attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ###################################################################
   4 || # Bugdar [#]version[#]
   5 || # Copyright ©2002-[#]year[#] Iris Studios, Inc.
   6 || #
   7 || # This program is free software; you can redistribute it and/or modify
   8 || # it under the terms of the GNU General Public License as published by
   9 || # the Free Software Foundation; version [#]gpl[#] of the License.
  10 || #
  11 || # This program is distributed in the hope that it will be useful, but
  12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  14 || # more details.
  15 || #
  16 || # You should have received a copy of the GNU General Public License along
  17 || # with this program; if not, write to the Free Software Foundation, Inc.,
  18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19 || ###################################################################
  20 \*=====================================================================*/
  21
  22 $fetchtemplates = array(
  23         'newattach',
  24         'editattach'
  25 );
  26
  27 define('SVN', '$Id$');
  28
  29 $focus['showreport'] = 'focus';
  30
  31 require_once('./global.php');
  32
  33 if (isset($bugsys->in['attachmentid']))
  34 {
  35         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  36         if (!$attachment)
  37         {
  38                 $message->error($lang->getlex('error_invalid_id'));
  39         }
  40 }
  41
  42 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . (($attachment['attachmentid']) ? $attachment['bugid'] : intval($bugsys->in['bugid'])));
  43 if (!$bug)
  44 {
  45         $message->error($lang->getlex('error_invalid_id'));
  46 }
  47
  48 // setup logging
  49 require_once('./includes/class_history.php');
  50 $log = new History();
  51 $log->bugid = $bug['bugid'];
  52
  53 // ###################################################################
  54
  55 if ($_POST['do'] == 'insert')
  56 {
  57         if (!can_perform('canputattach', $bug['productid']))
  58         {
  59                 $message->error_permission();
  60         }
  61
  62         // max packet size
  63         $var = $db->query_first("SHOW VARIABLES LIKE 'max_allowed_packet'");
  64         $bugsys->debug("max_allowed_packet = $var[Value]");
  65
  66         // create alias
  67         $FILE =& $_FILES['attachment'];
  68
  69         // PHP errors
  70         switch ($FILE['error'])
  71         {
  72                 case 0: break;
  73                 case 1: $message->items[] = $lang->string('PHP said the file you uploaded was too big.'); break;
  74                 case 2: $message->items[] = $lang->string('The file exceeds the allowed upload size.'); break;
  75                 case 3: $message->items[] = $lang->string('The file was only partially uploaded.'); break;
  76                 case 4: $message->items[] = $lang->string('The file was not uploaded at all.'); break;
  77                 case 6: $message->items[] = $lang->string('PHP could not find the /tmp directory.'); break;
  78         }
  79
  80         // did it upload?
  81         if (!is_uploaded_file($FILE['tmp_name']))
  82         {
  83                 $message->items[] = $lang->string('The file you specified did not upload.');
  84         }
  85
  86         // #*# put some MIME-type validation here
  87
  88         if (filesize($FILE['tmp_name']) > $var['Value'])
  89         {
  90                 $message->items[] = $lang->string('The file you specified exceeds MySQL\'s maximum allowed packet.');
  91         }
  92
  93         // insert an attachment
  94         if (!$message->items)
  95         {
  96                 $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
  97                 $time = TIMENOW;
  98
  99                 $db->query("
 100                         INSERT INTO " . TABLE_PREFIX . "attachment
 101                                 (bugid, filename, mimetype, filesize,
 102                                 attachment, description, dateline, userid)
 103                         VALUES
 104                                 ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 105                                 '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 106                                 '$filedata', '" . $bugsys->in['description'] . "', $time,
 107                                 " . $bugsys->userinfo['userid'] . "
 108                         )"
 109                 );
 110
 111                 // mark obsoletes
 112                 $obsoletes = $_POST['obsoletes'];
 113                 if (count($obsoletes) > 0)
 114                 {
 115                         array_walk($obsoletes, 'intval');
 116                         $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 117
 118                         foreach ($obsoletes AS $attachmentid)
 119                         {
 120                                 $log->attachmentid = $attachmentid;
 121                                 $log->log($log->diff('obsolete', 0, 1));
