foto-portfolio/upload.php

<?php
/**
 * Public guest uploader: /upload.php?g=<slug>&k=<upload_key>
 *
 * Lets someone without an admin account upload into a gallery, gated by:
 *   1. a per-gallery secret key in the URL (k), compared with hash_equals,
 *   2. the gallery's password (if set), reusing the viewer's session unlock,
 *   3. the gallery's expiry.
 * A wrong/missing key is indistinguishable from a missing gallery — the same
 * neutral "not available" page as gallery.php, so links can't be enumerated.
 */
require __DIR__ . '/app/bootstrap.php';

session_boot();

$slug = (string)($_GET['g'] ?? '');
$gallery = $slug !== '' ? gallery_load($slug) : null;

$keyOk = $gallery !== null
    && !empty($gallery['upload_key'])
    && hash_equals((string)$gallery['upload_key'], (string)($_GET['k'] ?? ''));

if ($gallery === null || gallery_is_expired($gallery) || !$keyOk) {
    http_response_code(404);
    public_header('Upload not available');
    echo '<div class="gate"><div class="gate-card"><h1>Upload not available</h1>'
       . '<p class="page-sub">This upload link does not exist or is no longer active.</p></div></div>';
    public_footer();
    exit;
}

$needsPassword = !empty($gallery['password_hash']);
$unlocked = !$needsPassword || !empty($_SESSION['gallery_unlocked'][$slug]);

if ($needsPassword && !$unlocked && $_SERVER['REQUEST_METHOD'] === 'POST') {
    csrf_verify();
    if (password_verify((string)($_POST['password'] ?? ''), $gallery['password_hash'])) {
        $_SESSION['gallery_unlocked'][$slug] = true;
        redirect('upload.php?g=' . rawurlencode($slug) . '&k=' . rawurlencode((string)$gallery['upload_key']));
    }
    $error = 'Wrong password.';
}

if ($needsPassword && !$unlocked) {
    public_header(e($gallery['title']));
    ?>
    <div class="gate"><div class="gate-card">
        <h1><?= e($gallery['title']) ?></h1>
        <?php if (!empty($error)): ?><div class="flash flash-error"><?= e($error) ?></div><?php endif; ?>
        <form method="post">
            <?= csrf_field() ?>
            <label for="pw">Password</label>
            <input type="password" id="pw" name="password" autofocus autocomplete="off">
            <button type="submit">Continue</button>
        </form>
    </div></div>
    <?php
    public_footer();
    exit;
}

public_header(e($gallery['title']));
?>
<main class="page">
    <h1 class="page-title"><?= e($gallery['title']) ?></h1>
    <p class="page-sub">Upload your photos to this gallery.</p>

    <div class="dropzone" id="dropzone"
         data-api="upload-api.php"
         data-slug="<?= e($slug) ?>"
         data-csrf="<?= e(csrf_token()) ?>"
         data-key="<?= e((string)$gallery['upload_key']) ?>"
         data-thumb-size="<?= (int)config('uploads.thumb_size', 600) ?>"
         data-thumb-quality="<?= e((string)config('uploads.thumb_quality', 0.8)) ?>"
         data-concurrency="<?= (int)config('uploads.concurrency', 3) ?>"
         data-max-resolution="<?= (int)($gallery['max_resolution'] ?? 0) ?>"
         data-resize-quality="<?= e((string)config('uploads.resize_quality', 0.9)) ?>">
        Drop images here or click to select.<br>
        <small>
            <?php if (isset($gallery['max_resolution'])): ?>
                Downscaled to <?= (int)$gallery['max_resolution'] ?> px on the longest edge.
            <?php else: ?>
                Full resolution, unmodified.
            <?php endif; ?>
        </small>
    </div>
    <input type="file" id="file-input" accept="image/*" multiple style="display:none">
    <div class="upload-list" id="upload-list"></div>
</main>
<script src="assets/admin.js"></script>
<?php public_footer(); ?>