5
* @version $Id: functions_upload.php,v 1.40 2007/10/05 14:30:11 acydburn Exp $
6
* @copyright (c) 2005 phpBB Group
7
* @license http://opensource.org/licenses/gpl-license.php GNU Public License
14
if (!defined('IN_PHPBB'))
20
* Responsible for holding all file relevant information, as well as doing file-specific operations.
21
* The {@link fileupload fileupload class} can be used to upload several files, each of them being this object to operate further on.
34
var $image_info = array();
36
var $destination_file = '';
37
var $destination_path = '';
39
var $file_moved = false;
40
var $init_error = false;
51
function filespec($upload_ary, $upload_namespace)
53
if (!isset($upload_ary))
55
$this->init_error = true;
59
$this->filename = $upload_ary['tmp_name'];
60
$this->filesize = $upload_ary['size'];
61
$name = trim(htmlspecialchars(basename($upload_ary['name'])));
62
$this->realname = $this->uploadname = (STRIP) ? stripslashes($name) : $name;
63
$this->mimetype = $upload_ary['type'];
65
// Opera adds the name to the mime type
66
$this->mimetype = (strpos($this->mimetype, '; name') !== false) ? str_replace(strstr($this->mimetype, '; name'), '', $this->mimetype) : $this->mimetype;
70
$this->mimetype = 'application/octetstream';
73
$this->extension = strtolower($this->get_extension($this->realname));
75
// Try to get real filesize from temporary folder (not always working) ;)
76
$this->filesize = (@filesize($this->filename)) ? @filesize($this->filename) : $this->filesize;
78
$this->width = $this->height = 0;
79
$this->file_moved = false;
81
$this->local = (isset($upload_ary['local_mode'])) ? true : false;
82
$this->upload = $upload_namespace;
86
* Cleans destination filename
88
* @param real|unique|unique_ext $mode real creates a realname, filtering some characters, lowering every character. Unique creates an unique filename
89
* @param string $prefix Prefix applied to filename
92
function clean_filename($mode = 'unique', $prefix = '', $user_id = '')
94
if ($this->init_error)
102
// Remove every extension from filename (to not let the mime bug being exposed)
103
if (strpos($this->realname, '.') !== false)
105
$this->realname = substr($this->realname, 0, strpos($this->realname, '.'));
108
// Replace any chars which may cause us problems with _
109
$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
111
$this->realname = rawurlencode(str_replace($bad_chars, '_', strtolower($this->realname)));
112
$this->realname = preg_replace("/%(\w{2})/", '_', $this->realname);
114
$this->realname = $prefix . $this->realname . '.' . $this->extension;
118
$this->realname = $prefix . md5(unique_id());
122
$this->extension = strtolower($this->extension);
123
$this->realname = $prefix . $user_id . '.' . $this->extension;
129
$this->realname = $prefix . md5(unique_id()) . '.' . $this->extension;
135
* Get property from file object
137
function get($property)
139
if ($this->init_error || !isset($this->$property))
144
return $this->$property;
148
* Check if file is an image (mimetype)
150
* @return true if it is an image, false if not
154
return (strpos($this->mimetype, 'image/') !== false) ? true : false;
158
* Check if the file got correctly uploaded
160
* @return true if it is a valid upload, false if not
162
function is_uploaded()
164
if (!$this->local && !is_uploaded_file($this->filename))
169
if ($this->local && !file_exists($this->filename))
182
if ($this->file_moved)
184
@unlink($this->destination_file);
191
function get_extension($filename)
193
if (strpos($filename, '.') === false)
198
$filename = explode('.', $filename);
199
return array_pop($filename);
203
* Get mimetype. Utilize mime_content_type if the function exist.
204
* Not used at the moment...
