private function upload_smiley() { $folder_phpboost_smileys = $this->smileys_path; if (!is_writable($folder_phpboost_smileys)) { $is_writable = @chmod($folder_phpboost_smileys, 0777); } else { $is_writable = true; } if ($is_writable) { $uploaded_file = $this->upload_form->get_value('file'); if ($uploaded_file !== null) { $authorized_pictures_extensions = FileUploadConfig::load()->get_authorized_picture_extensions(); if (empty($authorized_pictures_extensions)) { $this->view->put('MSG', MessageHelper::display(LangLoader::get_message('e_upload_invalid_format', 'errors'), MessageHelper::NOTICE)); } $upload = new Upload($this->smileys_path); if ($upload->file('upload_smiley_file', '`([a-z0-9()_-])+\\.(' . implode('|', array_map('preg_quote', $authorized_pictures_extensions)) . ')+$`i')) { // TODO : gérer les archives de smileys (possibilité d'uploader un zip + case à cocher si on veut créer directement chaque smiley avec :nom_du_smiley comme code) } else { $this->view->put('MSG', MessageHelper::display(LangLoader::get_message($upload->get_error(), 'errors'), MessageHelper::NOTICE)); } } else { $this->view->put('MSG', MessageHelper::display(LangLoader::get_message('process.error', 'status-messages-common'), MessageHelper::NOTICE)); } } else { $this->view->put('MSG', MessageHelper::display(LangLoader::get_message('e_upload_failed_unwritable', 'errors'), MessageHelper::WARNING)); } }
/** * @return string The html code for the input. */ public function display() { $template = $this->get_template_to_use(); $this->assign_common_template_variables($template); $file_type = new FileType(new File($this->get_value())); $template->put_all(array('C_PREVIEW_HIDDEN' => !$file_type->is_picture(), 'C_AUTH_UPLOAD' => FileUploadConfig::load()->is_authorized_to_access_interface_files(), 'FILE_PATH' => Url::to_rel($this->get_value()))); return $template; }
/** * @desc Display the editor * @return string Formated editor. */ public function display() { global $LANG; $template = $this->get_template(); $smileys_cache = SmileysCache::load(); $bbcode_lang = LangLoader::get('common', 'BBCode'); $template->put_all(array('PAGE_PATH' => $_SERVER['PHP_SELF'], 'C_EDITOR_NOT_ALREADY_INCLUDED' => !self::$editor_already_included, 'FIELD' => $this->identifier, 'FORBIDDEN_TAGS' => !empty($this->forbidden_tags) ? implode(',', $this->forbidden_tags) : '', 'C_UPLOAD_MANAGEMENT' => AppContext::get_current_user()->check_auth(FileUploadConfig::load()->get_authorization_enable_interface_files(), FileUploadConfig::AUTH_FILES_BIT), 'L_REQUIRE_TEXT' => $LANG['require_text'], 'L_BB_UPLOAD' => $bbcode_lang['bb_upload'], 'L_BB_SMILEYS' => $bbcode_lang['bb_smileys'], 'L_BB_BOLD' => $bbcode_lang['bb_bold'], 'L_BB_ITALIC' => $bbcode_lang['bb_italic'], 'L_BB_UNDERLINE' => $bbcode_lang['bb_underline'], 'L_BB_STRIKE' => $bbcode_lang['bb_strike'], 'L_BB_TITLE' => $bbcode_lang['bb_title'], 'L_BB_CONTAINER' => $bbcode_lang['bb_container'], 'L_BB_HTML' => $bbcode_lang['bb_html'], 'L_BB_STYLE' => $bbcode_lang['bb_style'], 'L_BB_URL' => $bbcode_lang['bb_link'], 'L_BB_IMAGE' => $bbcode_lang['bb_picture'], 'L_BB_LIGHTBOX' => $bbcode_lang['bb_lightbox'], 'L_BB_QUOTE' => $bbcode_lang['bb_quote'], 'L_BB_HIDE' => $bbcode_lang['bb_hide'], 'L_BB_COLOR' => $bbcode_lang['bb_color'], 'L_BB_SIZE' => $bbcode_lang['bb_size'], 'L_BB_FONT' => $bbcode_lang['bb_font'], 'L_BB_SMALL' => $bbcode_lang['bb_small'], 'L_BB_LARGE' => $bbcode_lang['bb_large'], 