← Back to branch summary

~ubuntu-branches/ubuntu/oneiric/moin/oneiric-security

« back to all changes in this revision

Viewing changes to wiki/htdocs/applets/FCKeditor/editor/filemanager/connectors/php/commands.php

  • Committer: Bazaar Package Importer
  • Author(s): Jamie Strandboge
  • Date: 2010-03-30 12:55:34 UTC
  • mfrom: (0.1.17 sid)
  • Revision ID: james.westby@ubuntu.com-20100330125534-4c2ufc1rok24447l
Tags: 1.9.2-2ubuntu1
https://launchpad.net/bugs/521834
* Merge from Debian testing (LP: #521834). Based on work by Stefan Ebner.
  Remaining changes:
 - Remove python-xml from Suggests field, the package isn't anymore in
   sys.path.
 - Demote fckeditor from Recommends to Suggests; the code was previously
   embedded in moin, but it was also disabled, so there's no reason for us
   to pull this in by default currently. Note: This isn't necessary anymore
   but needs a MIR for fckeditor, so postpone dropping this change until
   lucid+1
* debian/rules:
  - Replace hardcoded python2.5 with python* and hardcore python2.6 for ln
* debian/control.in: drop versioned depends on cdbs

Show diffs side-by-side

added added

removed removed

Lines of Context:
wiki/htdocs/applets/FCKeditor/editor/filemanager/connectors/php/commands.php
1
 
<?php
2
 
/*
3
 
 * FCKeditor - The text editor for Internet - http://www.fckeditor.net
4
 
 * Copyright (C) 2003-2009 Frederico Caldeira Knabben
5
 
 *
6
 
 * == BEGIN LICENSE ==
7
 
 *
8
 
 * Licensed under the terms of any of the following licenses at your
9
 
 * choice:
10
 
 *
11
 
 *  - GNU General Public License Version 2 or later (the "GPL")
12
 
 *    http://www.gnu.org/licenses/gpl.html
13
 
 *
14
 
 *  - GNU Lesser General Public License Version 2.1 or later (the "LGPL")
15
 
 *    http://www.gnu.org/licenses/lgpl.html
16
 
 *
17
 
 *  - Mozilla Public License Version 1.1 or later (the "MPL")
18
 
 *    http://www.mozilla.org/MPL/MPL-1.1.html
19
 
 *
20
 
 * == END LICENSE ==
21
 
 *
22
 
 * This is the File Manager Connector for PHP.
23
 
 */
24
 
 
25
 
function GetFolders( $resourceType, $currentFolder )
26
 
{
27
 
        // Map the virtual path to the local server path.
28
 
        $sServerDir = ServerMapFolder( $resourceType, $currentFolder, 'GetFolders' ) ;
29
 
 
30
 
        // Array that will hold the folders names.
31
 
        $aFolders       = array() ;
32
 
 
33
 
        $oCurrentFolder = opendir( $sServerDir ) ;
34
 
 
35
 
        while ( $sFile = readdir( $oCurrentFolder ) )
36
 
        {
37
 
                if ( $sFile != '.' && $sFile != '..' && is_dir( $sServerDir . $sFile ) )
38
 
                        $aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
39
 
        }
40
 
 
41
 
        closedir( $oCurrentFolder ) ;
42
 
 
43
 
        // Open the "Folders" node.
44
 
        echo "<Folders>" ;
45
 
 
46
 
        natcasesort( $aFolders ) ;
47
 
        foreach ( $aFolders as $sFolder )
48
 
                echo $sFolder ;
49
 
 
50
 
        // Close the "Folders" node.
51
 
        echo "</Folders>" ;
52
 
}
53
 
 
54
 
function GetFoldersAndFiles( $resourceType, $currentFolder )
55
 
{
56
 
        // Map the virtual path to the local server path.
57
 
        $sServerDir = ServerMapFolder( $resourceType, $currentFolder, 'GetFoldersAndFiles' ) ;
58
 
