tool.medowar.de/drop/index.php

<?php
declare(strict_types=1);

/**
 * Temporary file drop — transfer.sh style.
 *
 * Upload with a plain curl PUT:
 *     curl --upload-file ./hello.txt https://tool.medowar.de/drop/
 *
 * The response body is the download URL. Files expire after DEFAULT_DAYS (or
 * whatever the Max-Days / Max-Downloads request headers ask for) and are then
 * removed by a probabilistic garbage-collection sweep.
 *
 * Routes (all handled by this single script via .htaccess rewrite):
 *   GET    /                     web UI
 *   POST   /                     multipart upload (browser form fallback)
 *   PUT    /<name>               upload, returns the download URL as text
 *   GET    /<id>                 redirect to the full download URL
 *   GET    /<id>/<name>          download   (?meta=1 returns JSON metadata)
 *   HEAD   /<id>/<name>          metadata only
 *   GET    /d/<id>/<token>       delete confirmation page
 *   DELETE /d/<id>/<token>       delete the file
 */

const DATA_DIR        = __DIR__ . '/data';
const MAX_FILE_BYTES  = 512 * 1024 * 1024;        // 512 MB per file
const MAX_TOTAL_BYTES = 10 * 1024 * 1024 * 1024;  // 10 GB across the whole drop
const DEFAULT_DAYS    = 3;
const MAX_DAYS        = 30;
const MAX_PER_IP_HOUR = 60;                       // uploads per IP per hour
const GC_CHANCE       = 20;                       // 1-in-N requests sweep expired files
const CHUNK           = 262144;

ignore_user_abort(true);
@set_time_limit(0);

// ---------------------------------------------------------------- helpers ---

function h(?string $s): string
{
    return htmlspecialchars((string) $s, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
}

/** Absolute base URL of this folder, e.g. https://tool.medowar.de/drop */
function base_url(): string
{
    $https = (!empty($_SERVER['HTTPS']) && strtolower((string) $_SERVER['HTTPS']) !== 'off')
        || strtolower((string) ($_SERVER['HTTP_X_FORWARDED_PROTO'] ?? '')) === 'https'
        || (int) ($_SERVER['SERVER_PORT'] ?? 0) === 443;

    $host = (string) ($_SERVER['HTTP_HOST'] ?? 'localhost');
    $dir  = rtrim(str_replace('\\', '/', dirname((string) ($_SERVER['SCRIPT_NAME'] ?? '/'))), '/');

    return ($https ? 'https' : 'http') . '://' . $host . $dir;
}

/**
 * The path below this folder, as segments. Works with the .htaccess rewrite
 * (?_p=…), with PATH_INFO, and as a last resort straight off REQUEST_URI.
 *
 * @return string[]
 */
function route_segments(): array
{
    $path = '';

    if (isset($_GET['_p']) && is_string($_GET['_p'])) {
        $path = $_GET['_p'];
    } elseif (!empty($_SERVER['PATH_INFO'])) {
        $path = (string) $_SERVER['PATH_INFO'];
    } else {
        $uri = (string) ($_SERVER['REQUEST_URI'] ?? '/');
        $uri = explode('?', $uri, 2)[0];
        $uri = rawurldecode($uri);
        $dir = rtrim(str_replace('\\', '/', dirname((string) ($_SERVER['SCRIPT_NAME'] ?? '/'))), '/');
        if ($dir !== '' && str_starts_with($uri, $dir)) {
            $uri = substr($uri, strlen($dir));
        }
        $path = preg_replace('#^/index\.php#', '', $uri) ?? '';
    }

    $segments = [];
    foreach (explode('/', trim($path, '/')) as $seg) {
        if ($seg === '' || $seg === '.' || $seg === '..') {
            continue;
        }
        $segments[] = $seg;
    }

    return $segments;
}

/**
 * Last path component of the request, or null when the request addresses this
 * folder itself. Needed because a PUT to an existing file (`/drop/index.php`)
 * is served by Apache directly and never reaches the rewrite rule.
 */
function request_uri_tail(): ?string
{
    $path = rawurldecode(explode('?', (string) ($_SERVER['REQUEST_URI'] ?? ''), 2)[0]);
    $path = rtrim(str_replace('\\', '/', $path), '/');
    $dir  = rtrim(str_replace('\\', '/', dirname((string) ($_SERVER['SCRIPT_NAME'] ?? '/'))), '/');

    if ($dir === '' || !str_starts_with($path, $dir . '/')) {
        return null;
    }

