Project

General

Profile

1 4 ryan
<?php
2 1400 FrankH
/**
3
 *
4
 * @category        admin
5 1476 Luisehahne
 * @package         media
6 1400 FrankH
 * @author          WebsiteBaker Project
7
 * @copyright       2004-2009, Ryan Djurovich
8
 * @copyright       2009-2011, Website Baker Org. e.V.
9
 * @link			http://www.websitebaker2.org/
10
 * @license         http://www.gnu.org/licenses/gpl.html
11
 * @platform        WebsiteBaker 2.8.x
12
 * @requirements    PHP 5.2.2 and higher
13
 * @version         $Id$
14
 * @filesource		$HeadURL:  $
15
 * @lastmodified    $Date:  $
16
 *
17
 */
18 4 ryan
19
// Print admin header
20
require('../../config.php');
21 1041 Ruebenwurz
include_once('resize_img.php');
22
include_once('parameters.php');
23
24 4 ryan
require_once(WB_PATH.'/framework/class.admin.php');
25 1475 Luisehahne
// require_once(WB_PATH.'/include/pclzip/pclzip.lib.php');	// Required to unzip file.
26 1457 Luisehahne
// suppress to print the header, so no new FTAN will be set
27
$admin = new admin('Media', 'media_upload', false);
28 4 ryan
29 1457 Luisehahne
if( !$admin->checkFTAN() )
30 1400 FrankH
{
31 1457 Luisehahne
	$admin->print_header();
32
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'] );
33 1400 FrankH
}
34 1457 Luisehahne
// After check print the header
35
$admin->print_header();
36 1400 FrankH
37 1457 Luisehahne
// Target location
38
$requestMethod = '_'.strtoupper($_SERVER['REQUEST_METHOD']);
39
$target = (isset(${$requestMethod}['target'])) ? ${$requestMethod}['target'] : '';
40
41 4 ryan
// Include the WB functions file
42
require_once(WB_PATH.'/framework/functions.php');
43
44 1476 Luisehahne
$directory = ($target == '/') ?  '' : $target;
45
$dirlink = 'index.php?dir='.$directory;
46
$rootlink = 'index.php?dir=';
47
48 4 ryan
// Check to see if target contains ../
49 1425 Luisehahne
if (!check_media_path($target, false))
50
{
51 1457 Luisehahne
	$admin->print_error($MESSAGE['MEDIA']['TARGET_DOT_DOT_SLASH'] );
52 4 ryan
}
53
54
// Create relative path of the target location for the file
55
$relative = WB_PATH.$target.'/';
56 1102 ruud
$resizepath = str_replace(array('/',' '),'_',$target);
57 4 ryan
58
// Find out whether we should replace files or give an error
59 1475 Luisehahne
$overwrite = ($admin->get_post('overwrite') != '') ? true : false;
60 4 ryan
61 61 stefan
// Get list of file types to which we're supposed to append 'txt'
62
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
63
$file_extension_string='';
64
if ($get_result->numRows()>0) {
65
	$fetch_result=$get_result->fetchRow();
66
	$file_extension_string=$fetch_result['value'];
67
}
68 1475 Luisehahne
69 61 stefan
$file_extensions=explode(",",$file_extension_string);
70 1460 Luisehahne
// get from settings and add to forbidden list
71 1476 Luisehahne
$forbidden_file_types  = preg_replace( '/\s*[,;\|#]\s*/','|',RENAME_FILES_ON_UPLOAD);
72 4 ryan
// Loop through the files
73
$good_uploads = 0;
74 1468 Luisehahne
$sum_dirs = 0;
75
$sum_files = 0;
76
77 1476 Luisehahne
for($count = 1; $count <= 10; $count++)
78
{
79 4 ryan
	// If file was upload to tmp
80 1476 Luisehahne
	if(isset($_FILES["file$count"]['name']))
81
	{
82 4 ryan
		// Remove bad characters
83 1460 Luisehahne
		$filename = trim(media_filename($_FILES["file$count"]['name']),'.') ;
84 4 ryan
		// Check if there is still a filename left
85 1460 Luisehahne
		// if($filename != '') {
86
		$info = pathinfo($filename);
87
		$ext = isset($info['extension']) ? $info['extension'] : '';
88
89 1484 Luisehahne
		if ( ($filename != '') && !preg_match("/" . $forbidden_file_types . "$/i", $ext) )
90 1476 Luisehahne
		{
91 4 ryan
			// Move to relative path (in media folder)
92 1460 Luisehahne
