6 * @copyright (c) 2005 phpBB Group
7 * @license http://opensource.org/licenses/gpl-license.php GNU Public License
14 if (!defined('IN_PHPBB'))
20 * Responsible for holding all file relevant information, as well as doing file-specific operations.
21 * The {@link fileupload fileupload class} can be used to upload several files, each of them being this object to operate further on.
34 var $image_info = array();
36 var $destination_file = '';
37 var $destination_path = '';
39 var $file_moved = false;
40 var $init_error = false;
51 function filespec($upload_ary, $upload_namespace)
53 if (!isset($upload_ary))
55 $this->init_error
= true;
59 $this->filename
= $upload_ary['tmp_name'];
60 $this->filesize
= $upload_ary['size'];
61 $name = trim(utf8_htmlspecialchars(utf8_basename($upload_ary['name'])));
62 $this->realname
= $this->uploadname
= (STRIP
) ?
stripslashes($name) : $name;
63 $this->mimetype
= $upload_ary['type'];
65 // Opera adds the name to the mime type
66 $this->mimetype
= (strpos($this->mimetype
, '; name') !== false) ?
str_replace(strstr($this->mimetype
, '; name'), '', $this->mimetype
) : $this->mimetype
;
70 $this->mimetype
= 'application/octetstream';
73 $this->extension
= strtolower($this->get_extension($this->realname
));
75 // Try to get real filesize from temporary folder (not always working) ;)
76 $this->filesize
= (@filesize
($this->filename
)) ? @filesize
($this->filename
) : $this->filesize
;
78 $this->width
= $this->height
= 0;
79 $this->file_moved
= false;
81 $this->local
= (isset($upload_ary['local_mode'])) ?
true : false;
82 $this->upload
= $upload_namespace;
86 * Cleans destination filename
88 * @param real|unique|unique_ext $mode real creates a realname, filtering some characters, lowering every character. Unique creates an unique filename
89 * @param string $prefix Prefix applied to filename
92 function clean_filename($mode = 'unique', $prefix = '', $user_id = '')
94 if ($this->init_error
)
102 // Remove every extension from filename (to not let the mime bug being exposed)
103 if (strpos($this->realname
, '.') !== false)
105 $this->realname
= substr($this->realname
, 0, strpos($this->realname
, '.'));
108 // Replace any chars which may cause us problems with _
109 $bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');
111 $this->realname
= rawurlencode(str_replace($bad_chars, '_', strtolower($this->realname
)));
112 $this->realname
= preg_replace("/%(\w{2})/", '_', $this->realname
);
114 $this->realname
= $prefix . $this->realname
. '.' . $this->extension
;
118 $this->realname
= $prefix . md5(unique_id());
122 $this->extension
= strtolower($this->extension
);
123 $this->realname
= $prefix . $user_id . '.' . $this->extension
;
129 $this->realname
= $prefix . md5(unique_id()) . '.' . $this->extension
;
135 * Get property from file object
137 function get($property)
139 if ($this->init_error ||
!isset($this->$property))
144 return $this->$property;
148 * Check if file is an image (mimetype)
150 * @return true if it is an image, false if not
154 return (strpos($this->mimetype
, 'image/') !== false) ?
true : false;
158 * Check if the file got correctly uploaded
160 * @return true if it is a valid upload, false if not
162 function is_uploaded()
164 if (!$this->local
&& !is_uploaded_file($this->filename
))
169 if ($this->local
&& !file_exists($this->filename
))
182 if ($this->file_moved
)
184 @unlink
($this->destination_file
);
191 function get_extension($filename)
193 if (strpos($filename, '.') === false)
198 $filename = explode('.', $filename);
199 return array_pop($filename);
203 * Get mimetype. Utilize mime_content_type if the function exist.
204 * Not used at the moment...
206 function get_mimetype($filename)
210 if (function_exists('mime_content_type'))
212 $mimetype = mime_content_type($filename);
215 // Some browsers choke on a mimetype of application/octet-stream
216 if (!$mimetype ||
$mimetype == 'application/octet-stream')
218 $mimetype = 'application/octetstream';
227 function get_filesize($filename)
229 return @filesize
($filename);
234 * Check the first 256 bytes for forbidden content
236 function check_content($disallowed_content)
238 if (empty($disallowed_content))
243 $fp = @fopen
($this->filename
, 'rb');
247 $ie_mime_relevant = fread($fp, 256);
249 foreach ($disallowed_content as $forbidden)
251 if (stripos($ie_mime_relevant, '<' . $forbidden) !== false)
261 * Move file to destination folder
262 * The phpbb_root_path variable will be applied to the destination path
264 * @param string $destination_path Destination path, for example $config['avatar_path']
265 * @param bool $overwrite If set to true, an already existing file will be overwritten
266 * @param string $chmod Permission mask for chmodding the file after a successful move. The mode entered here reflects the mode defined by {@link phpbb_chmod()}
270 function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false)
272 global $user, $phpbb_root_path;
274 if (sizeof($this->error
))
279 $chmod = ($chmod === false) ? CHMOD_READ | CHMOD_WRITE
: $chmod;
281 // We need to trust the admin in specifying valid upload directories and an attacker not being able to overwrite it...
