Project

General

Profile

1 238 stefan
<?php
2
3 399 Ruebenwurz
// $Id$
4
5 238 stefan
/*
6
7
 Website Baker Project <http://www.websitebaker.org/>
8 915 Ruebenwurz
 Copyright (C) 2004-2009, Ryan Djurovich
9 238 stefan
10
 Website Baker is free software; you can redistribute it and/or modify
11
 it under the terms of the GNU General Public License as published by
12
 the Free Software Foundation; either version 2 of the License, or
13
 (at your option) any later version.
14
15
 Website Baker is distributed in the hope that it will be useful,
16
 but WITHOUT ANY WARRANTY; without even the implied warranty of
17
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18
 GNU General Public License for more details.
19
20
 You should have received a copy of the GNU General Public License
21
 along with Website Baker; if not, write to the Free Software
22
 Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23
24
*/
25
26
// Create admin object
27
require('../../config.php');
28
require_once(WB_PATH.'/framework/class.admin.php');
29
$admin = new admin('Media', 'media_rename', false);
30
31
// Include the WB functions file
32
require_once(WB_PATH.'/framework/functions.php');
33
34
// Include the basic header file
35
require(ADMIN_PATH.'/media/basic_header.html');
36
37
// Get list of file types to which we're supposed to append 'txt'
38
$get_result=$database->query("SELECT value FROM ".TABLE_PREFIX."settings WHERE name='rename_files_on_upload' LIMIT 1");
39
$file_extension_string='';
40
if ($get_result->numRows()>0) {
41
	$fetch_result=$get_result->fetchRow();
42
	$file_extension_string=$fetch_result['value'];
43
}
44
$file_extensions=explode(",",$file_extension_string);
45
46
47
// Get the current dir
48
$directory = $admin->get_post('dir');
49
if($directory == '/') {
50
	$directory = '';
51
}
52
// Check to see if it contains ../
53
if(strstr($directory, '../')) {
54
	$admin->print_header();
55
	$admin->print_error($MESSAGE['MEDIA']['DIR_DOT_DOT_SLASH']);
56
}
57
58
// Get the temp id
59
if(!is_numeric($admin->get_post('id'))) {
60
	header("Location: browse.php?dir=$directory");
61 286 stefan
	exit(0);
62 238 stefan
} else {
63
	$file_id = $admin->get_post('id');
64
}
65
66
// Get home folder not to show
67
$home_folders = get_home_folders();
68
69
// Figure out what folder name the temp id is
70
if($handle = opendir(WB_PATH.MEDIA_DIRECTORY.'/'.$directory)) {
71
	// Loop through the files and dirs an add to list
72
   while (false !== ($file = readdir($handle))) {
73
		if(substr($file, 0, 1) != '.' AND $file != '.svn' AND $file != 'index.php') {
74
			if(is_dir(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$file)) {
75
				if(!isset($home_folders[$directory.'/'.$file])) {
76
					$DIR[] = $file;
77
				}
78
			} else {
79
				$FILE[] = $file;
80
			}
81
		}
82
	}
83
	$temp_id = 0;
84
	if(isset($DIR)) {
85 384 Ruebenwurz
		sort($DIR);
86 238 stefan
		foreach($DIR AS $name) {
87
			$temp_id++;
88
			if($file_id == $temp_id) {
89
				$rename_file = $name;
90
				$type = 'folder';
91
			}
92
		}
93
	}
94
	if(isset($FILE)) {
95 384 Ruebenwurz
		sort($FILE);
96 238 stefan
		foreach($FILE AS $name) {
97
			$temp_id++;
98
			if($file_id == $temp_id) {
99
				$rename_file = $name;
100
				$type = 'file';
101
			}
102
		}
103
	}
104
}
105
106
if(!isset($rename_file)) {
107
	$admin->print_error($MESSAGE['MEDIA']['FILE_NOT_FOUND'], "browse.php?dir=$directory", false);
108
}
109
110
// Check if they entered a new name
111
if(media_filename($admin->get_post('name')) == "") {
112
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
113
} else {
114
	$old_name = $admin->get_post('old_name');
115
	$new_name =  media_filename($admin->get_post('name'));
116
}
117
118
// Check if they entered an extension
119
if($type == 'file') {
120
	if(media_filename($admin->get_post('extension')) == "") {
121
		$admin->print_error($MESSAGE['MEDIA']['BLANK_EXTENSION'], "rename.php?dir=$directory&id=$file_id", false);
122
	} else {
123
		$extension = media_filename($admin->get_post('extension'));
124
	}
125
} else {
126
	$extension = '';
127
}
128
129
// Join new name and extension
130
$name = $new_name.$extension;
131
132
// Check if the name contains ..
133
if(strstr($name, '..')) {
134
	$admin->print_error($MESSAGE['MEDIA']['NAME_DOT_DOT_SLASH'], "rename.php?dir=$directory&id=$file_id", false);
135
}
136
137
// Check if the name is index.php
138
if($name == 'index.php') {
139
	$admin->print_error($MESSAGE['MEDIA']['NAME_INDEX_PHP'], "rename.php?dir=$directory&id=$file_id", false);
140
}
141
142
// Check that the name still has a value
143
if($name == '') {
144
	$admin->print_error($MESSAGE['MEDIA']['BLANK_NAME'], "rename.php?dir=$directory&id=$file_id", false);
145
}
146
147
// Check for potentially malicious files and append 'txt' to their name
148
foreach($file_extensions as $file_ext) {
149
	$file_ext_len=strlen($file_ext);
150
	if (substr($name,-$file_ext_len)==$file_ext) {
151
		$name.='.txt';
152
	}
153
}
154
155
156
// Check if we should overwrite or not
157
if($admin->get_post('overwrite') != 'yes' AND file_exists(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name) == true) {
158
	if($type == 'folder') {
159
		$admin->print_error($MESSAGE['MEDIA']['DIR_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
160
	} else {
161
		$admin->print_error($MESSAGE['MEDIA']['FILE_EXISTS'], "rename.php?dir=$directory&id=$file_id", false);
162
	}
163
}
164
165
// Try and rename the file/folder
166
if(rename(WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$rename_file, WB_PATH.MEDIA_DIRECTORY.$directory.'/'.$name)) {
167
	$admin->print_success($MESSAGE['MEDIA']['RENAMED'], "browse.php?dir=$directory");
168
} else {
169
	$admin->print_error($MESSAGE['MEDIA']['CANNOT_RENAME'], "rename.php?dir=$directory&id=$file_id", false);
170
}
171 239 stefan
?>