Файл: modules/share/add_file.php
Строк: 116
<?php
$locate = 'in_share';
$cat_id = abs(intval($_GET['cat_id']));
if(!isset($user) || !isset($_GET['cat_id']))
{
header('Location:/');
exit;
}
if($db->query("SELECT * FROM `share_c` WHERE `id` = '". $cat_id ."'")->rowCount() == 0)
{
header('Location:/share/');
exit;
}
elseif(isset($_POST['add']) && $_GET['act'] == 'add')
{
$file_dir = ROOT .'/files/share/';
$screen_dir = ROOT .'/files/preview/';
if ($_FILES['file']['tmp_name'])
{
$file_name = (isset($_POST['name']) ? mb_substr(input($_POST['name']), 0, 90) : false);
if($file_name == false || empty($file_name))
{
$err = 'Name is empty';
}
$file_text = (isset($_POST['about']) ? mb_substr(input($_POST['about']), 0, 10000) : false);
if($file_text == false || empty($file_text))
{
$err = 'Text is empty';
}
$patch = pathinfo($_FILES['file']['name']);
$patch['extension'] = strtolower($patch['extension']);
$patch['extension'] = preg_replace('/hmtl|xhtml|htm|php|pl|phps|asp|aspx|rb|py|xml|wml|.htaccess/i', 'txt', $patch['extension']);
$ext = explode(';', $system['files_types']);
if (!in_array($patch['extension'], $ext))
{
$err = 'File extension not allowed.<br />';
}
$name_start = cyrlat($patch['filename']);
$name_short = trim($name_start).'_'.time();
$name_end = mb_convert_encoding($name_short, "UTF-8");
$name = 'MoSTOP.NeT_'.$name_end.'.'. $patch['extension'];
if (file_exists($file_dir . $name))
{
$err = 'This file exists<br />';
}
if($_FILES['screen']['tmp_name'])
{
$screenp = pathinfo($_FILES['screen']['name']);
if (!preg_match('/jpg|gif|jpeg|png/i', $screenp['extension'])) { $err = 'File extension not allowed.<br />'; }
move_uploaded_file($_FILES['screen']['tmp_name'], $screen_dir . $name .'.png');
}
if(!isset($err))
{
move_uploaded_file($_FILES['file']['tmp_name'], $file_dir . $name);
if (empty($file_name)) $file_name = str_replace('.'. $patch['extension'], '', $patch['basename']);
$db->query("UPDATE `users` SET `balans` = '".($user['balans']+$system[balans_obmen])."' WHERE `id` = '".$user['id'] . "'");
$db->query("UPDATE `users` SET `rub` = '".($user['rub']+0.10)."' WHERE `id` = '".$user['id'] . "'");
$db->query("INSERT INTO `share_files` SET `time` = '". time() ."', `name` = '". input($file_name) ."', `size` = '". $_FILES['file']['size'] ."', `path_name` = '". $name."', `ext` = '$patch[extension]', `path` = '$file_dir', `user_id` = '". $user['id'] ."', `text` = '". input($file_text) ."', `cat_id` = '". $cat_id ."', `moderate` = '0', `dload_times` = '0'");
// print_r($db->errorInfo());
header('Location:/share/file/'. $db->lastInsertId() .'/');
exit;
}
else
{
echo $err;
}
}
}
$title = $lang->word('add_file');
require_once(SYS.'/view/header.php');
$tpl->div('title', $lang->word('add_file'));
echo '<form action="/share/add_file/'. $cat_id .'/?act=add" method="post" enctype="multipart/form-data">
<div class="menu">
<b>'. $lang->word('form_album_name') .'</b>:<br/>
<input type="text" name="name" /><br/>
<b>'. $lang->word('choose_file') .'</b>:<br/>
<input name="file" type="file" /><br/>
<b>'.$lang->word('screenshot_add').'</b>:<br/>
<input name="screen" type="file" /><br/>
<b>'. $lang->word('about') .'</b>:<br/>
<textarea name="about" rows="5" cols="26"></textarea><br/>
<input name="add" type="submit" value="'. $lang->word('upload') .'" /><br/>
* Максимальный размер загружаемого файла: 20Mb.
</div>
</form>';
$tpl->div('block', img('share.png') .'<a href="/share/">'. $lang->word('share') .'</a><br/>' . HICO .'<a href="/">'. $lang->word('home').'</a>');
require_once(SYS.'/view/footer.php');
?>