'L_BB_LEFT' => $bbcode_lang['bb_left'], 'L_BB_CENTER' => $bbcode_lang['bb_center'], 'L_BB_RIGHT' => $bbcode_lang['bb_right'], 'L_BB_JUSTIFY' => $bbcode_lang['bb_justify'], 'L_BB_FLOAT_LEFT' => $bbcode_lang['bb_float_left'], 'L_BB_FLOAT_RIGHT' => $bbcode_lang['bb_float_right'], 'L_BB_SUP' => $bbcode_lang['bb_sup'], 'L_BB_SUB' => $bbcode_lang['bb_sub'], 'L_BB_INDENT' => $bbcode_lang['bb_indent'], 'L_BB_LIST' => $bbcode_lang['bb_list'], 'L_BB_TABLE' => $bbcode_lang['bb_table'], 'L_BB_SWF' => $bbcode_lang['bb_swf'], 'L_BB_YOUTUBE' => $bbcode_lang['bb_youtube'], 'L_BB_FLASH' => $bbcode_lang['bb_swf'], 'L_BB_MOVIE' => $bbcode_lang['bb_movie'], 'L_BB_SOUND' => $bbcode_lang['bb_sound'], 'L_BB_CODE' => $bbcode_lang['bb_code'], 'L_BB_MATH' => $bbcode_lang['bb_math'], 'L_BB_ANCHOR' => $bbcode_lang['bb_anchor'], 'L_BB_HELP' => $bbcode_lang['bb_help'], 'L_BB_MORE' => $bbcode_lang['bb_more'], 'L_URL_PROMPT' => $bbcode_lang['bb_url_prompt'], 'L_ANCHOR_PROMPT' => $bbcode_lang['bb_anchor_prompt'], 'L_TITLE' => LangLoader::get_message('format_title', 'editor-common'), 'L_CONTAINER' => $bbcode_lang['bb_container'], 'L_BLOCK' => $bbcode_lang['bb_block'], 'L_FIELDSET' => $bbcode_lang['bb_fieldset'], 'L_STYLE' => $LANG['style'], 'L_QUESTION' => $LANG['question'], 'L_NOTICE' => $LANG['notice'], 'L_WARNING' => $LANG['warning'], 'L_ERROR' => LangLoader::get_message('error', 'status-messages-common'), 'L_SUCCESS' => $LANG['success'], 'L_SIZE' => LangLoader::get_message('format_size', 'editor-common'), 'L_FONT' => LangLoader::get_message('format_font', 'editor-common'), 'L_CODE' => $bbcode_lang['bb_code'], 'L_TEXT' => $bbcode_lang['bb_text'], 'L_SCRIPT' => $bbcode_lang['bb_script'], 'L_WEB' => $bbcode_lang['bb_web'], 'L_PROG' => $bbcode_lang['bb_prog'], 'L_TABLE_HEAD' => $bbcode_lang['head_table'], 'L_ADD_HEAD' => $bbcode_lang['head_add'], 'L_LINES' => $bbcode_lang['lines'], 'L_COLS' => $bbcode_lang['cols'], 'L_ORDERED_LIST' => $bbcode_lang['ordered_list'], 'L_INSERT_LIST' => $bbcode_lang['insert_list'], 'L_INSERT_TABLE' => $bbcode_lang['insert_table'], 'L_PHPBOOST_LANGUAGES' => $bbcode_lang['phpboost_languages'])); foreach ($this->forbidden_tags as $forbidden_tag) { if ($forbidden_tag == 'fieldset') { $forbidden_tag = 'block'; } $template->put_all(array('AUTH_' . strtoupper($forbidden_tag) => 'style="opacity:0.3;filter:alpha(opacity=30);cursor:default;"', 'DISABLED_' . strtoupper($forbidden_tag) => 'return false;')); } foreach ($smileys_cache->get_smileys() as $code_smile => $infos) { $template->assign_block_vars('smileys', array('URL' => TPL_PATH_TO_ROOT . '/images/smileys/' . $infos['url_smiley'], 'CODE' => addslashes($code_smile))); } $template->put_all(array('L_SMILEY' => $LANG['smiley'])); if (!self::$editor_already_included) { self::$editor_already_included = true; } return $template->render(); }
###### Régénération du cache des rangs ####### ForumRanksCache::invalidate(); AppContext::get_response()->redirect('/forum/admin_ranks.php'); } else { AppContext::get_response()->redirect('/forum/admin_ranks_add.php?error=incomplete#message_helper'); } } elseif (!empty($_FILES['upload_ranks']['name'])) { //Si le dossier n'est pas en écriture on tente un CHMOD 777 @clearstatcache(); $dir = PATH_TO_ROOT . '/forum/templates/images/ranks/'; if (!is_writable($dir)) { $is_writable = @chmod($dir, 0777) ? true : false; } $error = ''; if (is_writable($dir)) { $authorized_pictures_extensions = FileUploadConfig::load()->get_authorized_picture_extensions(); if (!empty($authorized_pictures_extensions)) { $Upload = new Upload($dir); $Upload->disableContentCheck(); if (!