Subversion Repositories svnkaklik

Rev

Details | Last modification | View Log

Rev Author Line No. Line
6 kaklik 1
<?php
2
// +-----------------------------------------------------------------------+
3
// | PhpWebGallery - a PHP based picture gallery                           |
4
// | Copyright (C) 2002-2003 Pierrick LE GALL - pierrick@phpwebgallery.net |
5
// | Copyright (C) 2003-2005 PhpWebGallery Team - http://phpwebgallery.net |
6
// +-----------------------------------------------------------------------+
7
// | branch        : BSF (Best So Far)
8
// | file          : $RCSfile: upload.php,v $
9
// | last update   : $Date: 2005/01/13 10:18:49 $
10
// | last modifier : $Author: plg $
11
// | revision      : $Revision: 1.28 $
12
// +-----------------------------------------------------------------------+
13
// | This program is free software; you can redistribute it and/or modify  |
14
// | it under the terms of the GNU General Public License as published by  |
15
// | the Free Software Foundation                                          |
16
// |                                                                       |
17
// | This program is distributed in the hope that it will be useful, but   |
18
// | WITHOUT ANY WARRANTY; without even the implied warranty of            |
19
// | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU      |
20
// | General Public License for more details.                              |
21
// |                                                                       |
22
// | You should have received a copy of the GNU General Public License     |
23
// | along with this program; if not, write to the Free Software           |
24
// | Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, |
25
// | USA.                                                                  |
26
// +-----------------------------------------------------------------------+
27
define('PHPWG_ROOT_PATH','./');
28
include_once( PHPWG_ROOT_PATH.'include/common.inc.php' );
29
 
30
//------------------------------------------------------------------- functions
31
// The validate_upload function checks if the image of the given path is valid.
32
// A picture is valid when :
33
//     - width, height and filesize are not higher than the maximum
34
//       filesize authorized by the administrator
35
//     - the type of the picture is among jpg, gif and png
36
// The function returns an array containing :
37
//     - $result['type'] contains the type of the image ('jpg', 'gif' or 'png')
38
//     - $result['error'] contains an array with the different errors
39
//       found with the picture
40
function validate_upload( $temp_name, $my_max_file_size,
41
                          $image_max_width, $image_max_height )
42
{
43
  global $conf, $lang;
44
 
45
  $result = array();
46
  $result['error'] = array();
47
  //echo $_FILES['picture']['name']."<br />".$temp_name;
48
  $extension = get_extension( $_FILES['picture']['name'] );
49
  if (!in_array($extension, $conf['picture_ext']))
50
  {
51
    array_push( $result['error'], $lang['upload_advise_filetype'] );
52
    return $result;
53
  }
54
  if ( !isset( $_FILES['picture'] ) )
55
  {
56
    // do we even have a file?
57
    array_push( $result['error'], "You did not upload anything!" );
58
  }
59
  else if ( $_FILES['picture']['size'] > $my_max_file_size * 1024 )
60
  {
61
    array_push( $result['error'],
62
                $lang['upload_advise_filesize'].$my_max_file_size.' KB' );
63
  }
64
  else
65
  {
66
    // check if we are allowed to upload this file_type
67
    // upload de la photo sous un nom temporaire
68
    if ( !move_uploaded_file( $_FILES['picture']['tmp_name'], $temp_name ) )
69
    {
70
      array_push( $result['error'], $lang['upload_cannot_upload'] );
71
    }
72
    else
73
    {
74
      $size = getimagesize( $temp_name );
75
      if ( isset( $image_max_width )
76
           and $image_max_width != ""
77
           and $size[0] > $image_max_width )
78
      {
79
        array_push( $result['error'],
80
                    $lang['upload_advise_width'].$image_max_width.' px' );
81
      }
82
      if ( isset( $image_max_height )
83
           and $image_max_height != ""
84
           and $size[1] > $image_max_height )
85
      {
86
        array_push( $result['error'],
87
                    $lang['upload_advise_height'].$image_max_height.' px' );
88
      }
89
      // $size[2] == 1 means GIF
90
      // $size[2] == 2 means JPG
91
      // $size[2] == 3 means PNG
92
      switch ( $size[2] )
93
      {
94
      case 1 : $result['type'] = 'gif'; break;
95
      case 2 : $result['type'] = 'jpg'; break;
96
      case 3 : $result['type'] = 'png'; break;
97
      default :
98
        array_push( $result['error'], $lang['upload_advise_filetype'] );  
99
      }
100
    }
101
  }
102
  if ( sizeof( $result['error'] ) > 0 )
103
  {
104
    // destruction de l'image avec le nom temporaire
105
    @unlink( $temp_name );
106
  }
107
  else
108
  {
109
    @chmod( $temp_name, 0644);
110
  }
111
  return $result;
112
}	
113
 