282 $this->destination_path
= $phpbb_root_path . $destination;
284 // Check if the destination path exist...
285 if (!file_exists($this->destination_path
))
287 @unlink
($this->filename
);
291 $upload_mode = (@ini_get
('open_basedir') || @ini_get
('safe_mode') ||
strtolower(@ini_get
('safe_mode')) == 'on') ?
'move' : 'copy';
292 $upload_mode = ($this->local
) ?
'local' : $upload_mode;
293 $this->destination_file
= $this->destination_path
. '/' . utf8_basename($this->realname
);
295 // Check if the file already exist, else there is something wrong...
296 if (file_exists($this->destination_file
) && !$overwrite)
298 @unlink
($this->filename
);
302 if (file_exists($this->destination_file
))
304 @unlink
($this->destination_file
);
307 switch ($upload_mode)
311 if (!@copy
($this->filename
, $this->destination_file
))
313 if (!@move_uploaded_file
($this->filename
, $this->destination_file
))
315 $this->error
[] = sprintf($user->lang
[$this->upload
->error_prefix
. 'GENERAL_UPLOAD_ERROR'], $this->destination_file
);
323 if (!@move_uploaded_file
($this->filename
, $this->destination_file
))
325 if (!@copy
($this->filename
, $this->destination_file
))
327 $this->error
[] = sprintf($user->lang
[$this->upload
->error_prefix
. 'GENERAL_UPLOAD_ERROR'], $this->destination_file
);
335 if (!@copy
($this->filename
, $this->destination_file
))
337 $this->error
[] = sprintf($user->lang
[$this->upload
->error_prefix
. 'GENERAL_UPLOAD_ERROR'], $this->destination_file
);
343 // Remove temporary filename
344 @unlink
($this->filename
);
346 if (sizeof($this->error
))
351 phpbb_chmod($this->destination_file
, $chmod);
354 // Try to get real filesize from destination folder
355 $this->filesize
= (@filesize
($this->destination_file
)) ? @filesize
($this->destination_file
) : $this->filesize
;
357 if ($this->is_image() && !$skip_image_check)
359 $this->width
= $this->height
= 0;
361 if (($this->image_info
= @getimagesize
($this->destination_file
)) !== false)
363 $this->width
= $this->image_info
[0];
364 $this->height
= $this->image_info
[1];
366 if (!empty($this->image_info
['mime']))
368 $this->mimetype
= $this->image_info
['mime'];
372 $types = $this->upload
->image_types();
374 if (!isset($types[$this->image_info
[2]]) ||
!in_array($this->extension
, $types[$this->image_info
[2]]))
376 if (!isset($types[$this->image_info
[2]]))
378 $this->error
[] = sprintf($user->lang
['IMAGE_FILETYPE_INVALID'], $this->image_info
[2], $this->mimetype
);
382 $this->error
[] = sprintf($user->lang
['IMAGE_FILETYPE_MISMATCH'], $types[$this->image_info
[2]][0], $this->extension
);
386 // Make sure the dimensions match a valid image
387 if (empty($this->width
) ||
empty($this->height
))
389 $this->error
[] = $user->lang
['ATTACHED_IMAGE_NOT_IMAGE'];
394 $this->error
[] = $user->lang
['UNABLE_GET_IMAGE_SIZE'];
398 $this->file_moved
= true;
399 $this->additional_checks();
400 unset($this->upload
);
406 * Performing additional checks
408 function additional_checks()
412 if (!$this->file_moved
)
417 // Filesize is too big or it's 0 if it was larger than the maxsize in the upload form
418 if ($this->upload
->max_filesize
&& ($this->get('filesize') > $this->upload
->max_filesize ||
$this->filesize
== 0))
420 $max_filesize = get_formatted_filesize($this->upload
->max_filesize
, false);
422 $this->error
[] = sprintf($user->lang
[$this->upload
->error_prefix
. 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']);
427 if (!$this->upload
->valid_dimensions($this))
429 $this->error
[] = sprintf($user->lang
[$this->upload
->error_prefix
. 'WRONG_SIZE'], $this->upload
->min_width
, $this->upload
->min_height
, $this->upload
->max_width
, $this->upload
->max_height
, $this->width
, $this->height
);
439 * Class for assigning error messages before a real filespec class can be assigned
443 class fileerror
extends filespec
445 function fileerror($error_msg)
447 $this->error
[] = $error_msg;
453 * Init class (all parameters optional and able to be set/overwritten separately) - scope is global and valid for all uploads
459 var $allowed_extensions = array();
460 var $disallowed_content = array();
461 var $max_filesize = 0;
466 var $error_prefix = '';
469 * Init file upload class.
