Файл: vsime.com/comm/inc/act_files.php
Строк: 283
<?
$unique_code = "unique_code";
// думаю для начала токого обменника должно хватить =)
if(mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `comm` WHERE `id` = '".intval($_GET['id'])."'"))!=0)
{
$comm = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `comm` WHERE `id` = '".intval($_GET['id'])."'"));
$cat = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `comm_cat` WHERE `id` = '$comm[id_cat]'"));
if (!mysqli_result("SELECT COUNT(*) FROM `comm_users` WHERE `id_comm` = '$comm[id]' AND `activate` = '1' AND `invite` = '0'"))$comm['id_user']=0;
$ank = profile($comm['id_user']); // sozdak
if (isset($moderate_files))$skp = NULL; else $skp = " `sk` = '0' AND";
if ($comm['files']==0)
{
$title .= ' - '.htmlspecialchars($comm['name']).' - Файлы'; // Заголовок страницы
ex_head();
echo "Раздел "Файлы" сообщества <b>".htmlspecialchars($comm['name'])."</b> закрытn";
ex_foot();
}
if (isset($_GET['dir']) && mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE `id` = '".intval($_GET['dir'])."' AND `type` = 'dir' AND `id_comm` = '$comm[id]'")!=0)
{
$dir = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files_comm` WHERE `id` = '".intval($_GET['dir'])."' AND `type` = 'dir' AND `id_comm` = '$comm[id]'"));
} else {
$dir = array();
$dir['id'] = 0;
$dir['name'] = "";
$dir['counter'] = '/0/';
}
$title .= ' - '.htmlspecialchars($comm['name']).' - Файлы'; // Заголовок страницы
//$title .= ($dir['id']!=0?" - ".hsc($dir['name']):NULL);
if (isset($_GET['delete_dir']))
{
if (!($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))access_denied();
if ($dir['id'] != 0)
{
$title .= ' - Удалить папку';
ex_head();
if (isset($_POST['submited']))
{
if (hsc(@$_POST['mdp'])==$mdp)
{
mysqli_query($dbi, "DELETE FROM `files_comm` WHERE `counter` LIKE '%/$dir[id]/%' OR `id` = '$dir[id]' AND `id_comm` = '$comm[id]'");
msg_sess("Папка ".hsc($dir['name'])." удалена");
header("Location: ?act=files&id=$comm[id]&dir=$dir[id_dir]");
exit;
} else hacked_by_Killer();
}
echo "<form method='POST'>n";
echo "Подтвердите удаление папки<br/>n";
echo "<input type='hidden' name='mdp' value='$mdp'>n";
echo "<input type='submit' name='submited' value='Удалить'> <a href='?act=files&id=$comm[id]&dir=$dir[id]'>Отмена</a>n";
echo "</form>n";
}
else
{
$error[] = "Нельзя удалять корневую папку!";
show_errors();
}
ex_foot();
}
if (isset($_GET['edit_dir']))
{
if (!($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))access_denied();
if ($dir['id'] != 0)
{
$title .= ' - Редактировать папку';
ex_head();
if(isset($_POST['submited']) && isset($_POST['name']))
{
if (hsc(@$_POST['mdp'])==$mdp)
{
$name = $_POST['name'];
if(mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE `name` = '".my_esc($name)."' AND `id` != '$dir[id]' AND `type` = 'dir' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]'")!=0)$error[]="Такая папка уже есть";
if(strlen2($name)>50 || strlen2($name)<1)$error[]="Название не должно быть пустым и не больше 50-ти символов";
$name = my_esc($name);
if (!isset($error))
{
mysqli_query($dbi, "UPDATE `files_comm` SET `name` = '$name' WHERE `id` = '$dir[id]' AND `type` = 'dir' AND `id_comm` = '$comm[id]'");
msg_sess("Настройки папки сохранены");
header("Location: ?act=files&id=$comm[id]&dir=$dir[id]");
exit;
}
} else hacked_by_Killer();
}
show_errors();
echo "<form method='POST'>n";
echo "Название:<br/>n";
echo "<input type='text' name='name' value='".input_value($dir['name'])."'><br/>n";
echo "<input type='hidden' name='mdp' value='$mdp'>n";
echo "<input type='submit' name='submited' value='Сохранить'> <a href='?act=files&id=$comm[id]&dir=$dir[id]'>Назад</a>n";
echo "</form>n";
}
else
{
$error[] = "Нельзя редактировать корневую папку!";
show_errors();
}
ex_foot();
}
if (isset($_GET['add_dir']))
{
if (!($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))access_denied();
$title .= ' - Создать папку';
ex_head();
if(isset($_POST['submited']) && isset($_POST['name']))
