Project

General

Profile

1 238 stefan
<?php
2
3
/*
4
5
 Website Baker Project <http://www.websitebaker.org/>
6
 Copyright (C) 2004-2005, Ryan Djurovich
7
8
 Website Baker is free software; you can redistribute it and/or modify
9
 it under the terms of the GNU General Public License as published by
10
 the Free Software Foundation; either version 2 of the License, or
11
 (at your option) any later version.
12
13
 Website Baker is distributed in the hope that it will be useful,
14
 but WITHOUT ANY WARRANTY; without even the implied warranty of
15
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
16
 GNU General Public License for more details.
17
18
 You should have received a copy of the GNU General Public License
19
 along with Website Baker; if not, write to the Free Software
20
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
21
22
*/
23
24
// Create admin object
25
require('../../config.php');
26
require_once(WB_PATH.'/framework/class.admin.php');
27
$admin = new admin('Media', 'media_rename', false);
28
29
// Include the WB functions file
30
require_once(WB_PATH.'/framework/functions.php');
31
32
// Include the basic header file
33
require(ADMIN_PATH.'/media/basic_header.html');
34
35
// Get list of file types to which we're supposed to append 'txt'
36
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
37
$file_extension_string='';
38
if ($get_result->numRows()>0) {
39
	$fetch_result=$get_result->fetchRow();
40
	$file_extension_string=$fetch_result['value'];
41
}
42
$file_extensions=explode(",",$file_extension_string);
43
44
45
// Get the current dir
46
$directory = $admin->get_post('dir');
47
if($directory == '/') {
48
	$directory = '';
49
}
50
// Check to see if it contains ../
51
if(strstr($directory, '../')) {
52
	$admin->print_header();
53
	$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH']);
54
}
55
56
// Get the temp id
57
if(!is_numeric($admin->get_post('id'))) {
58
	header("Location: browse.php?dir=$directory");
59 286 stefan
	exit(0);
60 238 stefan
} else {
61
	$file_id = $admin->get_post('id');
62
}
63
64
// Get home folder not to show
65
$home_folders = get_home_folders();
66
67
// Figure out what folder name the temp id is
68
if($handle = opendir(WB_PATH.MEDIA_DIRECTORY.'/'.$directory)) {
69
	// Loop through the files and dirs an add to list
70
   while (false !== ($file = readdir($handle))) {
71
		if(substr($file, 0, 1) != '.' AND $file != '.svn' AND $file != 'index.php') {
72
			if(is_dir(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$file)) {
73
				if(!isset($home_folders[$directory.'/'.$file])) {
74
					$DIR[] = $file;
75
				}
76
			} else {
77
				$FILE[] = $file;
78
			}
79
		}
80
	}
81
	$temp_id = 0;
82
	if(isset($DIR)) {
83
		foreach($DIR AS $name) {
84
			$temp_id++;
85
			if($file_id == $temp_id) {
86
				$rename_file = $name;
87
				$type = 'folder';
88
			}
89
		}
90
	}
91
	if(isset($FILE)) {
92
		foreach($FILE AS $name) {
93
			$temp_id++;
94
			if($file_id == $temp_id) {
95
				$rename_file = $name;
96
				$type = 'file';
97
			}
98
		}
99
	}
100
}
101
102
if(!isset($rename_file)) {
103
	$admin->print_error($MESSAGE['MEDIA']['FILE_NOT_FOUND'], "browse.php?dir=$directory", false);
104
}
105
106
// Check if they entered a new name
107
if(media_filename($admin->get_post('name')) == "") {
108
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
109
} else {
110
	$old_name = $admin->get_post('old_name');
111
	$new_name =  media_filename($admin->get_post('name'));
112
}
113
114
// Check if they entered an extension
115
if($type == 'file') {
116
	if(media_filename($admin->get_post('extension')) == "") {
117
		$admin->print_error($MESSAGE['MEDIA']['BLANK_EXTENSION'], "rename.php?dir=$directory&id=$file_id", false);
118
	} else {
119
		$extension = media_filename($admin->get_post('extension'));
120
	}
121
} else {
122
	$extension = '';
123
}
124
125
// Join new name and extension
126
$name = $new_name.$extension;
127
128
// Check if the name contains ..
129
if(strstr($name, '..')) {
130
	$admin->print_error($MESSAGE['MEDIA']['NAME_DOT_DOT_SLASH'], "rename.php?dir=$directory&id=$file_id", false);
131
}
132
133
// Check if the name is index.php
134
if($name == 'index.php') {
135
	$admin->print_error($MESSAGE['MEDIA']['NAME_INDEX_PHP'], "rename.php?dir=$directory&id=$file_id", false);
136
}
137
138
// Check that the name still has a value
139
if($name == '') {
140
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
141
}
142
143
// Check for potentially malicious files and append 'txt' to their name
144
foreach($file_extensions as $file_ext) {
145
	$file_ext_len=strlen($file_ext);
146
	if (substr($name,-$file_ext_len)==$file_ext) {
147
		$name.='.txt';
148
	}
149
}
150
151
152
// Check if we should overwrite or not
153
if($admin->get_post('overwrite') != 'yes' AND file_exists(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name) == true) {
154
	if($type == 'folder') {
155
		$admin->print_error($MESSAGE['MEDIA']['DIR_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
156
	} else {
157
		$admin->print_error($MESSAGE['MEDIA']['FILE_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
158
	}
159
}
160
161
// Try and rename the file/folder
162
if(rename(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$rename_file, WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name)) {
163
	$admin->print_success($MESSAGE['MEDIA']['RENAMED'], "browse.php?dir=$directory");
164
} else {
165
	$admin->print_error($MESSAGE['MEDIA']['CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false);
166
}
167 239 stefan
?>