root/trunk/redirectors/uploadavatar.php

<?php

/**
 * Package: Spam Board 5
 * File: redirectors/uploadavatar.php
 * Description: Upload a new image to the avatar directory
 *
 * Copyright (C) 2007, 2009 Hannes Schueller
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU Affero General Public License as
 * published by the Free Software Foundation, version 3 of the
 * License.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU Affero General Public License for more details.
 *
 * You should have received a copy of the GNU Affero General Public License
 * along with this program (see LICENCE). If not,
 * see <http://www.gnu.org/licenses/>.
 **/

// called independently from index
require_once('../includes/config/settings.php');

// load classes on demand
function __autoload($class) {
    global $SETTINGS;
    if (is_file($SETTINGS['fspath'] . 'classes/pages/' . $class . '.php')) {
        require_once($SETTINGS['fspath'] . 'classes/pages/' . $class . '.php');
    } elseif (is_file($SETTINGS['fspath'] . 'classes/misc/' . $class . '.php')) {
        require_once($SETTINGS['fspath'] . 'classes/misc/' . $class . '.php');
    } else { die('Class ' . $class . ' not found.'); }
}

// initialize global warnings array
$WARNINGS = Array();

// import version number
require_once($SETTINGS['fspath'] . 'includes/config/version.php');
// bots definition
require_once($SETTINGS['fspath'] . 'includes/config/bots.php');
// formatting object
$F = new Format();
require($SETTINGS['fspath'] . 'includes/lang/' . $SETTINGS['language'] . '.php');
// open database connection
$C = new Connection();
Member::session();
if (isset($_SESSION['lang']) && $_SESSION['lang'] != '') {
    include($SETTINGS['fspath'] . 'includes/lang/' . $_SESSION['lang'] . '.php');
}
// translate passed variables to local identifiers
require($SETTINGS['fspath'] . 'includes/input.php');

// page start
$_pref = '../';
$html = Page::start();

if (isset($INPUT['commit']) && $INPUT['commit'] == 'y') {
    // post-commit
    // check if user has permission; required: write; independent from id
    if (Member::checkRights('Uploadavatar', 'w')) {
        // permission granted
        if (is_array($_FILES['avatarfile']) && is_uploaded_file($_FILES['avatarfile']['tmp_name'])) {
            // check file size
            if ($_FILES['avatarfile']['size'] <= 512000) {
                // check file type
                if (in_array($_FILES['avatarfile']['type'], Array('image/gif', 'image/png', 'image/jpg', 'image/jpeg'))) {
                    // this wasn't too reliable, so check file type again
                    $_size = @getimagesize($_FILES['avatarfile']['tmp_name']);
                    if ($_size[2] <= 3 && $_size[2] >= 1) {
                        // check image dimensions
                        if ($_size[0] <= 100 && $_size[1] <= 100) {
                            // strip out any unwanted characters
                            $_FILES['avatarfile']['name'] = preg_replace('/[^0-9a-zA-Z\.\/_\-]/', '_', $_FILES['avatarfile']['name']);
                            // check if file name already exists
                            $_found = 0;
                            if ($handle = @opendir($SETTINGS['fspath'] . 'images/avatars')) {
                                while (($file = @readdir($handle)) !== FALSE) {
                                    if ($file == $_FILES['avatarfile']['name']) {
                                        $_found = 1;
                                    }
                                }
                                closedir($handle);
                            }
                            if ($_found === 0) {
                                // move file to avatar directory
                                if (@move_uploaded_file($_FILES['avatarfile']['tmp_name'], $SETTINGS['fspath'] . 'images/avatars/' . $_FILES['avatarfile']['name'])) {
                                    // success at last!
                                    $div = $html->body->addChild('div', $LANG['upload_avatar_success']);
                                    $div->addAttribute('class', 'message');
                                } else {
                                    // last minute error
                                    $div = $html->body->addChild('div', $LANG['error_avatar_move']);
                                    $div->addAttribute('class', 'message');
                                }
                            } else {
                                // file name taken
                                $div = $html->body->addChild('div', $LANG['error_avatar_filename']);
                                $div->addAttribute('class', 'message');
                            }
                        } else {
                            // width or height too large
                            $div = $html->body->addChild('div', $LANG['error_avatar_dimension']);
                            $div->addAttribute('class', 'message');
                        }
                    } else {
                        // invalid file type
                        $div = $html->body->addChild('div', $LANG['error_avatar_filetype']);
                        $div->addAttribute('class', 'message');
                    }
                } else {
                    // invalid file type
                    $div = $html->body->addChild('div', $LANG['error_avatar_filetype']);
                    $div->addAttribute('class', 'message');
                }
            } else {
                // file size too large
                $div = $html->body->addChild('div', $LANG['error_avatar_filesize']);
                $div->addAttribute('class', 'message');
            }
        } else {
            // no file set?
            $div = $html->body->addChild('div', $LANG['error_avatar_file_missing']);
            $div->addAttribute('class', 'message');
        }
    } else {
        $div = $html->body->addChild('div', $LANG['error_permission_denied']);
        $div->addAttribute('class', 'message');
    }
} else {
    // pre-commit
    // check if user has permission; required: read; independent from id
    if (Member::checkRights('Uploadavatar', 'r')) {
        // permission granted
        $html->body->addElement(new XMLElement($LANG['upload_avatar_hints']));
        $form = new Form($_SERVER['PHP_SELF'], 'uploadform', 'multipart/form-data');
        $form->addInput('hidden', 'commit', 'y');
        $form->addInput('hidden', 'MAX_FILE_SIZE', '51200');
        $form->addInput('file', 'avatarfile');
        $form->addChild('br');
        $form->addChild('br');
        $form->addInput('reset', 'reset', $LANG['Reset']);
        $form->addInput('submit', 'submit', $LANG['Submit']);
        $html->body->addElement($form->get());
    } else {
        $div = $html->body->addChild('div', $LANG['error_permission_denied']);
        $div->addAttribute('class', 'message');
    }
}

$html->body->addChild('br');
$html->body->addChild('br');
$div = $html->body->addChild('div');
$div->addAttribute('align', 'center');
$a = $div->addChild('a', $LANG['Close_Window']);
$a->addAttribute('href', 'javascript:self.close()');

// page output
Page::send($html);

?>