From 2f47bef354d52b0660420c210447cb0636cb4bed Mon Sep 17 00:00:00 2001
From: flashwave <me@flash.moe>
Date: Tue, 7 Nov 2023 22:40:26 +0000
Subject: [PATCH] Fixed another duplicate hash issue.

---
 public/index.php         |  2 +-
 src/Auth/MisuzuAuth.php  |  7 ++++---
 src/Auth/NabuccoAuth.php |  1 -
 src/Upload.php           | 10 ++++++++--
 4 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/public/index.php b/public/index.php
index 7b407bf..82325ad 100644
--- a/public/index.php
+++ b/public/index.php
@@ -194,7 +194,7 @@ if($isApiDomain) {
         $hash = hash_file('sha256', $localFile);
 
         // this is stupid: dmca status is stored as a file record rather than in a separate table requiring this hack ass garbage
-        $uploadInfo = Upload::byUserHash($db, $userInfo, $hash) ?? Upload::byHash($db, $hash);
+        $uploadInfo = Upload::byAppUserHash($db, $appInfo, $userInfo, $hash) ?? Upload::byHash($db, $hash);
 
         if($uploadInfo !== null) {
             if($uploadInfo->isDMCA())
diff --git a/src/Auth/MisuzuAuth.php b/src/Auth/MisuzuAuth.php
index 1022e66..9b2e0cc 100644
--- a/src/Auth/MisuzuAuth.php
+++ b/src/Auth/MisuzuAuth.php
@@ -1,7 +1,7 @@
 <?php
 namespace EEPROM\Auth;
 
-use EEPROM\Config;
+use RuntimeException;
 use Index\Serialisation\Serialiser;
 
 class MisuzuAuth implements IAuth {
@@ -47,10 +47,11 @@ class MisuzuAuth implements IAuth {
                     'X-SharpChat-Signature: ' . $signature,
                 ],
             ]);
-            $userInfo = json_decode(curl_exec($login));
+            $rawUserInfo = curl_exec($login);
+            $userInfo = json_decode($rawUserInfo);
             curl_close($login);
 
-            return $userInfo->user_id;
+            return empty($userInfo->success) ? 0 : $userInfo->user_id;
         }
 
         return 0;
diff --git a/src/Auth/NabuccoAuth.php b/src/Auth/NabuccoAuth.php
index 15bb371..32b107c 100644
--- a/src/Auth/NabuccoAuth.php
+++ b/src/Auth/NabuccoAuth.php
@@ -1,7 +1,6 @@
 <?php
 namespace EEPROM\Auth;
 
-use EEPROM\Config;
 use Index\Serialisation\UriBase64;
 
 class NabuccoAuth implements IAuth {
diff --git a/src/Upload.php b/src/Upload.php
index a2f059c..ca7824c 100644
--- a/src/Upload.php
+++ b/src/Upload.php
@@ -283,7 +283,12 @@ final class Upload {
         return self::constructDb($result);
     }
 
-    public static function byUserHash(IDbConnection $conn, User|string $userInfo, string $hash): ?self {
+    public static function byAppUserHash(
+        IDbConnection $conn,
+        Application|string $appInfo,
+        User|string $userInfo,
+        string $hash
+    ): ?self {
         $get = $conn->prepare(
             'SELECT `upload_id`, `app_id`, `user_id`, `upload_name`, `upload_type`, `upload_size`, `upload_bump`,'
             . ' UNIX_TIMESTAMP(`upload_created`) AS `upload_created`,'
@@ -293,10 +298,11 @@ final class Upload {
             . ' UNIX_TIMESTAMP(`upload_dmca`) AS `upload_dmca`,'
             . ' INET6_NTOA(`upload_ip`) AS `upload_ip`,'
             . ' LOWER(HEX(`upload_hash`)) AS `upload_hash`'
-            . ' FROM `prm_uploads` WHERE `upload_hash` = UNHEX(?) AND `user_id` = ?'
+            . ' FROM `prm_uploads` WHERE `upload_hash` = UNHEX(?) AND `user_id` = ? AND `app_id` = ?'
         );
         $get->addParameter(1, $hash);
         $get->addParameter(2, $userInfo instanceof User ? $userInfo->getId() : $userInfo);
+        $get->addParameter(3, $appInfo instanceof Application ? $appInfo->getId() : $appInfo);
         $get->execute();
         $result = $get->getResult();