File: /home/awaldron/public_html/archive/demo/files.php
<?php
session_start();
include("_functions.php");
force_login();
dbconnect();
// SET BREADCRUMB
$GLOBALS[breadcrumb] = "<a href=\"/content.php?p=1\">Intranet Home</a> > <a href=\"/content.php?p=10\">My Intranet</a> > My Files";
//vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
// You may change maxsize, and allowable upload file types.
//^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
//Mmaximum file size. You may increase or decrease.
$MAX_SIZE = 16777216; // 16 MB
//Allowable file Mime Types. Add more mime types if you want
$FILE_MIMES = array('image/gif', 'image/x-xbitmap', 'image/jpeg', 'image/pjpeg', 'application/x-shockwave-flash', 'application/vnd.ms-excel', 'application/vnd.ms-powerpoint', 'application/msword', '*/*');
//Allowable file ext. names. you may add more extension names.
$FILE_EXTS = array('.zip','.rar','.jpg','.png','.gif','.bmp','.doc','.dot','.xls','.xlt','.ppt','.pdf','.htm','.html','.xml');
//Image Extensions
$IMAGE_EXTS = array('.jpg','.png','.gif','.bmp');
//Disallowed file ext. names. you may add more extension names.
$BAD_FILE_EXTS = array('.php','.pl','.cgi','.asp');
//Allow file delete? no, if only allow upload only
$DELETABLE = true;
/************************************************************
* Setup variables
************************************************************/
$oth = FALSE;
$user = $_SESSION["auth_user"];
if (is_admin() && isset($_GET["ou"])) {
$oth = TRUE;
$user = $_GET["ou"];
}
if (zero($_GET["od"]) && zero($_GET["ou"])) {
$user = $_SESSION["auth_user"];
}
$site_name = $_SERVER['HTTP_HOST'];
$url_dir = "http://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF']);
$url_this = self();
$d1 = (isset($_GET["d"])?$_GET["d"]:"user");
$d2 = (isset($_GET["od"])?$_GET["od"]:(isset($_GET["ou"])?$_GET["ou"]:$user));
if (zero($_GET["od"]) && zero($_GET["ou"])) {
$d1 = "user";
$d2 = $user;
}
$upload_dir = "/home/awaldron/public_html/demo/files/".$d1."/".$d2."/";
$upload_url = "/files/".$d1."/".$d2."/";
$message ="";
/************************************************************
* Check if Upload Directory Exists
************************************************************/
if (!is_dir($upload_dir)) {
if (!mkdir(substr($upload_dir,0,-1))) die ("upload_files directory doesn't exist and creation failed");
if (!chmod(substr($upload_dir,0,-1),0755)) die ("change permission to 755 failed.");
quickUPDATE("INSERT INTO tbl_files_access (username,files_type,files_dir) VALUES ('".$_SESSION[auth_user]."','user','".$_SESSION[auth_user]."')");
}
/************************************************************
* Setup permissions
************************************************************/
$sql = "SELECT * FROM tbl_files_access WHERE username='".$_SESSION["auth_user"]."' ORDER BY files_type ASC";
$res = mysql_query($sql);
$all_dept = FALSE;
$all_user = FALSE;
for ($i=0; $row = mysql_fetch_array($res); $i++) {
if (($row[files_type] == "dept") && ($row[files_dir] == "all")) {
$arr = array();
$all_dept = TRUE;
$handle = opendir("/home/awaldron/public_html/demo/files/dept");
while ($file = readdir($handle)) if (is_dir("/home/awaldron/public_html/demo/files/dept/".$file) && !preg_match("/\.+/",$file)) $arr[++$i] = $file;
sort($arr);
foreach ($arr as $key => $val) $perm_dept[$val] = TRUE;
}
