includes/SpecialUpload.php

   1 <?php
   2
   3 function wfSpecialUpload()
   4 {
   5         global $wgUser, $wgOut, $wpUpload, $wpReUpload, $action;
   6         global $wgDisableUploads;
   7
   8     if ( $wgDisableUploads ) {
   9         $wgOut->addWikiText( wfMsg( "uploaddisabled" ) );
  10         return;
  11     }
  12         if ( ( 0 == $wgUser->getID() )
  13                 or $wgUser->isBlocked() ) {
  14                 $wgOut->errorpage( "uploadnologin", "uploadnologintext" );
  15                 return;
  16         }
  17         if ( wfReadOnly() ) {
  18                 $wgOut->readOnlyPage();
  19                 return;
  20         }
  21         if ( isset( $wpReUpload) ) {
  22                 unsaveUploadedFile();
  23                 mainUploadForm( "" );
  24         } else if ( "submit" == $action || isset( $wpUpload ) ) {
  25                 processUpload();
  26         } else {
  27                 mainUploadForm( "" );
  28         }
  29 }
  30
  31 function processUpload()
  32 {
  33         global $wgUser, $wgOut, $wgLang, $wpUploadAffirm, $wpUploadFile;
  34         global $wpUploadDescription, $wpIgnoreWarning;
  35         global $wgUploadDirectory;
  36         global $wpUploadSaveName, $wpUploadTempName, $wpUploadSize;
  37         global $wgSavedFile, $wgUploadOldVersion, $wpUploadOldVersion;
  38         global $wgUseCopyrightUpload , $wpUploadCopyStatus , $wpUploadSource ;
  39         global $wgCheckFileExtensions, $wgStrictFileExtensions;
  40         global $wgFileExtensions, $wgFileBlacklist;
  41         global $wgRequest;
  42
  43         if ( $wgUseCopyrightUpload ) {
  44                 $wpUploadAffirm = 1;
  45                 if ( trim ( $wpUploadCopyStatus ) == "" || trim ( $wpUploadSource ) == "" ) {
  46                         $wpUploadAffirm = 0;
  47                 }
  48         }
  49
  50         if ( 1 != $wpUploadAffirm ) {
  51                 mainUploadForm( WfMsg( "noaffirmation" ) );
  52                 return;
  53         }
  54         if ( ! $wpUploadTempName ) {
  55                 $wpUploadTempName = $_FILES['wpUploadFile']['tmp_name'];
  56         }
  57         if ( ! $wpUploadSize ) {
  58                 $wpUploadSize = $_FILES['wpUploadFile']['size'];
  59         }
  60         $prev = error_reporting( E_ALL & ~( E_NOTICE | E_WARNING ) );
  61         $oname = $wgRequest->getGPCVal( $_FILES['wpUploadFile'], 'name' );
  62         error_reporting( $prev );
  63
  64         if ( "" != $oname ) {
  65                 $basename = strrchr( $oname, "/" );
  66                 if ( false === $basename ) { $basename = $oname; }
  67                 else ( $basename = substr( $basename, 1 ) );
  68
  69                 $ext = strrchr( $basename, "." );
  70                 if ( false === $ext ) { $ext = ""; }
  71                 else { $ext = substr( $ext, 1 ); }
  72
  73                 if ( "" == $ext ) { $xl = 0; } else { $xl = strlen( $ext ) + 1; }
  74                 $partname = substr( $basename, 0, strlen( $basename ) - $xl );
  75
  76                 if ( strlen( $partname ) < 3 ) {
  77                         mainUploadForm( WfMsg( "minlength" ) );
  78                         return;
  79                 }
  80                 $nt = Title::newFromText( $basename );
  81                 $wpUploadSaveName = $nt->getDBkey();
  82
  83                 /* Don't allow users to override the blacklist */
  84                 if( checkFileExtension( $ext, $wgFileBlacklist ) ||
  85                         ($wgStrictFileExtensions && !checkFileExtension( $ext, $wgFileExtensions ) ) ) {