471 * @param string $error_prefix Used error messages will get prefixed by this string
472 * @param array $allowed_extensions Array of allowed extensions, for example array('jpg', 'jpeg', 'gif', 'png')
473 * @param int $max_filesize Maximum filesize
474 * @param int $min_width Minimum image width (only checked for images)
475 * @param int $min_height Minimum image height (only checked for images)
476 * @param int $max_width Maximum image width (only checked for images)
477 * @param int $max_height Maximum image height (only checked for images)
480 function fileupload($error_prefix = '', $allowed_extensions = false, $max_filesize = false, $min_width = false, $min_height = false, $max_width = false, $max_height = false, $disallowed_content = false)
482 $this->set_allowed_extensions($allowed_extensions);
483 $this->set_max_filesize($max_filesize);
484 $this->set_allowed_dimensions($min_width, $min_height, $max_width, $max_height);
485 $this->set_error_prefix($error_prefix);
486 $this->set_disallowed_content($disallowed_content);
492 function reset_vars()
494 $this->max_filesize
= 0;
495 $this->min_width
= $this->min_height
= $this->max_width
= $this->max_height
= 0;
496 $this->error_prefix
= '';
497 $this->allowed_extensions
= array();
498 $this->disallowed_content
= array();
502 * Set allowed extensions
504 function set_allowed_extensions($allowed_extensions)
506 if ($allowed_extensions !== false && is_array($allowed_extensions))
508 $this->allowed_extensions
= $allowed_extensions;
513 * Set allowed dimensions
515 function set_allowed_dimensions($min_width, $min_height, $max_width, $max_height)
517 $this->min_width
= (int) $min_width;
518 $this->min_height
= (int) $min_height;
519 $this->max_width
= (int) $max_width;
520 $this->max_height
= (int) $max_height;
524 * Set maximum allowed filesize
526 function set_max_filesize($max_filesize)
528 if ($max_filesize !== false && (int) $max_filesize)
530 $this->max_filesize
= (int) $max_filesize;
535 * Set disallowed strings
537 function set_disallowed_content($disallowed_content)
539 if ($disallowed_content !== false && is_array($disallowed_content))
541 $this->disallowed_content
= $disallowed_content;
548 function set_error_prefix($error_prefix)
550 $this->error_prefix
= $error_prefix;
555 * Upload file from users harddisk
557 * @param string $form_name Form name assigned to the file input field (if it is an array, the key has to be specified)
558 * @return object $file Object "filespec" is returned, all further operations can be done with this object
561 function form_upload($form_name)
565 unset($_FILES[$form_name]['local_mode']);
566 $file = new filespec($_FILES[$form_name], $this);
568 if ($file->init_error
)
574 // Error array filled?
575 if (isset($_FILES[$form_name]['error']))
577 $error = $this->assign_internal_error($_FILES[$form_name]['error']);
579 if ($error !== false)
581 $file->error
[] = $error;
586 // Check if empty file got uploaded (not catched by is_uploaded_file)
587 if (isset($_FILES[$form_name]['size']) && $_FILES[$form_name]['size'] == 0)
589 $file->error
[] = $user->lang
[$this->error_prefix
. 'EMPTY_FILEUPLOAD'];
593 // PHP Upload filesize exceeded
594 if ($file->get('filename') == 'none')
596 $max_filesize = @ini_get
('upload_max_filesize');
599 if (!empty($max_filesize))
601 $unit = strtolower(substr($max_filesize, -1, 1));
602 $max_filesize = (int) $max_filesize;
604 $unit = ($unit == 'k') ?
'KB' : (($unit == 'g') ?
'GB' : 'MB');
607 $file->error
[] = (empty($max_filesize)) ?
