{

var $filename = '';

var $realname = '';

var $uploadname = '';

var $mimetype = '';

var $extension = '';

var $filesize = 0;

var $width = 0;

var $height = 0;

var $image_info = array();

var $destination_file = '';

var $destination_path = '';

var $file_moved = false;

var $init_error = false;

var $local = false;

var $error = array();

var $upload = '';

/**

protected $plupload;

/**

protected $mimetype_guesser;

/**

function filespec($upload_ary, $upload_namespace, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null)

{

if (!isset($upload_ary))

{

$this->init_error = true;

return;

}

$this->filename = $upload_ary['tmp_name'];

$this->filesize = $upload_ary['size'];

$name = (STRIP) ? stripslashes($upload_ary['name']) : $upload_ary['name'];

$name = trim(utf8_basename($name));

$this->realname = $this->uploadname = $name;

$this->mimetype = $upload_ary['type'];

// Opera adds the name to the mime type

$this->mimetype = (strpos($this->mimetype, '; name') !== false) ? str_replace(strstr($this->mimetype, '; name'), '', $this->mimetype) : $this->mimetype;

if (!$this->mimetype)

{

$this->mimetype = 'application/octet-stream';

}

$this->extension = strtolower(self::get_extension($this->realname));

// Try to get real filesize from temporary folder (not always working) ;)

$this->filesize = (@filesize($this->filename)) ? @filesize($this->filename) : $this->filesize;

$this->width = $this->height = 0;

$this->file_moved = false;

$this->local = (isset($upload_ary['local_mode'])) ? true : false;

$this->upload = $upload_namespace;

$this->plupload = $plupload;

$this->mimetype_guesser = $mimetype_guesser;

}

/**

function clean_filename($mode = 'unique', $prefix = '', $user_id = '')

{

if ($this->init_error)

{

return;

}

switch ($mode)

{

case 'real':

// Remove every extension from filename (to not let the mime bug being exposed)

if (strpos($this->realname, '.') !== false)

{

$this->realname = substr($this->realname, 0, strpos($this->realname, '.'));

}

// Replace any chars which may cause us problems with _

$bad_chars = array("'", "\\", ' ', '/', ':', '*', '?', '"', '<', '>', '|');

$this->realname = rawurlencode(str_replace($bad_chars, '_', strtolower($this->realname)));

$this->realname = preg_replace("/%(\w{2})/", '_', $this->realname);

$this->realname = $prefix . $this->realname . '.' . $this->extension;

break;

case 'unique':

$this->realname = $prefix . md5(unique_id());

break;

case 'avatar':

$this->extension = strtolower($this->extension);

$this->realname = $prefix . $user_id . '.' . $this->extension;

break;

case 'unique_ext':

default:

$this->realname = $prefix . md5(unique_id()) . '.' . $this->extension;

break;

}

}

/**

function get($property)

{

if ($this->init_error || !isset($this->$property))

{

return false;

}

return $this->$property;

}

/**

function is_image()

{

return (strpos($this->mimetype, 'image/') === 0);

}

/**

function is_uploaded()

{

$is_plupload = $this->plupload && $this->plupload->is_active();

if (!$this->local && !$is_plupload && !is_uploaded_file($this->filename))

{

return false;

}

if (($this->local || $is_plupload) && !file_exists($this->filename))

{

return false;

}

return true;

}

/**

function remove()

{

if ($this->file_moved)

{

@unlink($this->destination_file);

}

}

/**

static public function get_extension($filename)

{

if (strpos($filename, '.') === false)

{

return '';

}

$filename = explode('.', $filename);

return array_pop($filename);

}

/**

function get_mimetype($filename)

{

if ($this->mimetype_guesser !== null)

{

$mimetype = $this->mimetype_guesser->guess($filename, $this->uploadname);

if ($mimetype !== 'application/octet-stream')

{

$this->mimetype = $mimetype;

}

}

return $this->mimetype;

}

/**

function get_filesize($filename)

{

return @filesize($filename);

}

/**

function check_content($disallowed_content)

{

if (empty($disallowed_content))

{

return true;

}

$fp = @fopen($this->filename, 'rb');

if ($fp !== false)

{

$ie_mime_relevant = fread($fp, 256);

fclose($fp);

foreach ($disallowed_content as $forbidden)

{

if (stripos($ie_mime_relevant, '<' . $forbidden) !== false)

{

return false;

}

}

}

return true;

}

/**

function move_file($destination, $overwrite = false, $skip_image_check = false, $chmod = false)

{

global $user, $phpbb_root_path;

if (sizeof($this->error))

{

return false;

}

$chmod = ($chmod === false) ? CHMOD_READ | CHMOD_WRITE : $chmod;

// We need to trust the admin in specifying valid upload directories and an attacker not being able to overwrite it...