  86                         return uploadError( wfMsg( "badfiletype", $ext ) );
  87                 }
  88
  89                 saveUploadedFile();
  90                 if ( ( ! $wpIgnoreWarning ) &&
  91                   ( 0 != strcmp( ucfirst( $basename ), $wpUploadSaveName ) ) ) {
  92                         return uploadWarning( wfMsg( "badfilename", $wpUploadSaveName ) );
  93                 }
  94
  95                 if ( $wgCheckFileExtensions ) {
  96                         if ( ( ! $wpIgnoreWarning ) &&
  97                                  ( ! checkFileExtension( $ext, $wgFileExtensions ) ) ) {
  98                                 return uploadWarning( wfMsg( "badfiletype", $ext ) );
  99                         }
 100                 }
 101                 if ( ( ! $wpIgnoreWarning ) && ( $wpUploadSize > 150000 ) ) {
 102                         return uploadWarning( WfMsg( "largefile" ) );
 103                 }
 104         }
 105         if ( isset( $wpUploadOldVersion ) ) {
 106                 $wgUploadOldVersion = $wpUploadOldVersion;
 107         }
 108         wfRecordUpload( $wpUploadSaveName, $wgUploadOldVersion,
 109           $wpUploadSize, $wpUploadDescription );
 110
 111         $sk = $wgUser->getSkin();
 112         $ilink = $sk->makeMediaLink( $wpUploadSaveName, wfImageUrl(
 113           $wpUploadSaveName ) );
 114         $dname = $wgLang->getNsText( Namespace::getImage() ) . ":{$wpUploadSaveName}";
 115         $dlink = $sk->makeKnownLink( $dname, $dname );
 116
 117         $wgOut->addHTML( "<h2>" . wfMsg( "successfulupload" ) . "</h2>\n" );
 118         $text = wfMsg( "fileuploaded", $ilink, $dlink );
 119         $wgOut->addHTML( "<p>{$text}\n" );
 120         $wgOut->returnToMain( false );
 121 }
 122
 123 function checkFileExtension( $ext, $list ) {
 124         return in_array( strtolower( $ext ), $list );
 125 }
 126
 127 function saveUploadedFile()
 128 {
 129         global $wpUploadSaveName, $wpUploadTempName;
 130         global $wgSavedFile, $wgUploadOldVersion;
 131         global $wgUploadDirectory, $wgOut;
 132
 133         $dest = wfImageDir( $wpUploadSaveName );
 134         $archive = wfImageArchiveDir( $wpUploadSaveName );
 135         $wgSavedFile = "{$dest}/{$wpUploadSaveName}";
 136
 137         if ( is_file( $wgSavedFile ) ) {
 138                 $wgUploadOldVersion = gmdate( "YmdHis" ) . "!{$wpUploadSaveName}";
 139
 140                 if ( ! rename( $wgSavedFile, "${archive}/{$wgUploadOldVersion}" ) ) {
 141                         $wgOut->fileRenameError( $wgSavedFile,
 142                           "${archive}/{$wgUploadOldVersion}" );
 143                         return;
 144                 }
 145         } else {
 146                 $wgUploadOldVersion = "";
 147         }
 148         if ( ! move_uploaded_file( $wpUploadTempName, $wgSavedFile ) ) {
 149                 $wgOut->fileCopyError( $wpUploadTempName, $wgSavedFile );
 150         }
 151         chmod( $wgSavedFile, 0644 );
 152 }
 153
 154 function unsaveUploadedFile()
 155 {
 156         global $wpSessionKey, $wpUploadOldVersion;
 157         global $wgUploadDirectory, $wgOut;
 158
 159         $wgSavedFile = $_SESSION['wsUploadFiles'][$wpSessionKey];
 160         $wgUploadOldVersion = $wpUploadOldVersion;
 161
 162         if ( ! @unlink( $wgSavedFile ) ) {
 163                 $wgOut->fileDeleteError( $wgSavedFile );
 164                 return;
 165         }
 166         if ( "" != $wgUploadOldVersion ) {
 167                 $hash = md5( substr( $wgUploadOldVersion, 15 ) );
 168                 $archive = "{$wgUploadDirectory}/archive/" . $hash{0} .