$user->lang
[$this->error_prefix
. 'PHP_SIZE_NA'] : sprintf($user->lang
[$this->error_prefix
. 'PHP_SIZE_OVERRUN'], $max_filesize, $user->lang
[$unit]);
611 // Not correctly uploaded
612 if (!$file->is_uploaded())
614 $file->error
[] = $user->lang
[$this->error_prefix
. 'NOT_UPLOADED'];
618 $this->common_checks($file);
624 * Move file from another location to phpBB
626 function local_upload($source_file, $filedata = false)
630 $form_name = 'local';
632 $_FILES[$form_name]['local_mode'] = true;
633 $_FILES[$form_name]['tmp_name'] = $source_file;
635 if ($filedata === false)
637 $_FILES[$form_name]['name'] = utf8_basename($source_file);
638 $_FILES[$form_name]['size'] = 0;
641 if (function_exists('mime_content_type'))
643 $mimetype = mime_content_type($source_file);
646 // Some browsers choke on a mimetype of application/octet-stream
647 if (!$mimetype ||
$mimetype == 'application/octet-stream')
649 $mimetype = 'application/octetstream';
652 $_FILES[$form_name]['type'] = $mimetype;
656 $_FILES[$form_name]['name'] = $filedata['realname'];
657 $_FILES[$form_name]['size'] = $filedata['size'];
658 $_FILES[$form_name]['type'] = $filedata['type'];
661 $file = new filespec($_FILES[$form_name], $this);
663 if ($file->init_error
)
669 if (isset($_FILES[$form_name]['error']))
671 $error = $this->assign_internal_error($_FILES[$form_name]['error']);
673 if ($error !== false)
675 $file->error
[] = $error;
680 // PHP Upload filesize exceeded
681 if ($file->get('filename') == 'none')
683 $max_filesize = @ini_get
('upload_max_filesize');
686 if (!empty($max_filesize))
688 $unit = strtolower(substr($max_filesize, -1, 1));
689 $max_filesize = (int) $max_filesize;
691 $unit = ($unit == 'k') ?
'KB' : (($unit == 'g') ?
'GB' : 'MB');
694 $file->error
[] = (empty($max_filesize)) ?
$user->lang
[$this->error_prefix
. 'PHP_SIZE_NA'] : sprintf($user->lang
[$this->error_prefix
. 'PHP_SIZE_OVERRUN'], $max_filesize, $user->lang
[$unit]);
698 // Not correctly uploaded
699 if (!$file->is_uploaded())
701 $file->error
[] = $user->lang
[$this->error_prefix
. 'NOT_UPLOADED'];
705 $this->common_checks($file);
711 * Remote upload method
712 * Uploads file from given url
714 * @param string $upload_url URL pointing to file to upload, for example http://www.foobar.com/example.gif
715 * @return object $file Object "filespec" is returned, all further operations can be done with this object
718 function remote_upload($upload_url)
720 global $user, $phpbb_root_path;
722 $upload_ary = array();
723 $upload_ary['local_mode'] = true;
725 if (!preg_match('#^(https?://).*?\.(' . implode('|', $this->allowed_extensions
) . ')$#i', $upload_url, $match))
727 $file = new fileerror($user->lang
[$this->error_prefix
. 'URL_INVALID']);
731 if (empty($match[2]))
733 $file = new fileerror($user->lang
[$this->error_prefix
. 'URL_INVALID']);
737 $url = parse_url($upload_url);
739 $host = $url['host'];
740 $path = $url['path'];
741 $port = (!empty($url['port'])) ?
(int) $url['port'] : 80;
743 $upload_ary['type'] = 'application/octet-stream';
745 $url['path'] = explode('.', $url['path']);
746 $ext = array_pop($url['path']);
748 $url['path'] = implode('', $url['path']);
749 $upload_ary['name'] = utf8_basename($url['path']) . (($ext) ?
'.' . $ext : '');
750 $filename = $url['path'];
756 if (!($fsock = @fsockopen
($host, $port, $errno, $errstr)))
758 $file = new fileerror($user->lang
[$this->error_prefix
. 'NOT_UPLOADED']);
762 // Make sure $path not beginning with /
763 if (strpos($path, '/') === 0)
765 $path = substr($path, 1);
768 fputs($fsock, 'GET /' . $path . " HTTP/1.1\r\n");
769 fputs($fsock, "HOST: " . $host . "\r\n");
770 fputs($fsock, "Connection: close\r\n\r\n");
774 while (!@feof
($fsock))
778 $data .= @fread
($fsock, 1024);
782 $line = @fgets
($fsock, 1024);
790 if (stripos($line, 'content-type: ') !== false)
792 $upload_ary['type'] = rtrim(str_replace('content-type: ', '', strtolower($line)));
794 else if (stripos($line, '404 not found') !== false)
796 $file = new fileerror($user->lang
[$this->error_prefix
. 'URL_NOT_FOUND']);
806 $file = new fileerror($user->lang
[$this->error_prefix
. 'EMPTY_REMOTE_DATA']);
810 $tmp_path = (!@ini_get
('safe_mode') ||
strtolower(@ini_get
('safe_mode')) == 'off') ?
