tools/filemanager/upload.php

   1 <?php
   2 /****************************************************************/
   3 /* ATutor                                                                                                               */
   4 /****************************************************************/
   5 /* Copyright (c) 2002-2008 by Greg Gay & Joel Kronenberg        */
   6 /* Adaptive Technology Resource Centre / University of Toronto  */
   7 /* http://atutor.ca                                                                                             */
   8 /*                                                              */
   9 /* This program is free software. You can redistribute it and/or*/
  10 /* modify it under the terms of the GNU General Public License  */
  11 /* as published by the Free Software Foundation.                                */
  12 /****************************************************************/
  13 // $Id$
  14
  15 define('AT_INCLUDE_PATH', '../../include/');
  16 require(AT_INCLUDE_PATH.'vitals.inc.php');
  17 require(AT_INCLUDE_PATH.'lib/filemanager.inc.php');
  18
  19 if (!authenticate(AT_PRIV_FILES,AT_PRIV_RETURN)) {
  20         authenticate(AT_PRIV_CONTENT);
  21 }
  22
  23 $_SESSION['done'] = 1;
  24 $popup = $_REQUEST['popup'];
  25 $framed = $_REQUEST['framed'];
  26 $alter = $_REQUEST['alter'];
  27
  28 //echo $_REQUEST['cid'];
  29 //echo $_REQUEST['tab'];
  30
  31 //echo $alter;
  32
  33 /* get this courses MaxQuota and MaxFileSize: */
  34 $sql    = "SELECT max_quota, max_file_size FROM ".TABLE_PREFIX."courses WHERE course_id=$_SESSION[course_id]";
  35 $result = mysql_query($sql, $db);
  36 $row    = mysql_fetch_array($result);
  37 $my_MaxCourseSize       = $row['max_quota'];
  38 $my_MaxFileSize = $row['max_file_size'];
  39
  40         if ($my_MaxCourseSize == AT_COURSESIZE_DEFAULT) {
  41                 $my_MaxCourseSize = $MaxCourseSize;
  42         }
  43         if ($my_MaxFileSize == AT_FILESIZE_DEFAULT) {
  44                 $my_MaxFileSize = $MaxFileSize;
  45         } else if ($my_MaxFileSize == AT_FILESIZE_SYSTEM_MAX) {
  46                 $my_MaxFileSize = megabytes_to_bytes(substr(ini_get('upload_max_filesize'), 0, -1));
  47         }
  48
  49 $path = AT_CONTENT_DIR . $_SESSION['course_id'].'/'.$_POST['pathext'];
  50
  51 if (isset($_POST['submit'])) {
  52
  53         if($_FILES['uploadedfile']['name'])     {
  54
  55                 $_FILES['uploadedfile']['name'] = trim($_FILES['uploadedfile']['name']);
  56                 $_FILES['uploadedfile']['name'] = str_replace(' ', '_', $_FILES['uploadedfile']['name']);
  57
  58                 $path_parts = pathinfo($_FILES['uploadedfile']['name']);
  59                 $ext = $path_parts['extension'];
  60
  61                 /* check if this file extension is allowed: */
  62                 /* $IllegalExtentions is defined in ./include/config.inc.php */
  63                 if (in_array($ext, $IllegalExtentions)) {
  64                         $errors = array('FILE_ILLEGAL', $ext);
  65                         $msg->addError($errors);
  66                         header('Location: index.php?pathext='.$_POST['pathext']);
  67                         exit;
  68                 }
  69
  70                 /* also have to handle the 'application/x-zip-compressed'  case */
  71                 if (   ($_FILES['uploadedfile']['type'] == 'application/x-zip-compressed')
  72                         || ($_FILES['uploadedfile']['type'] == 'application/zip')
  73                         || ($_FILES['uploadedfile']['type'] == 'application/x-zip')){
  74                         $is_zip = true;
  75                 }
  76
  77
  78                 /* anything else should be okay, since we're on *nix.. hopefully */
  79                 $_FILES['uploadedfile']['name'] = str_replace(array(' ', '/', '\\', ':', '*', '?', '"', '<', '>', '|', '\''), '', $_FILES['uploadedfile']['name']);
  80
  81
  82                 /* if the file size is within allowed limits */
  83                 if( ($_FILES['uploadedfile']['size'] > 0) && ($_FILES['uploadedfile']['size'] <= $my_MaxFileSize) ) {
  84
  85                         /* if adding the file will not exceed the maximum allowed total */
  86                         $course_total = dirsize($path);
  87
  88                         if ((($course_total + $_FILES['uploadedfile']['size']) <= ($my_MaxCourseSize + $MaxCourseFloat)) || ($my_MaxCourseSize == AT_COURSESIZE_UNLIMITED)) {
  89
  90                                 /* check if this file exists first */
  91                                 if (file_exists($path.$_FILES['uploadedfile']['name'])) {
  92                                         /* this file already exists, so we want to prompt for override */
  93
  94                                         /* save it somewhere else, temporarily first                    */
  95                                         /* file_name.time ? */
  96                                         $_FILES['uploadedfile']['name'] = substr(time(), -4).'.'.$_FILES['uploadedfile']['name'];
  97
  98                                         $f = array('FILE_EXISTS',
  99                                                                         substr($_FILES['uploadedfile']['name'], 5),