    $tail = substr($path, strlen($dir) + 1);

    return str_contains($tail, '/') ? null : ($tail !== '' ? $tail : null);
}

/** Reduce an arbitrary client-supplied name to a safe, single path component. */
function clean_name(string $name): string
{
    $name = str_replace('\\', '/', $name);
    $name = basename($name);
    $name = (string) preg_replace('/[\x00-\x1F\x7F]/', '', $name);
    $name = trim($name);

    if ($name === '' || $name === '.' || $name === '..') {
        return 'upload.bin';
    }

    if (strlen($name) > 200) {
        $ext  = pathinfo($name, PATHINFO_EXTENSION);
        $ext  = $ext !== '' ? '.' . substr($ext, 0, 20) : '';
        $name = substr($name, 0, 200 - strlen($ext)) . $ext;
    }

    return $name;
}

function human_bytes(int $bytes): string
{
    $units = ['B', 'KB', 'MB', 'GB', 'TB'];
    $i = 0;
    $n = (float) $bytes;
    while ($n >= 1024 && $i < count($units) - 1) {
        $n /= 1024;
        $i++;
    }
    return ($i === 0 ? (string) (int) $n : number_format($n, $n >= 100 ? 0 : 1)) . ' ' . $units[$i];
}

function is_valid_id(string $id): bool
{
    return (bool) preg_match('/^[a-f0-9]{12}$/', $id);
}

function entry_dir(string $id): string
{
    return DATA_DIR . '/' . $id;
}

/** @return array<string,mixed>|null */
function read_meta(string $id): ?array
{
    if (!is_valid_id($id)) {
        return null;
    }
    $file = entry_dir($id) . '/meta.json';
    if (!is_file($file)) {
        return null;
    }
    $meta = json_decode((string) file_get_contents($file), true);
    if (!is_array($meta) || !isset($meta['name'], $meta['expires'])) {
        return null;
    }
    return $meta;
}

/** @param array<string,mixed> $meta */
function write_meta(string $id, array $meta): void
{
    file_put_contents(
        entry_dir($id) . '/meta.json',
        json_encode($meta, JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES),
        LOCK_EX
    );
}

/** @param array<string,mixed> $meta */
function is_expired(array $meta): bool
{
    if ((int) $meta['expires'] <= time()) {
        return true;
    }
    $max = (int) ($meta['max_downloads'] ?? 0);
    return $max > 0 && (int) ($meta['downloads'] ?? 0) >= $max;
}

function rrmdir(string $dir): void
{
    if (!is_dir($dir)) {
        return;
    }
    foreach (scandir($dir) ?: [] as $entry) {
        if ($entry === '.' || $entry === '..') {
            continue;
        }
        $path = $dir . '/' . $entry;
        is_dir($path) ? rrmdir($path) : @unlink($path);
    }
    @rmdir($dir);
}

/** Drop everything that has expired, plus half-finished uploads older than an hour. */
function gc_sweep(): void
{
    foreach (glob(DATA_DIR . '/*', GLOB_ONLYDIR) ?: [] as $dir) {
        $meta = read_meta(basename($dir));
        if ($meta === null) {
            if ((int) @filemtime($dir) < time() - 3600) {
                rrmdir($dir);
            }
            continue;
        }
        if (is_expired($meta)) {
            rrmdir($dir);
        }
    }
}

/** @return array{count:int,bytes:int} */
function store_stats(): array
{
    $count = 0;
    $bytes = 0;
    foreach (glob(DATA_DIR . '/*', GLOB_ONLYDIR) ?: [] as $dir) {
        $meta = read_meta(basename($dir));
        if ($meta === null || is_expired($meta)) {
            continue;
        }
        $count++;
        $bytes += (int) ($meta['size'] ?? 0);
    }
    return ['count' => $count, 'bytes' => $bytes];
}

function client_ip(): string
{
    return (string) ($_SERVER['REMOTE_ADDR'] ?? '0.0.0.0');
}