else if (($row[files_type] == "user") && ($row[files_dir] == "all")) {
$arr = array();
$all_user = TRUE;
$handle = opendir("/home/awaldron/public_html/demo/files/user");
while ($file = readdir($handle)) if (is_dir("/home/awaldron/public_html/demo/files/user/".$file) && !preg_match("/\.+/",$file)) $arr[++$i] = $file;
sort($arr);
foreach ($arr as $key => $val) $perm_user[$val] = TRUE;
}
else if ($row[files_type] == "dept") $perm_dept[$row[files_dir]] = TRUE;
else if ($row[files_type] == "user") $perm_user[$row[files_dir]] = TRUE;
}
function dept_files($dept,$perm_dept) {
$out = "<SELECT name=\"od\" onChange=\"document.deptfiles.submit();\">";
$out .= "<option></option>\n";
foreach ($perm_dept as $key => $bool) {
$out .= "<option value=\"".$key."\"".($dept==$key?" SELECTED":"").">".ucwords(str_replace("_"," ",$key))."</option>";
}
$out .= "</SELECT>\n";
return $out;
}
function user_files($user,$perm_user) {
$out = "<SELECT name=\"ou\" onChange=\"document.userfiles.submit();\">";
$out .= "<option></option>\n";
foreach ($perm_user as $key => $bool) {
$out .= "<option value=\"".$key."\"".($user==$key?" SELECTED":"").">".$key."</option>";
}
$out .= "</SELECT>\n";
return $out;
}
function sort_custom($arr,$s,$stype="reg") {
$sort = array();
for ($j=0; $j < count($arr); $j++) $sort[$j] = strtolower($arr[$j][$s])."|".$j;
sort($sort,($stype=="int"?SORT_NUMERIC:SORT_REGULAR));
for ($k=0; $k < count($sort); $k++) {
$sub = (int)substr($sort[$k],(strrpos($sort[$k],"|")+1));
$arr2[$k] = $arr[$sub];
}
return $arr2;
}
function do_upload($upload_dir, $upload_url) {
//print_r($_FILES);
$temp_name = $_FILES['userfile']['tmp_name'];
$file_name = $_FILES['userfile']['name'];
$file_name = str_replace("\\","",$file_name);
$file_name = str_replace("'","",$file_name);
$file_name = str_replace("&","_",$file_name);
$file_name = str_replace(" ","_",$file_name);
$file_name = str_replace("[","(",$file_name);
$file_name = str_replace("]",")",$file_name);
$file_name = preg_replace("/_+/","_",$file_name);
$file_path = $upload_dir.$file_name;
//File Name Check
if ( $file_name =="") {
$message = "Invalid File Name Specified";
return $message;
}
$result = move_uploaded_file($temp_name, $file_path);
if (FALSE) //(!chmod($file_path,0777))
$message = "change permission to 777 failed.";
else $message = (($result)?"$file_name uploaded successfully." : "An unknown error occurred during upload.");
return $message;
}
$name = get_user($user,"fullname");
$page_title = "My Files";
if (isset($_GET[od])) $page_title_display = $page_title." : ".ucwords(str_replace("_"," ",$_GET[od]));
else $page_title_display = $page_title." : ".$name;
$GLOBALS["ext_page"] = $page_title; // SET FAUX PAGE NAME
$_GET["p"] = 13; // SET FAUX PARENT ID
$lnav_mods = get_layout($_GET["p"],1);
$rnav_mods = get_layout($_GET["p"],3);
include("_pagestart.php");
echo "<P><div class=\"headline\">".$page_title_display."</div>\n";
echo "<div class=\"pagebody\">\n";
?>
<script language="JavaScript1.2">
<!--
function ConfirmFD(d1,d2,filename) {
var v2;
input_box=confirm("Are you sure you want to delete this file?");
if (input_box==true) {
if (d1 == 'user') v2 = 'ou';
if (d1 == 'dept') v2 = 'od';
self.location = '/files.php?d='+d1+'&'+v2+'='+d2+'&del='+filename;
}
}
//-->
</script>
<?php
//vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv
// Do not touch the below if you are not confident.
