File: /home/awaldron/www/archive/demo/upload/functions.php
<?php
/*##################################################################################
| |
| upload script by http://www.reducedcomplexity.com |
| if you use the script please send an email to scripts@reducedcomplexity.com |
| found a bug? please send me an email so i can fix it. |
| |
| use at your own risk! reducedcomplexity.com gives absolutely no warranties. |
| copyright 2002, 2003 http://www.reducedcomplexity.com | Rudi Bieller |
| |
*/##################################################################################
// ---------------------------------------------------------------------------------------
// main upload function ------------------------------------------------------------------
// ---------------------------------------------------------------------------------------
function upload($RCFILES) {
global $badExt;
global $mailaddress;
$oimg = $_POST["gennewname0"];
$fn = str_replace(" ","_",$RCFILES['file2upl']['name'][0]);
for($i=0;$i<count($RCFILES["file2upl"]["tmp_name"]);$i++) {
$RCFILES['file2upl']['name'][$i] = str_replace(" ","_",$RCFILES['file2upl']['name'][$i]);
$destination = BASEFOLDER . $RCFILES['file2upl']['name'][$i]; // do NOT edit this line!
if (count($RCFILES["file2upl"]["tmp_name"])>1) $j = $i + 1;
else $j = "";
//if (!empty($RCFILES["file2upl"]["name"][$i])) echo $j . " " . $RCFILES["file2upl"]["name"][$i] . ":<br>\n";
//else echo $j . " --<br>\n";
if ( (isset($_POST["pwd"]) && $_POST["pwd"] == PWDUP) || PWDUP == "") { // password is ok
$test = @opendir(BASEFOLDER);
if (empty($test)) { // upload-folder does not exist yet
mkdir (BASEFOLDER, 0777);
}
if ($RCFILES['file2upl']['tmp_name'][$i] == "none") { // nothing was uploaded
echo "<P>Filesize_1 : " . $RCFILES['file2upl']['size'][$i] . " / " . MAXFSIZE;
echo ERR_MSG_NOUP;
$ok = "no";
} elseif ( (!checkExt($RCFILES['file2upl']['name'][$i])) && (PUB_MODE == 1) ) { // check the extensions
echo MSG_INVEXT;
$ok = "no";
} elseif ($RCFILES['file2upl']['size'][$i] > MAXFSIZE) { // filesize is too big
echo "<P>Filesize_2 : " . $RCFILES['file2upl']['size'][$i] . " / " . MAXFSIZE;
echo ERR_MSG_TOOBIG;
$ok = "no";
} else { // file size is ok
//echo "<P>Is Uploaded File? " . is_uploaded_file($RCFILES['file2upl']['tmp_name'][$i]);
//echo "<br>File Exists? " . file_exists($RCFILES['file2upl']['tmp_name'][$i]);
if (is_uploaded_file($RCFILES['file2upl']['tmp_name'][$i])) {
if (file_exists($destination) && empty($_POST["gennewname".$i])) { // file already exists, no new name was set
switch($_POST["fileexists".$i]) {
case "overwrite":
$target = BASEFOLDER . $RCFILES['file2upl']['name'][$i];
echo MSG_OVER;
break;
case "autorename":
$autoname = autoRename($RCFILES['file2upl']['name'][$i]);
$target = BASEFOLDER . $autoname;
$fn = $autoname;
echo "<b>".MSG_REN." '".$autoname."'</b><br>\n";
break;
case "rename":
if(empty($_POST["newname".$i])) {
echo ERR_MSG_OVER;
$ok = "no";
}
if (file_exists(BASEFOLDER . $_POST["newname".$i]) && (!isset($ok))) {
echo ERR_MSG_RENEX;
$ok = "no";
}
if (!checkName($_POST["newname".$i])) {
$ok = "no";
}
if ( (!checkExt($_POST["newname".$i])) && (PUB_MODE == 1) ) { // check the extensions
echo MSG_INVEXT;
$ok = "no";
}
$target = BASEFOLDER . $_POST["newname".$i];
if (!isset($ok)) echo MSG_REN;
break;
case "quit":
$target = BASEFOLDER . $RCFILES['file2upl']['name'][$i];
echo MSG_QUIT;
$ok = "no";
break;
default:
$target = BASEFOLDER . $RCFILES['file2upl']['name'][$i];
