uploader.php

<?php

 
define('XCUBE_IMAGETYPE_ENUM_GIF', 1);
define('XCUBE_IMAGETYPE_ENUM_JPG', 2);
define('XCUBE_IMAGETYPE_ENUM_PNG', 3);
define('XCUBE_IMAGETYPE_ENUM_BMP', 6);
 
class XoopsMediaUploader
{
    public $allowUnknownTypes = false;
    public $mediaName;
    public $mediaType;
    public $mediaSize;
    public $mediaTmpName;
    public $mediaError;
    public $mediaRealType = '';
    public $uploadDir = '';
    public $allowedMimeTypes = [];
    public $allowedExtensions = [];
    public $maxFileSize = 0;
    public $maxWidth;
    public $maxHeight;
    public $targetFileName;
    public $prefix;
    public $errors = [];
    public $savedDestination;
    public $savedFileName;
    public $extensionToMime = [];
 
    public $_strictCheckExtensions = [];

    public function __construct($uploadDir, $allowedMimeTypes, $maxFileSize=0, $maxWidth=null, $maxHeight=null)
    {
        @$this->extensionToMime = include(XOOPS_ROOT_PATH . '/class/mimetypes.inc.php');
        if (!is_array($this->extensionToMime)) {
            $this->extensionToMime = [];
            return false;
        }
        if (is_array($allowedMimeTypes)) {
            $this->allowedMimeTypes =& $allowedMimeTypes;
        }
        $this->uploadDir = $uploadDir;
        $this->maxFileSize = (int)$maxFileSize;
        if (isset($maxWidth)) {
            $this->maxWidth = (int)$maxWidth;
        }
        if (isset($maxHeight)) {
            $this->maxHeight = (int)$maxHeight;
        }
 
        $this->_strictCheckExtensions = [
            'gif'  =>XCUBE_IMAGETYPE_ENUM_GIF,
            'jpg'  =>XCUBE_IMAGETYPE_ENUM_JPG,
            'jpeg' =>XCUBE_IMAGETYPE_ENUM_JPG,
            'png'  =>XCUBE_IMAGETYPE_ENUM_PNG,
            'bmp'  =>XCUBE_IMAGETYPE_ENUM_BMP
        ];
    }
 
    public function setAllowedExtensions($extensions)
    {
        $this->allowedExtensions = is_array($extensions) ? $extensions : [];
    }
 
    public function setStrictCheckExtensions($extensions)
    {
        $this->_strictCheckExtensions = $extensions;
    }

    public function fetchMedia($media_name, $index = null)
    {
        if (empty($this->extensionToMime)) {
            $this->setErrors('Error loading mimetypes definition');
            return false;
        }
        if (!isset($_FILES[$media_name])) {
            $this->setErrors('File not found');
            return false;
        }
 
        if (is_array($_FILES[$media_name]['name']) && isset($index)) {
            $index = (int)$index;
            $this->mediaName = $_FILES[$media_name]['name'][$index];
            $this->mediaType = $_FILES[$media_name]['type'][$index];
            $this->mediaSize = $_FILES[$media_name]['size'][$index];
            $this->mediaTmpName = $_FILES[$media_name]['tmp_name'][$index];
            $this->mediaError = !empty($_FILES[$media_name]['error'][$index]) ? $_FILES[$media_name]['errir'][$index] : 0;
        } else {
            $media_name =& $_FILES[$media_name];
            $this->mediaName = $media_name['name'];
            $this->mediaName = $media_name['name'];
            $this->mediaType = $media_name['type'];
            $this->mediaSize = $media_name['size'];
            $this->mediaTmpName = $media_name['tmp_name'];
            $this->mediaError = !empty($media_name['error']) ? $media_name['error'] : 0;
        }
        if (false !== ($ext = strrpos($this->mediaName, '.'))) {
            $this->ext = strtolower(substr($this->mediaName, $ext + 1));
            if (isset($this->extensionToMime[$this->ext])) {
                $this->mediaRealType = $this->extensionToMime[$this->ext];
                //trigger_error( "XoopsMediaUploader: Set mediaRealType to {$this->mediaRealType} (file extension is ".$this->ext.")", E_USER_NOTICE );
            }
        } else {
            $this->setErrors('Invalid Extension');
            return false;
        }
        $this->errors = [];
        if ((int)$this->mediaSize < 0) {
            $this->setErrors('Invalid File Size');
            return false;
        }
        if ('' == $this->mediaName) {
            $this->setErrors('Filename Is Empty');
            return false;
        }
        if ('none' === $this->mediaTmpName || !is_uploaded_file($this->mediaTmpName)) {
            $this->setErrors('No file uploaded');
            return false;
        }
        if ($this->mediaError > 0) {
            $this->setErrors('Error occurred: Error #'.$this->mediaError);
            return false;
        }
        return true;
    }

    public function setTargetFileName($value)
    {
        $this->targetFileName = (string)trim($value);
    }

    public function setPrefix($value)
    {
        $this->prefix = (string)trim($value);
    }

    public function getMediaName()
    {
        return $this->mediaName;
    }

    public function getMediaType()
    {
        return $this->mediaType;
    }

    public function getMediaSize()
    {
        return $this->mediaSize;
    }

    public function getMediaTmpName()
    {
        return $this->mediaTmpName;
    }