 122                         }
 123                 }
 124
 125                 // handle comment stuff
 126                 if (can_perform('canpostcomments', $bug['productid']) AND trim($bugsys->in['comment']))
 127                 {
 128                         $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 129
 130                         if (!$bugsys->options['allowhtml'])
 131                         {
 132                                 $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 133                         }
 134
 135                         $db->query("
 136                                 INSERT INTO " . TABLE_PREFIX . "comment
 137                                         (bugid, userid, dateline, comment, comment_parsed)
 138                                 VALUES
 139                                         ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 140                                         $time, '" . $bugsys->in['comment'] . "',
 141                                         '" . nl2br($bugsys->in['comment_parsed']) . "'
 142                                 )"
 143                         );
 144                 }
 145
 146                 // update the last post data
 147                 $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 148
 149                 $message->redirect($lang->string('The attachment has been added to the bug.'), "showreport.php?bugid=$bug[bugid]");
 150         }
 151         else
 152         {
 153                 $show['errors'] = true;
 154                 $_REQUEST['do'] = 'add';
 155                 $message->error_list_process();
 156         }
 157 }
 158
 159 // ###################################################################
 160
 161 if ($_REQUEST['do'] == 'add')
 162 {
 163         if (!can_perform('canputattach', $bug['productid']))
 164         {
 165                 $message->error_permission();
 166         }
 167
 168         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 169
 170         $show['addcomment'] = ((can_perform('canpostcomments', $bug['productid'])) ? true : false);
 171         $show['obsoletes'] = false;
 172
 173         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 174         $obsoletes = '';
 175         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 176         {
 177                 $show['obsoletes'] = true;
 178                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\"" . (in_array($obsolete['attachmentid'], $bugsys->in['obsoletes']) ? ' checked="checked"' : '') . " /> $obsolete[filename]" . ($obsolete['description'] ? " [$obsolete[description]]" : '') . "</div>\n";
 179         }
 180
 181         eval('$template->flush("' . $template->fetch('newattach') . '");');
 182 }
 183
 184 // ###################################################################
 185
 186 if ($_POST['do'] == 'update')
 187 {
 188         if (!(can_perform('caneditattach', $bug['productid']) OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach', $bug['productid']))))
 189         {
 190                 $message->error_permission();
 191         }
 192
 193         $db->query("
 194                 UPDATE " . TABLE_PREFIX . "attachment
 195                 SET description = '" . $bugsys->in['description'] . "',
 196                         obsolete = " . intval($bugsys->in['obsolete']) . "
 197                 WHERE attachmentid = " . intval($bugsys->in['attachmentid'])
 198         );
 199
 200         $hist[1] = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = $attachment[attachmentid]");
 201
 202         $diff[0] = array_diff_assoc($attachment, $hist[1]);
 203         $diff[1] = array_diff_assoc($hist[1], $attachment);
 204
 205         $log->attachmentid = $attachment['attachmentid'];
 206         $log->log($log->diff('description', $diff[0]['description'], $diff[1]['description']));
 207         $log->log($log->diff('obsolete', $diff[0]['obsolete'], $diff[1]['obsolete']));
 208
 209         $message->redirect($lang->string('The attachment was successfully modified.'), "showreport.php?bugid=$bug[bugid]");
 210 }
 211
 212 // ###################################################################
 213
 214 if ($_REQUEST['do'] == 'edit')
 215 {
 216         if (!(can_perform('caneditattach', $bug['productid']) OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach', $bug['productid']))))
 217         {
 218                 $message->error_permission();
 219         }
 220
 221         $show['delete'] = ((can_perform('caneditattach', $bug['productid'])) ? true : false);
 222
 223         eval('$template->flush("' . $template->fetch('editattach') . '");');
 224 }
 225
 226 /*=====================================================================*\
 227 || ###################################################################
 228 || # $HeadURL$
 229 || # $Id$
 230 || ###################################################################
 231 \*=====================================================================*/
 232 ?>