114
//-------------------------------------------------- access authorization check
115
check_login_authorization();
116
check_cat_id( $_GET['cat'] );
117
if ( isset( $page['cat'] ) and is_numeric( $page['cat'] ) )
118
{
119
  check_restrictions( $page['cat'] );
120
  $result = get_cat_info( $page['cat'] );
121
  $page['cat_dir']        = get_complete_dir( $page['cat'] );
122
  $page['cat_site_id']    = $result['site_id'];
123
  $page['cat_name']       = $result['name'];
124
  $page['cat_uploadable'] = $result['uploadable'];
125
  if ($page['cat_site_id'] != 1 or !$page['cat_uploadable'])
126
  {
127
    echo '<div style="text-align:center;">'.$lang['upload_forbidden'].'<br />';
128
    echo '<a href="'.add_session_id( './category.php' ).'">';
129
    echo $lang['thumbnails'].'</a></div>';
130
    exit();
131
  }
132
}
133
 
134
$error = array();
135
$page['upload_successful'] = false;
136
if ( isset( $_GET['waiting_id'] ) )
137
{
138
  $page['waiting_id'] = $_GET['waiting_id'];
139
}
140
//-------------------------------------------------------------- picture upload
141
// verfying fields
142
if ( isset( $_POST['submit'] ) and !isset( $_GET['waiting_id'] ) )
143
{
144
  $path = $page['cat_dir'].$_FILES['picture']['name'];
145
  if ( @is_file( $path ) )
146
  {
147
    array_push( $error, $lang['upload_file_exists'] );
148
  }
149
  // test de la présence des champs obligatoires
150
  if ( empty($_FILES['picture']['name']))
151
  {
152
    array_push( $error, $lang['upload_filenotfound'] );
153
  }
154
  if ( !ereg( "([_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)+)",
155
             $_POST['mail_address'] ) )
156
  {
157
    array_push( $error, $lang['reg_err_mail_address'] );
158
  }
159
  if ( empty($_POST['username']) )
160
  {
161
    array_push( $error, $lang['upload_err_username'] );
162
  }
163
 
164
  $date_creation = '';
165
  if ( !empty($_POST['date_creation']) )
166
  {
167
    list( $day,$month,$year ) = explode( '/', $_POST['date_creation'] );
168
    // int checkdate ( int month, int day, int year)
169
    if (checkdate($month, $day, $year))
170
    {
171
      $date_creation = $year.'-'.$month.'-'.$day;
172
    }
173
    else
174
    {
175
      array_push( $error, $lang['err_date'] );
176
    }
177
  }
178
  // creation of the "infos" field :
179
  // <infos author="Pierrick LE GALL" comment="my comment"
180
  //        date_creation="2004-08-14" name="" />
181
  $xml_infos = '<infos';
182
  $xml_infos.= ' author="'.htmlspecialchars($_POST['author'],ENT_QUOTES).'"';
183
  $xml_infos.= ' comment="'.htmlspecialchars($_POST['comment'],ENT_QUOTES).'"';
184
  $xml_infos.= ' date_creation="'.$date_creation.'"';
185
  $xml_infos.= ' name="'.htmlspecialchars( $_POST['name'], ENT_QUOTES).'"';
186
  $xml_infos.= ' />';
187
 
188
  if ( !preg_match( '/^[a-zA-Z0-9-_.]+$/', $_FILES['picture']['name'] ) )
189
  {
190
    array_push( $error, $lang['update_wrong_dirname'] );
191
  }
192
 