echo MSG_QUIT;
$ok = "no";
}
} elseif (isset($_POST["gennewname".$i]) && !empty($_POST["gennewname".$i])) { // file should get a new name
if (empty($_POST["gennewname".$i])) { // is a new name given? usually yes.. ;)
echo ERR_MSG_OVER;
$ok = "no";
}
if (!checkName($_POST["gennewname".$i])) { // check invalid characters in name
$ok = "no";
}
if ( (!checkExt($_POST["gennewname".$i])) && (PUB_MODE == 1) ) { // check the extensions
echo MSG_INVEXT;
$ok = "no";
}
if (file_exists(BASEFOLDER . $_POST["gennewname".$i]) && (!isset($ok))) { // a file with the new name already exists
if (!isset($_POST["fileexists".$i]) || $_POST["fileexists".$i] == "quit") {
$target = BASEFOLDER . $RCFILES['file2upl']['name'][$i];
echo ERR_MSG_RENEX;
$ok = "no";
} else {
###############################
switch($_POST["fileexists".$i]) {
case "overwrite":
$target = BASEFOLDER . $_POST["gennewname".$i];
echo MSG_OVER;
break;
case "autorename":
$autoname = autoRename($RCFILES['file2upl']['name'][$i]);
$target = BASEFOLDER . $autoname;
$fn = $autoname;
echo "<b>".MSG_REN." '".$autoname."'</b><br>\n";
break;
case "rename":
if(empty($_POST["newname".$i])) {
echo ERR_MSG_OVER;
$ok = "no";
}
if (file_exists(BASEFOLDER . $_POST["newname".$i]) && (!isset($ok))) {
echo ERR_MSG_RENEX;
$ok = "no";
}
if (!checkName($_POST["newname".$i])) {
$ok = "no";
}
if ( (!checkExt($_POST["newname".$i])) && (PUB_MODE == 1) ) {
echo MSG_INVEXT;
$ok = "no";
}
$target = BASEFOLDER . $_POST["newname".$i];
if (!isset($ok)) echo MSG_REN;
break;
default:
$target = BASEFOLDER . $RCFILES['file2upl']['name'][$i];
echo MSG_QUIT;
$ok = "no";
}
###############################
}
} else { // new name is ok
$target = BASEFOLDER . $_POST["gennewname".$i];
}
} else { // file does not exist yet
if (!checkName($RCFILES['file2upl']['name'][$i])) $ok = "no";
else $target = BASEFOLDER . $RCFILES['file2upl']['name'][$i];
}
if (!isset($ok) || $ok != "no") {
move_uploaded_file($RCFILES['file2upl']['tmp_name'][$i], $target) or die ($errMsgCpfail);
@chmod($target, 0755); // in case 600 is set after move_uploaded_file
//echo "<P>Filesize_Punk : " . $RCFILES['file2upl']['size'][$i] . " / " . MAXFSIZE;
//echo "<P>Filename_Punk : " . $RCFILES['file2upl']['name'][$i];
//echo "<P>Proposed Name : " . $_POST["gennewname0"];
//echo "<P>FileNewName_Punk : " . $RCFILES['file2upl']['tmp_name'][$i];
echo MSG_SUCCESS;
if (SENDMAILUP == 1) {
$ip = $_SERVER["REMOTE_ADDR"];
$mailsubject = "reducedcomplexity uploader: new file uploaded!";
$mailbody = "changes in your upload-folder:\n";
$mailbody .= "$target\n\n";
$mailbody .= "date of upload: ".date("Y-m-d, H:i:s")."\n";
$mailbody .= "ip of uploader: $ip\n\n";
$mailbody .= "reducedcomplexity uploader\n";
$mailbody .= "http://www.reducedcomplexity.com/scripts\n";
@mail($mailaddress, $mailsubject, $mailbody);
}
}
} else { // !file_is_uploaded
//echo "<P>Filesize_Punk : " . $RCFILES['file2upl']['size'][$i] . " / " . MAXFSIZE;
//echo "<P>Filename_Punk : " . $RCFILES['file2upl']['name'][$i];
//echo "<P>Proposed Name : " . $_POST["gennewname0"];
//echo "<P>FileNewName_Punk : " . $RCFILES['file2upl']['tmp_name'][$i];
//echo "<P>" . MSG_PUNK;
}
}
} elseif (isset($_POST["pwd"]) && $_POST["pwd"] != PWDUP) { // wrong password
echo MSG_PWD;
} else { // no password set at all / impossible ;)
echo MSG_PWD;
}
print "<br>\n";
//unset ($ok);
}// end for
if ($_GET["a"]=="photo") {
// DUPLICATE & RESIZE IMAGES
// (-) Fit, (+) Cover, (0) Exact
require("hft_image.php");
