PageRenderTime 99ms CodeModel.GetById 18ms RepoModel.GetById 3ms app.codeStats 1ms

/modules/storecommander/ead6f6fce09/SC/lib/js/ckeditor/kcfinder/core/class/browser.php

https://gitlab.com/ptisky/API_prestashop
PHP | 945 lines | 828 code | 78 blank | 39 comment | 151 complexity | 302023a359623bc3d67e5ee9a5c8b5e0 MD5 | raw file
  1. <?php
  2. /**
  3. * Store Commander
  4. *
  5. * @category administration
  6. * @author Store Commander - support@storecommander.com
  7. * @version 2015-09-15
  8. * @uses Prestashop modules
  9. * @since 2009
  10. * @copyright Copyright &copy; 2009-2015, Store Commander
  11. * @license commercial
  12. * All rights reserved! Copying, duplication strictly prohibited
  13. *
  14. * *****************************************
  15. * * STORE COMMANDER *
  16. * * http://www.StoreCommander.com *
  17. * * V 2015-09-15 *
  18. * *****************************************
  19. *
  20. * Compatibility: PS version: 1.1 to 1.6.1
  21. *
  22. **/
  23. /** This file is part of KCFinder project
  24. *
  25. * @desc Browser actions class
  26. * @package KCFinder
  27. * @version 3.12
  28. * @author Pavel Tzonkov <sunhater@sunhater.com>
  29. * @copyright 2010-2014 KCFinder Project
  30. * @license http://opensource.org/licenses/GPL-3.0 GPLv3
  31. * @license http://opensource.org/licenses/LGPL-3.0 LGPLv3
  32. * @link http://kcfinder.sunhater.com
  33. */
  34. namespace kcfinder;
  35. class browser extends uploader {
  36. protected $action;
  37. protected $thumbsDir;
  38. protected $thumbsTypeDir;
  39. public function __construct() {
  40. parent::__construct();
  41. // SECURITY CHECK INPUT DIRECTORY
  42. if (isset($_POST['dir'])) {
  43. $dir = $this->checkInputDir($_POST['dir'], true, true);
  44. if ($dir === false) unset($_POST['dir']);
  45. $_POST['dir'] = $dir;
  46. }
  47. if (isset($_GET['dir'])) {
  48. $dir = $this->checkInputDir($_GET['dir'], true, true);
  49. if ($dir === false) unset($_GET['dir']);
  50. $_GET['dir'] = $dir;
  51. }
  52. $thumbsDir = $this->config['uploadDir'] . "/" . $this->config['thumbsDir'];
  53. if (!$this->config['disabled'] &&
  54. (
  55. (
  56. !is_dir($thumbsDir) &&
  57. !@mkdir($thumbsDir, $this->config['dirPerms'])
  58. ) ||
  59. !is_readable($thumbsDir) ||
  60. !dir::isWritable($thumbsDir) ||
  61. (
  62. !is_dir("$thumbsDir/{$this->type}") &&
  63. !@mkdir("$thumbsDir/{$this->type}", $this->config['dirPerms'])
  64. )
  65. )
  66. )
  67. $this->errorMsg("Cannot access or create thumbnails folder.");
  68. $this->thumbsDir = $thumbsDir;
  69. $this->thumbsTypeDir = "$thumbsDir/{$this->type}";
  70. // Remove temporary zip downloads if exists
  71. if (!$this->config['disabled']) {
  72. $files = dir::content($this->config['uploadDir'], array(
  73. 'types' => "file",
  74. 'pattern' => '/^.*\.zip$/i'
  75. ));
  76. if (is_array($files) && count($files)) {
  77. $time = time();
  78. foreach ($files as $file)
  79. if (is_file($file) && ($time - filemtime($file) > 3600))
  80. unlink($file);
  81. }
  82. }
  83. if (isset($_GET['theme']) &&
  84. $this->checkFilename($_GET['theme']) &&
  85. is_dir("themes/{$_GET['theme']}")
  86. )
  87. $this->config['theme'] = $_GET['theme'];
  88. }
  89. public function action() {
  90. $act = isset($_GET['act']) ? $_GET['act'] : "browser";
  91. if (!method_exists($this, "act_$act"))
  92. $act = "browser";
  93. $this->action = $act;
  94. $method = "act_$act";
  95. if ($this->config['disabled']) {
  96. $message = $this->label("You don't have permissions to browse server.");
  97. if (in_array($act, array("browser", "upload")) ||
  98. (substr($act, 0, 8) == "download")
  99. )
  100. $this->backMsg($message);
  101. else {
  102. header("Content-Type: text/plain; charset={$this->charset}");
  103. die(json_encode(array('error' => $message)));
  104. }
  105. }
  106. if (!isset($this->session['dir']))
  107. $this->session['dir'] = $this->type;
  108. else {
  109. $type = $this->getTypeFromPath($this->session['dir']);