/** Sliding one-hour upload budget per IP. Returns false when the budget is used up. */
function rate_limit_ok(): bool
{
    $file = DATA_DIR . '/rate.json';
    $fh = @fopen($file, 'c+');
    if ($fh === false) {
        return true; // never block uploads because the counter is unwritable
    }

    try {
        if (!flock($fh, LOCK_EX)) {
            return true;
        }

        $raw  = stream_get_contents($fh);
        $data = json_decode((string) $raw, true);
        $data = is_array($data) ? $data : [];
        $now  = time();
        $key  = hash('sha256', client_ip());

        foreach ($data as $k => $stamps) {
            $data[$k] = array_values(array_filter((array) $stamps, static fn($t) => (int) $t > $now - 3600));
            if ($data[$k] === []) {
                unset($data[$k]);
            }
        }

        if (count($data[$key] ?? []) >= MAX_PER_IP_HOUR) {
            return false;
        }

        $data[$key][] = $now;

        ftruncate($fh, 0);
        rewind($fh);
        fwrite($fh, (string) json_encode($data));
        fflush($fh);
        return true;
    } finally {
        flock($fh, LOCK_UN);
        fclose($fh);
    }
}

function fail(int $status, string $message): never
{
    http_response_code($status);
    header('Content-Type: text/plain; charset=utf-8');
    echo $message . "\n";
    exit;
}

// ------------------------------------------------------------- the upload ---

/**
 * Store an upload. $source is either a stream to read from or a local file to
 * move. Returns [id, meta].
 *
 * @param resource|null $stream
 * @return array{0:string,1:array<string,mixed>}
 */
function store_upload(string $name, $stream, ?string $movePath, int $days, int $maxDownloads): array
{
    $stats = store_stats();
    if ($stats['bytes'] >= MAX_TOTAL_BYTES) {
        fail(507, 'The drop is full — try again later.');
    }

    $id  = bin2hex(random_bytes(6));
    $dir = entry_dir($id);
    if (!@mkdir($dir, 0770, true) && !is_dir($dir)) {
        fail(500, 'Could not create storage directory.');
    }

    $blob = $dir . '/blob';

    if ($movePath !== null) {
        if (!@move_uploaded_file($movePath, $blob) && !@rename($movePath, $blob)) {
            rrmdir($dir);
            fail(500, 'Could not store the uploaded file.');
        }
        $size = (int) filesize($blob);
    } else {
        $out = @fopen($blob, 'wb');
        if ($out === false) {
            rrmdir($dir);
            fail(500, 'Could not open storage file.');
        }

        $size    = 0;
        $allowed = min(MAX_FILE_BYTES, MAX_TOTAL_BYTES - $stats['bytes']);

        while (!feof($stream)) {
            $chunk = fread($stream, CHUNK);
            if ($chunk === false) {
                break;
            }
            if ($chunk === '') {
                continue;
            }
            $size += strlen($chunk);
            if ($size > $allowed) {
                fclose($out);
                rrmdir($dir);
                fail(413, 'File too large — the limit is ' . human_bytes(MAX_FILE_BYTES) . '.');
            }
            if (fwrite($out, $chunk) === false) {
                fclose($out);
                rrmdir($dir);
                fail(500, 'Write failed.');
            }
        }
        fclose($out);
    }

    if ($size === 0) {
        rrmdir($dir);
        fail(400, 'Refusing to store an empty file.');
    }

    $meta = [
        'id'            => $id,
        'name'          => $name,
        'size'          => $size,
        'created'       => time(),
        'expires'       => time() + $days * 86400,
        'max_downloads' => $maxDownloads,
        'downloads'     => 0,
        'delete_token'  => bin2hex(random_bytes(16)),
    ];
    write_meta($id, $meta);

    return [$id, $meta];
}

/** Read Max-Days / Max-Downloads request headers. @return array{0:int,1:int} */
function upload_options(): array
{
    $days = (int) ($_SERVER['HTTP_MAX_DAYS'] ?? $_POST['days'] ?? DEFAULT_DAYS);
    $days = max(1, min(MAX_DAYS, $days ?: DEFAULT_DAYS));

