#!/bin/sh

# disable filename globbing
set -f

URLDECODE=/home/httpd/cgi-bin/urlencoded2sh

UPLOAD_LOCATION=/home/httpd/generic/upload



# For obvious reasons, always pick up any Server environment
# things BEFORE expanding query string

#echo 'HTTP_USER_AGENT='"$HTTP_USER_AGENT"
#echo 'HTTP_COOKIE='"$HTTP_COOKIE"
#echo 'HTTP_ACCEPT='"$HTTP_ACCEPT"
#echo 'HTTP_ACCEPT_CHARSET='"$HTTP_ACCEPT_CHARSET"
#echo 'HTTP_ACCEPT_ENCODING='"$HTTP_ACCEPT_ENCODING"
#echo 'HTTP_ACCEPT_LANGUAGE='"$HTTP_ACCEPT_LANGUAGE"
#echo 'HTTP_CONNECTION='"$HTTP_CONNECTION"
#echo 'REMOTE_ADDR/PORT='"$REMOTE_ADDR":"$REMOTE_PORT"

#echo 'SERVER_NAME='"$SERVER_NAME"
#echo 'QUERY_STRING='"$QUERY_STRING"

badRequest()
{
	cat <<RESPONSE
	Content-type: text/plain

bad request, thanks for playing
RESPONSE
}


# check args for correctness

if [ "$REQUEST_METHOD" != "POST" ] ; then
	badRequest
	exit 0
fi

eval `echo "$QUERY_STRING" | $URLDECODE`
if [ -z "$filename" ] ; then
	badRequest
	exit 0
fi

nfilename=`echo "$filename" | sed -e '
/\.\./d
/[&!,\/\\]/d
'`

if [ "$filename" != "$nfilename" ] ; then
	badRequest
	echo "only a-z 0-9 _ and . are allowed in filenames"
	exit 0
fi
filename=`echo $filename | tr -s ' ' | tr ' ' '_' `

if [ -z "$dir" ] ; then
	badRequest
	exit 0
fi

if [ ! -d "$UPLOAD_LOCATION/$dir" ] ; then
	badRequest
	exit 0
fi


cat <<PREAMBLE
Content-type: text/plain

PREAMBLE

# any page header goes here
cat <<HEADER
HEADER

#echo 'CONTENT_TYPE: '"$CONTENT_TYPE"
#echo 'CONTENT_LENGTH: '"$CONTENT_LENGTH"

#cat - | $URLDECODE $CONTENT_TYPE $CONTENT_LENGTH >"$UPLOAD_LOCATION/$dir/$filename"
cat - >"$UPLOAD_LOCATION/$dir/$filename.download"
mv "$UPLOAD_LOCATION/$dir/$filename.download" "$UPLOAD_LOCATION/$dir/$filename"

echo "$dir/$filename" uploaded successfully

exit 0