mosbth/cimage — pull request #37 by lorenzos (2014-11-08 22:56:18+00:00)
Title: Fixed security issue and PHP file status cache

This pull requests fixes two issues:

* In **img.php** I wanted to make sure *src* image path does not contain directory traversal, so I removed any occourrence of the string `../`. This way an attacker cannot use the script to get images outside the defined folder, or, worse, outside document root.

* In **CImage.php** I added a call to [`clearstatcache()`](http://php.net/manual/en/function.clearstatcache.php) to ensure the subsequent call to `filemtime()` returns the correct timestamp. I noticed every time I edit the original image, I had to refresh my web page exactly two times to display the correct one. I discovered the issue was that the return value for `filemtime()` on cache file is cached by PHP, i.e.:
1. `filemtime()` is first called on original image (result **X**) and cache file (result **Y**) in the first lines of `useCacheIfPossible()`;
2. `X` is greater than **Y**, because original image was edited: so cache is regenerated;
3. When `output()` is finally called, `filemtime()` is called again on cache file, in order to fill the `$lastModified` variable: but **Y** is returned again because of PHP internal [file status cache](http://php.net/manual/en/function.clearstatcache.php), so browser receive an incorrect *Last-Modified* header and displays the old cached image.
4. When page is refreshed again, the correct image is finally displayed because **Y** does not change in the middle of the execution.

* Additionally, I moved the call to `getimagesize()` in `output()` because its return value is not needed when replying with *304 Not Modified*.