attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         //'editattach'
  16 );
  17
  18 ob_start();
  19
  20 require_once('./global.php');
  21
  22 if (isset($bugsys->in['attachmentid']))
  23 {
  24         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  25         if (!$attachment)
  26         {
  27                 echo 'alert: bad attachment';
  28                 exit;
  29         }
  30 }
  31
  32 // ###################################################################
  33
  34 if (empty($_REQUEST['do']))
  35 {
  36         $_REQUEST['do'] = 'modify';
  37 }
  38 else
  39 {
  40         $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . intval($bugsys->in['bugid']));
  41         if (!$bug)
  42         {
  43                 echo 'alert: bad bug';
  44                 exit;
  45         }
  46 }
  47
  48 // ###################################################################
  49
  50 if ($_REQUEST['do'] == 'kill')
  51 {
  52         // run code to remove item in database
  53 }
  54
  55 // ###################################################################
  56
  57 if ($_REQUEST['do'] == 'delete')
  58 {
  59         // display delete confirmation message
  60 }
  61
  62 // ###################################################################
  63
  64 if ($_POST['do'] == 'insert')
  65 {
  66         if (!can_perform('canputattach'))
  67         {
  68                 echo 'alert: no permission';
  69                 exit;
  70         }
  71
  72         // create alias
  73         $FILE =& $_FILES['attachment'];
  74
  75         // PHP errors
  76         switch ($FILE['error'])
  77         {
  78                 case 0: break;
  79                 case 1: echo 'PHP said the file you uploaded was too big.'; exit; break;
  80                 case 2: echo 'The file exceeds the allowed upload size.'; exit; break;
  81                 case 3: echo 'The file was only partially uploaded.'; exit; break;
  82                 case 4: echo 'The file was not uploaded at all.'; exit; break;
  83                 case 6: echo 'PHP could not find the /tmp directory.'; exit; break;
  84         }
  85
  86         // did it upload?
  87         if (!is_uploaded_file($FILE['tmp_name']))
  88         {
  89                 echo 'The file you specified did not upload.';
  90                 exit;
  91         }
  92
  93         // put some MIME-type validation here
  94
  95         if (!$bugsys->in['description'])
  96         {
  97                 echo 'you need a file description!';
  98                 exit;
  99         }
 100
 101         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
 102         $time = time();
 103
 104         // insert an attachment
 105         $db->query("
 106                 INSERT INTO attachment
 107                         (bugid, filename, mimetype, filesize,
 108                         attachment, description, dateline, userid)
 109                 VALUES
 110                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 111                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 112                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 113                         " . $bugsys->userinfo['userid'] . "
 114                 )"
 115         );
 116
 117         // mark obsoletes
 118         $obsoletes = $_POST['obsoletes'];
 119         array_walk($obsoletes, 'intval');
 120         $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 121
 122         // handle comment stuff
 123         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 124         {
 125                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 126
 127                 if (!$bugsys->options['allowhtml'])
 128                 {
 129                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 130                 }
 131
 132                 $db->query("
 133                         INSERT INTO " . TABLE_PREFIX . "comment
 134                                 (bugid, userid, dateline, comment, comment_parsed)
 135                         VALUES
 136                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 137                                 $time, '" . $bugsys->in['comment'] . "',
 138                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 139                         )"
 140                 );
 141         }
 142
 143         // update the last post data
 144         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 145
 146         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment added</a>";
 147
 148 }
 149
 150 // ###################################################################
 151
 152 if ($_REQUEST['do'] == 'add')
 153 {
 154         if (!can_perform('canputattach'))
 155         {
 156                 echo 'alert: no permission';
 157                 exit;
 158         }
 159
 160         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 161
 162         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 163         $show['obsoletes'] = false;
 164
 165         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 166         $obsoletes = '';
 167         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 168         {
 169                 $show['obsoletes'] = true;
 170                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 171         }
 172
 173         eval('$template->flush("' . $template->fetch('newattach') . '");');
 174 }
 175
 176 // ###################################################################
 177
 178 if ($_POST['do'] == 'update')
 179 {
 180         // run code to update item in database
 181 }
 182
 183 // ###################################################################
 184
 185 if ($_REQUEST['do'] == 'edit')
 186 {
 187         // display form to edit item
 188 }
 189
 190 // ###################################################################
 191
 192 if ($_REQUEST['do'] == 'modify')
 193 {
 194         if (!can_perform('cangetattach'))
 195         {
 196                 echo 'alert: no permission';
 197                 exit;
 198         }
 199
 200         ob_clean();
 201         ob_end_clean();
 202
 203         if ($funct->fetch_extension($attachment['filename']) != 'txt')
 204         {
 205                 header("Content-Disposition: inline; filename=$attachment[filename]");
 206                 header("Content-transfer-encoding: binary");
 207         }
 208         else
 209         {
 210                 header("Content-Disposition: attachment; filename=$attachment[filename]");
 211         }
 212         header("Content-Length: " . strlen($attachment['attachment']));
 213         header("Content-Type: $attachment[mimetype]");
 214
 215         print($attachment['attachment']);
 216 }
 217
 218 /*=====================================================================*\
 219 || ###################################################################
 220 || # $HeadURL$
 221 || # $Id$
 222 || ###################################################################
 223 \*=====================================================================*/
 224 ?>