| 1 | <?php |
| 2 | |
| 3 | |
| 4 | |
| 5 | function upload_data_file() { |
| 6 | // XXX sec. bug over sec. bug |
| 7 | |
| 8 | global $db,$error,$node; |
| 9 | |
| 10 | require(INCLUDE_DIR.'filez.inc'); |
| 11 | |
| 12 | if (($node['node_permission']!='owner') && |
| 13 | ($node['node_permission']!='master')) { |
| 14 | $error=$error_messages['EVENT_PERMISSION_ERROR']; |
| 15 | return false; |
| 16 | } |
| 17 | |
| 18 | $node_id=$node['node_id']; |
| 19 | |
| 20 | if ( !filez::filename_secure($_FILES['data_file']['name'])) { |
| 21 | $error = 'bad, naughty file type. Cruise missile launched.'; |
| 22 | return false; |
| 23 | } |
| 24 | |
| 25 | if (!is_dir(FILE_DIR.$_SESSION['user_id'])) { |
| 26 | mkdir(FILE_DIR.$_SESSION['user_id']); |
| 27 | } |
| 28 | |
| 29 | $suffix = array_pop(explode('.', basename($_FILES['data_file']['name']))); |
| 30 | |
| 31 | if ($suffix=='zip' && $_POST['unzip']) { |
| 32 | mkdir(TMP."/".$_FILES['data_file']['name']); |
| 33 | |
| 34 | // directory traversal si dissabled by default from zip v 5.50 |
| 35 | $cmd="unzip ".$_FILES['data_file']['tmp_name']." -d " |
| 36 | .TMP."/".$_FILES['data_file']['name']; |
| 37 | |
| 38 | shell_exec($cmd); |
| 39 | $handle=opendir(TMP."/".$_FILES['data_file']['name']); |
| 40 | |
| 41 | // XXX move this mess into a function |
| 42 | while (($file = readdir($handle))!==false) { |
| 43 | if ($file!="." && $file!="..") { |
| 44 | |
| 45 | // Need to check extenstions of all extracted files |
| 46 | if ( !filez::filename_secure($_FILES['data_file']['file'])) { |
| 47 | $error = 'ale ale, kto nam to tady loupe pernicek.. '; |
| 48 | return false; |
| 49 | } |
| 50 | |
| 51 | $node_params['node_name']=$file; |
| 52 | $node_params['node_creator']=$_SESSION['user_id']; |
| 53 | if ($_POST['gallery']) $node_params['template_id']="1041658"; |
| 54 | else $node_params['template_id']=12; |
| 55 | $node_params['node_parent']=$node['node_id']; |
| 56 | |
| 57 | $node_params['node_content']=$file; |
| 58 | $datanode_id=nodes::addNode($node_params); |
| 59 | $file_suffix = array_pop(explode('.', basename($file))); |
| 60 | copy(TMP."/".$_FILES['data_file']['name']."/".$file, |
| 61 | FILE_DIR.$_SESSION['user_id'].'/'.$datanode_id.".$file_suffix"); |
| 62 | symlink(FILE_DIR.$_SESSION['user_id'].'/'.$datanode_id.".$file_suffix", |
| 63 | SYSTEM_ROOT.'/files/'.$datanode_id); |
| 64 | if ($_POST['gallery']) { |
| 65 | $image=TMP."/".$_FILES['data_file']['name']."/".$file; |
| 66 | $image_name=$file; |
| 67 | $width=NODE_IMAGE_WIDTH; |
| 68 | |
| 69 | if (stristr($image_name,".jpg") || |
| 70 | stristr($image_name,".jpeg") ){ |
| 71 | |
| 72 | /// XXX UTILZ_DIR is not set. remove? |
| 73 | $cmd=UTILZ_DIR."/jpegtopnm $image |".UTILZ_DIR."/pnmscale -width=$width | ".UTILZ_DIR."ppmquant 256 |".UTILZ_DIR."ppmtogif >".SYSTEM_ROOT.SYSTEM_IMAGES.'/nodes/'.substr($datanode_id,0,1)."/".substr($datanode_id,1,1)."/".$datanode_id.".gif"; |
| 74 | } |
| 75 | elseif (stristr($image_name,".gif")) { |
| 76 | $cmd=UTILZ_DIR."/gifsicle --resize ".$width."x_ $image > ".SYSTE_ROOT.SYSTEM_IMAGES.'/nodes/'.substr($datanode_id,0,1)."/".substr($datanode_id,1,1)."/".$datanode_id.".gif"; |
| 77 | } |
| 78 | if ($cmd) { |
| 79 | shell_exec($cmd); |
| 80 | } |
| 81 | // XXX WTF |
| 82 | echo $cmd; |
| 83 | } |
| 84 | |
| 85 | } |
| 86 | } |
| 87 | closedir($handle); |
| 88 | die(); |
| 89 | } |
| 90 | |
| 91 | else { |
| 92 | copy($_FILES['data_file']['tmp_name'], |
| 93 | FILE_DIR.$_SESSION['user_id'].'/'.$node['node_id'].".$suffix"); |
| 94 | symlink(FILE_DIR.$_SESSION['user_id'].'/'.$node['node_id'].".$suffix", |
| 95 | SYSTEM_ROOT.'/files/'.$node['node_id']); |
| 96 | } |
| 97 | |
| 98 | |
| 99 | } |
| 100 | |
| 101 | ?> |