Project

General

Profile

1
<?php
2
/**
3
 *
4
 * @category        admin
5
 * @package         media
6
 * @author          Ryan Djurovich (2004-2009), WebsiteBaker Project
7
 * @copyright       2009-2012, WebsiteBaker Org. e.V.
8
 * @link			http://www.websitebaker2.org/
9
 * @license         http://www.gnu.org/licenses/gpl.html
10
 * @platform        WebsiteBaker 2.8.x
11
 * @requirements    PHP 5.2.2 and higher
12
 * @version         $Id: rename2.php 1818 2012-11-15 22:54:21Z Luisehahne $
13
 * @filesource		$HeadURL: svn://isteam.dynxs.de/wb-archiv/branches/2.8.x/wb/admin/media/rename2.php $
14
 * @lastmodified    $Date: 2012-11-15 23:54:21 +0100 (Thu, 15 Nov 2012) $
15
 *
16
 */
17

    
18
if(!defined('WB_URL'))
19
{
20
    $config_file = realpath('../../config.php');
21
    if(file_exists($config_file) && !defined('WB_URL'))
22
    {
23
    	require($config_file);
24
    }
25
}
26
if(!class_exists('admin', false)){ include(WB_PATH.'/framework/class.admin.php'); }
27

    
28
$admin = new admin('Media', 'media', false);
29

    
30
// Include the WB functions file
31
require_once(WB_PATH.'/framework/functions.php');
32

    
33
// Get the current dir
34
$requestMethod = '_'.strtoupper($_SERVER['REQUEST_METHOD']);
35
$directory = (isset(${$requestMethod}['dir'])) ? ${$requestMethod}['dir'] : '';
36
$directory = ($directory == '/') ?  '' : $directory;
37

    
38
$dirlink = 'browse.php?dir='.$directory;
39
$rootlink = 'browse.php?dir=';
40
// $file_id = intval($admin->get_post('id'));
41

    
42
// Get the current dir
43
$currentHome = $admin->get_home_folder();
44
// check for correct directory
45
if ($currentHome && stripos(WB_PATH.MEDIA_DIRECTORY.$rootlink,WB_PATH.MEDIA_DIRECTORY.$currentHome)===false) {
46
	$rootlink = $currentHome;
47
}
48

    
49
// first Check to see if it contains ..
50
if (!check_media_path($directory)) {
51
	$admin->print_error($MESSAGE['MEDIA_DIR_DOT_DOT_SLASH'],$rootlink, false);
52
}
53

    
54
// Get the temp id
55
$file_id = intval($admin->checkIDKEY('id', false, $_SERVER['REQUEST_METHOD']));
56
if (!$file_id) {
57
	$admin->print_error($MESSAGE['GENERIC_SECURITY_ACCESS'],$dirlink, false);
58
}
59

    
60
// Check for potentially malicious files
61
$forbidden_file_types  = preg_replace( '/\s*[,;\|#]\s*/','|',RENAME_FILES_ON_UPLOAD);
62
// Get home folder not to show
63
$home_folders = get_home_folders();
64

    
65
// Figure out what folder name the temp id is
66
if($handle = opendir(WB_PATH.MEDIA_DIRECTORY.'/'.$directory)) {
67
	// Loop through the files and dirs an add to list
68
   while (false !== ($file = readdir($handle))) {
69
		$info = pathinfo($file);
70
		$ext = isset($info['extension']) ? $info['extension'] : '';
71
		if(substr($file, 0, 1) != '.' AND $file != '.svn' AND $file != 'index.php') {
72
			if( !preg_match('/'.$forbidden_file_types.'$/i', $ext) ) {
73
				if(is_dir(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$file)) {
74
					if(!isset($home_folders[$directory.'/'.$file])) {
75
						$DIR[] = $file;
76
					}
77
				} else {
78
					$FILE[] = $file;
79
				}
80
			}
81
		}
82
	}
83
	$temp_id = 0;
84
	if(isset($DIR)) {
85
		sort($DIR);
86
		foreach($DIR AS $name) {
87
			$temp_id++;
88
			if($file_id == $temp_id) {
89
				$rename_file = $name;
90
				$type = 'folder';
91
			}
92
		}
93
	}
94
	if(isset($FILE)) {
95
		sort($FILE);
96
		foreach($FILE AS $name) {
97
			$temp_id++;
98
			if($file_id == $temp_id) {
99
				$rename_file = $name;
100
				$type = 'file';
101
			}
102
		}
103
	}
104
}
105