  110. $dir = $this->config['uploadDir'] . "/" . $this->session['dir'];
  111. if (($type != $this->type) || !is_dir($dir) || !is_readable($dir))
  112. $this->session['dir'] = $this->type;
  113. }
  114. $this->session['dir'] = path::normalize($this->session['dir']);
  115. // Render the browser
  116. if ($act == "browser") {
  117. header("X-UA-Compatible: chrome=1");
  118. header("Content-Type: text/html; charset={$this->charset}");
  119. // Ajax requests
  120. } elseif (
  121. (substr($act, 0, 8) != "download") &&
  122. !in_array($act, array("thumb", "upload"))
  123. )
  124. header("Content-Type: text/plain; charset={$this->charset}");
  125. $return = $this->$method();
  126. echo ($return === true)
  127. ? '{}'
  128. : $return;
  129. }
  130. protected function act_browser() {
  131. if (isset($_GET['dir'])) {
  132. $dir = "{$this->typeDir}/{$_GET['dir']}";
  133. if ($this->checkFilePath($dir) && is_dir($dir) && is_readable($dir))
  134. $this->session['dir'] = path::normalize("{$this->type}/{$_GET['dir']}");
  135. }
  136. return $this->output();
  137. }
  138. protected function act_init() {
  139. $tree = $this->getDirInfo($this->typeDir);
  140. $tree['dirs'] = $this->getTree($this->session['dir']);
  141. if (!is_array($tree['dirs']) || !count($tree['dirs']))
  142. unset($tree['dirs']);
  143. $files = $this->getFiles($this->session['dir']);
  144. $dirWritable = dir::isWritable("{$this->config['uploadDir']}/{$this->session['dir']}");
  145. $data = array(
  146. 'tree' => &$tree,
  147. 'files' => &$files,
  148. 'dirWritable' => $dirWritable
  149. );
  150. return json_encode($data);
  151. }
  152. protected function act_thumb() {
  153. if (!isset($_GET['file']) ||
  154. !isset($_GET['dir']) ||
  155. !$this->checkFilename($_GET['file'])
  156. )
  157. $this->sendDefaultThumb();
  158. $dir = $this->getDir();
  159. $file = "{$this->thumbsTypeDir}/{$_GET['dir']}/${_GET['file']}";
  160. // Create thumbnail
  161. if (!is_file($file) || !is_readable($file)) {
  162. $file = "$dir/{$_GET['file']}";
  163. if (!is_file($file) || !is_readable($file))
  164. $this->sendDefaultThumb($file);
  165. $image = image::factory($this->imageDriver, $file);
  166. if ($image->initError)
  167. $this->sendDefaultThumb($file);
  168. $img = new fastImage($file);
  169. $type = $img->getType();
  170. $img->close();
  171. if (in_array($type, array("gif", "jpeg", "png")) &&
  172. ($image->width <= $this->config['thumbWidth']) &&
  173. ($image->height <= $this->config['thumbHeight'])
  174. ) {
  175. $mime = "image/$type";
  176. httpCache::file($file, $mime);
  177. } else
  178. $this->sendDefaultThumb($file);
  179. // Get type from already-existing thumbnail
  180. } else {
  181. $img = new fastImage($file);
  182. $type = $img->getType();
  183. $img->close();
  184. }
  185. httpCache::file($file, "image/$type");
  186. }
  187. protected function act_expand() {
  188. return json_encode(array('dirs' => $this->getDirs($this->postDir())));
  189. }
  190. protected function act_chDir() {
  191. $this->postDir(); // Just for existing check
  192. $this->session['dir'] = "{$this->type}/{$_POST['dir']}";
  193. $dirWritable = dir::isWritable("{$this->config['uploadDir']}/{$this->session['dir']}");
  194. return json_encode(array(
  195. 'files' => $this->getFiles($this->session['dir']),
  196. 'dirWritable' => $dirWritable
  197. ));
  198. }
  199. protected function act_newDir() {
  200. if (!$this->config['access']['dirs']['create'] ||
  201. !isset($_POST['dir']) ||
  202. !isset($_POST['newDir']) ||
  203. !$this->checkFilename($_POST['newDir'])
  204. )
  205. $this->errorMsg("Unknown error.");
  206. $dir = $this->postDir();
  207. $newDir = $this->normalizeDirname(trim($_POST['newDir']));
  208. if (!strlen($newDir))
  209. $this->errorMsg("Please enter new folder name.");
  210. if (preg_match('/[\/\\\\]/s', $newDir))
  211. $this->errorMsg("Unallowable characters in folder name.");
  212. if (substr($newDir, 0, 1) == ".")