$src_folder = "../gui/photos/upload/";
$dest_folder = "../gui/photos/";
$original_image = $src_folder.$oimg;
if (file_exists($original_image)) {
$image = new hft_image($original_image);
$sz=getimagesize($original_image);
// Create Viewable Photo
if (file_exists($dest_folder.$oimg)) unlink($dest_folder.$oimg);
$image->resize(160, 200, '+');
$new_file = $dest_folder.$oimg;
$image->output_resized($new_file, "JPEG");
$sz1 = getimagesize($new_file);
echo "<P>w=".$sz1[0]." h=".$sz1[1];
if ($sz1[0] > 160) {
$tmp_file = $dest_folder."tmpphoto.jpg";
$dest_img = imagecreatefromjpeg($tmp_file);
$src_img = imagecreatefromjpeg($new_file);
$src_x = ceil(($sz1[0] - 160) / 2);
$src_y = 0;
if (imagecopy($dest_img,$src_img,0,0,$src_x,0,160,200)) imagejpeg($dest_img,$new_file);
} else if ($sz1[1] > 200) {
$tmp_file = $dest_folder."tmpphoto.jpg";
$dest_img = imagecreatefromjpeg($tmp_file);
$src_img = imagecreatefromjpeg($new_file);
$src_y = ceil(($sz1[1] - 200) / 2);
if (imagecopy($dest_img,$src_img,0,0,0,$src_y,160,200)) imagejpeg($dest_img,$new_file);
}
// // Create Thumbnail
// if (file_exists($dest_folder."th_".$oimg)) unlink($dest_folder."th_".$oimg);
// $image->resize(68, 85, '+');
// $new_file = $dest_folder."th_".$oimg;
// $image->output_resized($new_file, "JPEG");
}
}
if ($ok == "no") return FALSE;
else return $fn;
}// end function
// ---------------------------------------------------------------------------------------
// check for invalid characters given in new filenames -----------------------------------
// ---------------------------------------------------------------------------------------
function checkName($names) {
// '\' => '\',
$slashtest = explode("/", $names);
if (sizeof($slashtest) > 1) $preg_err[] = "/ ";
$backslashtest = explode("\\", $names);
if (sizeof($backslashtest) > 1) $preg_err[] = "\ ";
$invalidArr = array(
' ' => 'blanks',
"'" => "'",
'\"' => """,
'&' => '&',
',' => ',',
';' => ';',
'`' => '`',
'<' => '<',
'>' => '>',
':' => ':',
'|' => '|',
'�' => '�',
'^' => '^',
'=' => '=',
'$' => '$',
'*' => '*',
'?' => '?',
'+' => '+',
'(' => '(',
')' => ')',
'%' => '%',
'#' => '#'
);
foreach($invalidArr as $badChar=>$eigenschaft) {
if (strstr($names, $badChar)) $preg_err[] = "$eigenschaft ";
}
if (!isset($preg_err)) return true;
else {
echo MSG_INVCHAR1;
foreach ($preg_err as $single_err) {
echo stripslashes($single_err);
}
echo MSG_INVCHAR2;
return false;
}
}
// ---------------------------------------------------------------------------------------
// check for malicious extensions when high security is on -------------------------------
// ---------------------------------------------------------------------------------------
function checkExt($fname) {
global $badExt;
$path = pathinfo($fname);
foreach($badExt as $singleExt) {
$singleExt = strtolower($singleExt);
if (strtolower(@$path["extension"]) == $singleExt) $ok[] = "no";
if (@$path["extension"] == "") $ok[] = "no";
}
if (isset($ok) && sizeof($ok) > 0) {
return true;
} else {
return false;
}
}
// ---------------------------------------------------------------------------------------
// show readable filesize ----------------------------------------------------------------
// ---------------------------------------------------------------------------------------
function niceFilesize($f_size) {
if ($f_size >= 1073741824) {
$show_filesize = number_format(($f_size / 1073741824),2) . " gb";
} elseif ($f_size >= 1048576) {