//^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
/************************************************************
* Process User's Request
************************************************************/
if ($_REQUEST[del] && $DELETABLE) {
//$resource = fopen("/home/awaldron/public_html/demo/files/log.txt","a");
//fwrite($resource,date("Ymd h:i:s")."DELETE - $_SERVER[REMOTE_ADDR]"."$_REQUEST[del]\n");
//fclose($resource);
if (strpos($_REQUEST[del],"/.") > 0) ; //possible hacking
//else if (strpos($_REQUEST[del],$upload_dir) === false); //possible hacking
else {
unlink("/home/awaldron/public_html/demo/files/".$d1."/".$d2."/".$_REQUEST[del]);
if ($d1 == "user") $v2 = "ou"; if ($d1 == "dept") $v2 = "od";
print "<script>window.location.href='/files.php?d=".$d1."&".$v2."=".$d2."&message=File \"".$_REQUEST[del]."\" deleted successfully'</script>";
}
}
else if ($_FILES['userfile']) {
$resource = fopen("/home/awaldron/public_html/demo/files/log.txt","a");
fwrite($resource,date("Ymd h:i:s")."UPLOAD - $_SERVER[REMOTE_ADDR]"
.$_FILES['userfile']['name']." "
.$_FILES['userfile']['type']."\n");
fclose($resource);
$file_type = $_FILES['userfile']['type'];
$file_name = $_FILES['userfile']['name'];
$file_ext = strtolower(substr($file_name,strrpos($file_name,".")));
//File Size Check
if ( $_FILES['userfile']['size'] > $MAX_SIZE)
$message = "The file size is over 16MB.";
//File Type/Extension Check
else if ( in_array($file_ext, $BAD_FILE_EXTS) )
$message = "Sorry, $file_name($file_type) is not allowed to be uploaded.";
else
$message = do_upload($upload_dir, $upload_url);
print "<script>window.location.href='$url_this".(strstr($url_this,"?")?"&":"?")."message=$message'</script>";
}
else if (!$_FILES['userfile']);
else
$message = "Invalid File Specified.";
/************************************************************
* List Files
************************************************************/
$ctr = 0;
$data = array();
$handle=opendir($upload_dir);
$filelist = "";
$filelist .= "<br><br><table border=0 cellspacing=1 cellpadding=5 bgcolor=\"#CCCCCC\" width=80%>";
$filelist .= "<tr><td bgcolor=\"#F0F0F0\" align=\"center\">\n";
$filelist .= "<table border=0 cellspacing=3>\n";
//$filelist .= "<tr><td width=100% colspan=3><b>Directory: /".$upload_dir."</b></td></tr>\n";
$filelist .= "<tr>";
$filelist .= "<form action=\"".self()."\" name=\"upload\" id=\"upload\" ENCTYPE=\"multipart/form-data\" method=\"post\" onSubmit=\"document.upload.upload.value='Uploading... Please Wait.';document.upload.upload.disabled=true;document.upload.submit();\">\n";
$filelist .= "<td><b style=\"color:#".COLOR_TBAR."\">Upload New File</b></td><td><input type=\"file\" id=\"userfile\" name=\"userfile\"></td><td><input type=\"submit\" name=\"upload\" value=\"Upload\" class=\"btn\"></td>\n";
$filelist .= "</form>";
$filelist .= "</tr>";
$filelist .= "</table>\n";
$filelist .= "</td>\n";
if ($all_user || (count($perm_user) > 1) || (count($perm_dept) > 0)) {
$filelist .= "<td bgcolor=\"#F0F0F0\" align=\"center\">\n";
$filelist .= "<table>";
