Project

General

Profile

1 4 ryan
<?php
2 1400 FrankH
/**
3
 *
4
 * @category        admin
5
 * @package         admintools
6
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2011, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL:  $
15
 * @lastmodified    $Date:  $
16
 *
17
 */
18 4 ryan
19
// Print admin header
20
require('../../config.php');
21 1041 Ruebenwurz
include_once('resize_img.php');
22
include_once('parameters.php');
23
24 4 ryan
require_once(WB_PATH.'/framework/class.admin.php');
25 1475 Luisehahne
// require_once(WB_PATH.'/include/pclzip/pclzip.lib.php');	// Required to unzip file.
26 1457 Luisehahne
// suppress to print the header, so no new FTAN will be set
27
$admin = new admin('Media', 'media_upload', false);
28 4 ryan
29 1457 Luisehahne
if( !$admin->checkFTAN() )
30 1400 FrankH
{
31 1457 Luisehahne
	$admin->print_header();
32
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'] );
33 1400 FrankH
}
34 1457 Luisehahne
// After check print the header
35
$admin->print_header();
36 1400 FrankH
37 1457 Luisehahne
// Target location
38
$requestMethod = '_'.strtoupper($_SERVER['REQUEST_METHOD']);
39
$target = (isset(${$requestMethod}['target'])) ? ${$requestMethod}['target'] : '';
40
41 4 ryan
// Include the WB functions file
42
require_once(WB_PATH.'/framework/functions.php');
43
44
// Check to see if target contains ../
45 1425 Luisehahne
if (!check_media_path($target, false))
46
{
47 1457 Luisehahne
	$admin->print_error($MESSAGE['MEDIA']['TARGET_DOT_DOT_SLASH'] );
48 4 ryan
}
49
50
// Create relative path of the target location for the file
51
$relative = WB_PATH.$target.'/';
52 1102 ruud
$resizepath = str_replace(array('/',' '),'_',$target);
53 4 ryan
54
// Find out whether we should replace files or give an error
55 1475 Luisehahne
$overwrite = ($admin->get_post('overwrite') != '') ? true : false;
56 4 ryan
57 61 stefan
// Get list of file types to which we're supposed to append 'txt'
58
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
59
$file_extension_string='';
60
if ($get_result->numRows()>0) {
61
	$fetch_result=$get_result->fetchRow();
62
	$file_extension_string=$fetch_result['value'];
63
}
64 1475 Luisehahne
65 61 stefan
$file_extensions=explode(",",$file_extension_string);
66 1460 Luisehahne
// get from settings and add to forbidden list
67
$rename_file_types  = str_replace(',','|',RENAME_FILES_ON_UPLOAD);
68
// hardcodet forbidden filetypes
69
$forbidden_file_types = 'phtml|php5|php4|php|cgi|pl|exe|com|bat|src|'.$rename_file_types;
70 4 ryan
// Loop through the files
71
$good_uploads = 0;
72 1468 Luisehahne
$sum_dirs = 0;
73
$sum_files = 0;
74
75 4 ryan
for($count = 1; $count <= 10; $count++) {
76
	// If file was upload to tmp
77
	if(isset($_FILES["file$count"]['name'])) {
78
		// Remove bad characters
79 1460 Luisehahne
		$filename = trim(media_filename($_FILES["file$count"]['name']),'.') ;
80 4 ryan
		// Check if there is still a filename left
81 1460 Luisehahne
		// if($filename != '') {
82
		$info = pathinfo($filename);
83
		$ext = isset($info['extension']) ? $info['extension'] : '';
84
85
		if ( ($filename != '') && !preg_match("/\." . $forbidden_file_types . "$/i", $ext) ) {
86 4 ryan
			// Move to relative path (in media folder)
87 1460 Luisehahne
			if(file_exists($relative.$filename) AND $overwrite == true) {
88 4 ryan
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
