*/ /** * Controller class of the file module * @author NAVER (developers@xpressengine.com) */ class fileController extends file { /** * Initialization * @return void */ function init() { } /** * Upload attachments in the editor * * Determine the upload target srl from editor_sequence and uploadTargetSrl variables. * Create and return the UploadTargetSrl if not exists so that UI can use the value * for sync. * * @return void */ function procFileUpload() { $file_info = Context::get('Filedata'); // An error appears if not a normally uploaded file if(!is_uploaded_file($file_info['tmp_name'])) exit(); // Basic variables setting $oFileModel = getModel('file'); $editor_sequence = Context::get('editor_sequence'); $upload_target_srl = intval(Context::get('uploadTargetSrl')); if(!$upload_target_srl) $upload_target_srl = intval(Context::get('upload_target_srl')); $module_srl = $this->module_srl; // Exit a session if there is neither upload permission nor information if(!$_SESSION['upload_info'][$editor_sequence]->enabled) exit(); // Extract from session information if upload_target_srl is not specified if(!$upload_target_srl) $upload_target_srl = $_SESSION['upload_info'][$editor_sequence]->upload_target_srl; // Create if upload_target_srl is not defined in the session information if(!$upload_target_srl) $_SESSION['upload_info'][$editor_sequence]->upload_target_srl = $upload_target_srl = getNextSequence(); return $this->insertFile($file_info, $module_srl, $upload_target_srl); } /** * Iframe upload attachments * * @return Object */ function procFileIframeUpload() { // Basic variables setting $editor_sequence = Context::get('editor_sequence'); $callback = Context::get('callback'); $module_srl = $this->module_srl; $upload_target_srl = intval(Context::get('uploadTargetSrl')); if(!$upload_target_srl) $upload_target_srl = intval(Context::get('upload_target_srl')); // Exit a session if there is neither upload permission nor information if(!$_SESSION['upload_info'][$editor_sequence]->enabled) exit(); // Extract from session information if upload_target_srl is not specified if(!$upload_target_srl) $upload_target_srl = $_SESSION['upload_info'][$editor_sequence]->upload_target_srl; // Create if upload_target_srl is not defined in the session information if(!$upload_target_srl) $_SESSION['upload_info'][$editor_sequence]->upload_target_srl = $upload_target_srl = getNextSequence(); // Delete and then attempt to re-upload if file_srl is requested $file_srl = Context::get('file_srl'); if($file_srl) $this->deleteFile($file_srl); $file_info = Context::get('Filedata'); // An error appears if not a normally uploaded file if(is_uploaded_file($file_info['tmp_name'])) { $output = $this->insertFile($file_info, $module_srl, $upload_target_srl); Context::set('uploaded_fileinfo',$output); } Context::set('layout','none'); $this->setTemplatePath($this->module_path.'tpl'); $this->setTemplateFile('iframe'); } /** * Image resize * * @return Object */ function procFileImageResize() { $file_srl = Context::get('file_srl'); $width = Context::get('width'); $height = Context::get('height'); if(!$file_srl || !$width) { return new Object(-1,'msg_invalid_request'); } $oFileModel = getModel('file'); $fileInfo = $oFileModel->getFile($file_srl); if(!$fileInfo || $fileInfo->direct_download != 'Y') { return new Object(-1,'msg_invalid_request'); } $source_src = $fileInfo->uploaded_filename; $output_src = $source_src . '.resized' . strrchr($source_src,'.'); $type = 'ratio'; if(!$height) $height = $width-1; if(FileHandler::createImageFile($source_src,$output_src,$width,$height,'','ratio')) { $output->info = getimagesize($output_src); $output->src = $output_src; } else { return new Object(-1,'msg_invalid_request'); } $this->add('resized_info',$output); } /** * Download Attachment * *
* Receive a request directly * file_srl: File sequence * sid : value in DB for comparison, No download if not matched * * This method call trigger 'file.downloadFile'. * before, after. * Trigger object contains: * - download_url * - file_srl * - upload_target_srl * - upload_target_type * - sid * - module_srl * - member_srl * - download_count * - direct_download * - source_filename * - uploaded_filename * - file_size * - comment * - isvalid * - regdate * - ipaddress ** * return void */ function procFileDownload() { $oFileModel = getModel('file'); if(isset($this->grant->access) && $this->grant->access !