Project

General

Profile

1 4 ryan
<?php
2
3 61 stefan
// $Id$
4 4 ryan
5
/*
6
7
 Website Baker Project <http://www.websitebaker.org/>
8
 Copyright (C) 2004-2005, Ryan Djurovich
9
10
 Website Baker is free software; you can redistribute it and/or modify
11
 it under the terms of the GNU General Public License as published by
12
 the Free Software Foundation; either version 2 of the License, or
13
 (at your option) any later version.
14
15
 Website Baker is distributed in the hope that it will be useful,
16
 but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
 GNU General Public License for more details.
19
20
 You should have received a copy of the GNU General Public License
21
 along with Website Baker; if not, write to the Free Software
22
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23
24
*/
25
26
// Target location
27
if(!isset($_POST['target']) OR $_POST['target'] == '') {
28
	header("Location: index.php");
29
} else {
30
	$target = $_POST['target'];
31
}
32
33
// Print admin header
34
require('../../config.php');
35
require_once(WB_PATH.'/framework/class.admin.php');
36
$admin = new admin('Media', 'media_upload');
37
38
// Include the WB functions file
39
require_once(WB_PATH.'/framework/functions.php');
40
41
// Check to see if target contains ../
42
if(strstr($target, '../')) {
43
	$admin->print_error($MESSAGE['MEDIA']['TARGET_DOT_DOT_SLASH']);
44
}
45
46
// Create relative path of the target location for the file
47
$relative = WB_PATH.$target.'/';
48
49
// Find out whether we should replace files or give an error
50
if($admin->get_post('overwrite') != '') {
51
	$overwrite = true;
52
} else {
53
	$overwrite = false;
54
}
55
56 61 stefan
// Get list of file types to which we're supposed to append 'txt'
57
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
58
$file_extension_string='';
59
if ($get_result->numRows()>0) {
60
	$fetch_result=$get_result->fetchRow();
61
	$file_extension_string=$fetch_result['value'];
62
}
63
$file_extensions=explode(",",$file_extension_string);
64
65
66 4 ryan
// Loop through the files
67
$good_uploads = 0;
68
for($count = 1; $count <= 10; $count++) {
69
	// If file was upload to tmp
70
	if(isset($_FILES["file$count"]['name'])) {
71
		// Remove bad characters
72
		$filename = media_filename($_FILES["file$count"]['name']);
73
		// Check if there is still a filename left
74
		if($filename != '') {
75 61 stefan
			// Check for potentially malicious files and append 'txt' to their name
76
			foreach($file_extensions as $file_ext) {
77
				$file_ext_len=strlen($file_ext);
78
				if (substr($filename,-$file_ext_len)==$file_ext) {
79
					$filename.='.txt';
80
				}
81
			}
82 4 ryan
			// Move to relative path (in media folder)
83
			if(file_exists($relative.$filename) AND $overwrite == true) {
84
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
85
					$good_uploads++;
86
					// Chmod the uploaded file
87
					change_mode($relative.$filename, 'file');
88
				}
89
			} elseif(!file_exists($relative.$filename)) {
90
				if(move_uploaded_file($_FILES["file$count"]['tmp_name'], $relative.$filename)) {
91
					$good_uploads++;
92
					// Chmod the uploaded file
93
					change_mode($relative.$filename);
94
				}
95
			}
96
		}
97
	}
98
}
99
100
if($good_uploads == 1) {
101
	$admin->print_success($good_uploads.$MESSAGE['MEDIA']['SINGLE_UPLOADED']);
102
} else {
103
	$admin->print_success($good_uploads.$MESSAGE['MEDIA']['UPLOADED']);
104
}
105
106
// Print admin
107
$admin->print_footer();
108
109
?>