First Commit

ajax.imageUploader.php

@@ -0,0 +1,95 @@
+<?php
+$ValidAccess = 2010;
+require_once("include/globals.php");
+
+
+if (SessionActive() != 1 || ! UserLoggedIn()) {
+   logExit("Session is not active",$moduleName);
+   exit();
+}
+
+// Set userType
+$userType = "Parent";
+if (array_key_exists('type', $_SESSION['UserInfo']) && in_array($_SESSION['UserInfo']['type'],$AllAdminUserTypes)) $userType = "Admin";
+if ($userType != 'Admin') return;
+
+
+// CSRF token validation
+include "include/ajax.csrfToken.php";
+
+
+// startLog("ajax.imageUploader.php");
+
+// Set default timezone
+date_default_timezone_set("Canada/Pacific");
+$now = date("Y-m-d H:i:s",time());
+
+// writeLog("_FILES['file']: ".$_FILES['file']);
+// writeLog("_FILES['file']['error']: ".$_FILES['file']['error']);
+
+// Set defaults
+$maxImageSize = 900;
+$thumbWidth = 200;
+
+
+// A list of permitted file extensions
+$allowed = array('png', 'jpg', 'jpeg', 'gif', 'jpeg');
+if(isset($_FILES['file']) && $_FILES['file']['error'] == 0){
+
+   $mimetype = mime_content_type($_FILES['file']['tmp_name']);
+   if (strpos($mimetype, "image") !== 0) {
+      echo '{"status":"error"}';
+      writeLog("Not an Image: $mimetype");
+      return;
+   }
+
+   $extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
+   writeLog("extension: $extension");
+   if(!in_array(strtolower($extension), $allowed)){
+      echo '{"status":"error"}';
+      writeLog("Invalid Extension");
+      exit();
+   }
+
+   writeLog($_FILES['file']['tmp_name']);
+   writeLog($_FILES['file']['name']);
+
+   $image_name = $_FILES['file']['name'];
+   $file_name = trim($image_name);
+   $file_name = str_replace(' ','_',$file_name);
+   $file_name = str_replace('%20','_',$file_name);
+   $file_name = str_replace('"','',$file_name);
+   $file_name = str_replace("'",'',$file_name);
+   $file_name = str_replace('$','',$file_name);
+   $file_name = str_replace('/','',$file_name);
+   $file_name = str_replace('\\','',$file_name);
+   $file_name = str_replace('(','.',$file_name);
+   $file_name = str_replace(')','',$file_name);
+   $file_name = str_replace('[','',$file_name);
+   $file_name = str_replace(']','',$file_name);
+   $file_name = str_replace('&','_and_',$file_name);
+   $file_name = str_replace(';','_and_',$file_name);
+   $file_name = preg_replace('/[^[:print:]]/', '', $file_name);
+   $image_name = $file_name;
+
+   $image_path = "files/$subpath/image";
+   $image_target = "$image_path/$file_name";
+   writeLog("image_target: $image_target");
+
+   if (is_file($image_target)) unlink($image_target);
+
+   if (move_uploaded_file($_FILES['file']['tmp_name'],$image_target)){
+      writeLog("Move completed");
+
+      // Resize image and create thumbnail
+      resizeImage($image_name, $image_path, $maxImageSize, $thumbWidth);
+
+      echo($image_target);
+      writeLog("Done");
+      exit();
+   }
+}
+echo '{"status":"error"}';
+exit();
+
+?>