94 lines
2.6 KiB
PHP
94 lines
2.6 KiB
PHP
<?php
|
|
$ValidAccess = 2010;
|
|
$sessionName = 'hotlunch';
|
|
session_name($sessionName);
|
|
session_start();
|
|
require_once("include/globals.php");
|
|
|
|
|
|
if (SessionActive() != 1 || ! UserLoggedIn()) {
|
|
header("Location: /?error_message=" . urlencode(getLanguageText('ERRORMSG-SESSION-EXPIRED')));
|
|
exit;
|
|
}
|
|
|
|
// CSRF token validation
|
|
include "include/ajax.csrfToken.php";
|
|
|
|
|
|
startLog("ajax.imageUploader.php");
|
|
|
|
// Set default timezone
|
|
date_default_timezone_set("Canada/Pacific");
|
|
$now = date("Y-m-d H:i:s",time());
|
|
|
|
|
|
writeLog("_FILES['file']: ".$_FILES['file']);
|
|
writeLog("_FILES['file']['error']: ".$_FILES['file']['error']);
|
|
|
|
// Set defaults
|
|
$maxImageSize = 900;
|
|
$thumbWidth = 200;
|
|
|
|
|
|
// A list of permitted file extensions
|
|
$allowed = array('png', 'jpg', 'gif', 'jpeg');
|
|
if(isset($_FILES['file']) && $_FILES['file']['error'] == 0){
|
|
|
|
$mimetype = mime_content_type($_FILES['file']['tmp_name']);
|
|
if (strpos($mimetype, "image") !== 0) {
|
|
echo '{"status":"error"}';
|
|
writeLog("Not an Image: $mimetype");
|
|
return;
|
|
}
|
|
|
|
$extension = pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION);
|
|
writeLog("extension: $extension");
|
|
if(!in_array(strtolower($extension), $allowed)){
|
|
echo '{"status":"error"}';
|
|
writeLog("Invalid Extension");
|
|
exit;
|
|
}
|
|
|
|
writeLog($_FILES['file']['tmp_name']);
|
|
writeLog($_FILES['file']['name']);
|
|
|
|
$image_name = $_FILES['file']['name'];
|
|
$file_name = trim($image_name);
|
|
$file_name = str_replace(' ','_',$file_name);
|
|
$file_name = str_replace('%20','_',$file_name);
|
|
$file_name = str_replace('"','',$file_name);
|
|
$file_name = str_replace("'",'',$file_name);
|
|
$file_name = str_replace('$','',$file_name);
|
|
$file_name = str_replace('/','',$file_name);
|
|
$file_name = str_replace('\\','',$file_name);
|
|
$file_name = str_replace('(','.',$file_name);
|
|
$file_name = str_replace(')','',$file_name);
|
|
$file_name = str_replace('[','',$file_name);
|
|
$file_name = str_replace(']','',$file_name);
|
|
$file_name = str_replace('&','_and_',$file_name);
|
|
$file_name = str_replace(';','_and_',$file_name);
|
|
$file_name = preg_replace('/[^[:print:]]/', '', $file_name);
|
|
$image_name = $file_name;
|
|
|
|
$image_path = "files/$subpath/image";
|
|
$image_target = "$image_path/$file_name";
|
|
writeLog("image_target: $image_target");
|
|
|
|
if (is_file($image_target)) unlink($image_target);
|
|
|
|
if (move_uploaded_file($_FILES['file']['tmp_name'],$image_target)){
|
|
writeLog("Move completed");
|
|
|
|
// Resize image and create thumbnail
|
|
resizeImage($image_name, $image_path, $maxImageSize, $thumbWidth);
|
|
|
|
echo($image_target);
|
|
writeLog("Done");
|
|
exit;
|
|
}
|
|
}
|
|
echo '{"status":"error"}';
|
|
exit;
|
|
|
|
?>
|