Project

General

Profile

1 238 stefan
<?php
2 1400 FrankH
/**
3
 *
4
 * @category        admin
5
 * @package         admintools
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2011, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL:  $
15
 * @lastmodified    $Date:  $
16
 *
17
 */
18 238 stefan
19
// Create admin object
20
require('../../config.php');
21
require_once(WB_PATH.'/framework/class.admin.php');
22
$admin = new admin('Media', 'media_rename', false);
23
24 1400 FrankH
if (!$admin->checkFTAN())
25
{
26
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL);
27
	exit();
28
}
29
30 238 stefan
// Include the WB functions file
31
require_once(WB_PATH.'/framework/functions.php');
32
33
// Get list of file types to which we're supposed to append 'txt'
34 1400 FrankH
$get_result = $database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
35
$file_extension_string = '';
36 238 stefan
if ($get_result->numRows()>0) {
37 1400 FrankH
	$fetch_result = $get_result->fetchRow();
38
	$file_extension_string = $fetch_result['value'];
39 238 stefan
}
40
$file_extensions=explode(",",$file_extension_string);
41
42
// Get the current dir
43
$directory = $admin->get_post('dir');
44
if($directory == '/') {
45
	$directory = '';
46
}
47 1400 FrankH
48
// Check to see if it contains ..
49
if (!check_media_path($directory)) {
50 238 stefan
	$admin->print_header();
51
	$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH']);
52
}
53
54
// Get the temp id
55 1400 FrankH
$file_id = $admin->checkIDKEY('id', false, 'POST');
56
if (!$file_id) {
57
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'], WB_URL);
58 238 stefan
}
59
60
// Get home folder not to show
61
$home_folders = get_home_folders();
62
63
// Figure out what folder name the temp id is
64
if($handle = opendir(WB_PATH.MEDIA_DIRECTORY.'/'.$directory)) {
65
	// Loop through the files and dirs an add to list
66
   while (false !== ($file = readdir($handle))) {
67
		if(substr($file, 0, 1) != '.' AND $file != '.svn' AND $file != 'index.php') {
68
			if(is_dir(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$file)) {
69
				if(!isset($home_folders[$directory.'/'.$file])) {
70
					$DIR[] = $file;
71
				}
72
			} else {
73
				$FILE[] = $file;
74
			}
75
		}
76
	}
77
	$temp_id = 0;
78
	if(isset($DIR)) {
79 384 Ruebenwurz
		sort($DIR);
80 238 stefan
		foreach($DIR AS $name) {
81
			$temp_id++;
82
			if($file_id == $temp_id) {
83
				$rename_file = $name;
84
				$type = 'folder';
85
			}
86
		}
87
	}
88
	if(isset($FILE)) {
89 384 Ruebenwurz
		sort($FILE);
90 238 stefan
		foreach($FILE AS $name) {
91
			$temp_id++;
92
			if($file_id == $temp_id) {
93
				$rename_file = $name;
94
				$type = 'file';
95
			}
96
		}
97
	}
98
}
99
100
if(!isset($rename_file)) {
101
	$admin->print_error($MESSAGE['MEDIA']['FILE_NOT_FOUND'], "browse.php?dir=$directory", false);
102
}
103
104
// Check if they entered a new name
105
if(media_filename($admin->get_post('name')) == "") {
106
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
107
} else {
108
	$old_name = $admin->get_post('old_name');
109
	$new_name =  media_filename($admin->get_post('name'));
110
}
111
112
// Check if they entered an extension
113
if($type == 'file') {
114
	if(media_filename($admin->get_post('extension')) == "") {
115
		$admin->print_error($MESSAGE['MEDIA']['BLANK_EXTENSION'], "rename.php?dir=$directory&id=$file_id", false);
116
	} else {
117
		$extension = media_filename($admin->get_post('extension'));
118
	}
119
} else {
120
	$extension = '';
121
}
122
123
// Join new name and extension
124
$name = $new_name.$extension;
125
126
// Check if the name contains ..
127
if(strstr($name, '..')) {
128
	$admin->print_error($MESSAGE['MEDIA']['NAME_DOT_DOT_SLASH'], "rename.php?dir=$directory&id=$file_id", false);
129
}
130
131
// Check if the name is index.php
132
if($name == 'index.php') {
133
	$admin->print_error($MESSAGE['MEDIA']['NAME_INDEX_PHP'], "rename.php?dir=$directory&id=$file_id", false);
134
}
135
136
// Check that the name still has a value
137
if($name == '') {
138
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
139
}
140
141
// Check for potentially malicious files and append 'txt' to their name
142
foreach($file_extensions as $file_ext) {
143
	$file_ext_len=strlen($file_ext);
144
	if (substr($name,-$file_ext_len)==$file_ext) {
145
		$name.='.txt';
146
	}
147
}
148
149
150
// Check if we should overwrite or not
151
if($admin->get_post('overwrite') != 'yes' AND file_exists(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name) == true) {
152
	if($type == 'folder') {
153
		$admin->print_error($MESSAGE['MEDIA']['DIR_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
154
	} else {
155
		$admin->print_error($MESSAGE['MEDIA']['FILE_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
156
	}
157
}
158
159
// Try and rename the file/folder
160
if(rename(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$rename_file, WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name)) {
161
	$admin->print_success($MESSAGE['MEDIA']['RENAMED'], "browse.php?dir=$directory");
162
} else {
163
	$admin->print_error($MESSAGE['MEDIA']['CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false);
164
}
165 239 stefan
?>