$Upload->file('upload_ranks', '`([a-z0-9_ -])+\\.(' . implode('|', array_map('preg_quote', $authorized_pictures_extensions)) . ')+$`i')) { $error = $Upload->get_error(); } } else { $error = 'e_upload_invalid_format'; } } else { $error = 'e_upload_failed_unwritable'; } $error = !empty($error) ? '?error=' . $error : ''; AppContext::get_response()->redirect(HOST . SCRIPT . $error); } else {
private function add_bandwidth_protection() { //Bandwidth protection. The /upload directory can be forbidden if the request comes from out of PHPBoost if (FileUploadConfig::load()->get_enable_bandwidth_protect()) { $this->add_section('Bandwith protection'); $this->add_line('RewriteCond %{HTTP_REFERER} !^$'); $this->add_line('RewriteCond %{HTTP_REFERER} !^' . $this->general_config->get_site_url()); $this->add_line('RewriteRule .*upload/.*$ - [F]'); $this->add_section('Stop hotlinking'); $this->add_line('RewriteCond %{HTTP_REFERER} !^$'); $this->add_line('RewriteCond %{HTTP_HOST}@@%{HTTP_REFERER} !^([^@]*)@@https?://\\1/.* [NC]'); $this->add_line('RewriteRule \\.(bmp|gif|jpe?g|png|swf)$ - [F,L,NC]'); } }
$display_close_button = $close_button != '0'; $popup = '&popup=1&fd=' . $field . '&edt=' . $editor . '&parse=' . $parse . '&no_path=' . $no_path; $popup_noamp = '&popup=1&fd=' . $field . '&edt=' . $editor . '&parse=' . $parse . '&no_path=' . $no_path; } else { $Bread_crumb->add($LANG['member_area'], UserUrlBuilder::profile(AppContext::get_current_user()->get_id())->rel()); $Bread_crumb->add($LANG['files_management'], UserUrlBuilder::upload_files_panel()->rel()); require_once '../kernel/header.php'; $field = ''; $popup = ''; $popup_noamp = ''; } if (!AppContext::get_current_user()->check_level(User::MEMBER_LEVEL)) { $error_controller = PHPBoostErrors::unexisting_page(); DispatchManager::redirect($error_controller); } $files_upload_config = FileUploadConfig::load(); //Droit d'accès?. if (!AppContext::get_current_user()->check_auth($files_upload_config->get_authorization_enable_interface_files(), FileUploadConfig::AUTH_FILES_BIT)) { $error_controller = PHPBoostErrors::unexisting_page(); DispatchManager::redirect($error_controller); } $folder = retrieve(GET, 'f', 0); $parent_folder = retrieve(GET, 'fup', 0); $home_folder = retrieve(GET, 'root', false); $del_folder = retrieve(GET, 'delf', 0); $del_file = retrieve(GET, 'del', 0); $get_error = retrieve(GET, 'error', ''); $get_l_error = retrieve(GET, 'erroru', ''); $move_folder = retrieve(GET, 'movefd', 0); $move_file = retrieve(GET, 'movefi', 0); $to = retrieve(POST, 'new_cat', -1);
private function upload_avatar($form, $member_extended_field) { $avatar = $form->get_value('upload_avatar'); $user_accounts_config = UserAccountsConfig::load(); $authorized_pictures_extensions = FileUploadConfig::load()->get_authorized_picture_extensions(); if (empty($authorized_pictures_extensions)) { return new MemberExtendedFieldErrorsMessageException(LangLoader::get_message('e_upload_invalid_format', 'errors')); } if ($form->get_value('link_avatar')) { if (preg_match('`([A-Za-z0-9()_-])+\\.