 100                                                                         $_FILES['uploadedfile']['name'],
 101                                                                         $_POST['pathext'],
 102                                                                         $_GET['popup'],
 103                                                                         SEP);
 104                                         $msg->addFeedback($f);
 105                                 }
 106
 107                                 /* copy the file in the directory */
 108                                 $result = move_uploaded_file( $_FILES['uploadedfile']['tmp_name'], $path.$_FILES['uploadedfile']['name'] );
 109
 110                                 if (!$result) {
 111                                         require(AT_INCLUDE_PATH.'header.inc.php');
 112                                         $msg->printErrors('FILE_NOT_SAVED');
 113                                         echo '<a href="tools/filemanager/index.php?pathext=' . $_POST['pathext'] . SEP . 'popup=' . $_GET['popup'] . '">' . _AT('back') . '</a>';
 114                                         require(AT_INCLUDE_PATH.'footer.inc.php');
 115                                         exit;
 116                                 } else {
 117                                         if ($is_zip) {
 118                                                 $f = array('FILE_UPLOADED_ZIP',
 119                                                                                 urlencode($_POST['pathext']),
 120                                                                                 urlencode($_FILES['uploadedfile']['name']),
 121                                                                                 $_GET['popup'],
 122                                                                                 SEP);
 123                                                 $msg->addFeedback($f);
 124                                                 if ($alter)
 125                                                         header('Location: '.$_base_href.'editor/edit_content.php?cid='.$_REQUEST['cid'].SEP . 'pathext='.$_POST['pathext'].SEP. 'popup='.$_GET['popup'].SEP. 'tab='.$_REQUEST['tab']);
 126                                                 else
 127                                                         header('Location: index.php?pathext=' . $_POST['pathext'] . SEP . 'popup=' . $_GET['popup']);
 128                                                 exit;
 129                                         } /* else */
 130
 131                                         $msg->addFeedback('FILE_UPLOADED');
 132
 133                                         if ($alter)
 134                                                         header('Location: '.$_base_href.'editor/edit_content.php?cid='.$_REQUEST['cid'].SEP . 'pathext='.$_POST['pathext'].SEP. 'popup='.$_GET['popup'].SEP. 'tab='.$_REQUEST['tab']);
 135                                                 else
 136                                                         header('Location: index.php?pathext=' . $_POST['pathext'] . SEP . 'popup=' . $_GET['popup']);
 137                                         exit;
 138                                 }
 139                         } else {
 140                                 $msg->addError(array('MAX_STORAGE_EXCEEDED', get_human_size($my_MaxCourseSize)));
 141                                 if ($alter)
 142                                                         header('Location: '.$_base_href.'editor/edit_content.php?cid='.$_REQUEST['cid'].SEP . 'pathext='.$_POST['pathext'].SEP. 'popup='.$_GET['popup'].SEP. 'tab='.$_REQUEST['tab']);
 143                                                 else
 144                                                         header('Location: index.php?pathext=' . $_POST['pathext'] . SEP . 'popup=' . $_GET['popup']);
 145
 146                                 exit;
 147                         }
 148                 } else {
 149                         $msg->addError(array('FILE_TOO_BIG', get_human_size($my_MaxFileSize)));
 150                         if ($alter)
 151                                                         header('Location: '.$_base_href.'editor/edit_content.php?cid='.$_REQUEST['cid'].SEP . 'pathext='.$_POST['pathext'].SEP. 'popup='.$_GET['popup'].SEP. 'tab='.$_REQUEST['tab']);
 152                                                 else
 153                                                         header('Location: index.php?pathext=' . $_POST['pathext'] . SEP . 'popup=' . $_GET['popup']);
 154
 155                         exit;
 156                 }
 157         } else {
 158                 $msg->addError('FILE_NOT_SELECTED');
 159                 if ($alter)
 160                                                         header('Location: '.$_base_href.'editor/edit_content.php?cid='.$_REQUEST['cid'].SEP . 'pathext='.$_POST['pathext'].SEP. 'popup='.$_GET['popup'].SEP. 'tab='.$_REQUEST['tab']);
 161                                                 else
 162                                                         header('Location: index.php?pathext=' . $_POST['pathext'] . SEP . 'popup=' . $_GET['popup']);
 163                 exit;
 164         }
 165 }
 166
 167 ?>