<?PHP
/* ====================
Seditio - Website engine
Copyright Seditio Team
https://seditio.org
[BEGIN_SED]
File=plugins/uploader/uploader.ajax.php
Version=179
Updated=2022-jun-29
Type=Plugin
Author=Amro
Description=
[END_SED]
[BEGIN_SED_EXTPLUGIN]
Code=uploader
Part=AjaxUp
File=uploader.ajax
Hooks=ajax
Tags=
Minlevel=0
Order=10
[END_SED_EXTPLUGIN]
==================== */
if (!defined('SED_CODE')) { die('Wrong URL.'); }
list($usr['auth_read'], $usr['auth_write'], $usr['isadmin']) = sed_auth('pfs', 'a');
//error_reporting(0);
$pfs_delete = $cfg['plugin']['uploader']['pfs_delete'];
$upl_delete = sed_import('upl_delete', 'G', 'TXT');
$upl_rotate = sed_import('upl_rotate', 'G', 'TXT');
$upl_degree_lvl = sed_import('upl_degree_lvl', 'G', 'INT');
$upl_pid = sed_import('upl_pid', 'G', 'INT');
$disp_errors = '';
$buildfilename = $cfg['plugin']['uploader']['buildfilename'];
$upl_filename = sed_import('upl_filename', 'G', 'TXT');
if ($upl_delete)
{
if ($pfs_delete == "yes")
{
sed_block($usr['auth_write']);
//sed_check_xg();
$sql = sed_sql_query("SELECT pfs_id, pfs_file, pfs_folderid FROM $db_pfs WHERE pfs_userid='".$usr['id']."' AND pfs_file='$upl_delete' LIMIT 1");
if ($row = sed_sql_fetchassoc($sql))
{
$pfs_file = $row['pfs_file'];
$f = $row['pfs_folderid'];
$ff = $cfg['pfs_dir'].$pfs_file;
if (file_exists($ff) && (mb_substr($pfs_file, 0, mb_strpos($pfs_file, "-")) == $usr['id'] || $usr['isadmin']))
{
@unlink($ff);
if (file_exists($cfg['th_dir'].$pfs_file))
{ @unlink($cfg['th_dir'].$pfs_file); }
}
$sql = sed_sql_query("DELETE FROM $db_pfs WHERE pfs_id='".$row['pfs_id']."'");
exit;
}
}
exit;
}
elseif ($upl_rotate)
{
sed_block($usr['auth_write']);
//sed_check_xg();
$sql = sed_sql_query("SELECT pfs_id, pfs_file, pfs_folderid FROM $db_pfs WHERE pfs_userid='".$usr['id']."' AND pfs_file='$upl_rotate' LIMIT 1");
if ($row = sed_sql_fetchassoc($sql))
{
$pfs_file = $row['pfs_file'];
$f = $row['pfs_folderid'];
$ff = $cfg['pfs_dir'].$pfs_file;
if (file_exists($ff) && (mb_substr($pfs_file, 0, mb_strpos($pfs_file, "-")) == $usr['id'] || $usr['isadmin']))
{
sed_rotateimage($cfg['pfs_dir'].$upl_rotate, $upl_degree_lvl);
sed_rotateimage($cfg['th_dir'].$upl_rotate, $upl_degree_lvl);
echo $upl_rotate;
}
}
exit;
}
$sql_total = sed_sql_query("SELECT SUM(pfs_size) FROM $db_pfs WHERE pfs_userid='".$usr['id']."'");
$pfs_totalsize = sed_sql_result($sql_total, 0, "SUM(pfs_size)");
$user_info = sed_userinfo($usr['id']);
$maingroup = ($usr['id'] == 0) ? 5 : $user_info['user_maingrp'];
$sql = sed_sql_query("SELECT grp_pfs_maxfile, grp_pfs_maxtotal FROM $db_groups WHERE grp_id='$maingroup'");
if ($row = sed_sql_fetchassoc($sql))
{
$maxfile = $row['grp_pfs_maxfile'];
$maxtotal = $row['grp_pfs_maxtotal'];
}
else
{ exit; }