(' . implode('|', array_map('preg_quote', $authorized_pictures_extensions)) . ')+$`i', $form->get_value('link_avatar'))) { $image = new Image($form->get_value('link_avatar')); if ($image->get_width() > $user_accounts_config->get_max_avatar_width() || $image->get_height() > $user_accounts_config->get_max_avatar_height()) { if ($user_accounts_config->is_avatar_auto_resizing_enabled()) { $directory = '/images/avatars/' . Url::encode_rewrite($image->get_name() . '_' . $this->key_hash()) . '.' . $image->get_extension(); $resizer = new ImageResizer(); $resizer->resize_with_max_values($image, $user_accounts_config->get_max_avatar_width(), $user_accounts_config->get_max_avatar_height(), PATH_TO_ROOT . $directory); $this->delete_old_avatar($member_extended_field); return $directory; } throw new MemberExtendedFieldErrorsMessageException(LangLoader::get_message('e_upload_max_dimension', 'errors')); } $this->delete_old_avatar($member_extended_field); return $form->get_value('link_avatar'); } else { throw new MemberExtendedFieldErrorsMessageException(LangLoader::get_message('e_upload_invalid_format', 'errors')); } } elseif (!empty($avatar)) { if (UserAccountsConfig::load()->is_avatar_upload_enabled()) { $dir = '/images/avatars/'; if ($user_accounts_config->is_avatar_auto_resizing_enabled()) { $image = new Image($avatar->get_temporary_filename()); $resizer = new ImageResizer(); $explode = explode('.', $avatar->get_name()); $extension = array_pop($explode); if (!in_array($extension, $authorized_pictures_extensions)) { return new MemberExtendedFieldErrorsMessageException(LangLoader::get_message('e_upload_invalid_format', 'errors')); } $explode = explode('.', $avatar->get_name()); $name = $explode[0]; $directory = $dir . Url::encode_rewrite($name . '_' . $this->key_hash()) . '.' . $extension; try { $resizer->resize_with_max_values($image, $user_accounts_config->get_max_avatar_width(), $user_accounts_config->get_max_avatar_height(), PATH_TO_ROOT . $directory); $this->delete_old_avatar($member_extended_field); return $directory; } catch (UnsupportedOperationException $e) { throw new MemberExtendedFieldErrorsMessageException(LangLoader::get_message('e_upload_invalid_format', 'errors')); } } else { $Upload = new Upload(PATH_TO_ROOT . $dir); $Upload->file($form->get_html_id() . '_upload_avatar', '`([A-Za-z0-9()_-])+\\.(' . implode('|', array_map('preg_quote', $authorized_pictures_extensions)) . ')+$`i', Upload::UNIQ_NAME, $user_accounts_config->get_max_avatar_weight() * 1024); $upload_error = $Upload->get_error(); if (!empty($upload_error)) { throw new MemberExtendedFieldErrorsMessageException(LangLoader::get_message($upload_error, 'errors')); } $error = $Upload->check_img($user_accounts_config->get_max_avatar_width(), $user_accounts_config->get_max_avatar_height(), Upload::DELETE_ON_ERROR); if (!empty($error)) { throw new MemberExtendedFieldErrorsMessageException(LangLoader::get_message($error, 'errors')); } else { $this->delete_old_avatar($member_extended_field); return $dir . $Upload->get_filename(); } } } } else { return MemberExtendedFieldsService::return_field_member($member_extended_field->get_field_name(), $member_extended_field->get_user_id()); } }