 169                 "/" . substr( $hash, 0, 2 );
 170
 171                 if ( ! rename( "{$archive}/{$wgUploadOldVersion}", $wgSavedFile ) ) {
 172                         $wgOut->fileRenameError( "{$archive}/{$wgUploadOldVersion}",
 173                           $wgSavedFile );
 174                 }
 175         }
 176 }
 177
 178 function uploadError( $error )
 179 {
 180         global $wgOut;
 181         $sub = wfMsg( "uploadwarning" );
 182         $wgOut->addHTML( "<h2>{$sub}</h2>\n" );
 183         $wgOut->addHTML( "<h4><font color=red>{$error}</font></h4>\n" );
 184 }
 185
 186 function uploadWarning( $warning )
 187 {
 188         global $wgOut, $wgUser, $wgLang, $wgUploadDirectory;
 189         global $wpUpload, $wpReUpload, $wpUploadAffirm, $wpUploadFile;
 190         global $wpUploadDescription, $wpIgnoreWarning;
 191         global $wpUploadSaveName, $wpUploadTempName, $wpUploadSize;
 192         global $wgSavedFile, $wgUploadOldVersion;
 193         global $wpSessionKey, $wpUploadOldVersion;
 194         global $wgUseCopyrightUpload , $wpUploadCopyStatus , $wpUploadSource ;
 195
 196         # wgSavedFile is stored in the session not the form, for security
 197         $wpSessionKey = mt_rand( 0, 0x7fffffff );
 198         $_SESSION['wsUploadFiles'][$wpSessionKey] = $wgSavedFile;
 199
 200         $sub = wfMsg( "uploadwarning" );
 201         $wgOut->addHTML( "<h2>{$sub}</h2>\n" );
 202         $wgOut->addHTML( "<h4><font color=red>{$warning}</font></h4>\n" );
 203
 204         $save = wfMsg( "savefile" );
 205         $reupload = wfMsg( "reupload" );
 206         $iw = wfMsg( "ignorewarning" );
 207         $reup = wfMsg( "reuploaddesc" );
 208         $titleObj = Title::makeTitle( NS_SPECIAL, "Upload" );
 209         $action = $titleObj->escapeLocalURL( "action=submit" );
 210
 211         if ( $wgUseCopyrightUpload )
 212         {
 213                 $copyright =  "
 214 <input type=hidden name=\"wpUploadCopyStatus\" value=\"" . htmlspecialchars( $wpUploadCopyStatus ) . "\">
 215 <input type=hidden name=\"wpUploadSource\" value=\"" . htmlspecialchars( $wpUploadSource ) . "\">
 216 ";
 217         }
 218
 219         $wgOut->addHTML( "
 220 <form id=\"uploadwarning\" method=\"post\" enctype=\"multipart/form-data\"
 221 action=\"{$action}\">
 222 <input type=hidden name=\"wpUploadAffirm\" value=\"1\">
 223 <input type=hidden name=\"wpIgnoreWarning\" value=\"1\">
 224 <input type=hidden name=\"wpUploadDescription\" value=\"" . htmlspecialchars( $wpUploadDescription ) . "\">
 225 {$copyright}
 226 <input type=hidden name=\"wpUploadSaveName\" value=\"" . htmlspecialchars( $wpUploadSaveName ) . "\">
 227 <input type=hidden name=\"wpUploadTempName\" value=\"" . htmlspecialchars( $wpUploadTempName ) . "\">
 228 <input type=hidden name=\"wpUploadSize\" value=\"" . htmlspecialchars( $wpUploadSize ) . "\">
 229 <input type=hidden name=\"wpSessionKey\" value=\"" . htmlspecialchars( $wpSessionKey ) . "\">
 230 <input type=hidden name=\"wpUploadOldVersion\" value=\"" . htmlspecialchars( $wgUploadOldVersion) . "\">
 231 <table border=0><tr>
 232 <tr><td align=right>
 233 <input tabindex=2 type=submit name=\"wpUpload\" value=\"{$save}\">
 234 </td><td align=left>{$iw}</td></tr>
 235 <tr><td align=right>
 236 <input tabindex=2 type=submit name=\"wpReUpload\" value=\"{$reupload}\">
 237 </td><td align=left>{$reup}</td></tr></table></form>\n" );
 238 }
 239
 240 function mainUploadForm( $msg )
 241 {
 242         global $wgOut, $wgUser, $wgLang, $wgUploadDirectory;
 243         global $wpUpload, $wpUploadAffirm, $wpUploadFile;
 244         global $wpUploadDescription, $wpIgnoreWarning;
 245         global $wgUseCopyrightUpload , $wpUploadSource , $wpUploadCopyStatus ;
 246
 247         if ( "" != $msg ) {
 248                 $sub = wfMsg( "uploaderror" );
 249                 $wgOut->addHTML( "<h2>{$sub}</h2>\n" .