$this->destination_path = $phpbb_root_path . $destination;

// Check if the destination path exist...

if (!file_exists($this->destination_path))

{

@unlink($this->filename);

return false;

}

$upload_mode = (@ini_get('open_basedir') || @ini_get('safe_mode') || strtolower(@ini_get('safe_mode')) == 'on') ? 'move' : 'copy';

$upload_mode = ($this->local) ? 'local' : $upload_mode;

$this->destination_file = $this->destination_path . '/' . utf8_basename($this->realname);

// Check if the file already exist, else there is something wrong...

if (file_exists($this->destination_file) && !$overwrite)

{

@unlink($this->filename);

$this->error[] = $user->lang($this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR', $this->destination_file);

$this->file_moved = false;

return false;

}

else

{

if (file_exists($this->destination_file))

{

@unlink($this->destination_file);

}

switch ($upload_mode)

{

case 'copy':

if (!@copy($this->filename, $this->destination_file))

{

if (!@move_uploaded_file($this->filename, $this->destination_file))

{

$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file);

}

}

break;

case 'move':

if (!@move_uploaded_file($this->filename, $this->destination_file))

{

if (!@copy($this->filename, $this->destination_file))

{

$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file);

}

}

break;

case 'local':

if (!@copy($this->filename, $this->destination_file))

{

$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'GENERAL_UPLOAD_ERROR'], $this->destination_file);

}

break;

}

// Remove temporary filename

@unlink($this->filename);

if (sizeof($this->error))

{

return false;

}

phpbb_chmod($this->destination_file, $chmod);

}

// Try to get real filesize from destination folder

$this->filesize = (@filesize($this->destination_file)) ? @filesize($this->destination_file) : $this->filesize;

// Get mimetype of supplied file

$this->mimetype = $this->get_mimetype($this->destination_file);

if ($this->is_image() && !$skip_image_check)

{

$this->width = $this->height = 0;

if (($this->image_info = @getimagesize($this->destination_file)) !== false)

{

$this->width = $this->image_info[0];

$this->height = $this->image_info[1];

if (!empty($this->image_info['mime']))

{

$this->mimetype = $this->image_info['mime'];

}

// Check image type

$types = fileupload::image_types();

if (!isset($types[$this->image_info[2]]) || !in_array($this->extension, $types[$this->image_info[2]]))

{

if (!isset($types[$this->image_info[2]]))

{

$this->error[] = sprintf($user->lang['IMAGE_FILETYPE_INVALID'], $this->image_info[2], $this->mimetype);

}

else

{

$this->error[] = sprintf($user->lang['IMAGE_FILETYPE_MISMATCH'], $types[$this->image_info[2]][0], $this->extension);

}

}

// Make sure the dimensions match a valid image

if (empty($this->width) || empty($this->height))

{

$this->error[] = $user->lang['ATTACHED_IMAGE_NOT_IMAGE'];

}

}

else

{

$this->error[] = $user->lang['UNABLE_GET_IMAGE_SIZE'];

}

}

$this->file_moved = true;

$this->additional_checks();

unset($this->upload);

return true;

}

/**

function additional_checks()

{

global $user;

if (!$this->file_moved)

{

return false;

}

// Filesize is too big or it's 0 if it was larger than the maxsize in the upload form

if ($this->upload->max_filesize && ($this->get('filesize') > $this->upload->max_filesize || $this->filesize == 0))

{

$max_filesize = get_formatted_filesize($this->upload->max_filesize, false);

$this->error[] = sprintf($user->lang[$this->upload->error_prefix . 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']);

return false;

}

if (!$this->upload->valid_dimensions($this))

