/admin-dev/filemanager/upload.php

https://gitlab.com/jslee1/PrestaShop · PHP · 145 lines · 130 code · 13 blank · 2 comment · 44 complexity · de2c7d4a0405fc13bbf12f3dbadff328 MD5 · raw file

  1. <?php
  2. include('config/config.php');
  3. if ($_SESSION['verify'] != 'RESPONSIVEfilemanager') {
  4. die('forbiden');
  5. }
  6. include('include/utils.php');
  7. $_POST['path'] = $current_path.str_replace('\0', '', $_POST['path']);
  8. $_POST['path_thumb'] = $thumbs_base_path.str_replace("\0", '', $_POST['path_thumb']);
  9. $storeFolder = $_POST['path'];
  10. $storeFolderThumb = $_POST['path_thumb'];
  11. $path_pos = strpos($storeFolder, $current_path);
  12. $thumb_pos = strpos($_POST['path_thumb'], $thumbs_base_path);
  13. if ($path_pos === false || $thumb_pos === false
  14. || preg_match('/\.{1,2}[\/|\\\]/', $_POST['path_thumb']) !== 0
  15. || preg_match('/\.{1,2}[\/|\\\]/', $_POST['path']) !== 0) {
  16. die('wrong path');
  17. }
  18. $path = $storeFolder;
  19. $cycle = true;
  20. $max_cycles = 50;
  21. $i = 0;
  22. while ($cycle && $i < $max_cycles) {
  23. $i++;
  24. if ($path == $current_path) {
  25. $cycle = false;
  26. }
  27. if (file_exists($path.'config.php')) {
  28. require_once($path.'config.php');
  29. $cycle = false;
  30. }
  31. $path = fix_dirname($path).'/';
  32. }
  33. if (!empty($_FILES)) {
  34. $info = pathinfo($_FILES['file']['name']);
  35. if (isset($info['extension']) && in_array(fix_strtolower($info['extension']), $ext)) {
  36. $tempFile = $_FILES['file']['tmp_name'];
  37. $targetPath = $storeFolder;
  38. $targetPathThumb = $storeFolderThumb;
  39. $_FILES['file']['name'] = fix_filename($_FILES['file']['name'], $transliteration);
  40. $file_name_splitted = explode('.', $_FILES['file']['name']);
  41. array_pop($file_name_splitted);
  42. $_FILES['file']['name'] = implode('-', $file_name_splitted).'.'.$info['extension'];
  43. if (file_exists($targetPath.$_FILES['file']['name'])) {
  44. $i = 1;
  45. $info = pathinfo($_FILES['file']['name']);
  46. while (file_exists($targetPath.$info['filename'].'_'.$i.'.'.$info['extension'])) {
  47. $i++;
  48. }
  49. $_FILES['file']['name'] = $info['filename'].'_'.$i.'.'.$info['extension'];
  50. }
  51. $targetFile = $targetPath.$_FILES['file']['name'];
  52. $targetFileThumb = $targetPathThumb.$_FILES['file']['name'];
  53. if (in_array(fix_strtolower($info['extension']), $ext_img) && @getimagesize($tempFile) != false) {
  54. $is_img = true;
  55. } else {
  56. $is_img = false;
  57. }
  58. if ($is_img) {
  59. move_uploaded_file($tempFile, $targetFile);
  60. chmod($targetFile, 0755);
  61. $memory_error = false;
  62. if (!create_img_gd($targetFile, $targetFileThumb, 122, 91)) {
  63. $memory_error = false;
  64. } else {
  65. if (!new_thumbnails_creation($targetPath, $targetFile, $_FILES['file']['name'], $current_path, $relative_image_creation, $relative_path_from_current_pos, $relative_image_creation_name_to_prepend, $relative_image_creation_name_to_append, $relative_image_creation_width, $relative_image_creation_height, $fixed_image_creation, $fixed_path_from_filemanager, $fixed_image_creation_name_to_prepend, $fixed_image_creation_to_append, $fixed_image_creation_width, $fixed_image_creation_height)) {
  66. $memory_error = false;
  67. } else {
  68. $imginfo = getimagesize($targetFile);
  69. $srcWidth = $imginfo[0];
  70. $srcHeight = $imginfo[1];
  71. if ($image_resizing) {
  72. if ($image_resizing_width == 0) {
  73. if ($image_resizing_height == 0) {
  74. $image_resizing_width = $srcWidth;
  75. $image_resizing_height = $srcHeight;
  76. } else {
  77. $image_resizing_width = $image_resizing_height * $srcWidth / $srcHeight;
  78. }
  79. } elseif ($image_resizing_height == 0) {
  80. $image_resizing_height = $image_resizing_width * $srcHeight / $srcWidth;
  81. }
  82. $srcWidth = $image_resizing_width;
  83. $srcHeight = $image_resizing_height;
  84. create_img_gd($targetFile, $targetFile, $image_resizing_width, $image_resizing_height);
  85. }
  86. //max resizing limit control
  87. $resize = false;
  88. if ($image_max_width != 0 && $srcWidth > $image_max_width) {
  89. $resize = true;
  90. $srcHeight = $image_max_width * $srcHeight / $srcWidth;
  91. $srcWidth = $image_max_width;
  92. }
  93. if ($image_max_height != 0 && $srcHeight > $image_max_height) {
  94. $resize = true;
  95. $srcWidth = $image_max_height * $srcWidth / $srcHeight;
  96. $srcHeight = $image_max_height;
  97. }
  98. if ($resize) {
  99. create_img_gd($targetFile, $targetFile, $srcWidth, $srcHeight);
  100. }
  101. }
  102. }
  103. if ($memory_error) {
  104. //error
  105. unlink($targetFile);
  106. header('HTTP/1.1 406 Not enought Memory', true, 406);
  107. exit();
  108. }
  109. } else {
  110. move_uploaded_file($tempFile, $targetFile);
  111. chmod($targetFile, 0755);
  112. }
  113. } else {
  114. header('HTTP/1.1 406 file not permitted', true, 406);
  115. exit();
  116. }
  117. } else {
  118. header('HTTP/1.1 405 Bad Request', true, 405);
  119. exit();
  120. }
  121. if (isset($_POST['submit'])) {
  122. $query = http_build_query(
  123. array(
  124. 'type' => $_POST['type'],
  125. 'lang' => $_POST['lang'],
  126. 'popup' => $_POST['popup'],
  127. 'field_id' => $_POST['field_id'],
  128. 'fldr' => $_POST['fldr'],
  129. )
  130. );
  131. header('location: dialog.php?'.$query);
  132. }