== true) return new Object(-1, 'msg_not_permitted'); $file_srl = Context::get('file_srl'); $sid = Context::get('sid'); $logged_info = Context::get('logged_info'); // Get file information from the DB $columnList = array('file_srl', 'sid', 'isvalid', 'source_filename', 'module_srl', 'uploaded_filename', 'file_size', 'member_srl', 'upload_target_srl', 'upload_target_type'); $file_obj = $oFileModel->getFile($file_srl, $columnList); // If the requested file information is incorrect, an error that file cannot be found appears if($file_obj->file_srl!=$file_srl || $file_obj->sid!=$sid) return $this->stop('msg_file_not_found'); // Notify that file download is not allowed when standing-by(Only a top-administrator is permitted) if($logged_info->is_admin != 'Y' && $file_obj->isvalid!='Y') return $this->stop('msg_not_permitted_download'); // File name $filename = $file_obj->source_filename; $file_module_config = $oFileModel->getFileModuleConfig($file_obj->module_srl); // Not allow the file outlink if($file_module_config->allow_outlink == 'N') { // Handles extension to allow outlink if($file_module_config->allow_outlink_format) { $allow_outlink_format_array = array(); $allow_outlink_format_array = explode(',', $file_module_config->allow_outlink_format); if(!is_array($allow_outlink_format_array)) $allow_outlink_format_array[0] = $file_module_config->allow_outlink_format; foreach($allow_outlink_format_array as $val) { $val = trim($val); if(preg_match("/\.{$val}$/i", $filename)) { $file_module_config->allow_outlink = 'Y'; break; } } } // Sites that outlink is allowed if($file_module_config->allow_outlink != 'Y') { $referer = parse_url($_SERVER["HTTP_REFERER"]); if($referer['host'] != $_SERVER['HTTP_HOST']) { if($file_module_config->allow_outlink_site) { $allow_outlink_site_array = array(); $allow_outlink_site_array = explode("\n", $file_module_config->allow_outlink_site); if(!is_array($allow_outlink_site_array)) $allow_outlink_site_array[0] = $file_module_config->allow_outlink_site; foreach($allow_outlink_site_array as $val) { $site = parse_url(trim($val)); if($site['host'] == $referer['host']) { $file_module_config->allow_outlink = 'Y'; break; } } } } else $file_module_config->allow_outlink = 'Y'; } if($file_module_config->allow_outlink != 'Y') return $this->stop('msg_not_allowed_outlink'); } // Check if a permission for file download is granted $downloadGrantCount = 0; if(is_array($file_module_config->download_grant)) { foreach($file_module_config->download_grant AS $value) if($value) $downloadGrantCount++; } if(is_array($file_module_config->download_grant) && $downloadGrantCount>0) { if(!Context::get('is_logged')) return $this->stop('msg_not_permitted_download'); $logged_info = Context::get('logged_info'); if($logged_info->is_admin != 'Y') { $oModuleModel =& getModel('module'); $columnList = array('module_srl', 'site_srl'); $module_info = $oModuleModel->getModuleInfoByModuleSrl($file_obj->module_srl, $columnList); if(!$oModuleModel->isSiteAdmin($logged_info, $module_info->site_srl)) { $oMemberModel =& getModel('member'); $member_groups = $oMemberModel->getMemberGroups($logged_info->member_srl, $module_info->site_srl); $is_permitted = false; for($i=0;$i
* This method call trigger 'file.insertFile'. * * Before trigger object contains: * - module_srl * - upload_target_srl * * After trigger object contains: * - file_srl * - upload_target_srl * - module_srl * - direct_download * - source_filename * - uploaded_filename * - donwload_count * - file_size * - comment * - member_srl * - sid ** * @param object $file_info PHP file information array * @param int $module_srl Sequence of module to upload file * @param int $upload_target_srl Sequence of target to upload file * @param int $download_count Initial download count * @param bool $manual_insert If set true, pass validation check * @return Object */ function insertFile($file_info, $module_srl, $upload_target_srl, $download_count = 0, $manual_insert = false) { // Call a trigger (before) $trigger_obj = new stdClass; $trigger_obj->module_srl = $module_srl; $trigger_obj->upload_target_srl = $upload_target_srl; $output = ModuleHandler::triggerCall('file.insertFile', 'before', $trigger_obj); if(!$output->toBool()) return $output; // A workaround for Firefox upload bug if(preg_match('/^=\?UTF-8\?B\?(.+)\?=$/i', $file_info['name'], $match)) { $file_info['name'] = base64_decode(strtr($match[1], ':', '/')); } if(!