false : $phpbb_root_path . 'cache';
811 $filename = tempnam($tmp_path, unique_id() . '-');
813 if (!($fp = @fopen
($filename, 'wb')))
815 $file = new fileerror($user->lang
[$this->error_prefix
. 'NOT_UPLOADED']);
819 $upload_ary['size'] = fwrite($fp, $data);
823 $upload_ary['tmp_name'] = $filename;
825 $file = new filespec($upload_ary, $this);
826 $this->common_checks($file);
832 * Assign internal error
835 function assign_internal_error($errorcode)
842 $max_filesize = @ini_get
('upload_max_filesize');
845 if (!empty($max_filesize))
847 $unit = strtolower(substr($max_filesize, -1, 1));
848 $max_filesize = (int) $max_filesize;
850 $unit = ($unit == 'k') ?
'KB' : (($unit == 'g') ?
'GB' : 'MB');
853 $error = (empty($max_filesize)) ?
$user->lang
[$this->error_prefix
. 'PHP_SIZE_NA'] : sprintf($user->lang
[$this->error_prefix
. 'PHP_SIZE_OVERRUN'], $max_filesize, $user->lang
[$unit]);
857 $max_filesize = get_formatted_filesize($this->max_filesize
, false);
859 $error = sprintf($user->lang
[$this->error_prefix
. 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']);
863 $error = $user->lang
[$this->error_prefix
. 'PARTIAL_UPLOAD'];
867 $error = $user->lang
[$this->error_prefix
. 'NOT_UPLOADED'];
871 $error = 'Temporary folder could not be found. Please check your PHP installation.';
883 * Perform common checks
885 function common_checks(&$file)
889 // Filesize is too big or it's 0 if it was larger than the maxsize in the upload form
890 if ($this->max_filesize
&& ($file->get('filesize') > $this->max_filesize ||
$file->get('filesize') == 0))
892 $max_filesize = get_formatted_filesize($this->max_filesize
, false);
894 $file->error
[] = sprintf($user->lang
[$this->error_prefix
. 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']);
898 if (preg_match("#[\\/:*?\"<>|]#i", $file->get('realname')))
900 $file->error
[] = sprintf($user->lang
[$this->error_prefix
. 'INVALID_FILENAME'], $file->get('realname'));
904 if (!$this->valid_extension($file))
906 $file->error
[] = sprintf($user->lang
[$this->error_prefix
. 'DISALLOWED_EXTENSION'], $file->get('extension'));
910 if (!$this->valid_content($file))
912 $file->error
[] = sprintf($user->lang
[$this->error_prefix
. 'DISALLOWED_CONTENT']);
917 * Check for allowed extension
919 function valid_extension(&$file)
921 return (in_array($file->get('extension'), $this->allowed_extensions
)) ?
true : false;
925 * Check for allowed dimension
927 function valid_dimensions(&$file)
929 if (!$this->max_width
&& !$this->max_height
&& !$this->min_width
&& !$this->min_height
)
934 if (($file->get('width') > $this->max_width
&& $this->max_width
) ||
935 ($file->get('height') > $this->max_height
&& $this->max_height
) ||
936 ($file->get('width') < $this->min_width
&& $this->min_width
) ||
937 ($file->get('height') < $this->min_height
&& $this->min_height
))
946 * Check if form upload is valid
948 function is_valid($form_name)
950 return (isset($_FILES[$form_name]) && $_FILES[$form_name]['name'] != 'none') ?
true : false;
955 * Check for allowed extension
957 function valid_content(&$file)
959 return ($file->check_content($this->disallowed_content
));
963 * Return image type/extension mapping
965 function image_types()
969 2 => array('jpg', 'jpeg'),
974 7 => array('tif', 'tiff'),
975 8 => array('tif', 'tiff'),
976 9 => array('jpg', 'jpeg'),
977 10 => array('jpg', 'jpeg'),
978 11 => array('jpg', 'jpeg'),
979 12 => array('jpg', 'jpeg'),