attachment.php

   1 <?php
   2 /*=====================================================================*\
   3 || ################################################################### ||
   4 || # BugStrike [#]version[#]
   5 || # --------------------------------------------------------------- # ||
   6 || # Copyright ©2002-[#]year[#] by Iris Studios, Inc. All Rights Reserved. # ||
   7 || # This file may not be reproduced in any way without permission.  # ||
   8 || # --------------------------------------------------------------- # ||
   9 || # User License Agreement at http://www.iris-studios.com/license/  # ||
  10 || ################################################################### ||
  11 \*=====================================================================*/
  12
  13 $fetchtemplates = array(
  14         'newattach',
  15         'editattach'
  16 );
  17
  18 require_once('./global.php');
  19
  20 if (isset($bugsys->in['attachmentid']))
  21 {
  22         $attachment = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE attachmentid = " . intval($bugsys->in['attachmentid']));
  23         if (!$attachment)
  24         {
  25                 echo 'alert: bad attachment';
  26                 exit;
  27         }
  28 }
  29
  30 $bug = $db->query_first("SELECT * FROM " . TABLE_PREFIX . "bug WHERE bugid = " . (($attachment['attachmentid']) ? $attachment['bugid'] : intval($bugsys->in['bugid'])));
  31 if (!$bug)
  32 {
  33         echo 'alert: bad bug';
  34         exit;
  35 }
  36
  37 // ###################################################################
  38
  39 if ($_REQUEST['do'] == 'kill')
  40 {
  41         // run code to remove item in database
  42 }
  43
  44 // ###################################################################
  45
  46 if ($_REQUEST['do'] == 'delete')
  47 {
  48         // display delete confirmation message
  49 }
  50
  51 // ###################################################################
  52
  53 if ($_POST['do'] == 'insert')
  54 {
  55         if (!can_perform('canputattach'))
  56         {
  57                 echo 'alert: no permission';
  58                 exit;
  59         }
  60
  61         // create alias
  62         $FILE =& $_FILES['attachment'];
  63
  64         // PHP errors
  65         switch ($FILE['error'])
  66         {
  67                 case 0: break;
  68                 case 1: echo 'PHP said the file you uploaded was too big.'; exit; break;
  69                 case 2: echo 'The file exceeds the allowed upload size.'; exit; break;
  70                 case 3: echo 'The file was only partially uploaded.'; exit; break;
  71                 case 4: echo 'The file was not uploaded at all.'; exit; break;
  72                 case 6: echo 'PHP could not find the /tmp directory.'; exit; break;
  73         }
  74
  75         // did it upload?
  76         if (!is_uploaded_file($FILE['tmp_name']))
  77         {
  78                 echo 'The file you specified did not upload.';
  79                 exit;
  80         }
  81
  82         // #*# put some MIME-type validation here
  83
  84         if (!$bugsys->in['description'])
  85         {
  86                 echo 'you need a file description!';
  87                 exit;
  88         }
  89
  90         $filedata = $bugsys->escape(file_get_contents($FILE['tmp_name']), true, true);
  91         $time = time();
  92
  93         // insert an attachment
  94         $db->query("
  95                 INSERT INTO attachment
  96                         (bugid, filename, mimetype, filesize,
  97                         attachment, description, dateline, userid)
  98                 VALUES
  99                         ($bug[bugid], '" . $bugsys->escape($FILE['name']) . "',
 100                         '" . $bugsys->escape($FILE['type']) . "', " . intval($FILE['size']) . ",
 101                         '$filedata', '" . $bugsys->in['description'] . "', $time,
 102                         " . $bugsys->userinfo['userid'] . "
 103                 )"
 104         );
 105
 106         // mark obsoletes
 107         $obsoletes = $_POST['obsoletes'];
 108         array_walk($obsoletes, 'intval');
 109         $db->query("UPDATE " . TABLE_PREFIX . "attachment SET obsolete = 1 WHERE attachmentid IN (" . implode(',', $obsoletes) . ") AND !obsolete AND bugid = $bug[bugid]");
 110
 111         // handle comment stuff
 112         if (can_perform('canpostcomments') AND trim($bugsys->in['comment']))
 113         {
 114                 $bugsys->in['comment_parsed'] = $bugsys->in['comment'];
 115
 116                 if (!$bugsys->options['allowhtml'])
 117                 {
 118                         $bugsys->in['comment_parsed'] = $bugsys->sanitize($bugsys->in['comment_parsed']);
 119                 }
 120
 121                 $db->query("
 122                         INSERT INTO " . TABLE_PREFIX . "comment
 123                                 (bugid, userid, dateline, comment, comment_parsed)
 124                         VALUES
 125                                 ($bug[bugid], " . $bugsys->userinfo['userid'] . ",
 126                                 $time, '" . $bugsys->in['comment'] . "',
 127                                 '" . nl2br($bugsys->in['comment_parsed']) . "'
 128                         )"
 129                 );
 130         }
 131
 132         // update the last post data
 133         $db->query("UPDATE " . TABLE_PREFIX . "bug SET lastposttime = $time, lastpostby = " . $bugsys->userinfo['userid'] . " WHERE bugid = $bug[bugid]");
 134
 135         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment added</a>";
 136
 137 }
 138
 139 // ###################################################################
 140
 141 if ($_REQUEST['do'] == 'add')
 142 {
 143         if (!can_perform('canputattach'))
 144         {
 145                 echo 'alert: no permission';
 146                 exit;
 147         }
 148
 149         $MAXFILESIZE = $funct->fetch_max_attachment_size();
 150
 151         $show['addcomment'] = ((can_perform('canpostcomments')) ? true : false);
 152         $show['obsoletes'] = false;
 153
 154         $obsoletes_fetch = $db->query("SELECT * FROM " . TABLE_PREFIX . "attachment WHERE bugid = $bug[bugid] AND !obsolete");
 155         $obsoletes = '';
 156         while ($obsolete = $db->fetch_array($obsoletes_fetch))
 157         {
 158                 $show['obsoletes'] = true;
 159                 $obsoletes .= "<div><input name=\"obsoletes[]\" type=\"checkbox\" value=\"$obsolete[attachmentid]\" /> $obsolete[filename] [$obsolete[description]]</div>\n";
 160         }
 161
 162         eval('$template->flush("' . $template->fetch('newattach') . '");');
 163 }
 164
 165 // ###################################################################
 166
 167 if ($_POST['do'] == 'update')
 168 {
 169         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 170         {
 171                 echo 'alert: no permssion';
 172                 exit;
 173         }
 174
 175         $db->query("
 176                 UPDATE " . TABLE_PREFIX . "attachment
 177                 SET description = '" . $bugsys->in['description'] . "',
 178                         obsolete = " . intval($bugsys->in['obsolete']) . "
 179                 WHERE attachmentid = " . intval($bugsys->in['attachmentid'])
 180         );
 181
 182         echo "<a href=\"showreport.php?bugid=$bug[bugid]\">attachment updated</a>";
 183 }
 184
 185 // ###################################################################
 186
 187 if ($_REQUEST['do'] == 'edit')
 188 {
 189         if (!(can_perform('caneditattach') OR ($attachment['userid'] == $bugsys->userinfo['userid'] AND can_perform('canputattach'))))
 190         {
 191                 echo 'alert: no permssion';
 192                 exit;
 193         }
 194
 195         eval('$template->flush("' . $template->fetch('editattach') . '");');
 196 }
 197
 198 /*=====================================================================*\
 199 || ###################################################################
 200 || # $HeadURL$
 201 || # $Id$
 202 || ###################################################################
 203 \*=====================================================================*/
 204 ?>