    $max = (int) ($_SERVER['HTTP_MAX_DOWNLOADS'] ?? $_POST['max_downloads'] ?? 0);
    $max = max(0, min(10000, $max));

    return [$days, $max];
}

/** @param array<string,mixed> $meta */
function download_url(string $id, array $meta): string
{
    return base_url() . '/' . $id . '/' . rawurlencode((string) $meta['name']);
}

/** @param array<string,mixed> $meta */
function delete_url(string $id, array $meta): string
{
    return base_url() . '/d/' . $id . '/' . $meta['delete_token'];
}

// ----------------------------------------------------------- the download ---

/** @param array<string,mixed> $meta */
function send_file(string $id, array $meta, bool $headOnly): never
{
    $blob = entry_dir($id) . '/blob';
    $fh   = @fopen($blob, 'rb');
    if ($fh === false) {
        fail(404, 'Not found.');
    }

    $size = (int) $meta['size'];
    $name = (string) $meta['name'];
    $ascii = (string) preg_replace('/[^\x20-\x7E]/', '_', $name);
    $ascii = str_replace('"', '', $ascii);

    // Count the download first, so an aborted transfer cannot be used to
    // squeeze extra downloads out of a one-shot link.
    if (!$headOnly) {
        $meta['downloads'] = (int) $meta['downloads'] + 1;
        write_meta($id, $meta);

        $max = (int) $meta['max_downloads'];
        if ($max > 0 && $meta['downloads'] >= $max) {
            // The open handle stays valid after the directory is gone.
            rrmdir(entry_dir($id));
        }
    }

    $start = 0;
    $end   = $size - 1;
    $range = (string) ($_SERVER['HTTP_RANGE'] ?? '');

    if ($range !== '' && preg_match('/^bytes=(\d*)-(\d*)$/', trim($range), $m)) {
        if ($m[1] === '' && $m[2] === '') {
            http_response_code(416);
            header('Content-Range: bytes */' . $size);
            exit;
        }
        if ($m[1] === '') {
            $start = max(0, $size - (int) $m[2]);
        } else {
            $start = (int) $m[1];
            if ($m[2] !== '') {
                $end = min($size - 1, (int) $m[2]);
            }
        }
        if ($start > $end || $start >= $size) {
            http_response_code(416);
            header('Content-Range: bytes */' . $size);
            exit;
        }
        http_response_code(206);
        header('Content-Range: bytes ' . $start . '-' . $end . '/' . $size);
    }

    $length = $end - $start + 1;

    // Always an opaque download: this host serves other tools, so never let an
    // uploaded file render in the browser under this origin.
    header('Content-Type: application/octet-stream');
    header('Content-Disposition: attachment; filename="' . $ascii . '"; '
        . "filename*=UTF-8''" . rawurlencode($name));
    header('Content-Length: ' . $length);
    header('Accept-Ranges: bytes');
    header('X-Content-Type-Options: nosniff');
    header('X-Robots-Tag: noindex, nofollow');
    header('Cache-Control: private, no-store');

    if ($headOnly) {
        exit;
    }

    fseek($fh, $start);
    $remaining = $length;
    while ($remaining > 0 && !feof($fh)) {
        $chunk = fread($fh, (int) min(CHUNK, $remaining));
        if ($chunk === false || $chunk === '') {
            break;
        }
        echo $chunk;
        $remaining -= strlen($chunk);
        flush();
    }
    fclose($fh);
    exit;
}

// ------------------------------------------------------------------ setup ---

if (!is_dir(DATA_DIR) && !@mkdir(DATA_DIR, 0770, true) && !is_dir(DATA_DIR)) {
    fail(500, 'Storage directory ' . basename(DATA_DIR) . ' is missing and cannot be created.');
}

if (random_int(1, GC_CHANCE) === 1) {
    gc_sweep();
}

$method   = strtoupper((string) ($_SERVER['REQUEST_METHOD'] ?? 'GET'));
$segments = route_segments();

