From b0f17f0a91cdebbfd6732781943f1e04ce3311f7 Mon Sep 17 00:00:00 2001
From: "Jens-U. Mozdzen" <jmozdzen@nde.ag>
Date: Sun, 23 Oct 2022 00:18:56 +0200
Subject: [PATCH 1/3] added server-side YOURLS shortener call

---
 shortenviayourls.php | 85 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 85 insertions(+)
 create mode 100644 shortenviayourls.php

diff --git a/shortenviayourls.php b/shortenviayourls.php
new file mode 100644
index 0000000..2802281
--- /dev/null
+++ b/shortenviayourls.php
@@ -0,0 +1,85 @@
+<?php
+
+// change this, if your php files and data is outside of your webservers document root
+define('PATH', '');
+
+define('PUBLIC_PATH', __DIR__);
+require PATH . 'vendor' . DIRECTORY_SEPARATOR . 'autoload.php';
+
+$link = $_SERVER['REQUEST_URI'];
+$response = getGetData();
+
+$arr = explode('=',$response);
+$c = count ($arr);
+
+$opSuccess = FALSE;
+$errCode = 0;
+
+$shortenedUrl = "";
+$originalUrl = "";
+
+if(($c == 2) && ($arr[0] == "link") && (strlen($arr[1]) < 256)) {
+   // read in configuration values
+   $conf = new PrivateBin\Configuration;
+
+   $originalUrl = urldecode($arr[1]);
+   if (startsWith($originalUrl, $conf->getKey( "basepath") . "/?")) {
+
+      // Init the CURL session
+      $ch = curl_init();
+      curl_setopt($ch, CURLOPT_URL, $conf->getKey( "apiurl", "yourls"));
+      curl_setopt($ch, CURLOPT_HEADER, 0);            // No header in the result
+      curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); // Return, do not echo result
+      curl_setopt($ch, CURLOPT_POST, 1);              // This is a POST request
+      curl_setopt($ch, CURLOPT_POSTFIELDS, array(     // Data to POST
+                        'signature' => $conf->getKey( "signature", "yourls"),
+                        'format'   => 'json',
+                        'action'   => 'shorturl',
+                        'url' =>  $originalUrl
+      ));
+      // Fetch and return content
+      $data = curl_exec($ch);
+      curl_close($ch);
+      if (!($data === FALSE) && is_string($data))
+      {
+          $data = json_decode( $data, true);
+
+          if (!is_null($data) && array_key_exists('statusCode', $data)
+                && array_key_exists('shorturl', $data) &&  ($data['statusCode'] == 200))
+          {
+              $shortenedUrl = $data['shorturl'];
+              $opSuccess = TRUE;
+          } else {
+             // error with contents of YOURLS response.
+             $errCode = 3;
+          }
+      } else {
+         // error when calling YOURLS - probably a PrivateBin configuration issue, like wrong/missing apiurl or signature
+         $errCode = 2;
+      }
+   } else {
+      // trying to shorten a URL not pointing to our PrivateBin instance.
+      $errCode = 1;
+   }
+}
+
+if ($opSuccess)
+{
+   print("<br>Your shortened paste is <span class=\"shortensuccess\"><a href=\"$shortenedUrl\">$shortenedUrl</a></span>");
+}
+else
+{
+   print("<br><span class=\"shortenerror\">Error: An error occured while trying to shorten the given URL (error code $errCode)</span>");
+}
+ 
+function getGetData() {
+   $data = http_build_query($_GET);
+   return $data;
+}
+
+function startsWith($haystack, $needle)
+{
+   $length = strlen($needle);
+   return (substr($haystack, 0, $length) === $needle);
+}
+?>

From 3115cb8883cae1d4c08f8df54cb3e521f29cd465 Mon Sep 17 00:00:00 2001
From: "Jens-U. Mozdzen" <jmozdzen@nde.ag>
Date: Sun, 23 Oct 2022 00:19:43 +0200
Subject: [PATCH 2/3] added parameters for server-side YOURLS shortener call

---
 cfg/conf.sample.php   | 12 ++++++++++++
 lib/Configuration.php |  4 ++++
 2 files changed, 16 insertions(+)

diff --git a/cfg/conf.sample.php b/cfg/conf.sample.php
index cf46598..487a20a 100644
--- a/cfg/conf.sample.php
+++ b/cfg/conf.sample.php
@@ -227,3 +227,15 @@ dir = PATH "data"
 ;bucket = "my-bucket"
 ;accesskey = "access key id"
 ;secretkey = "secret access key"
+
+[yourls]
+; don't mix this up with "urlshortener" config item:
+; - when using a standard configuration, "urlshortener" will point to the YOURLS API, including access credentials, and will be part of the PrivateBin public web page (insecure!)
+; - when using the parameters in this section ("signature" and "apiurl"), "urlshortener" will point to a fixed PrivateBin page ("$basepath/shortenviayourls.php") and
+;   that PHP will in turn call YOURLS server-side, using the URL from "apiurl" and using the "access signature" from "signature" parameter.
+
+; (optional) the "signature" (access key) issued by YOURLS for the using account
+; signature = ""
+
+; (optional) the URL of the YOURLS API, called to shorten a PrivateBin URL
+; apiurl = ""
diff --git a/lib/Configuration.php b/lib/Configuration.php
index fad44a2..c2a5316 100644
--- a/lib/Configuration.php
+++ b/lib/Configuration.php
@@ -93,6 +93,10 @@ class Configuration
         'model_options' => array(
             'dir' => 'data',
         ),
+        'yourls' => array(
+            'signature' => '',
+            'apiurl' => '',
+        ),
     );
 
     /**

From dce8b8d3521811f2f34a6d5e31708cd759377fb4 Mon Sep 17 00:00:00 2001
From: "Jens-U. Mozdzen" <jmozdzen@nde.ag>
Date: Sun, 23 Oct 2022 01:07:43 +0200
Subject: [PATCH 3/3] updated code formatting

---
 lib/Configuration.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/Configuration.php b/lib/Configuration.php
index c2a5316..6f3a822 100644
--- a/lib/Configuration.php
+++ b/lib/Configuration.php
@@ -95,7 +95,7 @@ class Configuration
         ),
         'yourls' => array(
             'signature' => '',
-            'apiurl' => '',
+            'apiurl'    => '',
         ),
     );