  213. $this->errorMsg("Folder name shouldn't begins with '.'");
  214. if (file_exists("$dir/$newDir"))
  215. $this->errorMsg("A file or folder with that name already exists.");
  216. if (!@mkdir("$dir/$newDir", $this->config['dirPerms']))
  217. $this->errorMsg("Cannot create {dir} folder.", array('dir' => $this->htmlData($newDir)));
  218. return true;
  219. }
  220. protected function act_renameDir() {
  221. if (!$this->config['access']['dirs']['rename'] ||
  222. !isset($_POST['dir']) ||
  223. !strlen(rtrim(rtrim(trim($_POST['dir']), "/"), "\\")) ||
  224. !isset($_POST['newName']) ||
  225. !$this->checkFilename($_POST['newName'])
  226. )
  227. $this->errorMsg("Unknown error.");
  228. $dir = $this->postDir();
  229. $newName = $this->normalizeDirname(trim($_POST['newName']));
  230. if (!strlen($newName))
  231. $this->errorMsg("Please enter new folder name.");
  232. if (preg_match('/[\/\\\\]/s', $newName))
  233. $this->errorMsg("Unallowable characters in folder name.");
  234. if (substr($newName, 0, 1) == ".")
  235. $this->errorMsg("Folder name shouldn't begins with '.'");
  236. if (!@rename($dir, dirname($dir) . "/$newName"))
  237. $this->errorMsg("Cannot rename the folder.");
  238. $thumbDir = "$this->thumbsTypeDir/{$_POST['dir']}";
  239. if (is_dir($thumbDir))
  240. @rename($thumbDir, dirname($thumbDir) . "/$newName");
  241. return json_encode(array('name' => $newName));
  242. }
  243. protected function act_deleteDir() {
  244. if (!$this->config['access']['dirs']['delete'] ||
  245. !isset($_POST['dir']) ||
  246. !strlen(rtrim(rtrim(trim($_POST['dir']), "/"), "\\"))
  247. )
  248. $this->errorMsg("Unknown error.");
  249. $dir = $this->postDir();
  250. if (!dir::isWritable($dir))
  251. $this->errorMsg("Cannot delete the folder.");
  252. $result = !dir::prune($dir, false);
  253. if (is_array($result) && count($result))
  254. $this->errorMsg("Failed to delete {count} files/folders.",
  255. array('count' => count($result)));
  256. $thumbDir = "$this->thumbsTypeDir/{$_POST['dir']}";
  257. if (is_dir($thumbDir)) dir::prune($thumbDir);
  258. return true;
  259. }
  260. protected function act_upload() {
  261. header("Content-Type: text/plain; charset={$this->charset}");
  262. if (!$this->config['access']['files']['upload'] ||
  263. !isset($_POST['dir'])
  264. )
  265. $this->errorMsg("Unknown error.");
  266. $dir = $this->postDir();
  267. if (!dir::isWritable($dir))
  268. $this->errorMsg("Cannot access or write to upload folder.");
  269. if (is_array($this->file['name'])) {
  270. $return = array();
  271. foreach ($this->file['name'] as $i => $name) {
  272. $return[] = $this->moveUploadFile(array(
  273. 'name' => $name,
  274. 'tmp_name' => $this->file['tmp_name'][$i],
  275. 'error' => $this->file['error'][$i]
  276. ), $dir);
  277. }
  278. return implode("\n", $return);
  279. } else
  280. return $this->moveUploadFile($this->file, $dir);
  281. }
  282. protected function act_download() {
  283. $dir = $this->postDir();
  284. if (!isset($_POST['dir']) ||
  285. !isset($_POST['file']) ||
  286. !$this->checkFilename($_POST['file']) ||
  287. (false === ($file = "$dir/{$_POST['file']}")) ||
  288. !file_exists($file) || !is_readable($file)
  289. )
  290. $this->errorMsg("Unknown error.");
  291. header("Pragma: public");
  292. header("Expires: 0");
  293. header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
  294. header("Cache-Control: private", false);
  295. header("Content-Type: application/octet-stream");
  296. header('Content-Disposition: attachment; filename="' . str_replace('"', "_", $_POST['file']) . '"');
  297. header("Content-Transfer-Encoding: binary");
  298. header("Content-Length: " . filesize($file));
  299. readfile($file);
  300. die;
  301. }
  302. protected function act_rename() {
  303. $dir = $this->postDir();
  304. if (!$this->config['access']['files']['rename'] ||
  305. !isset($_POST['dir']) ||
  306. !isset($_POST['file']) ||
  307. !isset($_POST['newName']) ||
  308. !$this->checkFilename($_POST['file']) ||
  309. !$this->checkFilename($_POST['newName']) ||
  310. (false === ($file = "$dir/{$_POST['file']}")) ||
  311. !file_exists($file) || !is_readable($file) || !file::isWritable($file)
  312. )
  313. $this->errorMsg("Unknown error.");
  314. if (isset($this->config['denyExtensionRename']) &&
  315. $this->config['denyExtensionRename'] &&
  316. (file::getExtension($_POST['file'], true) !==
  317. file::getExtension($_POST['newName'], true)
  318. )
  319. )
  320. $this->errorMsg("You cannot rename the extension of files!");
  321. $newName = $this->normalizeFilename(trim($_POST['newName']));
  322. if (!strlen($newName))
  323. $this->errorMsg("Please enter new file name.");
  324. if (preg_match('/[\/\\\\]/s', $newName))
  325. $this->errorMsg("Unallowable characters in file name.");
  326. if (substr($newName, 0, 1) == ".")