private function build_form() { $contribution_number = $this->get_unread_contributions_number(); $is_authorized_files_panel = $this->user->check_auth(FileUploadConfig::load()->get_authorization_enable_interface_files(), FileUploadConfig::AUTH_FILES_BIT); $this->tpl->put_all(array('C_USER_AUTH_FILES' => $is_authorized_files_panel, 'C_USER_INDEX' => true, 'C_IS_MODERATOR' => $this->user->get_level() >= User::MODERATOR_LEVEL, 'C_UNREAD_CONTRIBUTION' => $contribution_number != 0, 'C_KNOWN_NUMBER_OF_UNREAD_CONTRIBUTION' => $contribution_number > 0, 'C_UNREAD_ALERT' => (bool) AdministratorAlertService::get_number_unread_alerts(), 'C_HAS_PM' => $this->user->get_unread_pm() > 0, 'COLSPAN' => $is_authorized_files_panel ? 3 : 2, 'PSEUDO' => $this->user->get_display_name(), 'NUMBER_UNREAD_ALERTS' => AdministratorAlertService::get_number_unread_alerts(), 'NUMBER_UNREAD_CONTRIBUTIONS' => $contribution_number, 'NUMBER_PM' => $this->user->get_unread_pm(), 'MSG_MBR' => FormatingHelper::second_parse(UserAccountsConfig::load()->get_welcome_message()), 'U_USER_ID' => UserUrlBuilder::profile($this->user->get_id())->rel(), 'U_USER_PM' => UserUrlBuilder::personnal_message($this->user->get_id())->rel(), 'U_CONTRIBUTION_PANEL' => UserUrlBuilder::contribution_panel()->rel(), 'U_MODERATION_PANEL' => UserUrlBuilder::moderation_panel()->rel(), 'U_UPLOAD' => UserUrlBuilder::upload_files_panel()->rel(), 'U_VIEW_PROFILE' => UserUrlBuilder::profile($this->user->get_id())->rel())); }
} } elseif ($home_folder) { //Retour à la racine. AppContext::get_response()->redirect('/admin/admin_files.php'); } elseif (!empty($_FILES['upload_file']['name']) && $folder) { //Si le dossier n'est pas en écriture on tente un CHMOD 777 @clearstatcache(); $dir = PATH_TO_ROOT . '/upload/'; if (!is_writable($dir)) { $is_writable = @chmod($dir, 0777); } @clearstatcache(); $error = ''; if (is_writable($dir)) { $Upload = new Upload($dir); $Upload->file('upload_file', '`([a-z0-9()_-])+\\.(' . implode('|', array_map('preg_quote', FileUploadConfig::load()->get_authorized_extensions())) . ')+$`i', Upload::UNIQ_NAME); if ($Upload->get_error() != '') { //Erreur, on arrête ici AppContext::get_response()->redirect('/admin/admin_files.php?f=' . $folder . '&erroru=' . $Upload->get_error() . '#message_helper'); } else { $check_user_folder = 0; try { $check_user_folder = PersistenceContext::get_querier()->get_column_value(DB_TABLE_UPLOAD_CAT, 'user_id', 'WHERE id=:id', array('id' => $folder)); } catch (RowNotFoundException $e) { } $user_id = $check_user_folder <= 0 ? -1 : AppContext::get_current_user()->get_id(); $user_id = max($user_id, $folder_member); $result = PersistenceContext::get_querier()->insert(DB_TABLE_UPLOAD, array('idcat' => $folder, 'name' => $Upload->get_original_filename(), 'path' => $Upload->get_filename(), 'user_id' => $user_id, 'size' => $Upload->get_human_readable_size(), 'type' => $Upload->get_extension(), 'timestamp' => time())); $id_file = $result->get_last_inserted_id(); } } else {
private function save() { $this->file_upload_config->set_authorization_enable_interface_files($this->form->get_value('authorizations')->build_auth_array()); $this->file_upload_config->set_maximum_size_upload($this->form->get_value('size_limit') * 1024); if ($this->form->get_value('bandwidth_protect')) { $this->file_upload_config->set_enable_bandwidth_protect(true); } else { $this->file_upload_config->set_enable_bandwidth_protect(false); } $authorized_extensions = $this->form->get_value('authorized_extensions'); $authorized_extensions = array(); foreach ($this->form->get_value('authorized_extensions') as $field => $option) { $authorized_extensions[] = $option->get_raw_value(); } $extend_extensions = preg_split('`, ?`', trim($this->form->get_value('extend_extensions'))); if (is_array($extend_extensions)) { foreach ($extend_extensions as $extension) { //Suppression de tous les caractères interdits dans les extensions $extension = str_replace('-', '', Url::encode_rewrite($extension)); if ($extension != '' && !isset($authorized_extensions[$extension]) && $extension != 'php') { array_push($authorized_extensions, $extension); } } } $this->file_upload_config->set_authorized_extensions($authorized_extensions); FileUploadConfig::save(); //Régénération du htaccess. HtaccessFileCache::regenerate(); }