// ---------------------------------------------------------------- routing ---

// PUT — the curl --upload-file path.
if ($method === 'PUT') {
    if (count($segments) > 1) {
        fail(400, "Upload to the root of this folder:\n  curl --upload-file ./file.txt " . base_url() . "/\n");
    }
    if (!rate_limit_ok()) {
        fail(429, 'Too many uploads from your address — try again later.');
    }

    $declared = (int) ($_SERVER['CONTENT_LENGTH'] ?? 0);
    if ($declared > MAX_FILE_BYTES) {
        fail(413, 'File too large — the limit is ' . human_bytes(MAX_FILE_BYTES) . '.');
    }

    // Segments are already URL-decoded; do not decode them again.
    $name = $segments[0] ?? request_uri_tail();

    // `curl --upload-file f https://host/drop` (no trailing slash) sends no
    // filename at all, so fall back to a header and then to a generic name.
    $name = clean_name($name ?? (string) ($_SERVER['HTTP_X_FILENAME'] ?? 'upload.bin'));

    [$days, $maxDownloads] = upload_options();

    $in = fopen('php://input', 'rb');
    if ($in === false) {
        fail(500, 'Could not read the request body.');
    }
    [$id, $meta] = store_upload($name, $in, null, $days, $maxDownloads);
    fclose($in);

    header('Content-Type: text/plain; charset=utf-8');
    header('X-Url-Delete: ' . delete_url($id, $meta));
    header('X-Expires: ' . gmdate('D, d M Y H:i:s', (int) $meta['expires']) . ' GMT');
    echo download_url($id, $meta) . "\n";
    exit;
}

// POST — browser upload (JS uses PUT; this is the no-JS fallback).
if ($method === 'POST' && $segments === []) {
    if (!rate_limit_ok()) {
        fail(429, 'Too many uploads from your address — try again later.');
    }
    if (!isset($_FILES['file']) || ($_FILES['file']['error'] ?? UPLOAD_ERR_NO_FILE) !== UPLOAD_ERR_OK) {
        $code = (int) ($_FILES['file']['error'] ?? UPLOAD_ERR_NO_FILE);
        $msg  = match ($code) {
            UPLOAD_ERR_INI_SIZE, UPLOAD_ERR_FORM_SIZE => 'The file exceeds the server upload limit.',
            UPLOAD_ERR_NO_FILE                        => 'No file selected.',
            default                                   => 'Upload failed (error ' . $code . ').',
        };
        fail(400, $msg);
    }

    [$days, $maxDownloads] = upload_options();
    $name = clean_name((string) $_FILES['file']['name']);
    [$id, $meta] = store_upload($name, null, (string) $_FILES['file']['tmp_name'], $days, $maxDownloads);

    $uploaded = ['url' => download_url($id, $meta), 'delete' => delete_url($id, $meta), 'meta' => $meta];
    // falls through to the UI below, which renders $uploaded
}

// /d/<id>/<token> — delete.
if (count($segments) === 3 && $segments[0] === 'd') {
    [, $id, $token] = $segments;
    $meta = read_meta($id);

    if ($meta === null || !hash_equals((string) $meta['delete_token'], $token)) {
        fail(404, 'Unknown or already deleted file.');
    }

    if ($method === 'DELETE' || ($method === 'POST' && ($_POST['confirm'] ?? '') === 'yes')) {
        rrmdir(entry_dir($id));
        if ($method === 'DELETE') {
            header('Content-Type: text/plain; charset=utf-8');
            echo "Deleted.\n";
            exit;
        }
        $notice = 'Deleted “' . $meta['name'] . '”.';
    } else {
        // A GET on the delete link only asks — link prefetchers must not delete.
        $confirm = ['id' => $id, 'token' => $token, 'meta' => $meta];
    }
}

// /<id> — no filename given, redirect to the canonical URL.
if ($method === 'GET' && count($segments) === 1 && is_valid_id($segments[0])) {
    $meta = read_meta($segments[0]);
    if ($meta !== null && !is_expired($meta)) {
        header('Location: ' . download_url($segments[0], $meta), true, 302);
        exit;
    }
    fail(410, 'This file does not exist any more.');
}

