attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         'editattach'
  16 );
  17
  18 define('SVN', '$Id$');
  19
  20 require_once('./global.php');
  21
  22 if (isset($bugsys->in['attachmentid']))
  23 {
  24         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  25         if (!$attachment)
  26         {
  27                 $message->error('alert: bad attachment');
  28         }
  29 }
  30
  31 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . (($attachment['attachmentid']) ? $attachment['bugid'] : intval($bugsys->in['bugid'])));
  32 if (!$bug)
  33 {
  34         $message->error('alert: bad bug');
  35 }
  36
  37 // setup logging
  38 require_once('./includes/class_history.php');
  39 $log = new History();
  40 $log->bugid = $bug['bugid'];
  41
  42 // ###################################################################
  43
  44 if ($_REQUEST['do'] == 'kill')
  45 {
  46         if (!can_perform('caneditattach'))
  47         {
  48                 $message->error_permission();
  49         }
  50
  51         $db->query("DELETE FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
  52
  53         $log->language = 'log_kill_attachment';
  54         $log->arguments = array($attachment['attachmentid']);
  55         $log->allowempty = true;
  56         $log->log();
  57
  58         $message->redirect('attachment removed', "showreport.php?bugid=$bug[bugid]");
  59 }
  60
  61 // ###################################################################
  62
  63 if ($_REQUEST['do'] == 'delete')
  64 {
  65         if (!can_perform('caneditattach'))
  66         {
  67                 $message->error_permission();
  68         }
  69
  70         echo "are you sure you want to delete this attachment? <a href=\"attachment.php?do=kill&amp;attachmentid=$attachment[attachmentid]\">yes</a>";
  71 }
  72
  73 // ###################################################################
  74
  75 if ($_POST['do'] == 'insert')
  76 {
  77         if (!can_perform('canputattach'))
  78         {
  79                 $message->error_permission();
  80         }
  81
  82         // create alias
  83         $FILE =& $_FILES['attachment'];
  84
  85         // PHP errors
  86         switch ($FILE['error'])
  87         {
  88                 case 0: break;
  89                 case 1: $message->error('PHP said the file you uploaded was too big.'); break;
  90                 case 2: $message->error('The file exceeds the allowed upload size.'); break;
  91                 case 3: $message->error('The file was only partially uploaded.'); break;
  92                 case 4: $message->error('The file was not uploaded at all.'); break;
  93                 case 6: $message->error('PHP could not find the /tmp directory.'); break;
  94         }
  95
  96         // did it upload?
  97         if (!is_uploaded_file($FILE['tmp_name']))
  98         {
  99                 $message->error('The file you specified did not upload.');
 100         }
 101
 102         // #*# put some MIME-type validation here
 103
 104         if (!$bugsys->in['description'])
 105         {
 106                 $message->error('you need a file description!');
 107         }
 108
 109         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
 110         $time = TIMENOW;
 111
 112         // insert an attachment
 113         $db->query("
 114                 INSERT INTO attachment
 115                         (bugid, filename, mimetype, filesize,
 116                         attachment, description, dateline, userid)
 117                 VALUES
 118                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 119                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 120                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 121                         " . $bugsys->userinfo['userid'] . "
 122                 )"
 123         );
 124
 125         $attachmentid = $db->insert_id();
 126         $log->language = 'log_new_attachment';
 127         $log->arguments = array($FILE['name'], $attachmentid);
 128         $log->allowempty = true;
 129         $log->log();
 130
 131         // mark obsoletes
 132         $obsoletes = $_POST['obsoletes'];
 133         if (count($obsoletes) > 0)
 134         {
 135                 array_walk($obsoletes, 'intval');
 136                 $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 137
 138                 $log->language = 'log_mark_obsoletes';
 139                 $log->arguments = array($attachmentid, $FILE['name'], implode(', ', $obsoletes));
 140                 $log->log($log->diff('obsoleted attachments', '', implode(', ', $obsoletes)));
 141         }
 142
 143         // handle comment stuff
 144         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 145         {
 146                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 147
 148                 if (!$bugsys->options['allowhtml'])
 149                 {
 150                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 151                 }
 152
 153                 $db->query("
 154                         INSERT INTO " . TABLE_PREFIX . "comment
 155                                 (bugid, userid, dateline, comment, comment_parsed)
 156                         VALUES
 157                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 158                                 $time, '" . $bugsys->in['comment'] . "',
 159                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 160                         )"
 161                 );
 162
 163                 $commentid = $db->insert_id();
 164
 165                 $log->language = 'log_new_attachment_comment';
 166                 $log->arguments = array($attachmentid, $commentid);
 167                 $log->allowempty = true;
 168                 $log->log();
 169         }
 170
 171         // update the last post data
 172         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 173
 174         $message->redirect('attachment added', "showreport.php?bugid=$bug[bugid]");
 175 }
 176
 177 // ###################################################################
 178
 179 if ($_REQUEST['do'] == 'add')
 180 {
 181         if (!can_perform('canputattach'))
 182         {
 183                 $message->error_permission();
 184         }
 185
 186         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 187
 188         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 189         $show['obsoletes'] = false;
 190
 191         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 192         $obsoletes = '';
 193         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 194         {
 195                 $show['obsoletes'] = true;
 196                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 197         }
 198
 199         eval('$template->flush("' . $template->fetch('newattach') . '");');
 200 }
 201
 202 // ###################################################################
 203
 204 if ($_POST['do'] == 'update')
 205 {
 206         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 207         {
 208                 $message->error_permission();
 209         }
 210
 211         $db->query("
 212                 UPDATE " . TABLE_PREFIX . "attachment
 213                 SET description = '" . $bugsys->in['description'] . "',
 214                         obsolete = " . intval($bugsys->in['obsolete']) . "
 215                 WHERE attachmentid = " . intval($bugsys->in['attachmentid'])
 216         );
 217
 218         $hist[1] = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
 219
 220         $diff[0] = array_diff_assoc($attachment, $hist[1]);
 221         $diff[1] = array_diff_assoc($hist[1], $attachment);
 222
 223         $log->language = 'log_update_attachment';
 224         $log->arguments = array($attachment['attachmentid']);
 225         $log->log($log->diff('description', $diff[0]['description'], $diff[1]['description']));
 226         $log->log($log->diff('obsolete', $diff[0]['obsolete'], $diff[1]['obsolete']));
 227
 228         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment updated</a>";
 229 }
 230
 231 // ###################################################################
 232
 233 if ($_REQUEST['do'] == 'edit')
 234 {
 235         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 236         {
 237                 $message->error_permission();
 238         }
 239
 240         $show['delete'] = ((can_perform('caneditattach')) ? true : false);
 241
 242         eval('$template->flush("' . $template->fetch('editattach') . '");');
 243 }
 244
 245 /*=====================================================================*\
 246 || ###################################################################
 247 || # $HeadURL$
 248 || # $Id$
 249 || ###################################################################
 250 \*=====================================================================*/
 251 ?>