206
function get_mimetype($filename)
210
if (function_exists('mime_content_type'))
212
$mimetype = mime_content_type($filename);
215
// Some browsers choke on a mimetype of application/octet-stream
216
if (!$mimetype || $mimetype == 'application/octet-stream')
218
$mimetype = 'application/octetstream';
227
function get_filesize($filename)
229
return @filesize($filename);
233
* Move file to destination folder
234
* The phpbb_root_path variable will be applied to the destination path
236
* @param string $destination_path Destination path, for example $config['avatar_path']
237
* @param bool $overwrite If set to true, an already existing file will be overwritten
238
* @param octal $chmod Permission mask for chmodding the file after a successful move
241
function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = 0666)
243
global $user, $phpbb_root_path;
245
if (sizeof($this->error))
250
// We need to trust the admin in specifying valid upload directories and an attacker not being able to overwrite it...
251
$this->destination_path = $phpbb_root_path . $destination;
253
// Check if the destination path exist...
254
if (!file_exists($this->destination_path))
256
@unlink($this->filename);
260
$upload_mode = (@ini_get('open_basedir') || @ini_get('safe_mode')) ? 'move' : 'copy';
261
$upload_mode = ($this->local) ? 'local' : $upload_mode;
262
$this->destination_file = $this->destination_path . '/' . basename($this->realname);
264
// Check if the file already exist, else there is something wrong...
265
if (file_exists($this->destination_file) && !$overwrite)
267
@unlink($this->filename);
271
if (file_exists($this->destination_file))
273
@unlink($this->destination_file);
276
switch ($upload_mode)
280
if (!@copy($this->filename, $this->destination_file))
282
if (!@move_uploaded_file($this->filename, $this->destination_file))
284
$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file);
289
@unlink($this->filename);
295
if (!@move_uploaded_file($this->filename, $this->destination_file))
297
if (!@copy($this->filename, $this->destination_file))
299
$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file);
304
@unlink($this->filename);
310
if (!@copy($this->filename, $this->destination_file))
312
$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file);
315
@unlink($this->filename);
320
@chmod($this->destination_file, $chmod);
323
// Try to get real filesize from destination folder
324
$this->filesize = (@filesize($this->destination_file)) ? @filesize($this->destination_file) : $this->filesize;
326
if ($this->is_image() && !$skip_image_check)
328
$this->width = $this->height = 0;
330
if (($this->image_info = @getimagesize($this->destination_file)) !== false)
332
$this->width = $this->image_info[0];
333
$this->height = $this->image_info[1];
335
if (!empty($this->image_info['mime']))
337
$this->mimetype = $this->image_info['mime'];
341
$types = $this->upload->image_types();
343
if (!isset($types[$this->image_info[2]]) || !in_array($this->extension, $types[$this->image_info[2]]))
345
if (!isset($types[$this->image_info[2]]))
347
$this->error[] = sprintf($user->lang['IMAGE_FILETYPE_INVALID'], $this->image_info[2], $this->mimetype);
351
$this->error[] = sprintf($user->lang['IMAGE_FILETYPE_MISMATCH'], $types[$this->image_info[2]][0], $this->extension);
355
// Make sure the dimensions match a valid image
356
if (empty($this->width) || empty($this->height))
358
$this->error[] = $user->lang['ATTACHED_IMAGE_NOT_IMAGE'];
363
$this->error[] = $user->lang['UNABLE_GET_IMAGE_SIZE'];
367
$this->file_moved = true;
368
$this->additional_checks();
369
unset($this->upload);
375
* Performing additional checks
377
function additional_checks()
381
if (!$this->file_moved)
386
// Filesize is too big or it's 0 if it was larger than the maxsize in the upload form
387
if ($this->upload->max_filesize && ($this->get('filesize') > $this->upload->max_filesize || $this->filesize == 0))
389
$size_lang = ($this->upload->max_filesize >= 1048576) ? $user->lang['MB'] : (($this->upload->max_filesize >= 1024) ? $user->lang['KB'] : $user->lang['BYTES'] );
390
$max_filesize = ($this->upload->max_filesize >= 1048576) ? round($this->upload->max_filesize / 1048576 * 100) / 100 : (($this->upload->max_filesize >= 1024) ? round($this->upload->max_filesize / 1024 * 100) / 100 : $this->upload->max_filesize);
392
$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'WRONG_FILESIZE'], $max_filesize, $size_lang);
397
if (!$this->upload->valid_dimensions($this))
399
$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'WRONG_SIZE'], $this->upload->min_width, $this->upload->min_height, $this->upload->max_width, $this->upload->max_height, $this->width, $this->height);
409
* Class for assigning error messages before a real filespec class can be assigned
413
class fileerror extends filespec
415
function fileerror($error_msg)
417
$this->error[] = $error_msg;
423
* Init class (all parameters optional and able to be set/overwritten separately) - scope is global and valid for all uploads
429
var $allowed_extensions = array();
430
var $max_filesize = 0;
435
var $error_prefix = '';
438
* Init file upload class.