			if(file_exists($relative.$filename) AND $overwrite == true) {
93 4 ryan
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
94
					$good_uploads++;
95 1468 Luisehahne
					$sum_files++;
96 4 ryan
					// Chmod the uploaded file
97 1460 Luisehahne
					change_mode($relative.$filename);
98 4 ryan
				}
99
			} elseif(!file_exists($relative.$filename)) {
100
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
101
					$good_uploads++;
102 1468 Luisehahne
					$sum_files++;
103 4 ryan
					// Chmod the uploaded file
104
					change_mode($relative.$filename);
105
				}
106
			}
107 1460 Luisehahne
108 1041 Ruebenwurz
			if(file_exists($relative.$filename)) {
109
				if ($pathsettings[$resizepath]['width'] || $pathsettings[$resizepath]['height'] ) {
110
					$rimg=new RESIZEIMAGE($relative.$filename);
111
					$rimg->resize_limitwh($pathsettings[$resizepath]['width'],$pathsettings[$resizepath]['height'],$relative.$filename);
112
					$rimg->close();
113
				}
114
			}
115 1460 Luisehahne
116 1023 Ruebenwurz
			// store file name of first file for possible unzip action
117
			if ($count == 1) {
118
				$filename1 = $relative . $filename;
119
			}
120 4 ryan
		}
121
	}
122
}
123 1460 Luisehahne
/*
124
 * Callback function to skip files in black-list
125
 */
126
function pclzipCheckValidFile($p_event, &$p_header)
127
{
128 1476 Luisehahne
    //  return 1;
129
// Check for potentially malicious files
130
	$forbidden_file_types  = preg_replace( '/\s*[,;\|#]\s*/','|',RENAME_FILES_ON_UPLOAD);
131 1460 Luisehahne
	$info = pathinfo($p_header['filename']);
132 1468 Luisehahne
	$ext = isset($info['extension']) ? $info['extension'] : '';
133
	$dots = (substr($info['basename'], 0, 1) == '.') || (substr($info['basename'], -1, 1) == '.');
134 1460 Luisehahne
	if( !preg_match('/'.$forbidden_file_types.'$/i', $ext) && $dots != '.' )
135
	{	// ----- allowed file types are extracted
136
	  return 1;
137
	}else
138
	{	// ----- all other files are skiped
139
	  return 0;
140
	}
141
}
142
/* ********************************* */
143 4 ryan
144 1023 Ruebenwurz
// If the user chose to unzip the first file, unzip into the current folder
145
if (isset($_POST['unzip']) && isset($filename1) && file_exists($filename1) ) {
146 1476 Luisehahne
	// Required to unzip file.
147
	require_once(WB_PATH.'/include/pclzip/pclzip.lib.php');
148 1023 Ruebenwurz
	$archive = new PclZip($filename1);
149 1460 Luisehahne
	$list = $archive->extract(PCLZIP_OPT_PATH, $relative,PCLZIP_CB_PRE_EXTRACT, 'pclzipCheckValidFile');
150
151 1023 Ruebenwurz
	if($list == 0) {
152
		// error while trying to extract the archive (most likely wrong format)
153
		$admin->print_error('UNABLE TO UNZIP FILE' . $archive -> errorInfo(true));
154
	}
155 1460 Luisehahne
	$sum_files = 0;
156 1407 FrankH
	// rename executable files!
157 1460 Luisehahne
	foreach ($list as $key => $val) {
158
	    if( ($val['folder'] ) && change_mode($val['filename']) ) {
159
		   $sum_dirs++;
160
		} elseif( is_writable($val['filename']) && ($val['status'] == 'ok') && change_mode($val['filename']) )  {
161
			$sum_files++;
162 1407 FrankH
		}
163
	}
164 1460 Luisehahne
	if (isset($_POST['delzip'])) { unlink($filename1); }
165 1023 Ruebenwurz
}
166 1460 Luisehahne
unset($list);
167 1468 Luisehahne
if($sum_files == 1) {
168 1460 Luisehahne
	$admin->print_success($sum_files.' '.$MESSAGE['MEDIA']['SINGLE_UPLOADED'] );
169 1476 Luisehahne
} elseif($sum_files > 1) {
170
	$admin->print_success($sum_files.' '.$MESSAGE['MEDIA']['UPLOADED'] );
171 4 ryan
} else {
172 1476 Luisehahne
	$admin->print_error($MESSAGE['MEDIA_NO_FILE_UPLOADED'] );
173 4 ryan
}
174
175 1468 Luisehahne
// Print admin
176 4 ryan
$admin->print_footer();