$manual_insert) { // Get the file configurations $logged_info = Context::get('logged_info'); if($logged_info->is_admin != 'Y') { $oFileModel = getModel('file'); $config = $oFileModel->getFileConfig($module_srl); $allowed_filesize = $config->allowed_filesize * 1024 * 1024; $allowed_attach_size = $config->allowed_attach_size * 1024 * 1024; // An error appears if file size exceeds a limit if($allowed_filesize < filesize($file_info['tmp_name'])) return new Object(-1, 'msg_exceeds_limit_size'); // Get total file size of all attachements (from DB) $size_args = new stdClass; $size_args->upload_target_srl = $upload_target_srl; $output = executeQuery('file.getAttachedFileSize', $size_args); $attached_size = (int)$output->data->attached_size + filesize($file_info['tmp_name']); if($attached_size > $allowed_attach_size) return new Object(-1, 'msg_exceeds_limit_size'); } } // Set upload path by checking if the attachement is an image or other kinds of file if(preg_match("/\.(jpe?g|gif|png|wm[va]|mpe?g|avi|swf|flv|mp[1-4]|as[fx]|wav|midi?|moo?v|qt|r[am]{1,2}|m4v)$/i", $file_info['name'])) { // Immediately remove the direct file if it has any kind of extensions for hacking $file_info['name'] = preg_replace('/\.(php|phtm|phar|html?|cgi|pl|exe|jsp|asp|inc)/i', '$0-x',$file_info['name']); $file_info['name'] = str_replace(array('<','>'),array('%3C','%3E'),$file_info['name']); $path = sprintf("./files/attach/images/%s/%s", $module_srl,getNumberingPath($upload_target_srl,3)); // special character to '_' // change to md5 file name. because window php bug. window php is not recognize unicode character file name - by cherryfilter $ext = substr(strrchr($file_info['name'],'.'),1); //$_filename = preg_replace('/[#$&*?+%"\']/', '_', $file_info['name']); $_filename = md5(crypt(rand(1000000,900000), rand(0,100))).'.'.$ext; $filename = $path.$_filename; $idx = 1; while(file_exists($filename)) { $filename = $path.preg_replace('/\.([a-z0-9]+)$/i','_'.$idx.'.$1',$_filename); $idx++; } $direct_download = 'Y'; } else { $path = sprintf("./files/attach/binaries/%s/%s", $module_srl, getNumberingPath($upload_target_srl,3)); $filename = $path.md5(crypt(rand(1000000,900000), rand(0,100))); $direct_download = 'N'; } // Create a directory if(!FileHandler::makeDir($path)) return new Object(-1,'msg_not_permitted_create'); // Check uploaded file if(!checkUploadedFile($file_info['tmp_name'])) return new Object(-1,'msg_file_upload_error'); // Move the file if($manual_insert) { @copy($file_info['tmp_name'], $filename); if(!file_exists($filename)) { $filename = $path. md5(crypt(rand(1000000,900000).$file_info['name'])).'.'.$ext; @copy($file_info['tmp_name'], $filename); } } else { if(!@move_uploaded_file($file_info['tmp_name'], $filename)) { $filename = $path. md5(crypt(rand(1000000,900000).$file_info['name'])).'.'.$ext; if(!@move_uploaded_file($file_info['tmp_name'], $filename)) return new Object(-1,'msg_file_upload_error'); } } // Get member information $oMemberModel = getModel('member'); $member_srl = $oMemberModel->getLoggedMemberSrl(); // List file information $args = new stdClass; $args->file_srl = getNextSequence(); $args->upload_target_srl = $upload_target_srl; $args->module_srl = $module_srl; $args->direct_download = $direct_download; $args->source_filename = $file_info['name']; $args->uploaded_filename = $filename; $args->download_count = $download_count; $args->file_size = @filesize($filename); $args->comment = NULL; $args->member_srl = $member_srl; $args->sid = md5(rand(rand(1111111,4444444),rand(4444445,9999999))); $output = executeQuery('file.insertFile', $args); if(!$output->toBool()) return $output; // Call a trigger (after) $trigger_output = ModuleHandler::triggerCall('file.insertFile', 'after', $args); if(!$trigger_output->toBool()) return $trigger_output; $_SESSION['__XE_UPLOADING_FILES_INFO__'][$args->file_srl] = true; $output->add('file_srl', $args->file_srl); $output->add('file_size', $args->file_size); $output->add('sid', $args->sid); $output->add('direct_download', $args->direct_download); $output->add('source_filename', $args->source_filename); $output->add('upload_target_srl', $upload_target_srl); $output->add('uploaded_filename', $args->uploaded_filename); return $output; } /** * Delete the attachment * *
* This method call trigger 'file.deleteFile'. * Before, after trigger object contains: * - download_url * - file_srl * - upload_target_srl * - upload_target_type * - sid * - module_srl * - member_srl * - download_count * - direct_download * - source_filename * - uploaded_filename * - file_size * - comment * - isvalid * - regdate * - ipaddress ** * @param int $file_srl Sequence of file to delete * @return Object */ function deleteFile($file_srl) { if(!$file_srl) return; $srls = explode(',',$file_srl); if(!count($srls)) return; $oDocumentController = getController('document'); $documentSrlList = array(); for($i=0;$i