440
* @param string $error_prefix Used error messages will get prefixed by this string
441
* @param array $allowed_extensions Array of allowed extensions, for example array('jpg', 'jpeg', 'gif', 'png')
442
* @param int $max_filesize Maximum filesize
443
* @param int $min_width Minimum image width (only checked for images)
444
* @param int $min_height Minimum image height (only checked for images)
445
* @param int $max_width Maximum image width (only checked for images)
446
* @param int $max_height Maximum image height (only checked for images)
449
function fileupload($error_prefix = '', $allowed_extensions = false, $max_filesize = false, $min_width = false, $min_height = false, $max_width = false, $max_height = false)
451
$this->set_allowed_extensions($allowed_extensions);
452
$this->set_max_filesize($max_filesize);
453
$this->set_allowed_dimensions($min_width, $min_height, $max_width, $max_height);
454
$this->set_error_prefix($error_prefix);
460
function reset_vars()
462
$this->max_filesize = 0;
463
$this->min_width = $this->min_height = $this->max_width = $this->max_height = 0;
464
$this->error_prefix = '';
465
$this->allowed_extensions = array();
469
* Set allowed extensions
471
function set_allowed_extensions($allowed_extensions)
473
if ($allowed_extensions !== false && is_array($allowed_extensions))
475
$this->allowed_extensions = $allowed_extensions;
480
* Set allowed dimensions
482
function set_allowed_dimensions($min_width, $min_height, $max_width, $max_height)
484
$this->min_width = (int) $min_width;
485
$this->min_height = (int) $min_height;
486
$this->max_width = (int) $max_width;
487
$this->max_height = (int) $max_height;
491
* Set maximum allowed filesize
493
function set_max_filesize($max_filesize)
495
if ($max_filesize !== false && (int) $max_filesize)
497
$this->max_filesize = (int) $max_filesize;
504
function set_error_prefix($error_prefix)
506
$this->error_prefix = $error_prefix;
511
* Upload file from users harddisk
513
* @param string $form_name Form name assigned to the file input field (if it is an array, the key has to be specified)
514
* @return object $file Object "filespec" is returned, all further operations can be done with this object
517
function form_upload($form_name)
521
unset($_FILES[$form_name]['local_mode']);
522
$file = new filespec($_FILES[$form_name], $this);
524
if ($file->init_error)
530
// Error array filled?
531
if (isset($_FILES[$form_name]['error']))
533
$error = $this->assign_internal_error($_FILES[$form_name]['error']);
535
if ($error !== false)
537
$file->error[] = $error;
542
// Check if empty file got uploaded (not catched by is_uploaded_file)
543
if (isset($_FILES[$form_name]['size']) && $_FILES[$form_name]['size'] == 0)
545
$file->error[] = $user->lang[$this->error_prefix . 'EMPTY_FILEUPLOAD'];
549
// PHP Upload filesize exceeded
550
if ($file->get('filename') == 'none')
552
$file->error[] = (@ini_get('upload_max_filesize') == '') ? $user->lang[$this->error_prefix . 'PHP_SIZE_NA'] : sprintf($user->lang[$this->error_prefix . 'PHP_SIZE_OVERRUN'], @ini_get('upload_max_filesize'));
556
// Not correctly uploaded
557
if (!$file->is_uploaded())
559
$file->error[] = $user->lang[$this->error_prefix . 'NOT_UPLOADED'];
563
$this->common_checks($file);
569
* Move file from another location to phpBB
571
function local_upload($source_file, $filedata = false)
575
$form_name = 'local';
577
$_FILES[$form_name]['local_mode'] = true;
578
$_FILES[$form_name]['tmp_name'] = $source_file;