// /<id>/<name> — download.
if (($method === 'GET' || $method === 'HEAD') && count($segments) === 2 && is_valid_id($segments[0])) {
    $id   = $segments[0];
    $meta = read_meta($id);

    if ($meta === null || is_expired($meta)) {
        fail(410, "This file does not exist any more.\n");
    }

    if (isset($_GET['meta'])) {
        header('Content-Type: application/json; charset=utf-8');
        echo json_encode([
            'name'          => $meta['name'],
            'size'          => $meta['size'],
            'created'       => gmdate('c', (int) $meta['created']),
            'expires'       => gmdate('c', (int) $meta['expires']),
            'downloads'     => $meta['downloads'],
            'max_downloads' => $meta['max_downloads'],
        ], JSON_PRETTY_PRINT | JSON_UNESCAPED_SLASHES) . "\n";
        exit;
    }

    send_file($id, $meta, $method === 'HEAD');
}

// Anything else that is not the UI root is a miss.
if ($segments !== [] && !isset($confirm) && !isset($notice)) {
    fail(404, "Not found.\n");
}

// --------------------------------------------------------------- the page ---

$stats = store_stats();
$base  = base_url();
header('X-Robots-Tag: noindex, nofollow');
?>
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <meta name="robots" content="noindex, nofollow">
    <title>File Drop</title>
    <style>
        body {
            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;
            max-width: 1000px;
            margin: 40px auto;
            padding: 0 20px;
            background: #f5f5f5;
            color: #333;
        }
        h1 { color: #333; }
        h2 { color: #333; margin-top: 30px; }
        .info { background: #e3f2fd; padding: 15px; border-radius: 5px; margin-bottom: 20px; }
        .info code, p code { background: rgba(0,0,0,0.06); padding: 1px 5px; border-radius: 3px; }
        .btn {
            display: inline-block; padding: 10px 20px; background: #2196F3; color: white;
            text-decoration: none; border-radius: 5px; border: none; cursor: pointer; font-size: 15px;
        }
        .btn:hover { background: #1976D2; }
        .btn:disabled { background: #90caf9; cursor: default; }
        .btn-small { padding: 5px 12px; font-size: 13px; }
        .btn-danger { background: #f44336; }
        .btn-danger:hover { background: #d32f2f; }
        .error { background: #ffebee; color: #c62828; padding: 10px; border-radius: 5px; margin: 10px 0; }
        .notice { background: #e8f5e9; color: #2e7d32; padding: 10px; border-radius: 5px; margin: 10px 0; }
        .drop {
            background: white; border: 2px dashed #90caf9; border-radius: 8px;
            padding: 40px 20px; text-align: center; color: #555; cursor: pointer;
            transition: background .15s, border-color .15s;
        }
        .drop.over { background: #e3f2fd; border-color: #2196F3; }
        .drop strong { display: block; font-size: 17px; color: #333; margin-bottom: 6px; }
        .opts { margin: 14px 0 20px; font-size: 14px; color: #555; display: flex; gap: 20px; flex-wrap: wrap; align-items: center; }
        .opts input { width: 80px; padding: 6px; border: 1px solid #ccc; border-radius: 4px; font-size: 14px; }
        .record {
            background: #263238; color: #aed581; padding: 10px 12px; border-radius: 4px;
            font-family: monospace; font-size: 13px; word-break: break-all; margin: 10px 0;
            white-space: pre-wrap;
        }
        table { width: 100%; border-collapse: collapse; background: white; box-shadow: 0 1px 3px rgba(0,0,0,0.1); margin-top: 10px; }
        th, td { padding: 8px 12px; text-align: left; border-bottom: 1px solid #eee; font-size: 13px; vertical-align: top; }
        th { background: #fafafa; color: #555; font-weight: 600; }
        td.mono, .mono { font-family: monospace; word-break: break-all; }
        progress { width: 100%; height: 10px; }
        .muted { color: #777; font-size: 13px; }
        #results:empty { display: none; }
    </style>
</head>
<body>
    <h1>📦 File Drop</h1>

    <?php if (isset($notice)): ?>
        <div class="notice"><?= h($notice) ?></div>
    <?php endif; ?>