if ($maxfile == 0 || $maxtotal == 0 || !$usr['auth_write'])
{
$disp_errors = $L['pfs_filetoobigorext'];
}
$filename = sed_newname($usr['id']."-".$upl_filename, TRUE);
if ($cfg['pfs_filemask'] || file_exists($cfg['pfs_dir'].$filename))
{
$filename = sed_newname($usr['id']."-".time().sed_unique(3)."-".$upl_filename, TRUE);
}
$allow_extension = array('gif','png','jpg','jpeg','bmp');
$extension_arr = explode(".", $filename);
$f_extension = end($extension_arr);
if (in_array($f_extension, $allow_extension) == FALSE)
{
$disp_errors = "Bad file extension";
}
elseif (file_exists($cfg['pfs_dir'].$filename))
{
$disp_errors = $L['pfs_fileexists'];
}
elseif (empty($disp_errors))
{
$u_size = file_put_contents($cfg['pfs_dir'].$filename, file_get_contents('php://input'));
$imgsize = @getimagesize($cfg['pfs_dir'].$filename);
if(!isset($imgsize) || !isset($imgsize['mime']) || !in_array($imgsize['mime'], array('image/jpeg', 'image/png', 'image/gif')))
{
$disp_errors = "File is not image!";
unlink($cfg['pfs_dir'].$filename);
}
elseif ((($pfs_totalsize + $u_size) > $maxtotal * 1024) || ($u_size > ($maxfile * 1024)))
{
$disp_errors = $L['pfs_filetoobigorext'];
unlink($cfg['pfs_dir'].$filename);
}
else
{
$u_size = filesize($cfg['pfs_dir'].$filename);
$u_sqlname = $filename;
$u_title = $filename;
@chmod($cfg['pfs_dir'].$filename, 0644);
$folder_title = $L[date('F')]." ".date('Y');
$sql = sed_sql_query("SELECT pff_id FROM $db_pfs_folders WHERE pff_userid = '".$usr['id']."' AND pff_title = '".$folder_title."' LIMIT 1");
if (sed_sql_numrows($sql) > 0)
{
$folderid = sed_sql_result($sql, 0, "pff_id");
}
else
{
$sql = sed_sql_query("INSERT INTO $db_pfs_folders
(pff_userid,
pff_title,
pff_date,
pff_updated,
pff_desc,
pff_type,
pff_count)
VALUES
(".(int)$usr['id'].",
'".sed_sql_prep($folder_title)."',
".(int)$sys['now'].",
".(int)$sys['now'].",
'',
0,
0)");
$folderid = sed_sql_insertid();
}
$sql = sed_sql_query("INSERT INTO $db_pfs
(pfs_userid,
pfs_date,
pfs_file,
pfs_extension,
pfs_folderid,
pfs_title,
pfs_desc,
pfs_size,
pfs_count)
VALUES
(".(int)$usr['id'].",
".(int)$sys['now_offset'].",
'".sed_sql_prep($u_sqlname)."',
'".sed_sql_prep($f_extension)."',
".(int)$folderid.",
'".sed_sql_prep($u_title)."',
'',
".(int)$u_size.",
0) ");
$sql = sed_sql_query("UPDATE $db_pfs_folders SET pff_updated='".$sys['now']."' WHERE pff_id='$folderid'");
sed_sm_createthumb($cfg['pfs_dir'].$filename, $cfg['th_dir'].$filename, $cfg['th_x'], $cfg['th_y'], $cfg['th_jpeg_quality'], "resize", TRUE);
}
}
$res = new stdClass;
$res->filename = $filename;
$res->error = $disp_errors;
header("Content-type: application/json; charset=UTF-8");
header("Cache-Control: must-revalidate");
header("Pragma: no-cache");
header("Expires: -1");
print json_encode($res);
?>