/** * send response (save uploaded file, resize if required) * @access public * */ public function sendResponse() { $iErrorNumber = CKFINDER_CONNECTOR_ERROR_NONE; $_config =& CKFinder_Connector_core_Factory::getInstance("core_config"); $oRegistry =& CKFinder_Connector_core_Factory::getInstance("core_Registry"); $oRegistry->set("FileUpload_fileName", "unknown file"); $uploadedFile = array_shift($_FILES); if (!isset($uploadedFile['name'])) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_INVALID); } $sUnsafeFileName = CKFinder_Connector_Utils_FileSystem::convertToFilesystemEncoding(CKFinder_Connector_Utils_Misc::mbBasename($uploadedFile['name'])); $sFileName = CKFinder_Connector_Utils_FileSystem::secureFileName($sUnsafeFileName); if ($sFileName != $sUnsafeFileName) { $iErrorNumber = CKFINDER_CONNECTOR_ERROR_UPLOADED_INVALID_NAME_RENAMED; //增加自定义的重命名函数后在此增加的两行 /* $sextension = CKFinder_Connector_Utils_FileSystem::getextension($sFileName); $sFileName = mySetFileName() . '.' . $sextension; //添加以下两行解决中文乱码问题(重命名) */ /* $sextension=CKFinder_Connector_Utils_FileSystem::getextension($sFileName); $sFileName=date("Ymd")."_".date("His").".".$sextension; */ } $oRegistry->set("FileUpload_fileName", $sFileName); $this->checkConnector(); $this->checkRequest(); if (!$this->_currentFolder->checkAcl(CKFINDER_CONNECTOR_ACL_FILE_UPLOAD)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UNAUTHORIZED); } $_resourceTypeconfig = $this->_currentFolder->getResourceTypeconfig(); if (!CKFinder_Connector_Utils_FileSystem::checkFileName($sFileName) || $_resourceTypeconfig->checkIsHiddenFile($sFileName)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_NAME); } $resourceTypeInfo = $this->_currentFolder->getResourceTypeconfig(); if (!$resourceTypeInfo->checkextension($sFileName)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_EXTENSION); } $oRegistry->set("FileUpload_fileName", $sFileName); $oRegistry->set("FileUpload_url", $this->_currentFolder->getUrl()); $maxSize = $resourceTypeInfo->getMaxSize(); if (!$_config->checkSizeAfterScaling() && $maxSize && $uploadedFile['size'] > $maxSize) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_TOO_BIG); } $htmlextensions = $_config->getHtmlextensions(); $sextension = CKFinder_Connector_Utils_FileSystem::getextension($sFileName); if ($htmlextensions && !CKFinder_Connector_Utils_Misc::inArrayCaseInsensitive($sextension, $htmlextensions) && ($detectHtml = CKFinder_Connector_Utils_FileSystem::detectHtml($uploadedFile['tmp_name'])) === true) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_WRONG_HTML_FILE); } $secureImageUploads = $_config->getSecureImageUploads(); if ($secureImageUploads && ($isImageValid = CKFinder_Connector_Utils_FileSystem::isImageValid($uploadedFile['tmp_name'], $sextension)) === false) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_CORRUPT); } switch ($uploadedFile['error']) { case UPLOAD_ERR_OK: break; case UPLOAD_ERR_INI_SIZE: case UPLOAD_ERR_FORM_SIZE: $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_TOO_BIG); break; case UPLOAD_ERR_PARTIAL: case UPLOAD_ERR_NO_FILE: $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_CORRUPT); break; case UPLOAD_ERR_NO_TMP_DIR: $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_NO_TMP_DIR); break; case UPLOAD_ERR_CANT_WRITE: $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_ACCESS_DENIED); break; case UPLOAD_ERR_EXTENSION: $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_ACCESS_DENIED); break; } $sServerDir = $this->_currentFolder->getServerPath(); while (true) { $sFilePath = CKFinder_Connector_Utils_FileSystem::combinePaths($sServerDir, $sFileName); if (file_exists($sFilePath)) { $sFileName = CKFinder_Connector_Utils_FileSystem::autoRename($sServerDir, $sFileName); $oRegistry->set("FileUpload_fileName", $sFileName); $iErrorNumber = CKFINDER_CONNECTOR_ERROR_UPLOADED_FILE_RENAMED; } else { if (false === move_uploaded_file($uploadedFile['tmp_name'], $sFilePath)) { $iErrorNumber = CKFINDER_CONNECTOR_ERROR_ACCESS_DENIED; } else { if (isset($detectHtml) && $detectHtml === -1 && CKFinder_Connector_Utils_FileSystem::detectHtml($sFilePath) === true) { @unlink($sFilePath); $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_WRONG_HTML_FILE); } else { if (isset($isImageValid) && $isImageValid === -1 && CKFinder_Connector_Utils_FileSystem::isImageValid($sFilePath, $sextension) === false) { @unlink($sFilePath); $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_CORRUPT); } } } if (is_file($sFilePath) && ($perms = $_config->getChmodFiles())) { $oldumask = umask(0); chmod($sFilePath, $perms); umask($oldumask); } break; } } if (!