{

$this->error[] = $user->lang($this->upload->error_prefix . 'WRONG_SIZE',

$user->lang('PIXELS', (int) $this->upload->min_width),

$user->lang('PIXELS', (int) $this->upload->min_height),

$user->lang('PIXELS', (int) $this->upload->max_width),

$user->lang('PIXELS', (int) $this->upload->max_height),

$user->lang('PIXELS', (int) $this->width),

$user->lang('PIXELS', (int) $this->height));

return false;

}

return true;

}

{

function fileerror($error_msg)

{

$this->error[] = $error_msg;

}

{

var $allowed_extensions = array();

var $disallowed_content = array('body', 'head', 'html', 'img', 'plaintext', 'a href', 'pre', 'script', 'table', 'title');

var $max_filesize = 0;

var $min_width = 0;

var $min_height = 0;

var $max_width = 0;

var $max_height = 0;

var $error_prefix = '';

/** @var int Timeout for remote upload */

var $upload_timeout = 6;

/**

function fileupload($error_prefix = '', $allowed_extensions = false, $max_filesize = false, $min_width = false, $min_height = false, $max_width = false, $max_height = false, $disallowed_content = false)

{

$this->set_allowed_extensions($allowed_extensions);

$this->set_max_filesize($max_filesize);

$this->set_allowed_dimensions($min_width, $min_height, $max_width, $max_height);

$this->set_error_prefix($error_prefix);

$this->set_disallowed_content($disallowed_content);

}

/**

function reset_vars()

{

$this->max_filesize = 0;

$this->min_width = $this->min_height = $this->max_width = $this->max_height = 0;

$this->error_prefix = '';

$this->allowed_extensions = array();

$this->disallowed_content = array();

}

/**

function set_allowed_extensions($allowed_extensions)

{

if ($allowed_extensions !== false && is_array($allowed_extensions))

{

$this->allowed_extensions = $allowed_extensions;

}

}

/**

function set_allowed_dimensions($min_width, $min_height, $max_width, $max_height)

{

$this->min_width = (int) $min_width;

$this->min_height = (int) $min_height;

$this->max_width = (int) $max_width;

$this->max_height = (int) $max_height;

}

/**

function set_max_filesize($max_filesize)

{

if ($max_filesize !== false && (int) $max_filesize)

{

$this->max_filesize = (int) $max_filesize;

}

}

/**

function set_disallowed_content($disallowed_content)

{

if ($disallowed_content !== false && is_array($disallowed_content))

{

$this->disallowed_content = array_diff($disallowed_content, array(''));

}

}

/**

function set_error_prefix($error_prefix)

{

$this->error_prefix = $error_prefix;

}

/**

function form_upload($form_name, \phpbb\mimetype\guesser $mimetype_guesser = null, \phpbb\plupload\plupload $plupload = null)

{

global $user, $request;

$upload = $request->file($form_name);

unset($upload['local_mode']);

if ($plupload)

{

$result = $plupload->handle_upload($form_name);

if (is_array($result))

{

$upload = array_merge($upload, $result);

}

}

$file = new filespec($upload, $this, $mimetype_guesser, $plupload);

if ($file->init_error)

{

$file->error[] = '';

return $file;

}

// Error array filled?

if (isset($upload['error']))

{

$error = $this->assign_internal_error($upload['error']);

if ($error !== false)

{

$file->error[] = $error;

return $file;

}

}

// Check if empty file got uploaded (not catched by is_uploaded_file)

if (isset($upload['size']) && $upload['size'] == 0)

{

$file->error[] = $user->lang[$this->error_prefix . 'EMPTY_FILEUPLOAD'];

return $file;

}

// PHP Upload filesize exceeded

if ($file->get('filename') == 'none')

{

$max_filesize = @ini_get('upload_max_filesize');

$unit = 'MB';

if (!empty($max_filesize))

{

$unit = strtolower(substr($max_filesize, -1, 1));

$max_filesize = (int) $max_filesize;

$unit = ($unit == 'k') ? 'KB' : (($unit == 'g') ? 'GB' : 'MB');

}

$file->error[] = (empty($max_filesize)) ? $user->lang[$this->error_prefix . 'PHP_SIZE_NA'] : sprintf($user->lang[$this->error_prefix . 'PHP_SIZE_OVERRUN'], $max_filesize, $user->lang[$unit]);

return $file;

}

// Not correctly uploaded

if (!$file->is_uploaded())