  327. $this->errorMsg("File name shouldn't begins with '.'");
  328. $newName = "$dir/$newName";
  329. if (file_exists($newName))
  330. $this->errorMsg("A file or folder with that name already exists.");
  331. $ext = file::getExtension($newName);
  332. if (!$this->validateExtension($ext, $this->type))
  333. $this->errorMsg("Denied file extension.");
  334. if (!@rename($file, $newName))
  335. $this->errorMsg("Unknown error.");
  336. $thumbDir = "{$this->thumbsTypeDir}/{$_POST['dir']}";
  337. $thumbFile = "$thumbDir/{$_POST['file']}";
  338. if (file_exists($thumbFile))
  339. @rename($thumbFile, "$thumbDir/" . basename($newName));
  340. return true;
  341. }
  342. protected function act_delete() {
  343. $dir = $this->postDir();
  344. if (!$this->config['access']['files']['delete'] ||
  345. !isset($_POST['dir']) ||
  346. !isset($_POST['file']) ||
  347. !$this->checkFilename($_POST['file']) ||
  348. (false === ($file = "$dir/{$_POST['file']}")) ||
  349. !file_exists($file) || !is_readable($file) || !file::isWritable($file) ||
  350. !@unlink($file)
  351. )
  352. $this->errorMsg("Unknown error.");
  353. $thumb = "{$this->thumbsTypeDir}/{$_POST['dir']}/{$_POST['file']}";
  354. if (file_exists($thumb)) @unlink($thumb);
  355. return true;
  356. }
  357. protected function act_cp_cbd() {
  358. $dir = $this->postDir();
  359. if (!$this->config['access']['files']['copy'] ||
  360. !isset($_POST['dir']) ||
  361. !is_dir($dir) || !is_readable($dir) || !dir::isWritable($dir) ||
  362. !isset($_POST['files']) || !is_array($_POST['files']) ||
  363. !count($_POST['files'])
  364. )
  365. $this->errorMsg("Unknown error.");
  366. $error = array();
  367. foreach($_POST['files'] as $file) {
  368. $file = path::normalize($file);
  369. if (substr($file, 0, 1) == ".") continue;
  370. $type = explode("/", $file);
  371. $type = $type[0];
  372. if ($type != $this->type) continue;
  373. $path = "{$this->config['uploadDir']}/$file";
  374. if (!$this->checkFilePath($path)) continue;
  375. $base = basename($file);
  376. $replace = array('file' => $this->htmlData($base));
  377. $ext = file::getExtension($base);
  378. if (!file_exists($path))
  379. $error[] = $this->label("The file '{file}' does not exist.", $replace);
  380. elseif (substr($base, 0, 1) == ".")
  381. $error[] = $this->htmlData($base) . ": " . $this->label("File name shouldn't begins with '.'");
  382. elseif (!$this->validateExtension($ext, $type))
  383. $error[] = $this->htmlData($base) . ": " . $this->label("Denied file extension.");
  384. elseif (file_exists("$dir/$base"))
  385. $error[] = $this->htmlData($base) . ": " . $this->label("A file or folder with that name already exists.");
  386. elseif (!is_readable($path) || !is_file($path))
  387. $error[] = $this->label("Cannot read '{file}'.", $replace);
  388. elseif (!@copy($path, "$dir/$base"))
  389. $error[] = $this->label("Cannot copy '{file}'.", $replace);
  390. else {
  391. if (function_exists("chmod"))
  392. @chmod("$dir/$base", $this->config['filePerms']);
  393. $fromThumb = "{$this->thumbsDir}/$file";
  394. if (is_file($fromThumb) && is_readable($fromThumb)) {
  395. $toThumb = "{$this->thumbsTypeDir}/{$_POST['dir']}";
  396. if (!is_dir($toThumb))
  397. @mkdir($toThumb, $this->config['dirPerms'], true);
  398. $toThumb .= "/$base";
  399. @copy($fromThumb, $toThumb);
  400. }
  401. }
  402. }
  403. if (count($error))
  404. return json_encode(array('error' => $error));
  405. return true;
  406. }
  407. protected function act_mv_cbd() {
  408. $dir = $this->postDir();
  409. if (!$this->config['access']['files']['move'] ||
  410. !isset($_POST['dir']) ||
  411. !is_dir($dir) || !is_readable($dir) || !dir::isWritable($dir) ||
  412. !isset($_POST['files']) || !is_array($_POST['files']) ||
  413. !count($_POST['files'])
  414. )
  415. $this->errorMsg("Unknown error.");
  416. $error = array();
  417. foreach($_POST['files'] as $file) {
  418. $file = path::normalize($file);
  419. if (substr($file, 0, 1) == ".") continue;
  420. $type = explode("/", $file);
  421. $type = $type[0];
  422. if ($type != $this->type) continue;
  423. $path = "{$this->config['uploadDir']}/$file";
  424. if (!$this->checkFilePath($path)) continue;
  425. $base = basename($file);
  426. $replace = array('file' => $this->htmlData($base));
  427. $ext = file::getExtension($base);
  428. if (!file_exists($path))
  429. $error[] = $this->label("The file '{file}' does not exist.", $replace);
  430. elseif (substr($base, 0, 1) == ".")