    <?php if (isset($confirm)): ?>
        <h2>Delete this file?</h2>
        <table>
            <tr><th>Name</th><td class="mono"><?= h((string) $confirm['meta']['name']) ?></td></tr>
            <tr><th>Size</th><td><?= h(human_bytes((int) $confirm['meta']['size'])) ?></td></tr>
            <tr><th>Uploaded</th><td><?= h(date('Y-m-d H:i:s', (int) $confirm['meta']['created'])) ?></td></tr>
            <tr><th>Downloads</th><td><?= (int) $confirm['meta']['downloads'] ?></td></tr>
        </table>
        <form method="POST" style="margin-top:15px;">
            <input type="hidden" name="confirm" value="yes">
            <button type="submit" class="btn btn-danger">Delete permanently</button>
            <a href="<?= h($base) ?>/" class="btn" style="background:#78909c;">Cancel</a>
        </form>
        <p class="muted">Deleting is immediate and cannot be undone.</p>
    <?php else: ?>

    <div class="info">
        Drop a file here and get a temporary link. Files are deleted automatically after
        <strong><?= DEFAULT_DAYS ?> days</strong> (max <?= MAX_DAYS ?>), or earlier if you set a download limit.
        Max <strong><?= h(human_bytes(MAX_FILE_BYTES)) ?></strong> per file.
        Anyone with the link can download the file — links are unguessable, but they are not access-controlled.
    </div>

    <h2>Upload from the command line</h2>
    <div class="record">curl --upload-file ./hello.txt <?= h($base) ?>/</div>
    <p class="muted">
        The response is the download URL. Optional request headers:
        <code>Max-Days: 3</code> and <code>Max-Downloads: 1</code> (a one-shot link).
        The delete URL comes back in the <code>X-Url-Delete</code> response header:
    </p>
    <div class="record">curl -H 'Max-Downloads: 1' -H 'Max-Days: 3' -D- --upload-file ./secret.zip <?= h($base) ?>/</div>

    <h2>Upload from the browser</h2>

    <?php if (isset($uploaded)): ?>
        <div class="notice">Uploaded <strong><?= h((string) $uploaded['meta']['name']) ?></strong></div>
        <table>
            <tr><th>Download URL</th><td class="mono"><a href="<?= h($uploaded['url']) ?>"><?= h($uploaded['url']) ?></a></td></tr>
            <tr><th>Delete URL</th><td class="mono"><?= h($uploaded['delete']) ?></td></tr>
            <tr><th>Expires</th><td><?= h(date('Y-m-d H:i', (int) $uploaded['meta']['expires'])) ?></td></tr>
        </table>
    <?php endif; ?>

    <form id="form" method="POST" enctype="multipart/form-data">
        <div class="drop" id="drop">
            <strong>Drop files here</strong>
            or click to choose — multiple files are uploaded one by one.
            <input type="file" name="file" id="file" multiple style="display:none;">
        </div>
        <div class="opts">
            <label>Keep for <input type="number" name="days" id="days" value="<?= DEFAULT_DAYS ?>" min="1" max="<?= MAX_DAYS ?>"> days</label>
            <label>Max downloads <input type="number" name="max_downloads" id="maxdl" value="0" min="0" placeholder="0"></label>
            <span class="muted">0 = unlimited</span>
            <button type="submit" class="btn" id="submit">Upload</button>
        </div>
    </form>

    <div id="results"></div>

    <h2>Notes</h2>
    <ul class="muted">
        <li>Downloads are always served as an attachment (<code>application/octet-stream</code>), so nothing uploaded here can run in your browser under this domain.</li>
        <li>Expired files are removed by a sweep that runs on roughly every <?= GC_CHANCE ?><sup>th</sup> request.</li>
        <li>Currently stored: <strong><?= (int) $stats['count'] ?></strong> files, <strong><?= h(human_bytes((int) $stats['bytes'])) ?></strong> of <?= h(human_bytes(MAX_TOTAL_BYTES)) ?>.</li>
        <li>Upload budget: <?= MAX_PER_IP_HOUR ?> files per IP per hour.</li>
    </ul>