{
if (hsc(@$_POST['mdp'])==$mdp)
{
$name = $_POST['name'];
if (mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE `type` = 'dir' AND `name` = '".my_esc($name)."' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]'")!=0)$error[]="Такая папка уже есть";
if(strlen2($name)>50 || strlen2($name)<1)$error[]="Название не должно быть пустым и не больше 50-ти символов";
$name = my_esc($name);
if (!isset($error))
{
//$pos = mysqli_result("SELECT MAX(`pos`) FROM `files_comm` WHERE `id_dir` = '$dir[id]' AND `type` = 'dir'")+1;
$pos = 0;
mysqli_query($dbi, "INSERT INTO `files_comm` (`type`, `name`, `id_dir`, `counter`, `id_user`, `time`, `pos`, `id_comm`) VALUES ('dir', '$name', '$dir[id]', '$dir[counter]$dir[id]/', '$user[id]', '$time', '$pos', '$comm[id]')");
msg_sess("Папка <b>".hsc($name)."</b> успешно создана");
header("Location: ?act=files&id=$comm[id]&dir=$dir[id]");
exit;
}
} else hacked_by_Killer();
}
show_errors();
echo "<form method='POST'>n";
echo "Название:<br/>n";
echo "<input type='text' name='name' value=''><br/>n";
echo "<input type='hidden' name='mdp' value='$mdp'>n";
echo "<input type='submit' name='submited' value='Добавить'> <a href='?act=files&id=$comm[id]&dir=$dir[id]'>Назад</a>n";
echo "</form>n";
ex_foot();
}
ex_head();
/*if (isset($_GET['up']) && ($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))
{
if (hsc(@$_GET['mdp']==$mdp))
{
$up=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files_comm` WHERE `type` = 'dir' AND `id` = '".intval($_GET['up'])."' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]' LIMIT 1"));
if(mysqli_result("SELECT * FROM `files_comm` WHERE `type` = 'dir' AND `pos` < '$up[pos]' AND `id_dir` = '$dir[id]' LIMIT 1")!=0)
{
mysqli_query($dbi, "UPDATE `files_comm` SET `pos` = '".($up['pos'])."' WHERE `pos` = '".($up['pos']-1)."' AND `type` = 'dir' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]' LIMIT 1");
mysqli_query($dbi, "UPDATE `files_comm` SET `pos` = '".($up['pos']-1)."' WHERE `id` = '".intval($_GET['up'])."' AND `type` = 'dir' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]' LIMIT 1");
}
} else hacked_by_Killer();
}
elseif (isset($_GET['down']))
{
if (hsc(@$_GET['mdp']==$mdp))
{
$down=mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files_comm` WHERE `type` = 'dir' AND `id` = '".intval($_GET['down'])."' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]' LIMIT 1"));
if(mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `files_comm` WHERE `type` = 'dir' AND `pos` > '$down[pos]' AND `id_dir` = '$dir[id]' LIMIT 1"))!=0)
{
mysqli_query($dbi, "UPDATE `files_comm` SET `pos` = '".($down['pos'])."' WHERE `pos` = '".($down['pos']+1)."' AND `type` = 'dir' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]' LIMIT 1");
mysqli_query($dbi, "UPDATE `files_comm` SET `pos` = '".($down['pos']+1)."' WHERE `id` = '".intval($_GET['down'])."' AND `type` = 'dir' AND `id_dir` = '$dir[id]' AND `id_comm` = '$comm[id]' LIMIT 1");
}
} else hacked_by_Killer();
}*/
$count_files = mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE `id_dir` = '$dir[id]' AND (`type` = 'file' OR `type` = 'foto') AND `id_comm` = '$comm[id]'");
$count_dirs = mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE `id_dir` = '$dir[id]' AND `type` = 'dir' AND `id_comm` = '$comm[id]'");
$count_results = mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE `id_dir` = '$dir[id]' AND (`type` = 'file' OR `type` = 'foto') AND `id_comm` = '$comm[id]'");
$count_pages = count_pages($count_results);
$page = page();
$start = start_pages();
include('multi_select_head.php');
if ($dir['id'] != 0)
{
echo "<div class='mod_grad'>n";
echo "<img src='/i/dir_type/dir.png' alt='dir' /> ".hsc($dir['name']);
if (($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))
{
echo "<span class='right'>n";
echo "<a href='?act=files&id=$comm[id]&dir=$dir[id]&edit_dir'>$config[code_edit]</a> <a href='?act=files&id=$comm[id]&dir=$dir[id]&delete_dir'>$config[code_delete]</a>n";