  431. $error[] = $this->htmlData($base) . ": " . $this->label("File name shouldn't begins with '.'");
  432. elseif (!$this->validateExtension($ext, $type))
  433. $error[] = $this->htmlData($base) . ": " . $this->label("Denied file extension.");
  434. elseif (file_exists("$dir/$base"))
  435. $error[] = $this->htmlData($base) . ": " . $this->label("A file or folder with that name already exists.");
  436. elseif (!is_readable($path) || !is_file($path))
  437. $error[] = $this->label("Cannot read '{file}'.", $replace);
  438. elseif (!file::isWritable($path) || !@rename($path, "$dir/$base"))
  439. $error[] = $this->label("Cannot move '{file}'.", $replace);
  440. else {
  441. if (function_exists("chmod"))
  442. @chmod("$dir/$base", $this->config['filePerms']);
  443. $fromThumb = "{$this->thumbsDir}/$file";
  444. if (is_file($fromThumb) && is_readable($fromThumb)) {
  445. $toThumb = "{$this->thumbsTypeDir}/{$_POST['dir']}";
  446. if (!is_dir($toThumb))
  447. @mkdir($toThumb, $this->config['dirPerms'], true);
  448. $toThumb .= "/$base";
  449. @rename($fromThumb, $toThumb);
  450. }
  451. }
  452. }
  453. if (count($error))
  454. return json_encode(array('error' => $error));
  455. return true;
  456. }
  457. protected function act_rm_cbd() {
  458. if (!$this->config['access']['files']['delete'] ||
  459. !isset($_POST['files']) ||
  460. !is_array($_POST['files']) ||
  461. !count($_POST['files'])
  462. )
  463. $this->errorMsg("Unknown error.");
  464. $error = array();
  465. foreach($_POST['files'] as $file) {
  466. $file = path::normalize($file);
  467. if (substr($file, 0, 1) == ".") continue;
  468. $type = explode("/", $file);
  469. $type = $type[0];
  470. if ($type != $this->type) continue;
  471. $path = "{$this->config['uploadDir']}/$file";
  472. if (!$this->checkFilePath($path)) continue;
  473. $base = basename($file);
  474. $replace = array('file' => $this->htmlData($base));
  475. if (!is_file($path))
  476. $error[] = $this->label("The file '{file}' does not exist.", $replace);
  477. elseif (!@unlink($path))
  478. $error[] = $this->label("Cannot delete '{file}'.", $replace);
  479. else {
  480. $thumb = "{$this->thumbsDir}/$file";
  481. if (is_file($thumb)) @unlink($thumb);
  482. }
  483. }
  484. if (count($error))
  485. return json_encode(array('error' => $error));
  486. return true;
  487. }
  488. protected function act_downloadDir() {
  489. $dir = $this->postDir();
  490. if (!isset($_POST['dir']) || $this->config['denyZipDownload'])
  491. $this->errorMsg("Unknown error.");
  492. $filename = basename($dir) . ".zip";
  493. do {
  494. $file = md5(time() . session_id());
  495. $file = "{$this->config['uploadDir']}/$file.zip";
  496. } while (file_exists($file));
  497. new zipFolder($file, $dir);
  498. header("Content-Type: application/x-zip");
  499. header('Content-Disposition: attachment; filename="' . str_replace('"', "_", $filename) . '"');
  500. header("Content-Length: " . filesize($file));
  501. readfile($file);
  502. unlink($file);
  503. die;
  504. }
  505. protected function act_downloadSelected() {
  506. $dir = $this->postDir();
  507. if (!isset($_POST['dir']) ||
  508. !isset($_POST['files']) ||
  509. !is_array($_POST['files']) ||
  510. $this->config['denyZipDownload']
  511. )
  512. $this->errorMsg("Unknown error.");
  513. $zipFiles = array();
  514. foreach ($_POST['files'] as $file) {
  515. $file = path::normalize($file);
  516. if ((substr($file, 0, 1) == ".") || (strpos($file, '/') !== false))
  517. continue;
  518. $file = "$dir/$file";
  519. if (!is_file($file) || !is_readable($file) || !$this->checkFilePath($file))
  520. continue;
  521. $zipFiles[] = $file;
  522. }
  523. do {