$_config->checkSizeAfterScaling()) { $this->_errorHandler->throwError($iErrorNumber, true, false); } //resize image if required require_once CKFINDER_CONNECTOR_LIB_DIR . "/CommandHandler/Thumbnail.php"; $_imagesconfig = $_config->getImagesconfig(); if ($_imagesconfig->getMaxWidth() > 0 && $_imagesconfig->getMaxHeight() > 0 && $_imagesconfig->getQuality() > 0) { CKFinder_Connector_CommandHandler_Thumbnail::createThumb($sFilePath, $sFilePath, $_imagesconfig->getMaxWidth(), $_imagesconfig->getMaxHeight(), $_imagesconfig->getQuality(), true); } if ($_config->checkSizeAfterScaling()) { //check file size after scaling, attempt to delete if too big clearstatcache(); if ($maxSize && filesize($sFilePath) > $maxSize) { @unlink($sFilePath); $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UPLOADED_TOO_BIG); } else { $this->_errorHandler->throwError($iErrorNumber, true, false); } } CKFinder_Connector_core_Hooks::run('AfterFileUpload', array(&$this->_currentFolder, &$uploadedFile, &$sFilePath)); }
/** * Check one file for security reasons * * @param object $filePathInfo * @param string $originalFileName * @return mixed bool(false) - if security checks fails. Otherwise string - ralative zip archive path with secured filename. */ protected function checkOneFile($filePathInfo, $originalFileName) { $resourceTypeInfo = $this->_currentFolder->getResourceTypeconfig(); // checked if it is a folder $fileStat = $this->zip->statName($originalFileName); if (empty($filePathInfo['extension']) && empty($fileStat['size'])) { $sNewFolderName = CKFinder_Connector_Utils_FileSystem::convertToFilesystemEncoding(rtrim($fileStat['name'], '/')); if ($this->_config->forceAscii()) { $sNewFolderName = CKFinder_Connector_Utils_FileSystem::convertToAscii($sNewFolderName); } if (!CKFinder_Connector_Utils_FileSystem::checkFolderPath($sNewFolderName) || $resourceTypeInfo->checkIsHiddenFolder($sNewFolderName)) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_INVALID_NAME; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } if (!is_writeable($this->_currentFolder->getServerPath())) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_ACCESS_DENIED; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } return $originalFileName; } $fileName = CKFinder_Connector_Utils_FileSystem::convertToFilesystemEncoding($filePathInfo['basename']); $sFileName = CKFinder_Connector_Utils_FileSystem::secureFileName($fileName); // max file size $maxSize = $resourceTypeInfo->getMaxSize(); if ($maxSize && $fileStat['size'] > $maxSize) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_UPLOADED_TOO_BIG; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } // extension if (!$resourceTypeInfo->checkextension($sFileName)) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_INVALID_EXTENSION; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } // hidden file if (!CKFinder_Connector_Utils_FileSystem::checkFileName($sFileName) || $resourceTypeInfo->checkIsHiddenFile($sFileName)) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } // unpack file to tmp dir for detecting html and valid image $dir = CKFinder_Connector_Utils_FileSystem::getTmpDir() . '/'; if (file_exists($dir . $sFileName) && !CKFinder_Connector_Utils_FileSystem::unlink($dir . $sFileName)) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } if (copy('zip://' . $this->filePath . '#' . $originalFileName, $dir . $sFileName)) { // html extensions $htmlextensions = $this->_config->getHtmlextensions(); $sextension = CKFinder_Connector_Utils_FileSystem::getextension($dir . $sFileName); if ($htmlextensions && !CKFinder_Connector_Utils_Misc::inArrayCaseInsensitive($sextension, $htmlextensions) && CKFinder_Connector_Utils_FileSystem::detectHtml($dir . $sFileName) === true) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_UPLOADED_INVALID; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } // proper image $secureImageUploads = $this->_config->getSecureImageUploads(); if ($secureImageUploads && ($isImageValid = CKFinder_Connector_Utils_FileSystem::isImageValid($dir . $sFileName, $sextension)) === false) { $this->errorCode = CKFINDER_CONNECTOR_ERROR_UPLOADED_INVALID; $this->appendErrorNode($this->skippedFilesNode, $this->errorCode, $originalFileName); return false; } } $sDirName = $filePathInfo['dirname'] != '.' ? $filePathInfo['dirname'] . '/' : ''; return $sDirName . $sFileName; }
