diff options
Diffstat (limited to '')
| -rw-r--r-- | upload.php | 348 |
1 files changed, 348 insertions, 0 deletions
diff --git a/upload.php b/upload.php new file mode 100644 index 000000000..d352427db --- /dev/null +++ b/upload.php @@ -0,0 +1,348 @@ +<?php +/*************************************************************************** + * upload.php is a part of PhpWebGallery * + * ------------------- * + * last update : Sunday, October 27, 2002 * + * email : pierrick@z0rglub.com * + * * + ***************************************************************************/ + +/*************************************************************************** + * * + * This program is free software; you can redistribute it and/or modify * + * it under the terms of the GNU General Public License as published by * + * the Free Software Foundation; * + * * + ***************************************************************************/ +function get_extension( $filename ) +{ + return substr ( strrchr( $filename, "." ), 1, strlen ( $filename ) ); +} +// The validate_upload function checks if the image of the given path is valid. +// A picture is valid when : +// - width, height and filesize are not higher than the maximum +// filesize authorized by the administrator +// - the type of the picture is among jpg, gif and png +// The function returns an array containing : +// - $result['type'] contains the type of the image ('jpg', 'gif' or 'png') +// - $result['error'] contains an array with the different errors +// found with the picture +function validate_upload( $temp_name, $my_max_file_size, + $image_max_width, $image_max_height ) +{ + global $lang; + + $result = array(); + $result['error'] = array(); + $i = 0; + //echo $_FILES['picture']['name']."<br />".$temp_name; + $extension = get_extension( $_FILES['picture']['name'] ); + if ( $extension != 'gif' && $extension != 'jpg' && $extension != 'png' ) + { + $result['error'][$i++] = $lang['upload_advise_filetype']; + return $result; + } + if ( !isset( $_FILES['picture'] ) ) + { + // do we even have a file? + $result['error'][$i++] = "You did not upload anything!"; + } + else if ( $_FILES['picture']['size'] > $my_max_file_size * 1024 ) + { + $result['error'][$i++] = $lang['upload_advise_width'].$my_max_file_size." KB"; + } + else + { + // check if we are allowed to upload this file_type + // upload de la photo sous un nom temporaire + if ( !move_uploaded_file( $_FILES['picture']['tmp_name'], $temp_name ) ) + { + $result['error'][$i++] = $lang['upload_cannot_upload']; + } + else + { + $size = getimagesize( $temp_name ); + if ( isset( $image_max_width ) + && $image_max_width != "" + && $size[0] > $image_max_width ) + { + $result['error'][$i++] = $lang['upload_advise_width'].$image_max_width." px"; + } + if ( isset( $image_max_height ) + && $image_max_height != "" + && $size[1] > $image_max_height ) + { + $result['error'][$i++] = $lang['upload_advise_height'].$image_max_height." px"; + } + // $size[2] == 1 means GIF + // $size[2] == 2 means JPG + // $size[2] == 3 means PNG + if ( $size[2] != 1 && $size[2] != 2 && $size[2] != 3 ) + { + $result['error'][$i++] = $lang['upload_advise_filetype']; + } + else + { + switch ( $size[2] ) + { + case 1 : + { + $result['type'] = 'gif'; + break; + } + case 2 : + { + $result['type'] = 'jpg'; + break; + } + case 3 : + { + $result['type'] = 'png'; + break; + } + } + } + } + } + if ( sizeof( $result['error'] ) > 0 ) + { + // destruction de l'image avec le nom temporaire + @unlink( $temp_name ); + } + return $result; +} +//----------------------------------------------------------- personnal include +include_once( './include/init.inc.php' ); +//-------------------------------------------------- access authorization check +check_login_authorization(); +check_cat_id( $_GET['cat'] ); +if ( isset( $page['cat'] ) && is_numeric( $page['cat'] ) ) +{ + check_restrictions( $page['cat'] ); + $result = get_cat_info( $page['cat'] ); + $page['cat_dir'] = $result['dir']; + $page['cat_site_id'] = $result['site_id']; + $page['cat_name'] = $result['name']; +} +else +{ + $access_forbidden = true; +} +if ( $access_forbidden == true + || $page['cat_site_id'] != 1 + || $conf['upload_available'] == 'false' ) +{ + echo"<div style=\"text-align:center;\">".