Revision 1475
Added by Dietmar almost 13 years ago
| rename2.php | ||
|---|---|---|
| 24 | 24 |
// Include the WB functions file |
| 25 | 25 |
require_once(WB_PATH.'/framework/functions.php'); |
| 26 | 26 |
|
| 27 |
// Get list of file types to which we're supposed to append 'txt' |
|
| 28 |
$get_result = $database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
|
|
| 29 |
$file_extension_string = ''; |
|
| 30 |
if ($get_result->numRows()>0) {
|
|
| 31 |
$fetch_result = $get_result->fetchRow(); |
|
| 32 |
$file_extension_string = $fetch_result['value']; |
|
| 33 |
} |
|
| 34 |
$file_extensions=explode(",",$file_extension_string);
|
|
| 35 |
|
|
| 36 | 27 |
// Get the current dir |
| 37 |
// $directory = $admin->get_post('dir');
|
|
| 38 |
|
|
| 39 |
// Target location |
|
| 40 | 28 |
$requestMethod = '_'.strtoupper($_SERVER['REQUEST_METHOD']); |
| 41 | 29 |
$directory = (isset(${$requestMethod}['dir'])) ? ${$requestMethod}['dir'] : '';
|
| 42 |
if($directory == '/') {
|
|
| 43 |
$directory = ''; |
|
| 44 |
} |
|
| 30 |
$directory = ($directory == '/') ? '' : $directory; |
|
| 45 | 31 |
|
| 46 |
// Check to see if it contains .. |
|
| 32 |
$dirlink = 'browse.php?dir='.$directory; |
|
| 33 |
$rootlink = 'browse.php?dir='; |
|
| 34 |
// $file_id = intval($admin->get_post('id'));
|
|
| 35 |
|
|
| 36 |
// first Check to see if it contains .. |
|
| 47 | 37 |
if (!check_media_path($directory)) {
|
| 48 |
$admin->print_header(); |
|
| 49 |
$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH']); |
|
| 38 |
$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH'],$rootlink, false); |
|
| 50 | 39 |
} |
| 51 | 40 |
|
| 52 | 41 |
// Get the temp id |
| 53 |
$file_id = $admin->checkIDKEY('id', false, 'POST');
|
|
| 42 |
$file_id = intval($admin->checkIDKEY('id', false, $_SERVER['REQUEST_METHOD']));
|
|
| 54 | 43 |
if (!$file_id) {
|
| 55 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS']); |
|
| 44 |
$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'],$dirlink, false);
|
|
| 56 | 45 |
} |
| 57 | 46 |
|
| 47 |
// Check for potentially malicious files and append 'txt' to their name |
|
| 48 |
$rename_file_types = str_replace(',','|',RENAME_FILES_ON_UPLOAD);
|
|
| 49 |
// hardcodet forbidden filetypes |
|
| 50 |
$forbidden_file_types = 'phtml|php5|php4|php|cgi|pl|exe|com|bat|src|'.$rename_file_types; |
|
| 58 | 51 |
// Get home folder not to show |
| 59 | 52 |
$home_folders = get_home_folders(); |
| 60 | 53 |
|
| ... | ... | |
| 62 | 55 |
if($handle = opendir(WB_PATH.MEDIA_DIRECTORY.'/'.$directory)) {
|
| 63 | 56 |
// Loop through the files and dirs an add to list |
| 64 | 57 |
while (false !== ($file = readdir($handle))) {
|
| 58 |
$info = pathinfo($file); |
|
| 59 |
$ext = isset($info['extension']) ? $info['extension'] : ''; |
|
| 65 | 60 |
if(substr($file, 0, 1) != '.' AND $file != '.svn' AND $file != 'index.php') {
|
| 66 |
if(is_dir(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$file)) {
|
|
| 67 |
if(!isset($home_folders[$directory.'/'.$file])) {
|
|
| 68 |
$DIR[] = $file; |
|
| 61 |
if( !preg_match('/'.$forbidden_file_types.'$/i', $ext) ) {
|
|
| 62 |
if(is_dir(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$file)) {
|
|
| 63 |
if(!isset($home_folders[$directory.'/'.$file])) {
|
|
| 64 |
$DIR[] = $file; |
|
| 65 |
} |
|
| 66 |
} else {
|
|
| 67 |
$FILE[] = $file; |
|
| 69 | 68 |
} |
| 70 |