echo "</span>n";
}
echo "<br />";
echo "</div>n";
}
if ($page == 1)
{
$query_dirs = mysqli_query($dbi, "SELECT * FROM `files_comm` WHERE `id_dir` = '$dir[id]' AND `type` = 'dir' AND `id_comm` = '$comm[id]' ORDER BY `pos`, `name` ASC");
while ($post_dir = mysqli_fetch_array($query_dirs))
{
$count_files = mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE (`type` = 'file' OR `type` = 'foto') AND `counter` like '%/$post_dir[id]/%' AND `id_comm` = '$comm[id]'");
$count_files_new = mysqli_result("SELECT COUNT(*) FROM `files_comm` WHERE (`type` = 'file' OR `type` = 'foto') AND `counter` like '%/$post_dir[id]/%' AND `time` > '".($time-(3600*24))."' AND `id_comm` = '$comm[id]'");
$count_files_show = $count_files.($count_files_new>0?"/+$count_files_new":NULL);
echo "<div class='list'>n";
echo "<img src='/i/dir_type/dir.png' alt='dir' /> <a href='?act=files&id=$comm[id]&dir=$post_dir[id]'>".hsc($post_dir['name'])."</a> ($count_files_show)n";
/*if (isset($moderate_forum))
{
echo "<span class='right'>n";
if(isset($_GET['moderate']))echo "<a href='?act=files&id=$comm[id]&dir=$dir[id]&moderate&up=$post_dir[id]&mdp=$mdp'>$config[code_up]</a> <a href='?act=files&id=$comm[id]&dir=$dir[id]&moderate&down=$post_dir[id]&mdp=$mdp'>$config[code_down]</a>n";
echo "</span>n";
}*/
echo "</div>n";
}
}
$query_files = mysqli_query($dbi, "SELECT * FROM `files_comm` WHERE `id_dir` = '$dir[id]' AND (`type` = 'file' OR `type` = 'foto') AND `id_comm` = '$comm[id]' ORDER BY `time` DESC LIMIT $start, $config[rop]");
while ($post_file = mysqli_fetch_array($query_files))
{
if ($post_file['type']=='file')
{
$file = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `files` WHERE `id` = '$post_file[id_file]' AND `id_comm` = '0'"));
$file['path']=H."system/files/files/users/user$file[id_user]/dir$file[id_dir]/".$file['id'].".dat";
$file['size']=filesize($file['path']);
$count_komm = mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `files_komm` WHERE$skp `id_comm` = '0' AND `id_file` = '$file[id]'"));
$count_komm_new = mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `files_komm` WHERE$skp `id_comm` = '0' AND `id_file` = '$file[id]' AND `time` > '".($time-(3600*24))."'"));
$count_komm_show = $count_komm.($count_komm_new>0?"/+$count_komm_new":NULL);
echo "<div class='list'>n";
echo "<div class='left'>n";
if (isset($_SESSION["files_comm_multi_select_$comm[id]"]) && ($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))echo "<input type='checkbox' name='multi_select_file_$post_file[id]' value='1'".(in_array($post_file['id'], $_SESSION["files_comm_multi_select_$comm[id]"])?" CHECKED":NULL)." />n";
echo ffs_screen($file['id'], 'file', WapWeb_show(48, 96), WapWeb_show(48, 96));
echo "</div>n";
echo "<div class='overfl_hid'>n";
echo "<a href='/files/?file=$file[id]'>n";
if (is_file(H.'/i/file_type/'.$file['ras'].'.png'))echo "<img src='/i/file_type/$file[ras].png' alt='$file[ras]' /> n";
else echo "<img src='/i/file_type/file.png' alt='file' /> n";
echo hsc($file['name']).".".hsc($file['ras'])."</a> ($count_komm_show)n";
echo "<br />n";
echo "<img src='/i/site/download.png' /> Размер: ".size_file($file['size'])."<br />n";
$audio_rasar = array('amr', 'mid', 'midi', 'mmf', 'mp3', 'wav', 'wma');
if (in_array($file['ras'], $audio_rasar) && $config['web']==true)
{
?>
<div class="mediaspace">
<script language="JavaScript" src="/i/swf/audio-player.js"></script>
<object type="application/x-shockwave-flash" data="/i/swf/player.swf" id=audioplayer<? echo $file['id'];?> height="24" width="530">
<param name=movie value="/i/swf/player.swf"></param>
<param name=FlashVars value="playerID=audioplayer<? echo $file['id'];?>&soundFile=<? echo "/files/download/".md5($file['id'])."/$unique_code/$mdp/".file_name_html($file['name']).".".hsc($file['ras'])."";?>">
</param>
<param name=quality value=high></param>
<param name=menu value=false></param>
<param name=wmode value=transparent></param>
</object>
</div>
<?