193
  if ( sizeof( $error ) == 0 )
194
  {
195
    $result = validate_upload( $path, $conf['upload_maxfilesize'],
196
                               $conf['upload_maxwidth'],
197
                               $conf['upload_maxheight']  );
198
    for ( $j = 0; $j < sizeof( $result['error'] ); $j++ )
199
    {
200
      array_push( $error, $result['error'][$j] );
201
    }
202
  }
203
 
204
  if ( sizeof( $error ) == 0 )
205
  {
206
    $query = 'insert into '.WAITING_TABLE;
207
    $query.= ' (storage_category_id,file,username,mail_address,date,infos)';
208
    $query.= ' values ';
209
    $query.= '('.$page['cat'].",'".$_FILES['picture']['name']."'";
210
    $query.= ",'".htmlspecialchars( $_POST['username'], ENT_QUOTES)."'";
211
    $query.= ",'".$_POST['mail_address']."',".time().",'".$xml_infos."')";
212
    $query.= ';';
213
    pwg_query( $query );
214
    $page['waiting_id'] = mysql_insert_id();
215
    // mail notification for administrators
216
    if ( $conf['mail_notification'] )
217
    {
218
      notify( 'upload' );
219
    }
220
  }
221
}
222
 
223
//------------------------------------------------------------ thumbnail upload
224
if ( isset( $_POST['submit'] ) and isset( $_GET['waiting_id'] ) )
225
{
226
  // upload of the thumbnail
227
  $query = 'select file';
228
  $query.= ' from '.WAITING_TABLE;
229
  $query.= ' where id = '.$_GET['waiting_id'];
230
  $query.= ';';
231
  $result= pwg_query( $query );
232
  $row = mysql_fetch_array( $result );
233
  $file = substr ( $row['file'], 0, strrpos ( $row['file'], ".") );
234
  $extension = get_extension( $_FILES['picture']['name'] );
235
  $path = $page['cat_dir'].'thumbnail/';
236
  $path.= $conf['prefix_thumbnail'].$file.'.'.$extension;
237
  $result = validate_upload( $path, $conf['upload_maxfilesize'],
238
                             $conf['upload_maxwidth_thumbnail'],
239
                             $conf['upload_maxheight_thumbnail']  );
240
  for ( $j = 0; $j < sizeof( $result['error'] ); $j++ )
241
  {
242
    array_push( $error, $result['error'][$j] );
243
  }
244
  if ( sizeof( $error ) == 0 )
245
  {
246
    $query = 'update '.WAITING_TABLE;
247
    $query.= " set tn_ext = '".$extension."'";
248
    $query.= ' where id = '.$_GET['waiting_id'];
249
    $query.= ';';
250
    pwg_query( $query );
251
    $page['upload_successful'] = true;
252
  }
253
}
254
 
255
//
256
// Start output of page
257
//
258
$title= $lang['upload_title'];
259
include(PHPWG_ROOT_PATH.'include/page_header.php');
260
$template->set_filenames(array('upload'=>'upload.tpl'));
261
 
262
$u_form = PHPWG_ROOT_PATH.'upload.php?cat='.$page['cat'];
263
if ( isset( $page['waiting_id'] ) )
264
{
265
$u_form.= '&amp;waiting_id='.$page['waiting_id'];
266
}
267
 
268
if ( isset( $page['waiting_id'] ) )
269
{
270
  $advise_title=$lang['upload_advise_thumbnail'].$_FILES['picture']['name'];
271
}
272
else
273
{
274
  $advise_title = $lang['upload_advise'];
275
  $advise_title.= get_cat_display_name($page['cat_name']);
276
}
277
 
278
$username = !empty($_POST['username'])?$_POST['username']:$user['username'];
279
$mail_address = !empty($_POST['mail_address'])?$_POST['mail_address']:$user['mail_address'];
280
$name = !empty($_POST['name'])?$_POST['name']:'';
281
$author = !empty($_POST['author'])?$_POST['author']:'';
282
$date_creation = !empty($_POST['date_creation'])?$_POST['date_creation']:'';
283
$comment = !empty($_POST['comment'])?$_POST['comment']:'';
284
 
