size exceeds the limit of 750 MB.');
	    }

	    // Check MIME Type
	    $finfo = new finfo(FILEINFO_MIME_TYPE);
	    if (false === $ext = array_search($finfo->file($_FILES['uploadedFileVCPM']['tmp_name']),
		array(
		'aac' => 'audio/aac',
		'abw' => 'application/x-abiword',
		'arc' => 'application/x-freearc',
		'avi' => 'video/x-msvideo',
		'azw' => 'application/vnd.amazon.ebook',
		'bin' => 'application/octet-stream',
                'bmp' => 'image/x-ms-bmp',
		'bz' => 'application/x-bzip',
		'bz2' => 'application/x-bzip2',
		'cda' => 'application/x-cdf',
		'csh' => 'application/x-csh',
		'css' => 'text/css',
		'csv' => 'text/csv',
		'doc' => 'application/msword',
		'docx' => 'application/vnd.openxmlformats-officedocument.wordprocessingml.document',
		'eot' => 'application/vnd.ms-fontobject',
		'epub' => 'application/epub+zip',
		'gz' => 'application/gzip',
		'gif' => 'image/gif',
		'htm' => 'text/html',
		'html' => 'text/html',
		'ico' => 'image/vnd.microsoft.icon',
		'ics' => 'text/calendar',
		'jar' => 'application/java-archive',
		'jpeg' => 'image/jpeg',
		'jpg' => 'image/jpeg',
		'json' => 'application/json',
		'jsonld' => 'application/ld+json',
		'mid' => 'audio/midi',
		'midi' => 'audio/midi',
		'mp3' => 'audio/mpeg',
		'mp4' => 'video/mp4',
		'mpeg' => 'video/mpeg',
		'mpkg' => 'application/vnd.apple.installer+xml',
		'odp' => 'application/vnd.oasis.opendocument.presentation',
		'ods' => 'application/vnd.oasis.opendocument.spreadsheet',
		'odt' => 'application/vnd.oasis.opendocument.text',
		'oga' => 'audio/ogg',
		'ogv' => 'video/ogg',
		'ogx' => 'application/ogg',
		'opus' => 'audio/opus',
		'otf' => 'font/otf',
		'png' => 'image/png',
		'pdf' => 'application/pdf',
		'ppt' => 'application/vnd.ms-powerpoint',
		'pptx' => 'application/vnd.openxmlformats-officedocument.presentationml.presentation',
		'rar' => 'application/vnd.rar',
		'rtf' => 'application/rtf',
		'sh' => 'application/x-sh',
		'swf' => 'application/x-shockwave-flash',
		'tar' => 'application/x-tar',
		'tif' => 'image/tiff',
		'tiff' => 'image/tiff',
		'ts' => 'video/mp2t',
		'ttf' => 'font/ttf',
		'txt' => 'text/plain',
		'vsd' => 'application/vnd.visio',
		'wav' => 'audio/wav',
		'weba' => 'audio/webm',
		'webm' => 'video/webm',
		'webp' => 'image/webp',
		'woff' => 'font/woff',
		'woff2' => 'font/woff2',
		'xhtml' => 'application/xhtml+xml',
		'xls' => 'application/vnd.ms-excel',
		'xlsx' => 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
		'xml' => 'text/xml',
		'xul' => 'application/vnd.mozilla.xul+xml',
		'zip' => 'application/zip',
		'3gp' => 'video/3gpp',
		'3g2' => 'video/3gpp2',
		'7z' => 'application/x-7z-compressed',
		),
		true
	    )) {
		throw new RuntimeException('Invalid file format.');
	    }

	    // Check if the uploaded file contains PHP or JavaScript code tags
	    $upFileContent = file_get_contents($_FILES['uploadedFileVCPM']['tmp_name']);
	    if ((strpos($upFileContent, "<?php") !== false) || (strpos($upFileContent, "<script") !== false)) { throw new RuntimeException('Invalid file type.'); }

	    // Create the directories if they don't exist
	    if (!is_dir('../textchat/' . $vcExtensionpm)) {
		mkdir('../textchat/' . $vcExtensionpm, 0700);
	    }

	    if (!is_dir('../textchat/' . $vcExtensionpm . '/uploads')) {
		mkdir('../textchat/' . $vcExtensionpm . '/uploads', 0700);
	    }

	    // Check if the name of the uploaded file is valid
	    $nameWithoutExt = pathinfo($_FILES["uploadedFileVCPM"]["name"], PATHINFO_FILENAME);

	    if (preg_match('/^[a-zA-Z0-9\-\_\.]+$/', $nameWithoutExt)) {

		// Check if the name of the uploaded file is larger than 50 bytes
		if (strlen(basename($_FILES["uploadedFileVCPM"]["name"])) <= 50) {

		    // Check if a file with the same name already exists in the 'uploads' directory of that respective user
		    if (!file_exists('../textchat/' . $vcExtensionpm . '/uploads/' . basename($_FILES["uploadedFileVCPM"]["name"]))) {

		        $upload_dir = '../textchat/' . $vcExtensionpm . '/uploads/';
		        $targetfile = $upload_dir . basename($_FILES["uploadedFileVCPM"]["name"]);

		        // Scan the uploaded file with ClamAV if ClamAV is installed
		        if (file_exists('/usr/bin/clamdscan')) {

		            $clamdisrunning = exec("systemctl show -p ActiveState --value clamav-daemon");

		            if ($clamdisrunning == 'active') {

				$safePath = escapeshellarg($_FILES["uploadedFileVCPM"]['tmp_name']);
		                $runclamdscan = 'clamdscan --fdpass --quiet ' . $safePath . '';
				$resout = '';
				$rescheck = 1;
				exec($runclamdscan, $resout, $rescheck);

				if ($rescheck == 0) {

		                    if (move_uploaded_file($_FILES["uploadedFileVCPM"]["tmp_name"], $targetfile)) {
		                        chmod($targetfile, 0600);
		                    } else {
		                        throw new RuntimeException('There was an error while uploading the file.');
		                    }

		                } else { unlink($safePath); throw new RuntimeException('The file contains a virus or other type of malware.'); }

		            } else { throw new RuntimeException("The ClavAV antivirus is installed but clamav-daemon is not active and the uploaded file couldn't be scanned! Please check the status of clamav-daemon!"); }

		        } else {

		                if (move_uploaded_file($_FILES["uploadedFileVCPM"]["tmp_name"], $targetfile)) {
		                    chmod($targetfile, 0600);
		                } else { throw new RuntimeException('There was an error while uploading the file.'); }
		        }

		    } else { throw new RuntimeException('A file with the same name, ' . basename($_FILES["uploadedFileVCPM"]["name"]) . ', has been already sent. Please send a different file or rename your file before sending it.'); }

		} else { throw new RuntimeException('The name of the uploaded file is too long. File name length should not exceed 50 (Latin) characters. You can give a shorter name to your file and try again.'); }

	    } else { throw new RuntimeException('The name of the uploaded file is not valid. File names should contain only alphanumeric characters, hyphens, underscores and dots.'); }

	  } catch (RuntimeException $e) {

		  $resmessage = $e->getMessage();
	  }

  }

  $respdata = ['error' => $resmessage];

  echo json_encode($respdata);

} else {
       header("Location: ../login.php");
}

?>