89
					$good_uploads++;
90 1468 Luisehahne
					$sum_files++;
91 4 ryan
					// Chmod the uploaded file
92 1460 Luisehahne
					change_mode($relative.$filename);
93 4 ryan
				}
94
			} elseif(!file_exists($relative.$filename)) {
95
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
96
					$good_uploads++;
97 1468 Luisehahne
					$sum_files++;
98 4 ryan
					// Chmod the uploaded file
99
					change_mode($relative.$filename);
100
				}
101
			}
102 1460 Luisehahne
103 1041 Ruebenwurz
			if(file_exists($relative.$filename)) {
104
				if ($pathsettings[$resizepath]['width'] || $pathsettings[$resizepath]['height'] ) {
105
					$rimg=new RESIZEIMAGE($relative.$filename);
106
					$rimg->resize_limitwh($pathsettings[$resizepath]['width'],$pathsettings[$resizepath]['height'],$relative.$filename);
107
					$rimg->close();
108
				}
109
			}
110 1460 Luisehahne
111 1023 Ruebenwurz
			// store file name of first file for possible unzip action
112
			if ($count == 1) {
113
				$filename1 = $relative . $filename;
114
			}
115 4 ryan
		}
116
	}
117
}
118 1460 Luisehahne
/*
119
 * Callback function to skip files in black-list
120
 */
121
function pclzipCheckValidFile($p_event, &$p_header)
122
{
123
                         //  return 1;
124
	$rename_file_types  = str_replace(',','|',RENAME_FILES_ON_UPLOAD);
125
	// hardcodet forbidden filetypes
126
	$forbidden_file_types = 'phtml|php5|php4|php|cgi|pl|exe|com|bat|src|'.$rename_file_types;
127
	$info = pathinfo($p_header['filename']);
128 1468 Luisehahne
	$ext = isset($info['extension']) ? $info['extension'] : '';
129
	$dots = (substr($info['basename'], 0, 1) == '.') || (substr($info['basename'], -1, 1) == '.');
130 1460 Luisehahne
	if( !preg_match('/'.$forbidden_file_types.'$/i', $ext) && $dots != '.' )
131
	{	// ----- allowed file types are extracted
132
	  return 1;
133
	}else
134
	{	// ----- all other files are skiped
135
	  return 0;
136
	}
137
}
138
/* ********************************* */
139 4 ryan
140 1023 Ruebenwurz
// If the user chose to unzip the first file, unzip into the current folder
141
if (isset($_POST['unzip']) && isset($filename1) && file_exists($filename1) ) {
142
	$archive = new PclZip($filename1);
143 1460 Luisehahne
144
	$list = $archive->extract(PCLZIP_OPT_PATH, $relative,PCLZIP_CB_PRE_EXTRACT, 'pclzipCheckValidFile');
145
146 1023 Ruebenwurz
	if($list == 0) {
147
		// error while trying to extract the archive (most likely wrong format)
148
		$admin->print_error('UNABLE TO UNZIP FILE' . $archive -> errorInfo(true));
149
	}
150 1460 Luisehahne
	$sum_files = 0;
151 1407 FrankH
	// rename executable files!
152 1460 Luisehahne
	foreach ($list as $key => $val) {
153
	    if( ($val['folder'] ) && change_mode($val['filename']) ) {
154
		   $sum_dirs++;
155
		} elseif( is_writable($val['filename']) && ($val['status'] == 'ok') && change_mode($val['filename']) )  {
156
			$sum_files++;
157 1407 FrankH
		}
158
	}
159 1460 Luisehahne
	if (isset($_POST['delzip'])) { unlink($filename1); }
160 1023 Ruebenwurz
}
161 1460 Luisehahne
unset($list);
162 1468 Luisehahne
if($sum_files == 1) {
163 1460 Luisehahne
	$admin->print_success($sum_files.' '.$MESSAGE['MEDIA']['SINGLE_UPLOADED'] );
164 4 ryan
} else {
165 1468 Luisehahne
	$admin->print_success($sum_files.' '.$MESSAGE['MEDIA']['UPLOADED'] );
166 4 ryan
}
167
168 1468 Luisehahne
// Print admin
169 4 ryan
$admin->print_footer();