<?php	
	/*
		Thiefinder 1.04
		By: Jeremy Steele
		http://www.nusuni.com
		
		Logs possible bandwidth theft.
		
		ToDo:
			Nuttin right now
	*/
	
	//CONFIG STUFF
	$log_dir = dirname(__FILE__);
	$log_name = 'log';
	$maxlines = 100; //0 = unlimited
	//END CONFIGS
	
	$log_path = $log_dir . '/' . $log_name;
	
	$output = "";
	
	$referer = @$_SERVER['HTTP_REFERER']; //get referer, or set it to "none" if no referer is present
	if($referer == '') {
		$referer = 'None';
	}
	
	$request = urldecode($_SERVER['REQUEST_URI']); //get url they requested
	
	if($request == $_SERVER['SCRIPT_NAME']) { //if they request this script directly return nothing!
		return;
	}
	
	$fileinfo = pathinfo($request); //get extension
	$extension = $fileinfo['extension'];
	
	$output .= date(DATE_RFC822) . ": ";
	$output .= $_SERVER['REMOTE_ADDR'] . ' ';
	$output .= "$referer $request"; //set output
	$output .= "\n";
	
	if(($maxlines > 0) && file_exists($log_path)) {
		$linecount = count(file($log_path));
		if($linecount > ($maxlines - 1)) {
			delete_lines($log_path,$linecount - ($maxlines - 1)); //delete top lines as needed
		}
	}
	
	//write out the output
	if(!($fp = fopen($log_path,'a+'))) { //if for some reason this fails just return, user will get no image
		return;
	}
	fwrite($fp,$output);
	fclose($fp);
	
	//if you add more types in .htaccess remember to put them here as well!
	switch($extension) {
		case 'bmp':
			header("Content-Type: image/bmp\n");
			break;
		case 'ico':
			header("Content-Type: image/vnd.microsoft.icon\n");
			break;
		case 'jpg':
		case 'jpeg':
			header("Content-Type: image/jpeg\n");
			break;
		case 'png':
			header("Content-Type: image/png\n");
			break;
		case 'gif':
			header("Content-Type: image/gif\n");
			break;
		default:
			return; //don't return nuttin for unknown types.
	}
	
	//set encoding to binary
	header("Content-Transfer-Encoding: binary");
	
	$doc_root = rtrim($_SERVER['DOCUMENT_ROOT'],'/'); //to prevent double slash further down
	$request = ltrim($request,'/');
	
	if(!file_exists($doc_root . "/$request")) {
		header("HTTP/1.0 404 Not Found");
		return;
	}
	
	//return the image to the calling url. You could also get fancy and print out another image like the goatse :P
	if($fp=fopen($doc_root . "/$request", "r")) {
		if($fp) {
			fpassthru($fp);
		}
		
		fclose($fp);
	}
	
	//functions
	
	function delete_lines($file,$num) { //I'm sure this could be greatly optimized!
		if(($arr = file($file)) === false) {
			return;
		}
		
		$arr2 = array_slice($arr,$num);
		
		if(($fp = fopen($file,'w')) === false) {
			return;
		}
		
		foreach($arr2 as $line) {
			fputs($fp,$line);
		}
			
		fclose($fp);
	}
?>