  524. $file = md5(time() . session_id());
  525. $file = "{$this->config['uploadDir']}/$file.zip";
  526. } while (file_exists($file));
  527. $zip = new \ZipArchive();
  528. $res = $zip->open($file, \ZipArchive::CREATE);
  529. if ($res === TRUE) {
  530. foreach ($zipFiles as $cfile)
  531. $zip->addFile($cfile, basename($cfile));
  532. $zip->close();
  533. }
  534. header("Content-Type: application/x-zip");
  535. header('Content-Disposition: attachment; filename="selected_files_' . basename($file) . '"');
  536. header("Content-Length: " . filesize($file));
  537. readfile($file);
  538. unlink($file);
  539. die;
  540. }
  541. protected function act_downloadClipboard() {
  542. if (!isset($_POST['files']) ||
  543. !is_array($_POST['files']) ||
  544. $this->config['denyZipDownload']
  545. )
  546. $this->errorMsg("Unknown error.");
  547. $zipFiles = array();
  548. foreach ($_POST['files'] as $file) {
  549. $file = path::normalize($file);
  550. if ((substr($file, 0, 1) == "."))
  551. continue;
  552. $type = explode("/", $file);
  553. $type = $type[0];
  554. if ($type != $this->type)
  555. continue;
  556. $file = $this->config['uploadDir'] . "/$file";
  557. if (!is_file($file) || !is_readable($file) || !$this->checkFilePath($file))
  558. continue;
  559. $zipFiles[] = $file;
  560. }
  561. do {
  562. $file = md5(time() . session_id());
  563. $file = "{$this->config['uploadDir']}/$file.zip";
  564. } while (file_exists($file));
  565. $zip = new \ZipArchive();
  566. $res = $zip->open($file, \ZipArchive::CREATE);
  567. if ($res === TRUE) {
  568. foreach ($zipFiles as $cfile)
  569. $zip->addFile($cfile, basename($cfile));
  570. $zip->close();
  571. }
  572. header("Content-Type: application/x-zip");
  573. header('Content-Disposition: attachment; filename="clipboard_' . basename($file) . '"');
  574. header("Content-Length: " . filesize($file));
  575. readfile($file);
  576. unlink($file);
  577. die;
  578. }
  579. protected function act_check4Update() {
  580. if ($this->config['denyUpdateCheck'])
  581. return json_encode(array('version' => false));
  582. // Caching HTTP request for 6 hours
  583. if (isset($this->session['checkVersion']) &&
  584. isset($this->session['checkVersionTime']) &&
  585. ((time() - $this->session['checkVersionTime']) < 21600)
  586. )
  587. return json_encode(array('version' => $this->session['checkVersion']));
  588. $protocol = "http";
  589. $host = "kcfinder.sunhater.com";
  590. $port = 80;
  591. $path = "/checkVersion.php";
  592. $url = "$protocol://$host:$port$path";
  593. $pattern = '/^\d+\.\d+$/';
  594. $responsePattern = '/^[A-Z]+\/\d+\.\d+\s+\d+\s+OK\s*([a-zA-Z0-9\-]+\:\s*[^\n]*\n)*\s*(.*)\s*$/';
  595. // file_get_contents()
  596. if (ini_get("allow_url_fopen") &&
  597. (false !== ($ver = file_get_contents($url))) &&
  598. preg_match($pattern, $ver)
  599. // HTTP extension
  600. ) {} elseif (
  601. function_exists("http_get") &&
  602. (false !== ($ver = @http_get($url))) &&
  603. (
  604. (
  605. preg_match($responsePattern, $ver, $match) &&
  606. false !== ($ver = $match[2])
  607. ) || true
  608. ) &&
  609. preg_match($pattern, $ver)
  610. // Curl extension
  611. ) {} elseif (
  612. function_exists("curl_init") &&
  613. (false !== ( $curl = @curl_init($url) )) &&
  614. ( @ob_start() || (@curl_close($curl) && false)) &&
  615. ( @curl_exec($curl) || (@curl_close($curl) && false)) &&
  616. ((false !== ( $ver = @ob_get_clean() )) || (@curl_close($curl) && false)) &&
  617. ( @curl_close($curl) || true ) &&
  618. preg_match($pattern, $ver)
  619. // Socket extension
  620. ) {} elseif (function_exists('socket_create')) {
  621. $cmd =
  622. "GET $path " . strtoupper($protocol) . "/1.1\r\n" .