$lang['upload_forbidden']."<br />"; + echo "<a href=\"".add_session_id_to_url( "./diapo.php" )."\">".$lang['thumbnails']."</a></div>"; + exit(); +} +//----------------------------------------------------- template initialization +$vtp = new VTemplate; +$handle = $vtp->Open( './template/default/upload.vtp' ); +// language +$vtp->setGlobalVar( $handle, 'upload_page_title',$lang['upload_title'] ); +$vtp->setGlobalVar( $handle, 'upload_title', $lang['upload_title'] ); +$vtp->setGlobalVar( $handle, 'upload_username', $lang['upload_username'] ); +$vtp->setGlobalVar( $handle, 'reg_mail_address', $lang['reg_mail_address'] ); +$vtp->setGlobalVar( $handle, 'submit', $lang['submit'] ); +$vtp->setGlobalVar( $handle, 'upload_successful',$lang['upload_successful'] ); +$vtp->setGlobalVar( $handle, 'search_return_main_page', + $lang['search_return_main_page'] ); +// user +$vtp->setGlobalVar( $handle, 'page_style', $user['style'] ); +$vtp->setGlobalVar( $handle, 'user_login', $user['pseudo'] ); +$vtp->setGlobalVar( $handle, 'user_mail_address',$user['mail_address'] ); +// structure +$vtp->setGlobalVar( $handle, 'frame_start', get_frame_start() ); +$vtp->setGlobalVar( $handle, 'frame_begin', get_frame_begin() ); +$vtp->setGlobalVar( $handle, 'frame_end', get_frame_end() ); + +$error = array(); +$i = 0; +$page['upload_successful'] = false; +if ( isset( $_GET['waiting_id'] ) ) +{ + $page['waiting_id'] = $_GET['waiting_id']; +} +//-------------------------------------------------------------- picture upload +// vérification de la présence et de la validité des champs. +if ( isset( $_POST['submit'] ) && !isset( $_GET['waiting_id'] ) ) +{ + $path = $page['cat_dir'].$_FILES['picture']['name']; + if ( @is_file( $path ) ) + { + $error[$i++] = $lang['upload_file_exists']; + } + // test de la présence des champs obligatoires + if ( $_FILES['picture']['name'] == "" ) + { + $error[$i++] = $lang['upload_filenotfound']; + } + if ( !ereg( "([_a-z0-9-]+(\.[_a-z0-9-]+)*@[a-z0-9-]+(\.[a-z0-9-]+)+)", + $_POST['mail_address'] ) ) + { + $error[$i++] = $lang['reg_err_mail_address']; + } + if ( $_POST['username'] == '' ) + { + $error[$i++] = $lang['upload_err_username']; + } + + if ( sizeof( $error ) == 0 ) + { + $result = validate_upload( $path, $conf['upload_maxfilesize'], + $conf['upload_maxwidth'], + $conf['upload_maxheight'] ); + $upload_type = $result['type']; + for ( $j = 0; $j < sizeof( $result['error'] ); $j++ ) + { + $error[$i++] = $result['error'][$j]; + } + } + + if ( sizeof( $error ) == 0 ) + { + $query = 'insert into '.$prefixeTable.'waiting'; + $query.= ' (cat_id,file,username,mail_address,date) values'; + $query.= " (".$page['cat'].",'".$_FILES['picture']['name']."'"; + $query.= ",'".htmlspecialchars( $_POST['username'], ENT_QUOTES)."'"; + $query.= ",'".$_POST['mail_address']."',".time().")"; + $query.= ';'; + mysql_query( $query ); + $page['waiting_id'] = mysql_insert_id(); + } +} +//------------------------------------------------------------ thumbnail upload +if ( isset( $_POST['submit'] ) && isset( $_GET['waiting_id'] ) ) +{ + // upload of the thumbnail + $query = 'select file'; + $query.= ' from '.$prefixeTable.'waiting'; + $query.= ' where id = '.$_GET['waiting_id']; + $query.= ';'; + $result= mysql_query( $query ); + $row = mysql_fetch_array( $result ); + $file = substr ( $row['file'], 0, strrpos ( $row['file'], ".") ); + $extension = get_extension( $_FILES['picture']['name'] ); + $path = $page['cat_dir'].'thumbnail/'; + $path.= $conf['prefixe_thumbnail'].$file.'.'.$extension; + $result = validate_upload( $path, $conf['upload_maxfilesize'], + $conf['upload_maxwidth_thumbnail'], + $conf['upload_maxheight_thumbnail'] ); + $upload_type = $result['type']; + for ( $j = 0; $j < sizeof( $result['error'] ); $j++ ) + { + $error[$i++] = $result['error'][$j]; + } + if ( sizeof( $error ) == 0 ) + { + $query = 'update '.