/** * Autorename file if previous name is already taken * * @param string $filePath * @param string $fileName * @param string $sFileNameOrginal */ public static function autoRename($filePath, $fileName) { $sFileNameOrginal = $fileName; $iCounter = 0; while (true) { $sFilePath = CKFinder_Connector_Utils_FileSystem::combinePaths($filePath, $fileName); if (file_exists($sFilePath)) { $iCounter++; $fileName = CKFinder_Connector_Utils_FileSystem::getFileNameWithoutextension($sFileNameOrginal, false) . "(" . $iCounter . ")" . "." . CKFinder_Connector_Utils_FileSystem::getextension($sFileNameOrginal, false); } else { break; } } return $fileName; }
/** * handle request and build XML * @access protected * */ function buildXml() { if (empty($_POST['CKFinderCommand']) || $_POST['CKFinderCommand'] != 'true') { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST); } $this->checkConnector(); $this->checkRequest(); //resizing to 1x1 is almost equal to deleting a file, that's why FILE_DELETE permissions are required if (!$this->_currentFolder->checkAcl(CKFINDER_CONNECTOR_ACL_FILE_DELETE) || !$this->_currentFolder->checkAcl(CKFINDER_CONNECTOR_ACL_FILE_UPLOAD)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_UNAUTHORIZED); } $_config =& CKFinder_Connector_core_Factory::getInstance("core_config"); $resourceTypeInfo = $this->_currentFolder->getResourceTypeconfig(); if (!isset($_POST["fileName"])) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_NAME); } $fileName = CKFinder_Connector_Utils_FileSystem::convertToFilesystemEncoding($_POST["fileName"]); if (!CKFinder_Connector_Utils_FileSystem::checkFileName($fileName) || $resourceTypeInfo->checkIsHiddenFile($fileName)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST); } if (!$resourceTypeInfo->checkextension($fileName, false)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST); } $filePath = CKFinder_Connector_Utils_FileSystem::combinePaths($this->_currentFolder->getServerPath(), $fileName); if (!file_exists($filePath) || !is_file($filePath)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_FILE_NOT_FOUND); } $newWidth = trim($_POST['width']); $newHeight = trim($_POST['height']); $quality = 80; $resizeOriginal = !empty($_POST['width']) && !empty($_POST['height']); if ($resizeOriginal) { if (!preg_match("/^\\d+\$/", $newWidth) || !preg_match("/^\\d+\$/", $newHeight) || !preg_match("/^\\d+\$/", $newWidth)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST); } if (!isset($_POST["newFileName"])) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_NAME); } $newFileName = CKFinder_Connector_Utils_FileSystem::convertToFilesystemEncoding($_POST["newFileName"]); if (!$resourceTypeInfo->checkextension($newFileName)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_EXTENSION); } if (!CKFinder_Connector_Utils_FileSystem::checkFileName($newFileName) || $resourceTypeInfo->checkIsHiddenFile($newFileName)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_NAME); } $newFilePath = CKFinder_Connector_Utils_FileSystem::combinePaths($this->_currentFolder->getServerPath(), $newFileName); if (!is_writable(dirname($newFilePath))) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_ACCESS_DENIED); } if ($_POST['overwrite'] != "1" && file_exists($newFilePath)) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_ALREADY_EXIST); } $_imagesconfig = $_config->getImagesconfig(); $maxWidth = $_imagesconfig->getMaxWidth(); $maxHeight = $_imagesconfig->getMaxHeight(); // Shouldn't happen as the JavaScript validation should not allow this. if ($maxWidth > 0 && $newWidth > $maxWidth || $maxHeight > 0 && $newHeight > $maxHeight) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_INVALID_REQUEST); } } require_once CKFINDER_CONNECTOR_LIB_DIR . "/CommandHandler/Thumbnail.php"; if ($resizeOriginal) { $result = CKFinder_Connector_CommandHandler_Thumbnail::createThumb($filePath, $newFilePath, $newWidth, $newHeight, $quality, false); if (!$result) { $this->_errorHandler->throwError(CKFINDER_CONNECTOR_ERROR_ACCESS_DENIED); } } $config = $this->getconfig(); $nameWithoutExt = preg_replace("/^(.+)\\_\\d+x\\d+\$/", "\$1", CKFinder_Connector_Utils_FileSystem::getFileNameWithoutextension($fileName)); $extension = CKFinder_Connector_Utils_FileSystem::getextension($fileName); foreach (array('small', 'medium', 'large') as $size) { if (!empty($_POST[$size]) && $_POST[$size] == '1') { $thumbName = $nameWithoutExt . "_" . $size . "." . $extension; $newFilePath = CKFinder_Connector_Utils_FileSystem::combinePaths($this->_currentFolder->getServerPath(), $thumbName); if (!empty($config[$size . 'Thumb'])) { if (preg_match("/^(\\d+)x(\\d+)\$/", $config[$size . 'Thumb'], $matches)) { CKFinder_Connector_CommandHandler_Thumbnail::createThumb($filePath, $newFilePath, $matches[1], $matches[2], $quality, true); } } } } }