    public function getSavedFileName()
    {
        return $this->savedFileName;
    }

    public function getSavedDestination()
    {
        return $this->savedDestination;
    }

    public function upload($chmod = 0644)
    {
        if ('' == $this->uploadDir) {
            $this->setErrors('Upload directory not set');
            return false;
        }
        if (!is_dir($this->uploadDir)) {
            $this->setErrors('Failed opening directory: '.$this->uploadDir);
        }
        if (!is_writable($this->uploadDir)) {
            $this->setErrors('Failed opening directory with write permission: '.$this->uploadDir);
        }
        if (!$this->checkMaxFileSize()) {
            $this->setErrors('File size too large: '.$this->mediaSize);
        }
        if (!$this->checkMaxWidth()) {
            $this->setErrors(sprintf('File width must be smaller than %u', $this->maxWidth));
        }
        if (!$this->checkMaxHeight()) {
            $this->setErrors(sprintf('File height must be smaller than %u', $this->maxHeight));
        }
        if (!$this->checkMimeType()) {
            $this->setErrors('Invalid file type');
        }
        if (count($this->errors) > 0) {
            return false;
        }
        if (!$this->_copyFile($chmod)) {
            $this->setErrors('Failed uploading file: '.$this->mediaName);
            return false;
        }
        return true;
    }

    public function _copyFile($chmod)
    {
        if (isset($this->targetFileName)) {
            $this->savedFileName = $this->targetFileName;
        } elseif (isset($this->prefix)) {
            $this->savedFileName = uniqid($this->prefix, true).'.'.strtolower($this->ext);
        } else {
            $this->savedFileName = strtolower($this->mediaName);
        }
        $this->savedDestination = $this->uploadDir.'/'.$this->savedFileName;
        if (!move_uploaded_file($this->mediaTmpName, $this->savedDestination)) {
            return false;
        }
        @chmod($this->savedDestination, $chmod);
        return true;
    }

    public function checkMaxFileSize()
    {
        return !($this->mediaSize > $this->maxFileSize);
    }

    public function checkMaxWidth()
    {
        if (!isset($this->maxWidth)) {
            return true;
        }
        if (false !== $dimension = getimagesize($this->mediaTmpName)) {
            if ($dimension[0] > $this->maxWidth) {
                return false;
            }
        } else {
            trigger_error(sprintf('Failed fetching image size of %s, skipping max width check..', $this->mediaTmpName), E_USER_WARNING);
        }
        return true;
    }

    public function checkMaxHeight()
    {
        if (!isset($this->maxHeight)) {
            return true;
        }
        if (false !== $dimension = getimagesize($this->mediaTmpName)) {
            if ($dimension[1] > $this->maxHeight) {
                return false;
            }
        } else {
            trigger_error(sprintf('Failed fetching image size of %s, skipping max height check..', $this->mediaTmpName), E_USER_WARNING);
        }
        return true;
    }

    public function checkMimeType()
    {
        if (!empty($this->allowedExtensions)) {
            if (!in_array($this->ext, $this->allowedExtensions)) {
                $this->setErrors('File extension not allowed');
                return false;
            }
            // Since the file extension is already checked against
            // allowed file extension values, it is safe to use
            // $this->mediaType for the allowed mime type check as was in
            // <= 2.0.9.2
            if (!empty($this->allowedMimeTypes)&& !in_array($this->mediaType, $this->allowedMimeTypes, true)) {
                $this->setErrors('Unexpected MIME Type');
                return false;
            }
        } else {
            // use $this->mediaRealType for the allowed mime type check to
            // make it more restrictive/secure
            if (empty($this->mediaRealType) && !$this->allowUnknownTypes) {
                return false;
            }
            if (!empty($this->allowedMimeTypes)&& !in_array($this->mediaRealType, $this->allowedMimeTypes, true)) {
                $this->setErrors('Unexpected MIME Type');
                return false;
            }
        }
 
        // If this extension need strict check, call method for it.
        if (isset($this->_strictCheckExtensions[$this->ext])) {
            return $this->_checkStrict();
        } else {
            return true;
        }
    }
 
    public function _checkStrict()
    {
        $parseValue = getimagesize($this->mediaTmpName);
 
        if (false === $parseValue) {
            return false;
        }
 
        return $parseValue[2]==$this->_strictCheckExtensions[$this->ext];
    }

    public function checkExpectedMimeType()
    {
        if (empty($this->mediaRealType) && !$this->allowUnknownTypes) {
            return false;
        }
 
        return (empty($this->allowedMimeTypes) || in_array($this->mediaRealType, $this->allowedMimeTypes, true));
    }

    public function setErrors($error)
    {
        $this->errors[] = trim($error);
    }

    public function &getErrors($ashtml = true)
    {
        if (!$ashtml) {
            return $this->errors;
        }
 
        $ret = '';
        if (count($this->errors) > 0) {
            $ret = '<h4>Errors Returned While Uploading</h4>';
            foreach ($this->errors as $error) {
                $ret .= $error.'<br>';
            }
        }
        return $ret;
    }
}