$prefixeTable.'waiting'; + $query.= " set tn_ext = '".$extension."'"; + $query.= ' where id = '.$_GET['waiting_id']; + $query.= ';'; + mysql_query( $query ); + $page['upload_successful'] = true; + } +} + +if ( !$page['upload_successful'] ) +{ + $vtp->addSession( $handle, 'upload_not_successful' ); +//-------------------------------------------------------------- errors display + if ( sizeof( $error ) != 0 ) + { + $vtp->addSession( $handle, 'errors' ); + for ( $i = 0; $i < sizeof( $error ); $i++ ) + { + $vtp->addSession( $handle, 'li' ); + $vtp->setVar( $handle, 'li.li', $error[$i] ); + $vtp->closeSession( $handle, 'li' ); + } + $vtp->closeSession( $handle, 'errors' ); + } +//----------------------------------------------------------------- form action + $url = './upload.php?cat='.$page['cat'].'&expand='.$_GET['expand']; + if ( isset( $page['waiting_id'] ) ) + { + $url.= '&waiting_id='.$page['waiting_id']; + } + $vtp->setGlobalVar( $handle, 'form_action', $url ); +//--------------------------------------------------------------------- advises + if ( $conf['upload_maxfilesize'] != '' ) + { + $vtp->addSession( $handle, 'advise' ); + $content = $lang['upload_advise_filesize']; + $content.= $conf['upload_maxfilesize'].' KB'; + $vtp->setVar( $handle, 'advise.content', $content ); + $vtp->closeSession( $handle, 'advise' ); + } + if ( isset( $page['waiting_id'] ) ) + { + $advise_title=$lang['upload_advise_thumbnail'].$_FILES['picture']['name']; + $vtp->setGlobalVar( $handle, 'advise_title', $advise_title ); + + if ( $conf['upload_maxwidth_thumbnail'] != '' ) + { + $vtp->addSession( $handle, 'advise' ); + $content = $lang['upload_advise_width']; + $content.= $conf['upload_maxwidth_thumbnail'].' px'; + $vtp->setVar( $handle, 'advise.content', $content ); + $vtp->closeSession( $handle, 'advise' ); + } + if ( $conf['upload_maxheight_thumbnail'] != '' ) + { + $vtp->addSession( $handle, 'advise' ); + $content = $lang['upload_advise_height']; + $content.= $conf['upload_maxheight_thumbnail'].' px'; + $vtp->setVar( $handle, 'advise.content', $content ); + $vtp->closeSession( $handle, 'advise' ); + } + } + else + { + $advise_title = $lang['upload_advise']; + $advise_title.= get_cat_display_name( $page['cat_name'], ' - ', + 'font-style:italic;' ); + $vtp->setGlobalVar( $handle, 'advise_title', $advise_title ); + + if ( $conf['upload_maxwidth'] != '' ) + { + $vtp->addSession( $handle, 'advise' ); + $content = $lang['upload_advise_width']; + $content.= $conf['upload_maxwidth'].' px'; + $vtp->setVar( $handle, 'advise.content', $content ); + $vtp->closeSession( $handle, 'advise' ); + } + if ( $conf['upload_maxheight'] != '' ) + { + $vtp->addSession( $handle, 'advise' ); + $content = $lang['upload_advise_height']; + $content.= $conf['upload_maxheight'].' px'; + $vtp->setVar( $handle, 'advise.content', $content ); + $vtp->closeSession( $handle, 'advise' ); + } + } + $vtp->addSession( $handle, 'advise' ); + $content = $lang['upload_advise_filetype']; + $vtp->setVar( $handle, 'advise.content', $content ); + $vtp->closeSession( $handle, 'advise' ); +//----------------------------------------- optionnal username and mail address + if ( !isset( $page['waiting_id'] ) ) + { + $vtp->addSession( $handle, 'fields' ); + $vtp->closeSession( $handle, 'fields' ); + } + $vtp->closeSession( $handle, 'upload_not_successful' ); +} +else +{ + $vtp->addSession( $handle, 'upload_successful' ); + $vtp->closeSession( $handle, 'upload_successful' ); +} +//----------------------------------------------------- return to main page url +$url = './category.php?cat='.$page['cat'].'&expand='.$_GET['expand']; +$vtp->setGlobalVar( $handle, 'return_url', add_session_id( $url ) ); +//----------------------------------------------------------- html code display +$code = $vtp->Display( $handle, 0 ); +echo $code; +?>
\ No newline at end of file |