merge with 1.4.5 branch(1.4.5.10)

git-svn-id: http://xe-core.googlecode.com/svn/trunk@9269 201d5d3c-b55e-5fd7-737f-ddc643e51545

modules/file/file.admin.view.php

@@ -163,11 +163,16 @@
             Context::set('total_count', $output->total_count);
             Context::set('total_page', $output->total_page);
             Context::set('page', $output->page);
-            Context::set('page_navigation', $output->page_navigation);
-
-            // 템플릿 지정
+            Context::set('page_navigation', $output->page_navigation);			
+			
+			$security = new Security();
+			$security->encodeHTML('file_list..source_filename','file_list..ipaddress');
+			$security->encodeHTML('module_list..browser_title','module_list..mid');						
+				
+			// 템플릿 지정
             $this->setTemplatePath($this->module_path.'tpl');
             $this->setTemplateFile('file_list');
+
         }
 
         /**

modules/file/file.controller.php

@@ -233,7 +233,7 @@
             header("Content-Transfer-Encoding: binary\n"); 
 
 			// if file size is lager than 10MB, use fread function (#18675748)
-			if (filesize($uploaded_filename) > pow(1024, 10240)) {
+			if (filesize($uploaded_filename) > 1024 * 1024) {
 				while(!feof($fp)) echo fread($fp, 1024);
 				fclose($fp);
 			} else {
@@ -266,7 +266,32 @@
             if(!$_SESSION['upload_info'][$editor_sequence]->enabled) exit();
 
             $upload_target_srl = $_SESSION['upload_info'][$editor_sequence]->upload_target_srl;
-            if($upload_target_srl && $file_srl) $output = $this->deleteFile($file_srl);
+
+			$logged_info = Context::get('logged_info');
+			$oFileModel = &getModel('file');
+
+            $srls = explode(',',$file_srl);
+            if(!count($srls)) return;
+
+            for($i=0;$i<count($srls);$i++) {
+                $srl = (int)$srls[$i];
+                if(!$srl) continue;
+
+                $args = null;
+                $args->file_srl = $srl;
+                $output = executeQuery('file.getFile', $args);
+                if(!$output->toBool()) continue;
+
+                $file_info = $output->data;
+                if(!$file_info) continue;
+
+				$file_grant = $oFileModel->getFileGrant($file_info, $logged_info); 
+
+				if(!$file_grant->is_deletable) continue;
+
+				if($upload_target_srl && $file_srl) $output = $this->deleteFile($file_srl);
+            }
+
         }
 
         /**
@@ -477,6 +502,9 @@
             $trigger_output = ModuleHandler::triggerCall('file.insertFile', 'after', $args);
             if(!$trigger_output->toBool()) return $trigger_output;
 
+
+			$_SESSION['__XE_UPLOADING_FILES_INFO__'][$args->file_srl] = true;
+
             $output->add('file_srl', $args->file_srl);
             $output->add('file_size', $args->file_size);
             $output->add('sid', $args->sid);

modules/file/file.model.php

@@ -209,5 +209,25 @@
         function getFileModuleConfig($module_srl) {
             return $this->getFileConfig($module_srl);
         }
+
+		function getFileGrant($file_info, $member_info){
+			if (!$file_info) return null;
+
+			if ($_SESSION['__XE_UPLOADING_FILES_INFO__'][$file_info->file_srl]) {
+				$file_grant->is_deletable = true;
+				return $file_grant;
+			}
+
+			$oModuleModel = &getModel('module');
+			$grant = $oModuleModel->getGrant($oModuleModel->getModuleInfoByModuleSrl($file_info->module_srl), $member_info);
+
+			$oDocumentModel = &getModel('document');
+			$oDocument = $oDocumentModel->getDocument($file_info->upload_target_srl);
+			if ($oDocument->isExists()) $document_grant = $oDocument->isGranted(); 
+			
+			$file_grant->is_deletable = ($document_grant || $member_info->is_admin == 'Y' || $member_info->member_srl == $file_info->member_srl || $grant->manager);
+			
+			return $file_grant;
+		}
     }
 ?>

modules/file/tpl/file_list.html

@@ -92,7 +92,7 @@
     <tr>
         <td class="tCenter number">{$no}</td>
         <td class="tCenter"><input type="checkbox" name="cart" value="{$val->file_srl}" /></td>
-        <td class="wide"><a href="{$val->download_url}" class="red">{htmlspecialchars($val->source_filename)}</a></td>
+        <td class="wide"><a href="{$val->download_url}" class="red">{$val->source_filename}</a></td>
         <td class="number tRight">{FileHandler::filesize($val->file_size)}</td>
         <td class="tCenter">
         <!--@if($val->isvalid=='Y')-->