  623. "Host: $host\r\n" .
  624. "Connection: Close\r\n\r\n";
  625. if ((false !== ( $socket = @socket_create(AF_INET, SOCK_STREAM, SOL_TCP) )) &&
  626. (false !== @socket_connect($socket, $host, $port) ) &&
  627. (false !== @socket_write($socket, $cmd, strlen($cmd)) ) &&
  628. (false !== ( $ver = @socket_read($socket, 2048) )) &&
  629. preg_match($responsePattern, $ver, $match)
  630. )
  631. $ver = $match[2];
  632. if (isset($socket) && is_resource($socket))
  633. @socket_close($socket);
  634. }
  635. if (isset($ver) && preg_match($pattern, $ver)) {
  636. $this->session['checkVersion'] = $ver;
  637. $this->session['checkVersionTime'] = time();
  638. return json_encode(array('version' => $ver));
  639. } else
  640. return json_encode(array('version' => false));
  641. }
  642. protected function moveUploadFile($file, $dir) {
  643. $message = $this->checkUploadedFile($file);
  644. if ($message !== true) {
  645. if (isset($file['tmp_name']))
  646. @unlink($file['tmp_name']);
  647. return "{$file['name']}: $message";
  648. }
  649. $filename = $this->normalizeFilename($file['name']);
  650. $target = "$dir/" . file::getInexistantFilename($filename, $dir);
  651. if (!@move_uploaded_file($file['tmp_name'], $target) &&
  652. !@rename($file['tmp_name'], $target) &&
  653. !@copy($file['tmp_name'], $target)
  654. ) {
  655. @unlink($file['tmp_name']);
  656. return $this->htmlData($file['name']) . ": " . $this->label("Cannot move uploaded file to target folder.");
  657. } elseif (function_exists('chmod'))
  658. chmod($target, $this->config['filePerms']);
  659. $this->makeThumb($target);
  660. return "/" . basename($target);
  661. }
  662. protected function sendDefaultThumb($file=null) {
  663. if ($file !== null) {
  664. $ext = file::getExtension($file);
  665. $thumb = "themes/{$this->config['theme']}/img/files/big/$ext.png";
  666. }
  667. if (!isset($thumb) || !file_exists($thumb))
  668. $thumb = "themes/{$this->config['theme']}/img/files/big/..png";
  669. header("Content-Type: image/png");
  670. readfile($thumb);
  671. die;
  672. }
  673. protected function getFiles($dir) {
  674. $thumbDir = "{$this->config['uploadDir']}/{$this->config['thumbsDir']}/$dir";
  675. $dir = "{$this->config['uploadDir']}/$dir";
  676. $return = array();
  677. $files = dir::content($dir, array('types' => "file"));
  678. if ($files === false)
  679. return $return;
  680. foreach ($files as $file) {
  681. $img = new fastImage($file);
  682. $type = $img->getType();
  683. if ($type !== false) {
  684. $size = $img->getSize($file);
  685. if (is_array($size) && count($size)) {
  686. $thumb_file = "$thumbDir/" . basename($file);
  687. if (!is_file($thumb_file))
  688. $this->makeThumb($file, false);
  689. $smallThumb =
  690. ($size[0] <= $this->config['thumbWidth']) &&
  691. ($size[1] <= $this->config['thumbHeight']) &&
  692. in_array($type, array("gif", "jpeg", "png"));
  693. } else
  694. $smallThumb = false;
  695. } else
  696. $smallThumb = false;
  697. $img->close();
  698. $stat = stat($file);
  699. if ($stat === false) continue;
  700. $name = basename($file);
  701. $ext = file::getExtension($file);
  702. $bigIcon = file_exists("themes/{$this->config['theme']}/img/files/big/$ext.png");
  703. $smallIcon = file_exists("themes/{$this->config['theme']}/img/files/small/$ext.png");
  704. $thumb = file_exists("$thumbDir/$name");
  705. $return[] = array(
  706. 'name' => stripcslashes($name),
  707. 'size' => $stat['size'],
  708. 'mtime' => $stat['mtime'],
  709. 'date' => @strftime($this->dateTimeSmall, $stat['mtime']),
  710. 'readable' => is_readable($file),
  711. 'writable' => file::isWritable($file),
  712. 'bigIcon' => $bigIcon,
  713. 'smallIcon' => $smallIcon,
  714. 'thumb' => $thumb,
  715. 'smallThumb' => $smallThumb
  716. );
  717. }
  718. return $return;
  719. }
  720. protected function getTree($dir, $index=0) {
  721. $path = explode("/", $dir);
  722. $pdir = "";
  723. for ($i = 0; ($i <= $index && $i < count($path)); $i++)
