From a9211d23b5b74445209d09a3fe3af33c29299492 Mon Sep 17 00:00:00 2001
From: Zankaria <zankaria.auxa@skiff.com>
Date: Tue, 16 Jan 2024 18:01:13 +0000
Subject: [PATCH] Remove feature: upload by url

---
 inc/config.php           |  6 ---
 post.php                 | 88 ----------------------------------------
 templates/post_form.html | 13 +-----
 3 files changed, 1 insertion(+), 106 deletions(-)

diff --git a/inc/config.php b/inc/config.php
index 47709ea6..4238484a 100644
--- a/inc/config.php
+++ b/inc/config.php
@@ -571,12 +571,6 @@
     $config['link_prefix'] = '';
     $config['url_ads'] = &$config['link_prefix'];    // leave alias
 
-    // Allow "uploading" images via URL as well. Users can enter the URL of the image and then Tinyboard will
-    // download it. Not usually recommended.
-    $config['allow_upload_by_url'] = false;
-    // The timeout for the above, in seconds.
-    $config['upload_by_url_timeout'] = 15;
-
     // Enable early 404? With default settings, a thread would 404 if it was to leave page 3, if it had less
     // than 3 replies.
     $config['early_404'] = false;
diff --git a/post.php b/post.php
index 59306600..0e3460d9 100644
--- a/post.php
+++ b/post.php
@@ -64,36 +64,6 @@ function strip_markup($post_body)
     }
 }
 
-/**
- * Download the url's target with curl.
- *
- * @param [type] $url
- * @param [type] $timeout
- * @param [type] $fd
- * @return null|string Returns a string on error.
- */
-function download_file_into($url, $timeout, $fd)
-{
-    $err = null;
-    $curl = curl_init();
-    curl_setopt($curl, CURLOPT_URL, $url);
-    curl_setopt($curl, CURLOPT_FAILONERROR, true);
-    curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false);
-    curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5);
-    curl_setopt($curl, CURLOPT_TIMEOUT, $timeout);
-    curl_setopt($curl, CURLOPT_USERAGENT, 'Tinyboard');
-    curl_setopt($curl, CURLOPT_FILE, $fd);
-    curl_setopt($curl, CURLOPT_PROTOCOLS, CURLPROTO_HTTP | CURLPROTO_HTTPS);
-    curl_setopt($curl, CURLOPT_IPRESOLVE, CURL_IPRESOLVE_V4);
-
-    if (curl_exec($curl) === false) {
-        $err = curl_error($curl);
-    }
-
-    curl_close($curl);
-    return $err;
-}
-
 /**
  * Method handling functions
  */
@@ -739,64 +709,6 @@ function handle_post()
         }
     }
 
-    if ($config['allow_upload_by_url'] && isset($_POST['file_url1']) && !empty($_POST['file_url1'])) {
-        function unlink_tmp_file($file)
-        {
-            @unlink($file);
-            fatal_error_handler();
-        }
-
-        function upload_by_url($config, $post, $url)
-        {
-            $post['file_url'] = $url;
-            if (!preg_match('@^https?://@', $post['file_url'])) {
-                error($config['error']['invalidimg']);
-            }
-
-            if (mb_strpos($post['file_url'], '?') !== false) {
-                $url_without_params = mb_substr($post['file_url'], 0, mb_strpos($post['file_url'], '?'));
-            } else {
-                $url_without_params = $post['file_url'];
-            }
-
-            $post['extension'] = strtolower(mb_substr($url_without_params, mb_strrpos($url_without_params, '.') + 1));
-
-            if ($post['op'] && $config['allowed_ext_op']) {
-                if (!in_array($post['extension'], $config['allowed_ext_op'])) {
-                    error($config['error']['unknownext']);
-                }
-            } else if (!in_array($post['extension'], $config['allowed_ext']) && !in_array($post['extension'], $config['allowed_ext_files'])) {
-                error($config['error']['unknownext']);
-            }
-
-            $post['file_tmp'] = tempnam($config['tmp'], 'url');
-            register_shutdown_function('unlink_tmp_file', $post['file_tmp']);
-
-            $fd = fopen($post['file_tmp'], 'w');
-
-            $dl_err = download_file_into($post['file_url'], $config['upload_by_url_timeout'], $fd);
-            fclose($fd);
-            if ($dl_err !== null) {
-                error($config['error']['nomove'] . '<br/>Curl says: ' . $dl_err);
-            }
-
-            $_FILES[$post['file_tmp']] = array(
-                'name' => basename($url_without_params),
-                'tmp_name' => $post['file_tmp'],
-                'file_tmp' => true,
-                'error' => 0,
-                'size' => filesize($post['file_tmp'])
-            );
-        }
-
-        for ($counter = 1; $counter <= $config['max_images']; $counter++) {
-            $varname = "file_url" . $counter;
-            if (isset($_POST[$varname]) && !empty($_POST[$varname])) {
-                upload_by_url($config, $post, $_POST[$varname]);
-            }
-        }
-    }
-
     // Convert multiple upload format to array of files. This makes the following code
     // work the same whether we used the JS or HTML multiple file upload techniques.
     if (array_key_exists('file_multiple', $_FILES)) {
diff --git a/templates/post_form.html b/templates/post_form.html
index dc8af008..89b60a09 100644
--- a/templates/post_form.html
+++ b/templates/post_form.html
@@ -145,7 +145,7 @@
 			<th>
 				{% trans %}File{% endtrans %}
 			</th>
-                       <td class="upload-area">
+				<td class="upload-area">
 				<input type="file" name="file_multiple[]" id="upload_file" multiple/>
 
 				{% if 'js/file-selector.js' in config.additional_javascript %}
@@ -156,17 +156,6 @@
 					}
 				</script>
 				{% endif %}
-
-
-				{% if config.allow_upload_by_url %}
-					<div style="float:none;text-align:left" id="upload_url">
-						<label for="file_url">{% trans %}Or URL{% endtrans %}</label>: 
-						{% for counter in 1..config.max_images %}
-						<input style="display:inline" type="text" id="file_url{{ counter }}" name="file_url{{ counter }}" size="35">
-						</br>
-						{% endfor %}
-					</div>
-				{% endif %}
 				{{ antibot.html() }}
 			</td>
 		</tr>