<?php
$location = 'uploads/';
// check if directory exists and writable if not show error 500
if (!is_dir($location) || !is_writable($location)) {
    header('HTTP/1.0 500 Internal Server Error');
    echo 'Directory does not exist or is not writable';
    exit;
}
// if .uploadsecret file does not exist, error 500
if (!file_exists('.uploadsecret')) {
    header('HTTP/1.0 500 Internal Server Error');
    echo 'Config missing';
    exit;
}

// read secret from .uploadsecret file
$secret = trim(file_get_contents('.uploadsecret'));

// Upload file and verify GET argument with password
if (isset($_GET['password']) && $_GET['password'] == $secret) {
    if (isset($_FILES['file'])) {
        $file = $_FILES['file'];
        $name = $file['name'];
        $tmp_name = $file['tmp_name'];
        // TODO: Check for safe name       
        if (move_uploaded_file($tmp_name, $location.$name)) {
            echo 'File '.$location.$name." uploaded successfully\n";
            // if $name suffix ends with "split.final" then merge all files
            if (substr($name, -11) == 'split.final') {
                echo('Merging files...');
                // Remove only the "split.final" file
                unlink($location.$name);
                // new $nameorig without the ".split.final" suffix
                $nameorig = substr($name, 0, -12);
                // Merge all files with the same $nameorig using cat
                chdir($location);
                shell_exec('cat '.$nameorig.'.split* > '.$nameorig);
                // Remove all the split files
                shell_exec('rm '.$nameorig.'.split*');
                // show checksum sha512 of the merged file
                $out = shell_exec('sha512sum '.$nameorig);
                echo $out;
            }
        }
    } else {
        // If it is not upload, show upload script file: upload.sh as text/plain
        header('Content-Type: text/plain');
        $data = file_get_contents('upload.sh');
        // replace %%UPLOADHOST%% in $data with the current hostname of webserver
        $data = str_replace('%%UPLOADHOST%%', $_SERVER['HTTP_HOST'], $data);
        echo $data;
    }
} else {
    // http error
    header('HTTP/1.0 403 Forbidden');
    echo 'Forbidden';
}