  724. $pdir .= "/{$path[$i]}";
  725. if (strlen($pdir))
  726. $pdir = substr($pdir, 1);
  727. $fdir = "{$this->config['uploadDir']}/$pdir";
  728. $dirs = $this->getDirs($fdir);
  729. if (is_array($dirs) && count($dirs) && ($index <= count($path) - 1)) {
  730. foreach ($dirs as $i => $cdir) {
  731. if ($cdir['hasDirs'] &&
  732. (
  733. ($index == count($path) - 1) ||
  734. ($cdir['name'] == $path[$index + 1])
  735. )
  736. ) {
  737. $dirs[$i]['dirs'] = $this->getTree($dir, $index + 1);
  738. if (!is_array($dirs[$i]['dirs']) || !count($dirs[$i]['dirs'])) {
  739. unset($dirs[$i]['dirs']);
  740. continue;
  741. }
  742. }
  743. }
  744. } else
  745. return false;
  746. return $dirs;
  747. }
  748. protected function postDir($existent=true) {
  749. $dir = $this->typeDir;
  750. if (isset($_POST['dir']))
  751. $dir .= "/" . $_POST['dir'];
  752. if (!$this->checkFilePath($dir))
  753. $this->errorMsg("Unknown error.");
  754. if ($existent && (!is_dir($dir) || !is_readable($dir)))
  755. $this->errorMsg("Inexistant or inaccessible folder.");
  756. return $dir;
  757. }
  758. protected function getDir($existent=true) {
  759. $dir = $this->typeDir;
  760. if (isset($_GET['dir']))
  761. $dir .= "/" . $_GET['dir'];
  762. if (!$this->checkFilePath($dir))
  763. $this->errorMsg("Unknown error.");
  764. if ($existent && (!is_dir($dir) || !is_readable($dir)))
  765. $this->errorMsg("Inexistant or inaccessible folder.");
  766. return $dir;
  767. }
  768. protected function getDirs($dir) {
  769. $dirs = dir::content($dir, array('types' => "dir"));
  770. $return = array();
  771. if (is_array($dirs)) {
  772. $writable = dir::isWritable($dir);
  773. foreach ($dirs as $cdir) {
  774. $info = $this->getDirInfo($cdir);
  775. if ($info === false) continue;
  776. $info['removable'] = $writable && $info['writable'];
  777. $return[] = $info;
  778. }
  779. }
  780. return $return;
  781. }
  782. protected function getDirInfo($dir, $removable=false) {
  783. if ((substr(basename($dir), 0, 1) == ".") || !is_dir($dir) || !is_readable($dir))
  784. return false;
  785. $dirs = dir::content($dir, array('types' => "dir"));
  786. if (is_array($dirs)) {
  787. foreach ($dirs as $key => $cdir)
  788. if (substr(basename($cdir), 0, 1) == ".")
  789. unset($dirs[$key]);
  790. $hasDirs = count($dirs) ? true : false;
  791. } else
  792. $hasDirs = false;
  793. $writable = dir::isWritable($dir);
  794. $info = array(
  795. 'name' => stripslashes(basename($dir)),
  796. 'readable' => is_readable($dir),
  797. 'writable' => $writable,
  798. 'removable' => $removable && $writable && dir::isWritable(dirname($dir)),
  799. 'hasDirs' => $hasDirs
  800. );
  801. if ($dir == "{$this->config['uploadDir']}/{$this->session['dir']}")
  802. $info['current'] = true;
  803. return $info;
  804. }
  805. protected function output($data=null, $template=null) {
  806. if (!is_array($data)) $data = array();
  807. if ($template === null)
  808. $template = $this->action;
  809. if (file_exists("tpl/tpl_$template.php")) {
  810. ob_start();
  811. $eval = "unset(\$data);unset(\$template);unset(\$eval);";
  812. $_ = $data;
  813. foreach (array_keys($data) as $key)
  814. if (preg_match('/^[a-z\d_]+$/i', $key))
  815. $eval .= "\$$key=\$_['$key'];";
  816. $eval .= "unset(\$_);require \"tpl/tpl_$template.php\";";
  817. eval($eval);
  818. return ob_get_clean();
  819. }
  820. return "";
  821. }
  822. protected function errorMsg($message, array $data=null) {
  823. if (in_array($this->action, array("thumb", "upload", "download", "downloadDir")))
  824. die($this->label($message, $data));
  825. if (($this->action === null) || ($this->action == "browser"))
  826. $this->backMsg($message, $data);
  827. else {
  828. $message = $this->label($message, $data);
  829. die(json_encode(array('error' => $message)));
  830. }
  831. }
  832. protected function htmlData($str) {
  833. return htmlentities($str, null, strtoupper($this->charset));
  834. }
  835. }
  836. ?>