580
if ($filedata === false)
582
$_FILES[$form_name]['name'] = basename($source_file);
583
$_FILES[$form_name]['size'] = 0;
586
if (function_exists('mime_content_type'))
588
$mimetype = mime_content_type($source_file);
591
// Some browsers choke on a mimetype of application/octet-stream
592
if (!$mimetype || $mimetype == 'application/octet-stream')
594
$mimetype = 'application/octetstream';
597
$_FILES[$form_name]['type'] = $mimetype;
601
$_FILES[$form_name]['name'] = $filedata['realname'];
602
$_FILES[$form_name]['size'] = $filedata['size'];
603
$_FILES[$form_name]['type'] = $filedata['type'];
606
$file = new filespec($_FILES[$form_name], $this);
608
if ($file->init_error)
614
if (isset($_FILES[$form_name]['error']))
616
$error = $this->assign_internal_error($_FILES[$form_name]['error']);
618
if ($error !== false)
620
$file->error[] = $error;
625
// PHP Upload filesize exceeded
626
if ($file->get('filename') == 'none')
628
$file->error[] = (@ini_get('upload_max_filesize') == '') ? $user->lang[$this->error_prefix . 'PHP_SIZE_NA'] : sprintf($user->lang[$this->error_prefix . 'PHP_SIZE_OVERRUN'], @ini_get('upload_max_filesize'));
632
// Not correctly uploaded
633
if (!$file->is_uploaded())
635
$file->error[] = $user->lang[$this->error_prefix . 'NOT_UPLOADED'];
639
$this->common_checks($file);
645
* Remote upload method
646
* Uploads file from given url
648
* @param string $upload_url URL pointing to file to upload, for example http://www.foobar.com/example.gif
649
* @return object $file Object "filespec" is returned, all further operations can be done with this object
652
function remote_upload($upload_url)
654
global $user, $phpbb_root_path;
656
$upload_ary = array();
657
$upload_ary['local_mode'] = true;
659
if (!preg_match('#^(https?://).*?\.(' . implode('|', $this->allowed_extensions) . ')$#i', $upload_url, $match))
661
$file = new fileerror($user->lang[$this->error_prefix . 'URL_INVALID']);
665
if (empty($match[2]))
667
$file = new fileerror($user->lang[$this->error_prefix . 'URL_INVALID']);
671
$url = parse_url($upload_url);
673
$host = $url['host'];
674
$path = $url['path'];
675
$port = (!empty($url['port'])) ? (int) $url['port'] : 80;
677
$upload_ary['type'] = 'application/octet-stream';
679
$url['path'] = explode('.', $url['path']);
680
$ext = array_pop($url['path']);
682
$url['path'] = implode('', $url['path']);
683
$upload_ary['name'] = basename($url['path']) . (($ext) ? '.' . $ext : '');
684
$filename = $url['path'];
690
if (!($fsock = @fsockopen($host, $port, $errno, $errstr)))
692
$file = new fileerror($user->lang[$this->error_prefix . 'NOT_UPLOADED']);
696
// Make sure $path not beginning with /
697
if (strpos($path, '/') === 0)
699
$path = substr($path, 1);
702
fputs($fsock, 'GET /' . $path . " HTTP/1.1\r\n");
703
fputs($fsock, "HOST: " . $host . "\r\n");
704
fputs($fsock, "Connection: close\r\n\r\n");
708
while (!@feof($fsock))
712
$data .= @fread($fsock, 1024);
716
$line = @fgets($fsock, 1024);
724
if (stripos($line, 'content-type: ') !== false)
726
$upload_ary['type'] = rtrim(str_replace('content-type: ', '', strtolower($line)));
728
else if (stripos($line, '404 not found') !== false)
730
$file = new fileerror($user->lang[$this->error_prefix . 'URL_NOT_FOUND']);
740
$file = new fileerror($user->lang[$this->error_prefix . 'EMPTY_REMOTE_DATA']);
744
$tmp_path = (!@ini_get('safe_mode')) ? false : $phpbb_root_path . 'cache';
745
$filename = tempnam($tmp_path, unique_id() . '-');