if ($all_user || (count($perm_user) > 1)) $filelist .= "<tr><form action=\"files.php\" name=\"userfiles\" method=\"get\"><input type=\"hidden\" name=\"d\" value=\"user\"><td align=\"right\">Change User:</td><td>".user_files($d2,$perm_user)."</td></form></tr>";
if ($all_dept || (count($perm_dept) > 0)) $filelist .= "<tr><form action=\"files.php\" name=\"deptfiles\" method=\"get\"><input type=\"hidden\" name=\"d\" value=\"dept\"><td align=\"right\">Change Department:</td><td>".dept_files($d2,$perm_dept)."</td></form></tr>";
$filelist .= "</table>";
$filelist .= "</td>";
}
$filelist .= "</tr></table>\n";
if ($_REQUEST[message]) {
$filelist .= "<P>";
if (strstr($_REQUEST[message],"successfully")) $filelist .= notice(stripslashes($_REQUEST[message]));
else $filelist .= error(stripslashes($_REQUEST[message]));
}
$filelist .= "<P><table border=0 cellspacing=1 cellpadding=5 bgcolor=\"#CCCCCC\" width=80%>";
$filelist .= "<tr class=\"header\"><td> </td><td>Filename</td><td>Filesize</td><td>Date Modified</td><td>Link/Image Code</td><td>Del?</td></tr>\n";
while ($file = readdir($handle)) {
if(!is_dir($file) && !is_link($file)) {
$ext = substr($file,(strrpos($file,".")+1));
if (in_array(".".$ext,$IMAGE_EXTS)) $linkcode = "[img]".$upload_url.$file."[/img]";
else $linkcode = "[url=".$upload_url.$file."]Link Text Here[/url]";
$dat1[$ctr][d_ext] = $ext;
$dat1[$ctr][d_file] = $file;
$dat1[$ctr][d_size] = filesize($upload_dir.$file);
$dat1[$ctr][d_date] = date("d-M-Y H:i a", filemtime($upload_dir.$file));
$dat1[$ctr][d_link] = $linkcode;
$dat1[$ctr][d_del] = "<a href=\"javascript:ConfirmFD('".$d1."','".$d2."','".urlencode($file)."')\" title='delete'><img src=\"/gui/file_del.gif\" border=0></a>";
$ctr++;
}
}
// SORT ARRAY
if ($_GET["s"]) $s = $_GET["s"];
else $s = "d_file";
$dat2 = sort_custom($dat1,$s);
for ($i=0; $i < count($dat2); $i++) {
$filelist .= "<tr bgcolor=\"#".($i%2==0?"FFFFFF":"F0F0F0")."\">";
$filelist .= "<td><img src=\"/gui/fileicons/".$dat2[$i][d_ext].".gif\"></td>";
$filelist .= "<td><a href=\"".$upload_url.$dat2[$i][d_file]."\" target=\"file\">".$dat2[$i][d_file]."</a></td>";
$filelist .= "<td>".file_size_info($dat2[$i][d_size])."</td>";
$filelist .= "<td>".$dat2[$i][d_date]."</td>";
$filelist .= "<td>".$dat2[$i][d_link]."</td>";
$filelist .= "<td align=\"center\">".$dat2[$i][d_del]."</td>";
$filelist .= "</tr>";
}
if (count($dat2) == 0) {
$filelist .= "<tr bgcolor=\"#FFFFFF\"><td colspan=6 align=\"center\"><br><b>There are no documents in this Directory. Use the upload form, above, to add a document.</b><br><br></td></tr>\n";
}
$filelist .= "</table><P>\n";
echo "<br><b>Welcome to My Files!</b> My Files is an area where you can store your documents for the purpose of redistribution on the intranet. To place your documents into an intranet webpage, simply copy and paste the file's <b>Link/Image Code</b> into the Edit Body field of the page or notice you are creating.\n";
echo "<P><b>Please Note:</b><ul style=\"line-height:18px;\"><li>Maximum filesize for uploads is 16MB.\n";
echo "<li>A file will be overwritten if a file of the same name is uploaded.\n";
echo "</ul><center>\n";
echo $filelist;
echo "</center></div><br><br><br><br>";
echo "</div>\n";
include("_pageend.php");
?>