$show_filesize = number_format(($f_size / 1048576),2) . " mb";
} elseif ($f_size >= 1024) {
$show_filesize = number_format(($f_size / 1024),2) . " kb";
} elseif ($f_size >= 0) {
$show_filesize = $f_size . " bytes";
} else {
$show_filesize = "0 bytes";
}
return $show_filesize;
}
// ---------------------------------------------------------------------------------------
// delete one or more file(s) in the upload folder ---------------------------------------
// ---------------------------------------------------------------------------------------
function delFiles($file) {
if (isset($file)) {
if (!isset($_POST["pwd"]) || $_POST["pwd"] != PWDADM) {
echo MSG_PWD;
$ok = "No";
} else {
foreach($file as $delme) {
$todel = BASEFOLDER . $delme;
unlink($todel);
}
echo MSG_DELSUCCESS;
}
} else {
echo MSG_NOFCHOSEN; // no checkbox was selected when clicking delete button
}
}
// ---------------------------------------------------------------------------------------
// rename one or more file(s) in the upload folder ---------------------------------------
// ---------------------------------------------------------------------------------------
function renFiles($alt, $neu) {
$old = BASEFOLDER . $alt;
$new = BASEFOLDER . $neu;
if (!isset($_POST["pwd"]) || $_POST["pwd"] != PWDADM) {
echo MSG_PWD;
$ok = "No";
} else {
// check new name....
if (!checkName($neu)) {
$ok = "no";
}
if (PUB_MODE == 1) {
if (!checkExt($neu)) {
echo MSG_INVEXT;
$ok = "no";
}
}
if (file_exists($new)) {
echo ERR_MSG_RENEX;
$ok ="no";
}
if (!isset($ok)) {
if (rename ($old, $new)) echo "rename ok.";
else echo "error: rename failed.";
}
}
}
// ---------------------------------------------------------------------------------------
// autorename a file in case filename already exists -------------------------------------
// ---------------------------------------------------------------------------------------
function autoRename($filename) {
$path = pathinfo($filename);
$filename_full = $path["basename"];
$filename_extension = @$path["extension"];
if (isset($filename_extension) && !empty($filename_extension)) {
$filename_extension = "." . $filename_extension;
$position = strpos($filename_full, $filename_extension); // get the position of ".extension"
$filename_noExt = substr($filename, 0, $position); // extract the filename without extension
} else {
$filename_noExt = $filename_full;
}
// dann den neuen namen erstellen
$n = 0;
$copy = "";
while(file_exists(BASEFOLDER . $filename_noExt . $copy . $filename_extension)) {
if ($n<=9) $n = "00" . $n;
if ($n<=99 && $n>=10) $n = "0" . $n;
if ($n<=999 && $n>=100) $n = "" . $n;
$copy = "_" . $n;
$n++;
}
// return new filename
return $new_filename = $filename_noExt . $copy . $filename_extension;
}
// ---------------------------------------------------------------------------------------
// function to show the html between <form> and </form> ----------------------------------
// ---------------------------------------------------------------------------------------
function showForm() {
// do not edit this ---------------------------------------------------------------------
print "<form action=\"".$_SERVER["PHP_SELF"]."\" method=\"post\" enctype=\"multipart/form-data\">
<input type=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"".MAXFSIZE."\">\n";
// --------------------------------------------------------------------------------------
// displays the upload fields
// you may edit this carefully, but keep in mind:
// -> edit the html only!
