attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         'editattach'
  16 );
  17
  18 define('SVN', '$Id$');
  19
  20 $focus['showreport'] = 'focus';
  21
  22 require_once('./global.php');
  23
  24 if (isset($bugsys->in['attachmentid']))
  25 {
  26         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  27         if (!$attachment)
  28         {
  29                 $message->error(lang::r('alert: bad attachment'));
  30         }
  31 }
  32
  33 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . (($attachment['attachmentid']) ? $attachment['bugid'] : intval($bugsys->in['bugid'])));
  34 if (!$bug)
  35 {
  36         $message->error(lang::r('alert: bad bug'));
  37 }
  38
  39 // setup logging
  40 require_once('./includes/class_history.php');
  41 $log = new History();
  42 $log->bugid = $bug['bugid'];
  43
  44 // ###################################################################
  45
  46 if ($_REQUEST['do'] == 'kill')
  47 {
  48         if (!can_perform('caneditattach'))
  49         {
  50                 $message->error_permission();
  51         }
  52
  53         $db->query("DELETE FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
  54
  55         $log->language = 'log_kill_attachment';
  56         $log->arguments = array($attachment['attachmentid']);
  57         $log->allowempty = true;
  58         $log->log();
  59
  60         $message->redirect(lang::r('attachment removed'), "showreport.php?bugid=$bug[bugid]");
  61 }
  62
  63 // ###################################################################
  64
  65 if ($_REQUEST['do'] == 'delete')
  66 {
  67         if (!can_perform('caneditattach'))
  68         {
  69                 $message->error_permission();
  70         }
  71
  72         $message->message(lang::r("are you sure you want to delete this attachment? <a href=\"attachment.php?do=kill&amp;attachmentid=$attachment[attachmentid]\">yes</a>"));
  73 }
  74
  75 // ###################################################################
  76
  77 if ($_POST['do'] == 'insert')
  78 {
  79         if (!can_perform('canputattach'))
  80         {
  81                 $message->error_permission();
  82         }
  83
  84         // create alias
  85         $FILE =& $_FILES['attachment'];
  86
  87         // PHP errors
  88         switch ($FILE['error'])
  89         {
  90                 case 0: break;
  91                 case 1: $message->error(lang::r('PHP said the file you uploaded was too big.')); break;
  92                 case 2: $message->error(lang::r('The file exceeds the allowed upload size.')); break;
  93                 case 3: $message->error(lang::r('The file was only partially uploaded.')); break;
  94                 case 4: $message->error(lang::r('The file was not uploaded at all.')); break;
  95                 case 6: $message->error(lang::r('PHP could not find the /tmp directory.')); break;
  96         }
  97
  98         // did it upload?
  99         if (!is_uploaded_file($FILE['tmp_name']))
 100         {
 101                 $message->error(lang::r('The file you specified did not upload.'));
 102         }
 103
 104         // #*# put some MIME-type validation here
 105
 106         if (!$bugsys->in['description'])
 107         {
 108                 $message->error(lang::r('you need a file description!'));
 109         }
 110
 111         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
 112         $time = TIMENOW;
 113
 114         // insert an attachment
 115         $db->query("
 116                 INSERT INTO attachment
 117                         (bugid, filename, mimetype, filesize,
 118                         attachment, description, dateline, userid)
 119                 VALUES
 120                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 121                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 122                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 123                         " . $bugsys->userinfo['userid'] . "
 124                 )"
 125         );
 126
 127         $attachmentid = $db->insert_id();
 128         $log->language = 'log_new_attachment';
 129         $log->arguments = array($FILE['name'], $attachmentid);
 130         $log->allowempty = true;
 131         $log->log();
 132
 133         // mark obsoletes
 134         $obsoletes = $_POST['obsoletes'];
 135         if (count($obsoletes) > 0)
 136         {
 137                 array_walk($obsoletes, 'intval');
 138                 $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 139
 140                 $log->language = 'log_mark_obsoletes';
 141                 $log->arguments = array($attachmentid, $FILE['name'], implode(', ', $obsoletes));
 142                 $log->log($log->diff(lang::r('obsoleted attachments'), '', implode(', ', $obsoletes)));
 143         }
 144
 145         // handle comment stuff
 146         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 147         {
 148                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 149
 150                 if (!$bugsys->options['allowhtml'])
 151                 {
 152                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 153                 }
 154
 155                 $db->query("
 156                         INSERT INTO " . TABLE_PREFIX . "comment
 157                                 (bugid, userid, dateline, comment, comment_parsed)
 158                         VALUES
 159                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 160                                 $time, '" . $bugsys->in['comment'] . "',
 161                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 162                         )"
 163                 );
 164
 165                 $commentid = $db->insert_id();
 166
 167                 $log->language = 'log_new_attachment_comment';
 168                 $log->arguments = array($attachmentid, $commentid);
 169                 $log->allowempty = true;
 170                 $log->log();
 171         }
 172
 173         // update the last post data
 174         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 175
 176         $message->redirect(lang::r('attachment added'), "showreport.php?bugid=$bug[bugid]");
 177 }
 178
 179 // ###################################################################
 180
 181 if ($_REQUEST['do'] == 'add')
 182 {
 183         if (!can_perform('canputattach'))
 184         {
 185                 $message->error_permission();
 186         }
 187
 188         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 189
 190         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 191         $show['obsoletes'] = false;
 192
 193         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 194         $obsoletes = '';
 195         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 196         {
 197                 $show['obsoletes'] = true;
 198                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 199         }
 200
 201         eval('$template->flush("' . $template->fetch('newattach') . '");');
 202 }
 203
 204 // ###################################################################
 205
 206 if ($_POST['do'] == 'update')
 207 {
 208         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 209         {
 210                 $message->error_permission();
 211         }
 212
 213         $db->query("
 214                 UPDATE " . TABLE_PREFIX . "attachment
 215                 SET description = '" . $bugsys->in['description'] . "',
 216                         obsolete = " . intval($bugsys->in['obsolete']) . "
 217                 WHERE attachmentid = " . intval($bugsys->in['attachmentid'])
 218         );
 219
 220         $hist[1] = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
 221
 222         $diff[0] = array_diff_assoc($attachment, $hist[1]);
 223         $diff[1] = array_diff_assoc($hist[1], $attachment);
 224
 225         $log->language = 'log_update_attachment';
 226         $log->arguments = array($attachment['attachmentid']);
 227         $log->log($log->diff('description', $diff[0]['description'], $diff[1]['description']));
 228         $log->log($log->diff('obsolete', $diff[0]['obsolete'], $diff[1]['obsolete']));
 229
 230         $message->redirect(lang::r('attachment updated'), "showreport.php?bugid=$bug[bugid]");
 231 }
 232
 233 // ###################################################################
 234
 235 if ($_REQUEST['do'] == 'edit')
 236 {
 237         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 238         {
 239                 $message->error_permission();
 240         }
 241
 242         $show['delete'] = ((can_perform('caneditattach')) ? true : false);
 243
 244         eval('$template->flush("' . $template->fetch('editattach') . '");');
 245 }
 246
 247 /*=====================================================================*\
 248 || ###################################################################
 249 || # $HeadURL$
 250 || # $Id$
 251 || ###################################################################
 252 \*=====================================================================*/
 253 ?>