attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         'editattach'
  16 );
  17
  18 require_once('./global.php');
  19
  20 if (isset($bugsys->in['attachmentid']))
  21 {
  22         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  23         if (!$attachment)
  24         {
  25                 echo 'alert: bad attachment';
  26                 exit;
  27         }
  28 }
  29
  30 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . (($attachment['attachmentid']) ? $attachment['bugid'] : intval($bugsys->in['bugid'])));
  31 if (!$bug)
  32 {
  33         echo 'alert: bad bug';
  34         exit;
  35 }
  36
  37 // ###################################################################
  38
  39 if ($_REQUEST['do'] == 'kill')
  40 {
  41         if (!can_perform('caneditattach'))
  42         {
  43                 echo 'alert: no permission';
  44                 exit;
  45         }
  46
  47         $db->query("DELETE FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
  48
  49         log_action($bug['bugid'], 'log_kill_attachment', array($attachment['attachmentid']), true);
  50
  51         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment removed</a>";
  52 }
  53
  54 // ###################################################################
  55
  56 if ($_REQUEST['do'] == 'delete')
  57 {
  58         if (!can_perform('caneditattach'))
  59         {
  60                 echo 'alert: no permission';
  61                 exit;
  62         }
  63
  64         echo "are you sure you want to delete this attachment? <a href=\"attachment.php?do=kill&amp;attachmentid=$attachment[attachmentid]\">yes</a>";
  65 }
  66
  67 // ###################################################################
  68
  69 if ($_POST['do'] == 'insert')
  70 {
  71         if (!can_perform('canputattach'))
  72         {
  73                 echo 'alert: no permission';
  74                 exit;
  75         }
  76
  77         // create alias
  78         $FILE =& $_FILES['attachment'];
  79
  80         // PHP errors
  81         switch ($FILE['error'])
  82         {
  83                 case 0: break;
  84                 case 1: echo 'PHP said the file you uploaded was too big.'; exit; break;
  85                 case 2: echo 'The file exceeds the allowed upload size.'; exit; break;
  86                 case 3: echo 'The file was only partially uploaded.'; exit; break;
  87                 case 4: echo 'The file was not uploaded at all.'; exit; break;
  88                 case 6: echo 'PHP could not find the /tmp directory.'; exit; break;
  89         }
  90
  91         // did it upload?
  92         if (!is_uploaded_file($FILE['tmp_name']))
  93         {
  94                 echo 'The file you specified did not upload.';
  95                 exit;
  96         }
  97
  98         // #*# put some MIME-type validation here
  99
 100         if (!$bugsys->in['description'])
 101         {
 102                 echo 'you need a file description!';
 103                 exit;
 104         }
 105
 106         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
 107         $time = time();
 108
 109         // insert an attachment
 110         $db->query("
 111                 INSERT INTO attachment
 112                         (bugid, filename, mimetype, filesize,
 113                         attachment, description, dateline, userid)
 114                 VALUES
 115                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 116                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 117                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 118                         " . $bugsys->userinfo['userid'] . "
 119                 )"
 120         );
 121
 122         $attachmentid = $db->insert_id();
 123         log_action($bug['bugid'], 'log_new_attachment', array($FILE['name'], $attachmentid), true);
 124
 125         // mark obsoletes
 126         $obsoletes = $_POST['obsoletes'];
 127         if (count($obsoletes) > 0)
 128         {
 129                 array_walk($obsoletes, 'intval');
 130                 $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 131                 log_action($bug['bugid'], 'log_mark_obsoletes', array($attachmentid, $FILE['name'], implode(', ', $obsoletes)), false, 'obsoleted attachments', '', implode(', ', $obsoletes));
 132         }
 133
 134         // handle comment stuff
 135         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 136         {
 137                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 138
 139                 if (!$bugsys->options['allowhtml'])
 140                 {
 141                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 142                 }
 143
 144                 $db->query("
 145                         INSERT INTO " . TABLE_PREFIX . "comment
 146                                 (bugid, userid, dateline, comment, comment_parsed)
 147                         VALUES
 148                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 149                                 $time, '" . $bugsys->in['comment'] . "',
 150                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 151                         )"
 152                 );
 153
 154                 $commentid = $db->insert_id();
 155
 156                 log_action($bug['bugid'], 'log_new_attachment_comment', array($attachmentid, $commentid), true);
 157         }
 158
 159         // update the last post data
 160         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 161
 162         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment added</a>";
 163 }
 164
 165 // ###################################################################
 166
 167 if ($_REQUEST['do'] == 'add')
 168 {
 169         if (!can_perform('canputattach'))
 170         {
 171                 echo 'alert: no permission';
 172                 exit;
 173         }
 174
 175         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 176
 177         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 178         $show['obsoletes'] = false;
 179
 180         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 181         $obsoletes = '';
 182         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 183         {
 184                 $show['obsoletes'] = true;
 185                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 186         }
 187
 188         eval('$template->flush("' . $template->fetch('newattach') . '");');
 189 }
 190
 191 // ###################################################################
 192
 193 if ($_POST['do'] == 'update')
 194 {
 195         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 196         {
 197                 echo 'alert: no permssion';
 198                 exit;
 199         }
 200
 201         $db->query("
 202                 UPDATE " . TABLE_PREFIX . "attachment
 203                 SET description = '" . $bugsys->in['description'] . "',
 204                         obsolete = " . intval($bugsys->in['obsolete']) . "
 205                 WHERE attachmentid = " . intval($bugsys->in['attachmentid'])
 206         );
 207
 208         $hist[1] = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
 209
 210         $diff[0] = array_diff_assoc($attachment, $hist[1]);
 211         $diff[1] = array_diff_assoc($hist[1], $attachment);
 212
 213         log_action($bug['bugid'], 'log_update_attachment', array($attachment['attachmentid']), false, 'description', $diff[0]['description'], $diff[1]['description']);
 214         log_action($bug['bugid'], 'log_update_attachment', array($attachment['attachmentid']), false, 'obsolete', $diff[0]['obsolete'], $diff[1]['obsolete']);
 215
 216         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment updated</a>";
 217 }
 218
 219 // ###################################################################
 220
 221 if ($_REQUEST['do'] == 'edit')
 222 {
 223         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 224         {
 225                 echo 'alert: no permssion';
 226                 exit;
 227         }
 228
 229         $show['delete'] = ((can_perform('caneditattach')) ? true : false);
 230
 231         eval('$template->flush("' . $template->fetch('editattach') . '");');
 232 }
 233
 234 /*=====================================================================*\
 235 || ###################################################################
 236 || # $HeadURL$
 237 || # $Id$
 238 || ###################################################################
 239 \*=====================================================================*/
 240 ?>