It supports base64 encoded file uploading, it's immune to all attacks that I'm currently aware of (though my PHP skills aren't great). Please do a security audit on it because I don't trust my code.
Workflow: POST api.php with file= parameter set as a base64 encoded binary string of file contents. Returns a 7 character random string that is used as the code. That 7 character string is sha1'd and the file is stored as store/sha1(7 char code).bin where store/ is a directory with .htaccess configured to "deny from all".
The client reconstructs the download URL as
http://host/path/download.php?fn=this_is_the_filename.txt&code=the_seven_letter_code_from_step_oneWhen a user goes to the download page, that user is presented with a download link and a ton of ads. The download link is pointing to verified.php?fn=file_name_passed_from_parameters&code=that_same_seven_letter_code×tamp=time()&sig=sha1($salt. time()) to ensure that the file isn't being reused.
Then it loops through the store/ directory and deletes all files whose filemtime is more than 30 days old.
Once at verified.php, the script first checks that the timestamp is less than 30 minutes old, then the it verifies the timestamp signature, and then it checks that the file store/sha1(code).bin exists. Then it sets the content-type to application/octet-stream, sets the content length, disposition and then prints the file contents with echo and file_get_contents.
I would really appreciate it if anyone here were so kind as to check the source code to make sure that it's good, but I think it should be okay.
https://drag2up.appspot.com/GShB Updated:
http://drag2up.appspot.com/X8si