// -> do not change any name attribute of an input tag!
// -> if you want to add a class oder style attribute use the preserved expression
// -----------------------------------------------------------------------------------------
for ($i=0; $i<UPLFIELDS; $i++)
{
echo TXT_FILE4UP."<br>\n";
echo "<input type=\"file\" name=\"file2upl[]\" size=\"36\"><br>\n";
echo "<br>\n";
if (SHOW_NEW == 1)
{
echo TXT_NEWNAME."<br>\n";
echo "<input type=\"text\" name=\"gennewname$i\" size=\"36\"><br><br>\n";
}
if (SHOW_OVER == 1 || SHOW_REN == 1 || SHOW_QUIT == 1 || SHOW_AUTORENAME == 1)
{
echo TXT_FILEEXISTS."<br>\n";
echo "<table border=\"0\">\n";
if (SHOW_OVER == 1)
{
echo "<tr>\n";
echo "<td><input type=\"radio\" name=\"fileexists$i\" value=\"overwrite\"></td>\n";
echo "<td>".TXT_OVERWRITE."</td>\n";
echo "</tr>\n";
}
if (SHOW_REN == 1)
{
echo "<tr>\n";
echo "<td><input type=\"radio\" name=\"fileexists$i\" value=\"rename\"></td>\n";
echo "<td>".TXT_NEWNAME."<br><input type=\"text\" name=\"newname$i\" size=\"36\"></td>\n";
echo "</tr>\n";
}
if (SHOW_AUTORENAME == 1)
{
echo "<tr>\n";
echo "<td><input type=\"radio\" name=\"fileexists$i\" value=\"autorename\"></td>\n";
echo "<td>".TXT_AUTORENAME."</td>\n";
echo "</tr>\n";
}
if (SHOW_QUIT == 1)
{
echo "<tr>\n";
echo "<td><input type=\"radio\" name=\"fileexists$i\" value=\"quit\" checked></td>\n";
echo "<td>".TXT_QUIT."</td>\n";
echo "</tr>\n";
}
echo "</table>\n";
}
echo "<p><br></p>\n";
}
// end
if (PWDUP != "")
{
echo "<br>\n";
echo TXT_PASS."<br>\n";
echo "<input type=\"password\" name=\"pwd\" class=\"form\"><br><br>\n";
echo "<input type=\"submit\" name=\"upload\" value=\"".TXT_GO."\">\n";
echo "<br><br>\n";
echo "<small style=\"font-size:08pt;\">upload script © <a href=\"http://www.reducedcomplexity.com\" target=\"_blank\">reducedcomplexity.com</a></small>\n";
echo "</form>\n";
}
else
{
echo "<br>\n";
echo "<input type=\"submit\" name=\"upload\" value=\"".TXT_GO."\">\n";
echo "<br><br>\n";
echo "<small style=\"font-size:08pt;\">upload script © <a href=\"http://www.reducedcomplexity.com\" target=\"_blank\">reducedcomplexity.com</a></small>\n";
echo "</form>\n";
}
} // end of function
?>