285
$template->assign_vars(array(
286
  'ADVISE_TITLE' => $advise_title,
287
  'NAME' => $username,
288
  'EMAIL' => $mail_address,
289
  'NAME_IMG' => $name,
290
  'AUTHOR_IMG' => $author,
291
  'DATE_IMG' => $date_creation,
292
  'COMMENT_IMG' => $comment,
293
 
294
  'L_TITLE' => $lang['upload_title'],
295
  'L_USERNAME' => $lang['upload_username'],
296
  'L_EMAIL' =>  $lang['mail_address'], 
297
  'L_NAME_IMG' =>  $lang['upload_name'], 
298
  'L_SUBMIT' =>  $lang['submit'],
299
  'L_AUTHOR' =>  $lang['upload_author'], 
300
  'L_CREATION_DATE' =>  $lang['upload_creation_date'], 
301
  'L_COMMENT' =>  $lang['comment'],
302
  'L_RETURN' =>  $lang['home'],
303
  'L_RETURN_HINT' =>  $lang['home_hint'],
304
  'L_UPLOAD_DONE' =>  $lang['upload_successful'],
305
  'L_MANDATORY' =>  $lang['mandatory'],
306
 
307
  'F_ACTION' => add_session_id( $u_form ),
308
 
309
  'U_RETURN' => add_session_id(PHPWG_ROOT_PATH.'category.php?'.$_SERVER['QUERY_STRING'])
310
  ));
311
 
312
if ( !$page['upload_successful'] )
313
{
314
  $template->assign_block_vars('upload_not_successful',array());
315
//-------------------------------------------------------------- errors display
316
if ( sizeof( $error ) != 0 )
317
{
318
  $template->assign_block_vars('upload_not_successful.errors',array());
319
  for ( $i = 0; $i < sizeof( $error ); $i++ )
320
  {
321
    $template->assign_block_vars('upload_not_successful.errors.error',array('ERROR'=>$error[$i]));
322
  }
323
}
324
 
325
//--------------------------------------------------------------------- advises
326
  if ( !empty($conf['upload_maxfilesize']) )
327
  {
328
    $content = $lang['upload_advise_filesize'];
329
    $content.= $conf['upload_maxfilesize'].' KB';
330
    $template->assign_block_vars('upload_not_successful.advise',array('ADVISE'=>$content));
331
  }
332
 
333
  if ( isset( $page['waiting_id'] ) )
334
  {
335
    if ( $conf['upload_maxwidth_thumbnail'] != '' )
336
    {
337
	  $content = $lang['upload_advise_width'];
338
      $content.= $conf['upload_maxwidth_thumbnail'].' px';
339
	  $template->assign_block_vars('upload_not_successful.advise',array('ADVISE'=>$content));
340
    }
341
    if ( $conf['upload_maxheight_thumbnail'] != '' )
342
    {
343
      $content = $lang['upload_advise_height'];
344
      $content.= $conf['upload_maxheight_thumbnail'].' px';
345
	  $template->assign_block_vars('upload_not_successful.advise',array('ADVISE'=>$content));
346
    }
347
  }
348
  else
349
  {
350
    if ( $conf['upload_maxwidth'] != '' )
351
    {
352
      $content = $lang['upload_advise_width'];
353
      $content.= $conf['upload_maxwidth'].' px';
354
	  $template->assign_block_vars('upload_not_successful.advise',array('ADVISE'=>$content));
355
    }
356
    if ( $conf['upload_maxheight'] != '' )
357
    {
358
      $content = $lang['upload_advise_height'];
359
      $content.= $conf['upload_maxheight'].' px';
360
	  $template->assign_block_vars('upload_not_successful.advise',array('ADVISE'=>$content));
361
    }
362
  }
363
  $template->assign_block_vars('upload_not_successful.advise',array('ADVISE'=>$lang['upload_advise_filetype']));
364
 
365
//----------------------------------------- optionnal username and mail address
366
  if ( !isset( $page['waiting_id'] ) )
367
  {
368
    $template->assign_block_vars('upload_not_successful.fields',array());
369
	$template->assign_block_vars('note',array());
370
  }
371
}
372
else
373
{
374
  $template->assign_block_vars('upload_successful',array());
375
}
376
//----------------------------------------------------------- html code display
377
$template->parse('upload');
378
include(PHPWG_ROOT_PATH.'include/page_tail.php');
379
?>