}
echo "</div>n";
echo "<div class='clear'></div>n";
echo "</div>n";
} elseif ($post_file['type']=='foto')
{
$foto = mysqli_fetch_array(mysqli_query($dbi, "SELECT * FROM `foto` WHERE `id` = '$post_file[id_file]'"));
$foto['path']=H."system/files/fotos/d$foto[id_dir]/".$foto['id'].".dat";
$foto['size']=filesize($foto['path']);
$count_komm = mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]'"));
$count_komm_new = mysqli_num_rows(mysqli_query($dbi, "SELECT * FROM `foto_komm` WHERE$skp `id_foto` = '$foto[id]' AND `time` > '".($time-(3600*24))."'"));
$count_komm_show = $count_komm.($count_komm_new>0?"/+$count_komm_new":NULL);
echo "<div class='list'>n";
echo "<div class='left'>n";
if (isset($_SESSION["files_comm_multi_select_$comm[id]"]) && ($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))echo "<input type='checkbox' name='multi_select_file_$post_file[id]' value='1'".(in_array($post_file['id'], $_SESSION["files_comm_multi_select_$comm[id]"])?" CHECKED":NULL)." />n";
echo ffs_screen($foto['id'], 'foto', WapWeb_show(48, 96), WapWeb_show(48, 96));
echo "</div>n";
echo "<div class='overfl_hid'>n";
echo "<a href='/fotos/?foto=$foto[id]'>n";
if (is_file(H.'/i/file_type/'.$foto['ras'].'.png'))echo "<img src='/i/file_type/$foto[ras].png' alt='$foto[ras]' /> n";
else echo "<img src='/i/file_type/file.png' alt='file' /> n";
echo hsc($foto['name']).".".hsc($foto['ras'])."</a> ($count_komm_show)n";
echo "<br />n";
echo "<img src='/i/site/download.png' /> Размер: ".size_file($foto['size'])."<br />n";
echo "</div>n";
echo "<div class='clear'></div>n";
echo "</div>n";
}
}
if ($count_results == 0 && mysqli_num_rows($query_dirs) == 0)
{
echo "<div class='list'>n";
echo "Пусто!";
echo "</div>n";
}
pages_show("?act=files&id=$comm[id]&dir=$dir[id]&");
include('multi_select_foot.php');
if (($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm' || mysqli_result("SELECT COUNT(*) FROM `comm_users` WHERE `id_comm` = '$comm[id]' AND `id_user` = '$user[id]' AND `activate` = '1'")) && !isset($_SESSION["files_comm_multi_select_$comm[id]"]))
{
echo "<div class='mod_grad'>n";
if (mysqli_result("SELECT COUNT(*) FROM `comm_users` WHERE `id_comm` = '$comm[id]' AND `id_user` = '$user[id]' AND `activate` = '1'")) {
echo $config['code_add']." Добавить: <a href='/fotos/?dir=0&select=comm&comm_id=$comm[id]&comm_dir=$dir[id]'>Фото</a> | <a href='/files/?dir=0&select=comm&comm_id=$comm[id]&comm_dir=$dir[id]'>Файл</a><br />n";
}
if (($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))echo "<img src='/i/dir_type/dir_add.png' /> <a href='?act=files&id=$comm[id]&dir=$dir[id]&add_dir'>Создать папку</a><br />n";
//echo "<img src='/i/site/configure.png' /> ".(isset($_GET['moderate'])?"<a href='?act=files&id=$comm[id]&dir=$dir[id]'>Отмена</a>":"<a href='?act=files&id=$comm[id]&dir=$dir[id]&moderate'>Управление</a>")."<br />n";
if (($ank['id']==$user['id'] && isset($user) || $uinc['access']=='adm'))echo "$config[code_move] <a href='?act=files&id=$comm[id]&dir=$dir[id]&files_comm_multi_select_$comm[id]=start&mdp=$mdp'".title_link('Выбрать файлы для перемещения').">Выбрать файлы</a><br />n";
echo "</div>n";
}
echo "<div class='foot'>n";
echo image_back()." <a href='".($dir['id']!=0?"?act=files&id=$comm[id]&dir=$dir[id_dir]":"?act=comm&id=$comm[id]")."'>Назад</a>n";
echo "</div>n";
ex_foot();
}
else{header("Location:/comm");exit;}
?>