    <script>
    (function () {
        const base = <?= json_encode($base, JSON_UNESCAPED_SLASHES) ?>;
        const dropZone = document.getElementById('drop');
        const input = document.getElementById('file');
        const form = document.getElementById('form');
        const results = document.getElementById('results');
        const submit = document.getElementById('submit');

        dropZone.addEventListener('click', () => input.click());
        input.addEventListener('change', () => queue([...input.files]));

        ['dragenter', 'dragover'].forEach(ev =>
            dropZone.addEventListener(ev, e => { e.preventDefault(); dropZone.classList.add('over'); }));
        ['dragleave', 'drop'].forEach(ev =>
            dropZone.addEventListener(ev, e => { e.preventDefault(); dropZone.classList.remove('over'); }));
        dropZone.addEventListener('drop', e => queue([...e.dataTransfer.files]));

        form.addEventListener('submit', e => {
            if (input.files.length) { e.preventDefault(); queue([...input.files]); }
        });

        let chain = Promise.resolve();
        function queue(files) {
            files.forEach(f => { chain = chain.then(() => upload(f)); });
            chain = chain.then(() => { input.value = ''; });
        }

        function row(label, value, isLink) {
            const td = isLink
                ? '<a href="' + escapeAttr(value) + '">' + escapeHtml(value) + '</a>'
                : escapeHtml(value);
            return '<tr><th>' + escapeHtml(label) + '</th><td class="mono">' + td + '</td></tr>';
        }
        const escapeHtml = s => String(s).replace(/[&<>"']/g,
            c => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[c]));
        const escapeAttr = escapeHtml;

        function upload(file) {
            const box = document.createElement('div');
            box.innerHTML = '<p><strong>' + escapeHtml(file.name) + '</strong> '
                + '<span class="muted">' + fmt(file.size) + '</span></p>'
                + '<progress max="100" value="0"></progress>';
            results.prepend(box);
            const bar = box.querySelector('progress');
            submit.disabled = true;

            return new Promise(resolve => {
                const xhr = new XMLHttpRequest();
                xhr.open('PUT', base + '/' + encodeURIComponent(file.name));
                xhr.setRequestHeader('Max-Days', document.getElementById('days').value || '<?= DEFAULT_DAYS ?>');
                xhr.setRequestHeader('Max-Downloads', document.getElementById('maxdl').value || '0');

                xhr.upload.addEventListener('progress', e => {
                    if (e.lengthComputable) bar.value = (e.loaded / e.total) * 100;
                });

                xhr.addEventListener('loadend', () => {
                    submit.disabled = false;
                    bar.remove();
                    if (xhr.status >= 200 && xhr.status < 300) {
                        const url = xhr.responseText.trim();
                        const del = xhr.getResponseHeader('X-Url-Delete') || '';
                        const exp = xhr.getResponseHeader('X-Expires') || '';
                        const table = document.createElement('table');
                        table.innerHTML = row('Download URL', url, true)
                            + (del ? row('Delete URL', del, false) : '')
                            + (exp ? row('Expires', exp, false) : '');
                        box.appendChild(table);
                        const copy = document.createElement('button');
                        copy.className = 'btn btn-small';
                        copy.style.marginTop = '8px';
                        copy.textContent = 'Copy link';
                        copy.onclick = () => {
                            navigator.clipboard.writeText(url)
                                .then(() => { copy.textContent = 'Copied'; })
                                .catch(() => { copy.textContent = 'Copy failed'; });
                        };
                        box.appendChild(copy);
                    } else {
                        const err = document.createElement('div');
                        err.className = 'error';
                        err.textContent = xhr.responseText.trim() || ('Upload failed (HTTP ' + xhr.status + ')');
                        box.appendChild(err);
                    }
                    resolve();
                });

                xhr.send(file);
            });
        }

        function fmt(b) {
            const u = ['B', 'KB', 'MB', 'GB'];
            let i = 0;
            while (b >= 1024 && i < u.length - 1) { b /= 1024; i++; }
            return (i ? b.toFixed(1) : b) + ' ' + u[i];
        }
    })();
    </script>

    <?php endif; ?>
</body>
</html>