 250                   "<h4><font color=red>{$msg}</font></h4>\n" );
 251         } else {
 252                 $sub = wfMsg( "uploadfile" );
 253                 $wgOut->addHTML( "<h2>{$sub}</h2>\n" );
 254         }
 255         $wgOut->addHTML( "<p>" . wfMsg( "uploadtext" ) );
 256         $sk = $wgUser->getSkin();
 257
 258         $fn = wfMsg( "filename" );
 259         $fd = wfMsg( "filedesc" );
 260         $ulb = wfMsg( "uploadbtn" );
 261
 262         $clink = $sk->makeKnownLink( wfMsg( "copyrightpage" ),
 263           wfMsg( "copyrightpagename" ) );
 264         $ca = wfMsg( "affirmation", $clink );
 265         $iw = wfMsg( "ignorewarning" );
 266
 267         $titleObj = Title::makeTitle( NS_SPECIAL, "Upload" );
 268         $action = $titleObj->escapeLocalURL();
 269
 270         $source = "
 271 <td align=right>
 272 <input tabindex=3 type=checkbox name=\"wpUploadAffirm\" value=\"1\" id=\"wpUploadAffirm\">
 273 </td><td align=left><label for=\"wpUploadAffirm\">{$ca}</label></td>
 274 " ;
 275         if ( $wgUseCopyrightUpload )
 276           {
 277             $source = "
 278 <td align=right nowrap>" . wfMsg ( "filestatus" ) . ":</td>
 279 <td><input tabindex=3 type=text name=\"wpUploadCopyStatus\" value=\"" .
 280 htmlspecialchars($wpUploadCopyStatus). "\" size=40></td>
 281 </tr><tr>
 282 <td align=right>". wfMsg ( "filesource" ) . ":</td>
 283 <td><input tabindex=4 type=text name=\"wpUploadSource\" value=\"" .
 284 htmlspecialchars($wpUploadSource). "\" size=40></td>
 285 " ;
 286           }
 287
 288         $wgOut->addHTML( "
 289 <form id=\"upload\" method=\"post\" enctype=\"multipart/form-data\"
 290 action=\"{$action}\">
 291 <table border=0><tr>
 292 <td align=right>{$fn}:</td><td align=left>
 293 <input tabindex=1 type=file name=\"wpUploadFile\" value=\""
 294   . htmlspecialchars( $wpUploadFile ) . "\" size=40>
 295 </td></tr><tr>
 296 <td align=right>{$fd}:</td><td align=left>
 297 <input tabindex=2 type=text name=\"wpUploadDescription\" value=\""
 298   . htmlspecialchars( $wpUploadDescription ) . "\" size=40>
 299 </td></tr><tr>
 300 {$source}
 301 </tr>
 302 <tr><td>&nbsp;</td><td align=left>
 303 <input tabindex=5 type=submit name=\"wpUpload\" value=\"{$ulb}\">
 304 </td></tr></table></form>\n" );
 305 }
 306
 307 ?>