From b175d77c7bae8d6480f575a505c6dcea03b96702 Mon Sep 17 00:00:00 2001
From: Stefan Brand <seiichiro@seiichiro0185.org>
Date: Sat, 24 Feb 2024 18:58:34 +0100
Subject: [PATCH] Parallel Thumbnail Generation

---
 index.php            |  8 +-------
 lib/thumbs.class.php |  8 +++-----
 thumb.php            | 33 +++++++++++++++++++++++++++++++++
 3 files changed, 37 insertions(+), 12 deletions(-)
 create mode 100644 thumb.php

diff --git a/index.php b/index.php
index 4f8bd91..c2b45af 100644
--- a/index.php
+++ b/index.php
@@ -2,7 +2,6 @@
 
 // Classes
 require_once('lib/helpers.class.php');
-require_once('lib/thumbs.class.php');
 require_once('lib/template.class.php');
 
 // Settings
@@ -10,9 +9,7 @@ require('conf/config.php');
 
 // Prepare Some Basic Variables
 $imagedir = Helpers::end_dir($conf['fs_imagedir']);
-$thumbdir = Helpers::end_dir($conf['fs_thumbdir']);
 $imageurl = Helpers::end_dir($conf['web_imagedir']);
-$thumburl = Helpers::end_dir($conf['web_thumbdir']);
 
 $galleryname = $conf['gallery_name'];
 
@@ -41,9 +38,6 @@ $secure = ($proto == 'https');
 session_set_cookie_params([ 'lifetime' => 3600, 'path' => '/', 'domain' => $host, 'secure' => $secure, 'httponly' => true, 'samesite' => 'lax' ]);
 session_start();
 
-// Initialize Thumbnail Handler
-$t = new Thumb(Helpers::end_dir($imagedir.$dir), $thumbdir, $thumburl, 200, 200);
-
 // Filelist Cache Handling
 $cdir = $dir;
 if (empty($cdir))
@@ -142,7 +136,7 @@ if (!empty($curfiles)| !empty($dirs)) {
         } else {
           $tmp['n'] = $image;
           $tmp['i'] = $index+1;
-          $tmp['t'] = $t->get_thumb($image);
+          $tmp['t'] = 'thumb.php?d='.Helpers::end_dir($imagedir.$dir).'&i='.$image;
           $data['images'][] = $tmp;
         }
       }
diff --git a/lib/thumbs.class.php b/lib/thumbs.class.php
index 36003c1..ef6b9bb 100644
--- a/lib/thumbs.class.php
+++ b/lib/thumbs.class.php
@@ -3,7 +3,6 @@
 class thumb {
   protected string $imagedir;
   protected string $thumbdir;
-  protected string $thumburl;
 
   protected int $w = 200;
   protected int $h = 200;
@@ -26,10 +25,9 @@ class thumb {
     ]
   ];
 
-  public function __construct($idir, $tdir, $turl, $width, $heigth) {
+  public function __construct($idir, $tdir, $width, $heigth) {
     $this->imagedir = $idir;
     $this->thumbdir = $tdir;
-    $this->thumburl = $turl;
     $this->w        = $width;
     $this->h        = $heigth;
   }
@@ -52,7 +50,7 @@ class thumb {
         if ($retval) {
           return "img/video.png";
         } else {
-          return $this->thumburl.$dstname.'.jpg';
+          return $dstpath;
         }
       }
 
@@ -92,7 +90,7 @@ class thumb {
       imagedestroy($image);
       imagedestroy($thumbnail);
     }
-    return $this->thumburl.$dstname.'.jpg';
+    return $dstpath;
   }
 }
 
diff --git a/thumb.php b/thumb.php
new file mode 100644
index 0000000..8105a4f
--- /dev/null
+++ b/thumb.php
@@ -0,0 +1,33 @@
+<?php
+// Load Helper Classes
+require_once('lib/helpers.class.php');
+require_once('lib/template.class.php');
+require_once('lib/thumbs.class.php');
+
+// Settings
+require('conf/config.php');
+
+// Prepare Some Basic Variables
+$thumbdir = Helpers::end_dir($conf['fs_thumbdir']);
+$imagedir = Helpers::end_dir($conf['fs_imagedir']);
+
+// Prepare Path Traversal Check
+$r_basedir=realpath($imagedir);
+
+$dir = $_GET['d'];
+$img = $_GET['i'];
+
+$r_imagedir = realpath($dir);
+if ($r_imagedir === false || strpos(Helpers::end_dir($r_imagedir), $r_basedir.DIRECTORY_SEPARATOR) !== 0) {
+  $data['script'] = $_SERVER['PHP_SELF'];
+  $data['errormsg'] = 'A Path Traversal was Detected';
+  Template::view('tpl/error.html', $data);
+  exit();
+}
+
+// Initialize Thumbnail Handler
+$t = new Thumb(Helpers::end_dir($dir), $thumbdir, 200, 200);
+$thumbfile = $t->get_thumb($img);
+
+header('Content-Type: image/jpeg');
+readfile($thumbfile);
\ No newline at end of file