/** * @desc Display the editor * @return string Formated editor. */ public function display() { $template = $this->get_template(); $displayed_icons_number = 0; list($toolbar1, $toolbar2, $toolbar3) = array('', '', ''); foreach ($this->array_tags as $tag => $tinymce_tag) { $tag = preg_replace('`[0-9]`', '', $tag); if (!in_array($tag, $this->forbidden_tags)) { $toolbar1 .= $tinymce_tag . ','; $displayed_icons_number++; } } foreach ($this->array_tags2 as $tag => $tinymce_tag) { $tag = preg_replace('`[0-9]`', '', $tag); if (!in_array($tag, $this->forbidden_tags)) { if ($displayed_icons_number < 18) { $toolbar1 .= $tinymce_tag . ','; } else { $toolbar2 .= $tinymce_tag . ','; } $displayed_icons_number++; } } foreach ($this->array_tags3 as $tag => $tinymce_tag) { $tag = preg_replace('`[0-9]`', '', $tag); if (!in_array($tag, $this->forbidden_tags)) { if ($tag != 'insertfile' || $tag == 'insertfile' && AppContext::get_current_user()->check_auth(FileUploadConfig::load()->get_authorization_enable_interface_files(), FileUploadConfig::AUTH_FILES_BIT)) { if ($displayed_icons_number < 25) { $toolbar1 .= $tinymce_tag . ','; } else { if ($displayed_icons_number < 35) { $toolbar2 .= $tinymce_tag . ','; } else { $toolbar3 .= $tinymce_tag . ','; } } $displayed_icons_number++; } } } $language = substr(AppContext::get_current_user()->get_locale(), 0, 2); switch ($language) { case 'fr': $language = 'fr_FR'; break; case 'en': $language = 'en_GB'; break; default: break; } $form_field_infos = explode('_', $this->identifier); $form_name = $form_field_infos[0]; unset($form_field_infos[0]); $field_name = implode('_', $form_field_infos); $template->put_all(array('C_NOT_JS_INCLUDED' => self::$js_included, 'C_HTMLFORM' => !empty($form_name) && !empty($field_name), 'PAGE_PATH' => $_SERVER['PHP_SELF'], 'FIELD' => $this->identifier, 'FORM_NAME' => $form_name, 'FIELD_NAME' => $field_name, 'FORBIDDEN_TAGS' => implode(',', $this->forbidden_tags), 'L_REQUIRE_TEXT' => LangLoader::get_message('require_text', 'main'), 'C_TOOLBAR1' => !empty($toolbar1), 'C_TOOLBAR2' => !empty($toolbar2), 'C_TOOLBAR3' => !empty($toolbar3), 'TOOLBAR1' => preg_replace('`\\|(,\\|)+`', '|', trim($toolbar1, ',')), 'TOOLBAR2' => preg_replace('`\\|(,\\|)+`', '|', trim($toolbar2, ',')), 'TOOLBAR3' => preg_replace('`\\|(,\\|)+`', '|', trim($toolbar3, ',')), 'LANGUAGE' => $language)); self::$js_included = true; //Chargement des smileys. $smileys = SmileysCache::load()->get_smileys(); $smile_by_line = 9; $nbr_smile = count($smileys); $j = 1; foreach ($smileys as $code_smile => $infos) { $template->assign_block_vars('smiley', array('C_NEW_ROW' => is_int(($j - 1) / $smile_by_line), 'C_LAST_OF_THE_ROW' => is_int($j / $smile_by_line), 'C_END_ROW' => is_int($j / $smile_by_line) || $nbr_smile == $j, 'C_LAST_ROW' => $nbr_smile == $j, 'URL' => Url::to_rel('/images/smileys/' . $infos['url_smiley']), 'CODE' => addslashes($code_smile))); $j++; } return $template->render(); }