<?php
/**
 * @version $Id: upload.inc.php v2.0 $
 * @package PBDigg
 * @copyright Copyright (C) 2007 - 2008 PBDigg.com. All Rights Reserved.
 * @license PBDigg is free software and use is subject to license terms
 */

define('PB_CSCRIPT', 'upload');
require_once('common.inc.php');
$t_a = array();
$fsid = GP('fsid');

if (!$allowaupload || !$pb_allowupload || !$fsid)
{
	uploaderror();
}
$action == 'upload' && clearFsession();
$atta = $DB->db_fetch_one_array("SELECT * FROM {$db_prefix}fsession WHERE fsid = '".$fsid."' AND uid = ".$customer['uid']." AND ip = '".$_PBDEV['PB_IP']."'");
!$atta && uploaderror();
$atta['attachment'] && $t_a = unserialize($atta['attachment']);
$t_num = count($t_a);
if ($t_num > $pb_attachnum) uploaderror();

if ($action == 'del')
{
	$id = intval($id);
	if (!array_key_exists($id, $t_a)) uploaderror();
	if (strpos($t_a[$id][3], '..') === FALSE) PDel(PBDIGG_ROOT.'attachments/temp/'.$t_a[$id][3]);
	unset($t_a[$id]);
	$t_a = empty($t_a) ? '' : serialize($t_a);
	$DB->db_query("UPDATE {$db_prefix}fsession SET attachment = '".$t_a."', exptime = $timestamp + 3600 WHERE fsid = '".$fsid."' AND uid = ".$customer['uid']);
	if (function_exists('json_encode'))
	{
		$id = json_encode($id);
	}
	else
	{
	   require_once(PBDIGG_ROOT.'include/json.class.php');
	   $json = new Services_JSON;
	   $id = $json->encode($id);
	}
	echo $id;
}
elseif ($action == 'show')
{
	$id = intval($id);
	if (!array_key_exists($id, $t_a)) uploaderror();
	$ca = &$t_a[$id];
	header('Pragma:no-cache');
	header('Cache-control:no-cache');
	if ($ca[4])
	{
		$img = PBDIGG_ROOT.'attachments/temp/'.$ca[3];
		$imginfo = @getimagesize($img);
		if (!$imginfo) uploaderror();
		header('Content-type: image/'.$ca[1]);
		readfile($img);
	}
	else
	{
		header('Content-type: image/gif');
		readfile(PBDIGG_ROOT.'images/icon.gif');
	}
}
elseif ($action == 'upload')
{
	require_once(PBDIGG_ROOT.'include/Upload.class.php');
	$Upload = new Upload();
	if (!$Upload->_count) uploaderror();
	$files = & $Upload->getFiles();
	$exts = $attachment = array();
	$attasize = ($pb_uploadmaxsize > $uploadmax) ? $uploadmax : $pb_uploadmaxsize;
	if ($pb_uploadfiletype && $uploadtype)
	{
		$exts = explode(',', $uploadtype);
		foreach ($exts as $key => $ext)
		{
			if (strpos($pb_uploadfiletype, $ext) === FALSE)
			{
				unset($exts[$key]);
			}
		}
	}
	foreach ($files as $file)
	{
		$file->checkFile($exts, $attasize) && uploaderror();
		$file->moveFile(PBDIGG_ROOT.'attachments/temp/');
		$ext = $file->getExtName();
		$isimg = in_array(strtolower($ext), array('gif','png','jpg','jpeg','bmp')) ? '1' : '0';
		$filetype = mimetype($ext);
		$t_a[] = array(addslashes(HConvert(convert_encoding('UTF-8', $db_charset, $file->getFileName()))), $filetype, intval($file->getFileSize()), addslashes($file->getRealName().'.'.$ext), $isimg);
	}
	$DB->db_query("UPDATE {$db_prefix}fsession SET attachment = '".serialize($t_a)."', exptime = $timestamp + 3600 WHERE fsid = '".$fsid."' AND uid = ".$customer['uid']);
	echo $t_num;
}
else
{
	uploaderror();
}

function uploaderror()
{
	global $action;
	if ($action == 'show')
	{
		header('Content-type: image/gif');
		readfile(PBDIGG_ROOT.'images/noimg.gif');
	}
	else
	{
		header('HTTP/1.1 500 Internal Server Error');
	}
	exit;
}
function mimetype($ext)
{
	switch ($ext)
	{
		case 'gif':
		case 'png':
		case 'bmp':
			$filetype = 'image/'.$ext;
			break;
		case 'jpg':
		case 'jpeg':
			$filetype = 'image/jpeg';
			break;
		case 'txt':
			$filetype = 'text/plain';
			break;
		case 'doc':
			$filetype = 'application/msword';
			break;
		default :
			$filetype = 'application/octet-stream';
			break;
	}
	return $filetype;
}
function clearFsession()
{
	global $DB, $db_prefix, $timestamp;
	$DB->db_query("SELECT * FROM {$db_prefix}fsession WHERE attachment <> '' AND exptime <= $timestamp");
	while ($f = $DB->db_fetch_array())
	{
		$a = unserialize($f['attachment']);
		if (strpos($a[3], '..') === FALSE)
		{
			PDel(PBDIGG_ROOT.'attachments/temp/'.$a[3]);
		}
	}
	$DB->db_query("DELETE FROM {$db_prefix}fsession WHERE exptime <= $timestamp", 0);
}
?>