{

$file->error[] = $user->lang[$this->error_prefix . 'NOT_UPLOADED'];

return $file;

}

$this->common_checks($file);

return $file;

}

/**

function local_upload($source_file, $filedata = false, \phpbb\mimetype\guesser $mimetype_guesser = null)

{

global $user, $request;

$upload = array();

$upload['local_mode'] = true;

$upload['tmp_name'] = $source_file;

if ($filedata === false)

{

$upload['name'] = utf8_basename($source_file);

$upload['size'] = 0;

}

else

{

$upload['name'] = $filedata['realname'];

$upload['size'] = $filedata['size'];

$upload['type'] = $filedata['type'];

}

$file = new filespec($upload, $this, $mimetype_guesser);

if ($file->init_error)

{

$file->error[] = '';

return $file;

}

if (isset($upload['error']))

{

$error = $this->assign_internal_error($upload['error']);

if ($error !== false)

{

$file->error[] = $error;

return $file;

}

}

// PHP Upload filesize exceeded

if ($file->get('filename') == 'none')

{

$max_filesize = @ini_get('upload_max_filesize');

$unit = 'MB';

if (!empty($max_filesize))

{

$unit = strtolower(substr($max_filesize, -1, 1));

$max_filesize = (int) $max_filesize;

$unit = ($unit == 'k') ? 'KB' : (($unit == 'g') ? 'GB' : 'MB');

}

$file->error[] = (empty($max_filesize)) ? $user->lang[$this->error_prefix . 'PHP_SIZE_NA'] : sprintf($user->lang[$this->error_prefix . 'PHP_SIZE_OVERRUN'], $max_filesize, $user->lang[$unit]);

return $file;

}

// Not correctly uploaded

if (!$file->is_uploaded())

{

$file->error[] = $user->lang[$this->error_prefix . 'NOT_UPLOADED'];

return $file;

}

$this->common_checks($file);

$request->overwrite('local', $upload, \phpbb\request\request_interface::FILES);

return $file;

}

/**

function remote_upload($upload_url, \phpbb\mimetype\guesser $mimetype_guesser = null)

{

global $user, $phpbb_root_path;

$upload_ary = array();

$upload_ary['local_mode'] = true;

if (!preg_match('#^(https?://).*?\.(' . implode('|', $this->allowed_extensions) . ')$#i', $upload_url, $match))

{

$file = new fileerror($user->lang[$this->error_prefix . 'URL_INVALID']);

return $file;

}

if (empty($match[2]))

{

$file = new fileerror($user->lang[$this->error_prefix . 'URL_INVALID']);

return $file;

}

$url = parse_url($upload_url);

$host = $url['host'];

$path = $url['path'];

$port = (!empty($url['port'])) ? (int) $url['port'] : 80;

$upload_ary['type'] = 'application/octet-stream';

$url['path'] = explode('.', $url['path']);

$ext = array_pop($url['path']);

$url['path'] = implode('', $url['path']);

$upload_ary['name'] = utf8_basename($url['path']) . (($ext) ? '.' . $ext : '');

$filename = $url['path'];

$filesize = 0;

$remote_max_filesize = $this->max_filesize;

if (!$remote_max_filesize)

{

$max_filesize = @ini_get('upload_max_filesize');

if (!empty($max_filesize))

{

$unit = strtolower(substr($max_filesize, -1, 1));

$remote_max_filesize = (int) $max_filesize;

switch ($unit)

{

case 'g':

$remote_max_filesize *= 1024;

// no break

case 'm':

$remote_max_filesize *= 1024;

// no break

case 'k':

$remote_max_filesize *= 1024;

// no break

}

}

}

$errno = 0;

$errstr = '';

if (!($fsock = @fsockopen($host, $port, $errno, $errstr)))

{

$file = new fileerror($user->lang[$this->error_prefix . 'NOT_UPLOADED']);

return $file;

}

// Make sure $path not beginning with /

if (strpos($path, '/') === 0)

{

$path = substr($path, 1);

}

fputs($fsock, 'GET /' . $path . " HTTP/1.1\r\n");

fputs($fsock, "HOST: " . $host . "\r\n");

fputs($fsock, "Connection: close\r\n\r\n");

// Set a proper timeout for the socket

socket_set_timeout($fsock, $this->upload_timeout);

$get_info = false;

