&k= * * Lets someone without an admin account upload into a gallery, gated by: * 1. a per-gallery secret key in the URL (k), compared with hash_equals, * 2. the gallery's password (if set), reusing the viewer's session unlock, * 3. the gallery's expiry. * A wrong/missing key is indistinguishable from a missing gallery — the same * neutral "not available" page as the gallery viewer, so links can't be enumerated. */ require __DIR__ . '/app/bootstrap.php'; session_boot(); $slug = (string)($_GET['g'] ?? ''); $gallery = $slug !== '' ? gallery_load($slug) : null; $keyOk = $gallery !== null && !empty($gallery['upload_key']) && hash_equals((string)$gallery['upload_key'], (string)($_GET['k'] ?? '')); if ($gallery === null || gallery_is_expired($gallery) || !$keyOk) { http_response_code(404); public_header('Upload not available'); echo '

Upload not available

' . '

This upload link does not exist or is no longer active.

'; public_footer(); exit; } $needsPassword = !empty($gallery['password_hash']); $unlocked = !$needsPassword || !empty($_SESSION['gallery_unlocked'][$slug]); if ($needsPassword && !$unlocked && $_SERVER['REQUEST_METHOD'] === 'POST') { csrf_verify(); if (password_verify((string)($_POST['password'] ?? ''), $gallery['password_hash'])) { $_SESSION['gallery_unlocked'][$slug] = true; redirect('upload.php?g=' . rawurlencode($slug) . '&k=' . rawurlencode((string)$gallery['upload_key'])); } $error = 'Wrong password.'; } if ($needsPassword && !$unlocked) { public_header(e($gallery['title'])); ?>

Upload your photos to this gallery.

Drop images here or click to select.
Downscaled to px on the longest edge. Full resolution, unmodified.