attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         'editattach'
  16 );
  17
  18 require_once('./global.php');
  19
  20 if (isset($bugsys->in['attachmentid']))
  21 {
  22         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  23         if (!$attachment)
  24         {
  25                 echo 'alert: bad attachment';
  26                 exit;
  27         }
  28 }
  29
  30 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . (($attachment['attachmentid']) ? $attachment['bugid'] : intval($bugsys->in['bugid'])));
  31 if (!$bug)
  32 {
  33         echo 'alert: bad bug';
  34         exit;
  35 }
  36
  37 // setup logging
  38 require_once('./includes/class_history.php');
  39 $log = new History();
  40 $log->bugid = $bug['bugid'];
  41
  42 // ###################################################################
  43
  44 if ($_REQUEST['do'] == 'kill')
  45 {
  46         if (!can_perform('caneditattach'))
  47         {
  48                 echo 'alert: no permission';
  49                 exit;
  50         }
  51
  52         $db->query("DELETE FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
  53
  54         $log->language = 'log_kill_attachment';
  55         $log->arguments = array($attachment['attachmentid']);
  56         $log->allowempty = true;
  57         $log->log();
  58
  59         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment removed</a>";
  60 }
  61
  62 // ###################################################################
  63
  64 if ($_REQUEST['do'] == 'delete')
  65 {
  66         if (!can_perform('caneditattach'))
  67         {
  68                 echo 'alert: no permission';
  69                 exit;
  70         }
  71
  72         echo "are you sure you want to delete this attachment? <a href=\"attachment.php?do=kill&amp;attachmentid=$attachment[attachmentid]\">yes</a>";
  73 }
  74
  75 // ###################################################################
  76
  77 if ($_POST['do'] == 'insert')
  78 {
  79         if (!can_perform('canputattach'))
  80         {
  81                 echo 'alert: no permission';
  82                 exit;
  83         }
  84
  85         // create alias
  86         $FILE =& $_FILES['attachment'];
  87
  88         // PHP errors
  89         switch ($FILE['error'])
  90         {
  91                 case 0: break;
  92                 case 1: echo 'PHP said the file you uploaded was too big.'; exit; break;
  93                 case 2: echo 'The file exceeds the allowed upload size.'; exit; break;
  94                 case 3: echo 'The file was only partially uploaded.'; exit; break;
  95                 case 4: echo 'The file was not uploaded at all.'; exit; break;
  96                 case 6: echo 'PHP could not find the /tmp directory.'; exit; break;
  97         }
  98
  99         // did it upload?
 100         if (!is_uploaded_file($FILE['tmp_name']))
 101         {
 102                 echo 'The file you specified did not upload.';
 103                 exit;
 104         }
 105
 106         // #*# put some MIME-type validation here
 107
 108         if (!$bugsys->in['description'])
 109         {
 110                 echo 'you need a file description!';
 111                 exit;
 112         }
 113
 114         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
 115         $time = time();
 116
 117         // insert an attachment
 118         $db->query("
 119                 INSERT INTO attachment
 120                         (bugid, filename, mimetype, filesize,
 121                         attachment, description, dateline, userid)
 122                 VALUES
 123                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 124                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 125                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 126                         " . $bugsys->userinfo['userid'] . "
 127                 )"
 128         );
 129
 130         $attachmentid = $db->insert_id();
 131         $log->language = 'log_new_attachment';
 132         $log->arguments = array($FILE['name'], $attachmentid);
 133         $log->allowempty = true;
 134         $log->log();
 135
 136         // mark obsoletes
 137         $obsoletes = $_POST['obsoletes'];
 138         if (count($obsoletes) > 0)
 139         {
 140                 array_walk($obsoletes, 'intval');
 141                 $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 142
 143                 $log->language = 'log_mark_obsoletes';
 144                 $log->arguments = array($attachmentid, $FILE['name'], implode(', ', $obsoletes));
 145                 $log->log($log->diff('obsoleted attachments', '', implode(', ', $obsoletes)));
 146         }
 147
 148         // handle comment stuff
 149         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 150         {
 151                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 152
 153                 if (!$bugsys->options['allowhtml'])
 154                 {
 155                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 156                 }
 157
 158                 $db->query("
 159                         INSERT INTO " . TABLE_PREFIX . "comment
 160                                 (bugid, userid, dateline, comment, comment_parsed)
 161                         VALUES
 162                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 163                                 $time, '" . $bugsys->in['comment'] . "',
 164                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 165                         )"
 166                 );
 167
 168                 $commentid = $db->insert_id();
 169
 170                 $log->language = 'log_new_attachment_comment';
 171                 $log->arguments = array($attachmentid, $commentid);
 172                 $log->allowempty = true;
 173                 $log->log();
 174         }
 175
 176         // update the last post data
 177         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 178
 179         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment added</a>";
 180 }
 181
 182 // ###################################################################
 183
 184 if ($_REQUEST['do'] == 'add')
 185 {
 186         if (!can_perform('canputattach'))
 187         {
 188                 echo 'alert: no permission';
 189                 exit;
 190         }
 191
 192         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 193
 194         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 195         $show['obsoletes'] = false;
 196
 197         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 198         $obsoletes = '';
 199         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 200         {
 201                 $show['obsoletes'] = true;
 202                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 203         }
 204
 205         eval('$template->flush("' . $template->fetch('newattach') . '");');
 206 }
 207
 208 // ###################################################################
 209
 210 if ($_POST['do'] == 'update')
 211 {
 212         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 213         {
 214                 echo 'alert: no permssion';
 215                 exit;
 216         }
 217
 218         $db->query("
 219                 UPDATE " . TABLE_PREFIX . "attachment
 220                 SET description = '" . $bugsys->in['description'] . "',
 221                         obsolete = " . intval($bugsys->in['obsolete']) . "
 222                 WHERE attachmentid = " . intval($bugsys->in['attachmentid'])
 223         );
 224
 225         $hist[1] = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
 226
 227         $diff[0] = array_diff_assoc($attachment, $hist[1]);
 228         $diff[1] = array_diff_assoc($hist[1], $attachment);
 229
 230         $log->language = 'log_update_attachment';
 231         $log->arguments = array($attachment['attachmentid']);
 232         $log->log($log->diff('description', $diff[0]['description'], $diff[1]['description']));
 233         $log->log($log->diff('obsolete', $diff[0]['obsolete'], $diff[1]['obsolete']));
 234
 235         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment updated</a>";
 236 }
 237
 238 // ###################################################################
 239
 240 if ($_REQUEST['do'] == 'edit')
 241 {
 242         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 243         {
 244                 echo 'alert: no permssion';
 245                 exit;
 246         }
 247
 248         $show['delete'] = ((can_perform('caneditattach')) ? true : false);
 249
 250         eval('$template->flush("' . $template->fetch('editattach') . '");');
 251 }
 252
 253 /*=====================================================================*\
 254 || ###################################################################
 255 || # $HeadURL$
 256 || # $Id$
 257 || ###################################################################
 258 \*=====================================================================*/
 259 ?>