$data = '';

$length = false;

$timer_stop = time() + $this->upload_timeout;

while ((!$length || $filesize < $length) && !@feof($fsock))

{

if ($get_info)

{

if ($length)

{

// Don't attempt to read past end of file if server indicated length

$block = @fread($fsock, min($length - $filesize, 1024));

}

else

{

$block = @fread($fsock, 1024);

}

$filesize += strlen($block);

if ($remote_max_filesize && $filesize > $remote_max_filesize)

{

$max_filesize = get_formatted_filesize($remote_max_filesize, false);

$file = new fileerror(sprintf($user->lang[$this->error_prefix . 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']));

return $file;

}

$data .= $block;

}

else

{

$line = @fgets($fsock, 1024);

if ($line == "\r\n")

{

$get_info = true;

}

else

{

if (stripos($line, 'content-type: ') !== false)

{

$upload_ary['type'] = rtrim(str_replace('content-type: ', '', strtolower($line)));

}

else if ($this->max_filesize && stripos($line, 'content-length: ') !== false)

{

$length = (int) str_replace('content-length: ', '', strtolower($line));

if ($remote_max_filesize && $length && $length > $remote_max_filesize)

{

$max_filesize = get_formatted_filesize($remote_max_filesize, false);

$file = new fileerror(sprintf($user->lang[$this->error_prefix . 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']));

return $file;

}

}

else if (stripos($line, '404 not found') !== false)

{

$file = new fileerror($user->lang[$this->error_prefix . 'URL_NOT_FOUND']);

return $file;

}

}

}

$stream_meta_data = stream_get_meta_data($fsock);

// Cancel upload if we exceed timeout

if (!empty($stream_meta_data['timed_out']) || time() >= $timer_stop)

{

$file = new fileerror($user->lang[$this->error_prefix . 'REMOTE_UPLOAD_TIMEOUT']);

return $file;

}

}

@fclose($fsock);

if (empty($data))

{

$file = new fileerror($user->lang[$this->error_prefix . 'EMPTY_REMOTE_DATA']);

return $file;

}

$tmp_path = (!@ini_get('safe_mode') || strtolower(@ini_get('safe_mode')) == 'off') ? false : $phpbb_root_path . 'cache';

$filename = tempnam($tmp_path, unique_id() . '-');

if (!($fp = @fopen($filename, 'wb')))

{

$file = new fileerror($user->lang[$this->error_prefix . 'NOT_UPLOADED']);

return $file;

}

$upload_ary['size'] = fwrite($fp, $data);

fclose($fp);

unset($data);

$upload_ary['tmp_name'] = $filename;

$file = new filespec($upload_ary, $this, $mimetype_guesser);

$this->common_checks($file);

return $file;

}

/**

function assign_internal_error($errorcode)

{

global $user;

switch ($errorcode)

{

case 1:

$max_filesize = @ini_get('upload_max_filesize');

$unit = 'MB';

if (!empty($max_filesize))

{

$unit = strtolower(substr($max_filesize, -1, 1));

$max_filesize = (int) $max_filesize;

$unit = ($unit == 'k') ? 'KB' : (($unit == 'g') ? 'GB' : 'MB');

}

$error = (empty($max_filesize)) ? $user->lang[$this->error_prefix . 'PHP_SIZE_NA'] : sprintf($user->lang[$this->error_prefix . 'PHP_SIZE_OVERRUN'], $max_filesize, $user->lang[$unit]);

break;

case 2:

$max_filesize = get_formatted_filesize($this->max_filesize, false);

$error = sprintf($user->lang[$this->error_prefix . 'WRONG_FILESIZE'], $max_filesize['value'], $max_filesize['unit']);

break;

case 3:

$error = $user->lang[$this->error_prefix . 'PARTIAL_UPLOAD'];

break;

case 4:

$error = $user->lang[$this->error_prefix . 'NOT_UPLOADED'];

break;

case 6:

$error = 'Temporary folder could not be found. Please check your PHP installation.';

break;

default:

$error = false;

break;

}

return $error;

}

/**

function common_checks(&$file)

{

global $user;

// Filesize is too big or it's 0 if it was larger than the maxsize in the upload form

if ($this->max_filesize && ($file->get('filesize') > $this->max_filesize || $file->get('filesize') == 0))