 
59
 
        // Arrays that will hold the folders and files names.
60
 
        $aFolders       = array() ;
61
 
        $aFiles         = array() ;
62
 
 
63
 
        $oCurrentFolder = opendir( $sServerDir ) ;
64
 
 
65
 
        while ( $sFile = readdir( $oCurrentFolder ) )
66
 
        {
67
 
                if ( $sFile != '.' && $sFile != '..' )
68
 
                {
69
 
                        if ( is_dir( $sServerDir . $sFile ) )
70
 
                                $aFolders[] = '<Folder name="' . ConvertToXmlAttribute( $sFile ) . '" />' ;
71
 
                        else
72
 
                        {
73
 
                                $iFileSize = @filesize( $sServerDir . $sFile ) ;
74
 
                                if ( !$iFileSize ) {
75
 
                                        $iFileSize = 0 ;
76
 
                                }
77
 
                                if ( $iFileSize > 0 )
78
 
                                {
79
 
                                        $iFileSize = round( $iFileSize / 1024 ) ;
80
 
                                        if ( $iFileSize < 1 ) $iFileSize = 1 ;
81
 
                                }
82
 
 
83
 
                                $aFiles[] = '<File name="' . ConvertToXmlAttribute( $sFile ) . '" size="' . $iFileSize . '" />' ;
84
 
                        }
85
 
                }
86
 
        }
87
 
 
88
 
        // Send the folders
89
 
        natcasesort( $aFolders ) ;
90
 
        echo '<Folders>' ;
91
 
 
92
 
        foreach ( $aFolders as $sFolder )
93
 
                echo $sFolder ;
94
 
 
95
 
        echo '</Folders>' ;
96
 
 
97
 
        // Send the files
98
 
        natcasesort( $aFiles ) ;
99
 
        echo '<Files>' ;
100
 
 
101
 
        foreach ( $aFiles as $sFiles )
102
 
                echo $sFiles ;
103
 
 
104
 
        echo '</Files>' ;
105
 
}
106
 
 
107
 
function CreateFolder( $resourceType, $currentFolder )
108
 
{
109
 
        if (!isset($_GET)) {
110
 
                global $_GET;
111
 
        }
112
 
        $sErrorNumber   = '0' ;
113
 
        $sErrorMsg              = '' ;
114
 
 
115
 
        if ( isset( $_GET['NewFolderName'] ) )
116
 
        {
117
 
                $sNewFolderName = $_GET['NewFolderName'] ;
118
 
                $sNewFolderName = SanitizeFolderName( $sNewFolderName ) ;
119
 
 
120
 
                if ( strpos( $sNewFolderName, '..' ) !== FALSE )
121
 
                        $sErrorNumber = '102' ;         // Invalid folder name.
122
 
                else
123
 
                {
124
 
                        // Map the virtual path to the local server path of the current folder.
125
 
                        $sServerDir = ServerMapFolder( $resourceType, $currentFolder, 'CreateFolder' ) ;
126
 
 
127
 
                        if ( is_writable( $sServerDir ) )
128
 
                        {
129
 
                                $sServerDir .= $sNewFolderName ;
130
 
 
131
 
                                $sErrorMsg = CreateServerFolder( $sServerDir ) ;
132
 
 
133
 
                                switch ( $sErrorMsg )
134
 
                                {
135
 
                                        case '' :
136
 
                                                $sErrorNumber = '0' ;
137
 
                                                break ;
138
 
                                        case 'Invalid argument' :
139
 
                                        case 'No such file or directory' :
140
 
                                                $sErrorNumber = '102' ;         // Path too long.
141
 
                                                break ;
142
 
                                        default :
143
 
                                                $sErrorNumber = '110' ;
144
 
                                                break ;
145
 
                                }
146
 
                        }
147
 
                        else
148
 
                                $sErrorNumber = '103' ;
149
 
                }
150
 
        }
151
 
        else
152
 
                $sErrorNumber = '102' ;
153
 
 
154
 
        // Create the "Error" node.
155
 
        echo '<Error number="' . $sErrorNumber . '" originalDescription="' . ConvertToXmlAttribute( $sErrorMsg ) . '" />' ;
156
 
}
157
 
 
158
 
function FileUpload( $resourceType, $currentFolder, $sCommand )
159
 
{
160
 
        if (!isset($_FILES)) {
161
 
                global $_FILES;
162
 
        }
163
 
        $sErrorNumber = '0' ;
164
 
        $sFileName = '' ;
165
 
 
166
 
        if ( isset( $_FILES['NewFile'] ) && !is_null( $_FILES['NewFile']['tmp_name'] ) )
167
 