    
106
$file_id = $admin->getIDKEY($file_id);
107

    
108
if(!isset($rename_file)) {
109
	$admin->print_error($MESSAGE['MEDIA_FILE_NOT_FOUND'], $dirlink, false);
110
}
111

    
112
// Check if they entered a new name
113
if(media_filename($admin->get_post('name')) == "") {
114
	$admin->print_error($MESSAGE['MEDIA_BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
115
} else {
116
	$old_name = $admin->get_post('old_name');
117
	$new_name =  media_filename($admin->get_post('name'));
118
}
119

    
120
// Check if they entered an extension
121
if($type == 'file') {
122
	if(media_filename($admin->get_post('extension')) == "") {
123
		$admin->print_error($MESSAGE['MEDIA_BLANK_EXTENSION'], "rename.php?dir=$directory&id=$file_id", false);
124
	} else {
125
		$extension = media_filename($admin->get_post('extension'));
126
	}
127
} else {
128
	$extension = '';
129
}
130

    
131
// Join new name and extension
132
$name = $new_name.$extension;
133

    
134
$info = pathinfo(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name);
135
$ext = isset($info['extension']) ? $info['extension'] : '';
136
$dots = (substr($info['basename'], 0, 1) == '.') || (substr($info['basename'], -1, 1) == '.');
137

    
138
if( preg_match('/'.$forbidden_file_types.'$/i', $ext) || $dots == '.' ) {
139
	$admin->print_error($MESSAGE['MEDIA_CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false);
140
}
141

    
142
// Check if the name contains ..
143
if(strstr($name, '..')) {
144
	$admin->print_error($MESSAGE['MEDIA_NAME_DOT_DOT_SLASH'], "rename.php?dir=$directory&id=$file_id", false);
145
}
146

    
147
// Check if the name is index.php
148
if($name == 'index.php') {
149
	$admin->print_error($MESSAGE['MEDIA_NAME_INDEX_PHP'], "rename.php?dir=$directory&id=$file_id", false);
150
}
151

    
152
// Check that the name still has a value
153
if($name == '') {
154
	$admin->print_error($MESSAGE['MEDIA_BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
155
}
156

    
157
$info = pathinfo(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$rename_file);
158
$ext = isset($info['extension']) ? $info['extension'] : '';
159
$dots = (substr($info['basename'], 0, 1) == '.') || (substr($info['basename'], -1, 1) == '.');
160

    
161
if( preg_match('/'.$forbidden_file_types.'$/i', $ext) || $dots == '.' ) {
162
	$admin->print_error($MESSAGE['MEDIA_CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false);
163
}
164

    
165
// Check if we should overwrite or not
166
if($admin->get_post('overwrite') != 'yes' AND file_exists(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name) == true) {
167
	if($type == 'folder') {
168
		$admin->print_error($MESSAGE['MEDIA_DIR_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
169
	} else {
170
		$admin->print_error($MESSAGE['MEDIA_FILE_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
171
	}
172
}
173

    
174
// Try and rename the file/folder
175
if(rename(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$rename_file, WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name)) {
176
	$usedFiles = array();
177
    // feature freeze
178
	// require_once(ADMIN_PATH.'/media/dse.php');
179

    
180
	$admin->print_success($MESSAGE['MEDIA_RENAMED'], $dirlink);
181
} else {
182
	$admin->print_error($MESSAGE['MEDIA_CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false);
183
}
(11-11/15)