} else {
|
|
| 71 |
$FILE[] = $file; |
|
| 72 | 69 |
} |
| 73 | 70 |
} |
| 74 | 71 |
} |
| ... | ... | |
| 94 | 91 |
} |
| 95 | 92 |
} |
| 96 | 93 |
} |
| 94 |
|
|
| 97 | 95 |
$file_id = $admin->getIDKEY($file_id); |
| 96 |
|
|
| 98 | 97 |
if(!isset($rename_file)) {
|
| 99 |
$admin->print_error($MESSAGE['MEDIA']['FILE_NOT_FOUND'], "browse.php?dir=$directory", false);
|
|
| 98 |
$admin->print_error($MESSAGE['MEDIA']['FILE_NOT_FOUND'], $dirlink, false);
|
|
| 100 | 99 |
} |
| 101 | 100 |
|
| 102 | 101 |
// Check if they entered a new name |
| ... | ... | |
| 121 | 120 |
// Join new name and extension |
| 122 | 121 |
$name = $new_name.$extension; |
| 123 | 122 |
|
| 123 |
$info = pathinfo(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name); |
|
| 124 |
$ext = isset($info['extension']) ? $info['extension'] : ''; |
|
| 125 |
$dots = (substr($info['basename'], 0, 1) == '.') || (substr($info['basename'], -1, 1) == '.'); |
|
| 126 |
|
|
| 127 |
if( preg_match('/'.$forbidden_file_types.'$/i', $ext) || $dots == '.' ) {
|
|
| 128 |
$admin->print_error($MESSAGE['MEDIA']['CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false); |
|
| 129 |
} |
|
| 130 |
|
|
| 124 | 131 |
// Check if the name contains .. |
| 125 | 132 |
if(strstr($name, '..')) {
|
| 126 | 133 |
$admin->print_error($MESSAGE['MEDIA']['NAME_DOT_DOT_SLASH'], "rename.php?dir=$directory&id=$file_id", false); |
| ... | ... | |
| 136 | 143 |
$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false); |
| 137 | 144 |
} |
| 138 | 145 |
|
| 139 |
// Check for potentially malicious files and append 'txt' to their name |
|
| 140 |
foreach($file_extensions as $file_ext) {
|
|
| 141 |
$file_ext_len=strlen($file_ext); |
|
| 142 |
if (substr($name,-$file_ext_len)==$file_ext) {
|
|
| 143 |
$name.='.txt'; |
|
| 144 |
} |
|
| 145 |
} |
|
| 146 |
$info = pathinfo(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$rename_file); |
|
| 147 |
$ext = isset($info['extension']) ? $info['extension'] : ''; |
|
| 148 |
$dots = (substr($info['basename'], 0, 1) == '.') || (substr($info['basename'], -1, 1) == '.'); |
|
| 146 | 149 |
|
| 150 |
if( preg_match('/'.$forbidden_file_types.'$/i', $ext) || $dots == '.' ) {
|
|
| 151 |
$admin->print_error($MESSAGE['MEDIA']['CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false); |
|
| 152 |
} |
|
| 147 | 153 |
|
| 148 | 154 |
// Check if we should overwrite or not |
| 149 | 155 |
if($admin->get_post('overwrite') != 'yes' AND file_exists(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name) == true) {
|
| ... | ... | |
| 160 | 166 |
// feature freeze |
| 161 | 167 |
// require_once(ADMIN_PATH.'/media/dse.php'); |
| 162 | 168 |
|
| 163 |
$admin->print_success($MESSAGE['MEDIA']['RENAMED'], "browse.php?dir=$directory");
|
|
| 169 |
$admin->print_success($MESSAGE['MEDIA']['RENAMED'], $dirlink);
|
|
| 164 | 170 |
} else {
|
| 165 | 171 |
$admin->print_error($MESSAGE['MEDIA']['CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false); |
| 166 | 172 |
} |
Also available in: Unified diff
! security fixes media, groups, users, sections
! reworked add sections in pages
! fix set empty href in show_menu2
! set show_menu2 version to 4.9.6
! reworked Droplet LoginBox, add redirect query
- remove unneeded folder js
! set Droplet to version 1.1.0
+ add checkboxes to change frontend absolute url to relative urls
! set output_filter version to 0.2