File Manager - BorneoXploit

Editing: upload_sw.php

<?php
require_once ("../funct.php");
require_once ("sess.php");
require_once ("conn.php");
$id_galleria = $_GET['id_galleria'] ? $_GET['id_galleria'] : 1;
$query = new doQuery ();

// Code for Session Cookie workaround
if (isset($_POST["PHPSESSID"])) {
	session_id($_POST["PHPSESSID"]);
} else if (isset($_GET["PHPSESSID"])) {
	session_id($_GET["PHPSESSID"]);
}

session_start();

// Check post_max_size (http://us3.php.net/manual/en/features.file-upload.php#73762)
$POST_MAX_SIZE = ini_get('post_max_size');
$unit = strtoupper(substr($POST_MAX_SIZE, -1));
$multiplier = ($unit == 'M' ? 1048576 : ($unit == 'K' ? 1024 : ($unit == 'G' ? 1073741824 : 1)));

if ((int)$_SERVER['CONTENT_LENGTH'] > $multiplier*(int)$POST_MAX_SIZE && $POST_MAX_SIZE) {
	header("HTTP/1.1 500 Internal Server Error"); // This will trigger an uploadError event in SWFUpload
	echo "I file complessivamente eccedono la massima grandezza consentita di ".$POST_MAX_SIZE." ".$unit;
	exit(0);
}

// Settings
if ($id_galleria > 1)
	$save_path = $_SESSION['perc_strutt']."fotogal/";
else
	$save_path = $_SESSION['perc_strutt']."foto/";
$upload_name = "Filedata";
$max_file_size_in_bytes = 4194304;	# 4 Mb in bytes
$extension_whitelist = array("jpg", "gif", "png");	// Allowed file extensions
$valid_chars_regex = '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-';				// Characters allowed in the file name (in a Regular Expression format)

// Other variables	
$MAX_FILENAME_LENGTH = 260;
$file_name = "";
$file_extension = "";
$uploadErrors = array(
    0=>"There is no error, the file uploaded with success",
    1=>"The uploaded file exceeds the upload_max_filesize directive in php.ini",
    2=>"The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form",
    3=>"The uploaded file was only partially uploaded",
    4=>"No file was uploaded",
    6=>"Missing a temporary folder"
);

// Validate the upload
if (!isset($_FILES[$upload_name])) {
	HandleError("No upload found in \$_FILES for " . $upload_name);
	exit(0);
} else if (isset($_FILES[$upload_name]["error"]) && $_FILES[$upload_name]["error"] != 0) {
	HandleError($uploadErrors[$_FILES[$upload_name]["error"]]);
	exit(0);
} else if (!isset($_FILES[$upload_name]["tmp_name"]) || !@is_uploaded_file($_FILES[$upload_name]["tmp_name"])) {
	HandleError("Upload failed is_uploaded_file test.");
	exit(0);
} else if (!isset($_FILES[$upload_name]['name'])) {
	HandleError("File has no name.");
	exit(0);
}

// Validate the file size (Warning: the largest files supported by this code is 2GB)
$file_size = @filesize($_FILES[$upload_name]["tmp_name"]);
if (!$file_size || $file_size > $max_file_size_in_bytes) {
	HandleError("I file eccedono la massima grandezza consentita di ".$max_file_size_in_bytes." bytes");
	exit(0);
}
if ($file_size <= 0) {
	HandleError("File size outside allowed lower bound");
	exit(0);
}

// Validate file name (for our purposes we'll just remove invalid characters)
$file_name = preg_replace('/[^'.$valid_chars_regex.']|\.+$/i', "", basename($_FILES[$upload_name]['name']));
if (strlen($file_name) == 0 || strlen($file_name) > $MAX_FILENAME_LENGTH) {
	HandleError("Invalid file name");
	exit(0);
}

// Validate that we won't over-write an existing file
if (file_exists($save_path . $file_name)) {
	HandleError("File with this name already exists");
	exit(0);
}

// Validate file extension
$path_info = pathinfo($_FILES[$upload_name]['name']);
$file_extension = $path_info["extension"];
$is_valid_extension = false;
foreach ($extension_whitelist as $extension) {
	if (strcasecmp($file_extension, $extension) == 0) {
		$is_valid_extension = true;
		break;
	}
}
if (!$is_valid_extension) {
	HandleError("Invalid file extension");
	exit(0);
}

// Process the file
if (!move_uploaded_file($_FILES[$upload_name]["tmp_name"], $save_path.$file_name)) {
	HandleError("File could not be saved.");
	exit(0);
}
else {
	exec ("chmod 666 ".$save_path.$file_name);;

# recupera la dimensione stabilita delle foto da inserire
	$sqlD = "SELECT `dim_thumb`, `dim_foto`, `dim_media`, `dim_grande` FROM `utenti` WHERE `id` = $id_utente";
	$rowD = $query->freeQuery ($sqlD, 0);
	if ($id_galleria > 2) { # azioni per gallerie
		$dim_norm = $rowD[0]->dim_media;
		# recupera l'ordine massimo
		$sqlO = "SELECT MAX(ordine) AS `ordine` FROM `foto` WHERE `id_galleria`= $id_galleria";
		$rowO = $query->freeQuery ($sqlO, 0);
		$ordine = ($rowO[0]->ordine)+1;
	}
	else { # azioni per pagine interne
		$dim_norm = $rowD[0]->dim_foto;
		$ordine = 0;
	}
	resampleImg ($file_name, $dim_norm, $rowD[0]->dim_thumb, $rowD[0]->dim_grande);
	$query->freeQuery ("INSERT INTO `foto` (`id_utente`, `foto`, `id_galleria`, `ordine`) VALUES ($id_utente, '$file_name', '$id_galleria', '$ordine')", 0);

}

exit(0);

/* Handles the error output. This error message will be sent to the uploadSuccess event handler.  The event handler
will have to check for any error messages and react as needed. */
function HandleError($message) {
	echo $message;
}
?>

Cancel