747
if (!($fp = @fopen($filename, 'wb')))
749
$file = new fileerror($user->lang[$this->error_prefix . 'NOT_UPLOADED']);
753
$upload_ary['size'] = fwrite($fp, $data);
757
$upload_ary['tmp_name'] = $filename;
759
$file = new filespec($upload_ary, $this);
760
$this->common_checks($file);
766
* Assign internal error
769
function assign_internal_error($errorcode)
776
$error = (@ini_get('upload_max_filesize') == '') ? $user->lang[$this->error_prefix . 'PHP_SIZE_NA'] : sprintf($user->lang[$this->error_prefix . 'PHP_SIZE_OVERRUN'], @ini_get('upload_max_filesize'));
780
$size_lang = ($this->max_filesize >= 1048576) ? $user->lang['MB'] : (($this->max_filesize >= 1024) ? $user->lang['KB'] : $user->lang['BYTES'] );
781
$max_filesize = ($this->max_filesize >= 1048576) ? round($this->max_filesize / 1048576 * 100) / 100 : (($this->max_filesize >= 1024) ? round($this->max_filesize / 1024 * 100) / 100 : $this->max_filesize);
783
$error = sprintf($user->lang[$this->error_prefix . 'WRONG_FILESIZE'], $max_filesize, $size_lang);
787
$error = $user->lang[$this->error_prefix . 'PARTIAL_UPLOAD'];
791
$error = $user->lang[$this->error_prefix . 'NOT_UPLOADED'];
795
$error = 'Temporary folder could not be found. Please check your PHP installation.';
807
* Perform common checks
809
function common_checks(&$file)
813
// Filesize is too big or it's 0 if it was larger than the maxsize in the upload form
814
if ($this->max_filesize && ($file->get('filesize') > $this->max_filesize || $file->get('filesize') == 0))
816
$size_lang = ($this->max_filesize >= 1048576) ? $user->lang['MB'] : (($this->max_filesize >= 1024) ? $user->lang['KB'] : $user->lang['BYTES'] );
817
$max_filesize = ($this->max_filesize >= 1048576) ? round($this->max_filesize / 1048576 * 100) / 100 : (($this->max_filesize >= 1024) ? round($this->max_filesize / 1024 * 100) / 100 : $this->max_filesize);
819
$file->error[] = sprintf($user->lang[$this->error_prefix . 'WRONG_FILESIZE'], $max_filesize, $size_lang);
823
if (preg_match("#[\\/:*?\"<>|]#i", $file->get('realname')))
825
$file->error[] = sprintf($user->lang[$this->error_prefix . 'INVALID_FILENAME'], $file->get('realname'));
829
if (!$this->valid_extension($file))
831
$file->error[] = sprintf($user->lang[$this->error_prefix . 'DISALLOWED_EXTENSION'], $file->get('extension'));
836
* Check for allowed extension
838
function valid_extension(&$file)
840
return (in_array($file->get('extension'), $this->allowed_extensions)) ? true : false;
844
* Check for allowed dimension
846
function valid_dimensions(&$file)
848
if (!$this->max_width && !$this->max_height && !$this->min_width && !$this->min_height)
853
if (($file->get('width') > $this->max_width && $this->max_width) ||
854
($file->get('height') > $this->max_height && $this->max_height) ||
855
($file->get('width') < $this->min_width && $this->min_width) ||
856
($file->get('height') < $this->min_height && $this->min_height))
865
* Check if form upload is valid
867
function is_valid($form_name)
869
return (isset($_FILES[$form_name]) && $_FILES[$form_name]['name'] != 'none') ? true : false;
873
* Return image type/extension mapping
875
function image_types()
879
2 => array('jpg', 'jpeg'),
884
7 => array('tif', 'tiff'),
885
8 => array('tif', 'tiff'),
886
9 => array('jpg', 'jpeg'),
887
10 => array('jpg', 'jpeg'),
888
11 => array('jpg', 'jpeg'),
889
12 => array('jpg', 'jpeg'),
b'\\ No newline at end of file'
added
removed
www/php/phpBB3/includes/functions_upload.php