        {
168
 
                global $Config ;
169
 
 
170
 
                $oFile = $_FILES['NewFile'] ;
171
 
 
172
 
                // Map the virtual path to the local server path.
173
 
                $sServerDir = ServerMapFolder( $resourceType, $currentFolder, $sCommand ) ;
174
 
 
175
 
                // Get the uploaded file name.
176
 
                $sFileName = $oFile['name'] ;
177
 
                $sFileName = SanitizeFileName( $sFileName ) ;
178
 
 
179
 
                $sOriginalFileName = $sFileName ;
180
 
 
181
 
                // Get the extension.
182
 
                $sExtension = substr( $sFileName, ( strrpos($sFileName, '.') + 1 ) ) ;
183
 
                $sExtension = strtolower( $sExtension ) ;
184
 
 
185
 
                if ( isset( $Config['SecureImageUploads'] ) )
186
 
                {
187
 
                        if ( ( $isImageValid = IsImageValid( $oFile['tmp_name'], $sExtension ) ) === false )
188
 
                        {
189
 
                                $sErrorNumber = '202' ;
190
 
                        }
191
 
                }
192
 
 
193
 
                if ( isset( $Config['HtmlExtensions'] ) )
194
 
                {
195
 
                        if ( !IsHtmlExtension( $sExtension, $Config['HtmlExtensions'] ) &&
196
 
                                ( $detectHtml = DetectHtml( $oFile['tmp_name'] ) ) === true )
197
 
                        {
198
 
                                $sErrorNumber = '202' ;
199
 
                        }
200
 
                }
201
 
 
202
 
                // Check if it is an allowed extension.
203
 
                if ( !$sErrorNumber && IsAllowedExt( $sExtension, $resourceType ) )
204
 
                {
205
 
                        $iCounter = 0 ;
206
 
 
207
 
                        while ( true )
208
 
                        {
209
 
                                $sFilePath = $sServerDir . $sFileName ;
210
 
 
211
 
                                if ( is_file( $sFilePath ) )
212
 
                                {
213
 
                                        $iCounter++ ;
214
 
                                        $sFileName = RemoveExtension( $sOriginalFileName ) . '(' . $iCounter . ').' . $sExtension ;
215
 
                                        $sErrorNumber = '201' ;
216
 
                                }
217
 
                                else
218
 
                                {
219
 
                                        move_uploaded_file( $oFile['tmp_name'], $sFilePath ) ;
220
 
 
221
 
                                        if ( is_file( $sFilePath ) )
222
 
                                        {
223
 
                                                if ( isset( $Config['ChmodOnUpload'] ) && !$Config['ChmodOnUpload'] )
224
 
                                                {
225
 
                                                        break ;
226
 
                                                }
227
 
 
228
 
                                                $permissions = 0777;
229
 
 
230
 
                                                if ( isset( $Config['ChmodOnUpload'] ) && $Config['ChmodOnUpload'] )
231
 
                                                {
232
 
                                                        $permissions = $Config['ChmodOnUpload'] ;
233
 
                                                }
234
 
 
235
 
                                                $oldumask = umask(0) ;
236
 
                                                chmod( $sFilePath, $permissions ) ;
237
 
                                                umask( $oldumask ) ;
238
 
                                        }
239
 
 
240
 
                                        break ;
241
 
                                }
242
 
                        }
243
 
 
244
 
                        if ( file_exists( $sFilePath ) )
245
 
                        {
246
 
                                //previous checks failed, try once again
247
 
                                if ( isset( $isImageValid ) && $isImageValid === -1 && IsImageValid( $sFilePath, $sExtension ) === false )
248
 
                                {
249
 
                                        @unlink( $sFilePath ) ;
250
 
                                        $sErrorNumber = '202' ;
251
 
                                }
252
 
                                else if ( isset( $detectHtml ) && $detectHtml === -1 && DetectHtml( $sFilePath ) === true )
253
 
                                {
254
 
                                        @unlink( $sFilePath ) ;
255
 
                                        $sErrorNumber = '202' ;
256
 
                                }
257
 
                        }
258
 
                }
259
 
                else
260
 
                        $sErrorNumber = '202' ;
261
 
        }
262
 
        else
263
 
                $sErrorNumber = '202' ;
264
 
 
265
 
 
266
 
        $sFileUrl = CombinePaths( GetResourceTypePath( $resourceType, $sCommand ) , $currentFolder ) ;
267
 
        $sFileUrl = CombinePaths( $sFileUrl, $sFileName ) ;
268
 
 
269
 
        SendUploadResults( $sErrorNumber, $sFileUrl, $sFileName ) ;
270
 
 
271
 
        exit ;
272
 
}
273
 
?>