attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         //'editattach'
  16 );
  17
  18 ob_start();
  19
  20 require_once('./global.php');
  21
  22 if (isset($bugsys->in['attachmentid']))
  23 {
  24         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  25         if (!$attachment)
  26         {
  27                 echo 'alert: bad attachment';
  28                 exit;
  29         }
  30 }
  31
  32 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . intval($bugsys->in['bugid']));
  33 if (!$bug)
  34 {
  35         echo 'alert: bad bug';
  36         exit;
  37 }
  38
  39 // ###################################################################
  40
  41 if ($_REQUEST['do'] == 'kill')
  42 {
  43         // run code to remove item in database
  44 }
  45
  46 // ###################################################################
  47
  48 if ($_REQUEST['do'] == 'delete')
  49 {
  50         // display delete confirmation message
  51 }
  52
  53 // ###################################################################
  54
  55 if ($_POST['do'] == 'insert')
  56 {
  57         if (!can_perform('canputattach'))
  58         {
  59                 echo 'alert: no permission';
  60                 exit;
  61         }
  62
  63         // create alias
  64         $FILE =& $_FILES['attachment'];
  65
  66         // PHP errors
  67         switch ($FILE['error'])
  68         {
  69                 case 0: break;
  70                 case 1: echo 'PHP said the file you uploaded was too big.'; exit; break;
  71                 case 2: echo 'The file exceeds the allowed upload size.'; exit; break;
  72                 case 3: echo 'The file was only partially uploaded.'; exit; break;
  73                 case 4: echo 'The file was not uploaded at all.'; exit; break;
  74                 case 6: echo 'PHP could not find the /tmp directory.'; exit; break;
  75         }
  76
  77         // did it upload?
  78         if (!is_uploaded_file($FILE['tmp_name']))
  79         {
  80                 echo 'The file you specified did not upload.';
  81                 exit;
  82         }
  83
  84         // put some MIME-type validation here
  85
  86         if (!$bugsys->in['description'])
  87         {
  88                 echo 'you need a file description!';
  89                 exit;
  90         }
  91
  92         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
  93         $time = time();
  94
  95         // insert an attachment
  96         $db->query("
  97                 INSERT INTO attachment
  98                         (bugid, filename, mimetype, filesize,
  99                         attachment, description, dateline, userid)
 100                 VALUES
 101                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 102                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 103                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 104                         " . $bugsys->userinfo['userid'] . "
 105                 )"
 106         );
 107
 108         // mark obsoletes
 109         $obsoletes = $_POST['obsoletes'];
 110         array_walk($obsoletes, 'intval');
 111         $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 112
 113         // handle comment stuff
 114         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 115         {
 116                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 117
 118                 if (!$bugsys->options['allowhtml'])
 119                 {
 120                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 121                 }
 122
 123                 $db->query("
 124                         INSERT INTO " . TABLE_PREFIX . "comment
 125                                 (bugid, userid, dateline, comment, comment_parsed)
 126                         VALUES
 127                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 128                                 $time, '" . $bugsys->in['comment'] . "',
 129                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 130                         )"
 131                 );
 132         }
 133
 134         // update the last post data
 135         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 136
 137         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment added</a>";
 138
 139 }
 140
 141 // ###################################################################
 142
 143 if ($_REQUEST['do'] == 'add')
 144 {
 145         if (!can_perform('canputattach'))
 146         {
 147                 echo 'alert: no permission';
 148                 exit;
 149         }
 150
 151         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 152
 153         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 154         $show['obsoletes'] = false;
 155
 156         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 157         $obsoletes = '';
 158         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 159         {
 160                 $show['obsoletes'] = true;
 161                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 162         }
 163
 164         eval('$template->flush("' . $template->fetch('newattach') . '");');
 165 }
 166
 167 // ###################################################################
 168
 169 if ($_POST['do'] == 'update')
 170 {
 171         // run code to update item in database
 172 }
 173
 174 // ###################################################################
 175
 176 if ($_REQUEST['do'] == 'edit')
 177 {
 178         // display form to edit item
 179 }
 180
 181 /*=====================================================================*\
 182 || ###################################################################
 183 || # $HeadURL$
 184 || # $Id$
 185 || ###################################################################
 186 \*=====================================================================*/
 187 ?>