<%Server.ScriptTimeOut=7000%>
<!--#include file="tgzcm_Conn.asp"-->
<!--#include file="tgzcm_Check.asp"-->
<!--#include file="../tgzcm.Cache/tgzcm.Admin.asp"-->
<!--#include file="inc/tgzcm.File.asp" -->
<!--#include file="Inc/cht.asp"-->
<!--#include file="Inc/Funaspjpeg.asp" -->
<style type="text/css">
<!--
body,td,th {
	font-size: 12px;
	background-color: #fff;
}
body {
	margin: 0px;
}
-->
</style>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312" />
<table width="100%" border="0" cellspacing="0" cellpadding="0">
  <tr>
    <td style="padding-top:4px; padding-left:3px;">
<%
Call Chkhttp()
Function ckFileExt(fileExt)		'文件扩展名检查
fExt="jpg;gif;bmp;png;"     '限制文件上传的类型
	everyfext=split(fExt,";")
		for i=Lbound(everyfext) to ubound(everyfext)
			if fileExt=right(everyfext(i),3) then
				ckFileExt=True
				exit for
			end if
		next
End Function

dim upload,file,formPath,formName,fileExt,t_width,t_height
set upload=new cht  '建立上传对象
formPath=tgzcmFile   '上传后的文件存放目录
if right(formPath,1)<>"/" then formPath=formPath&"/"    '在目录后加"/"
set file=upload.file("file1")   '生成一个文件对象
fileExt=LCase(right(File.FileName,3))   '获取文件扩展名
t_width=upload.Form("t_width")'图片宽度
t_height=upload.Form("t_height")'图片高度
If file.FileSize<1 then       
  Response.Write ("<script language=javascript>alert('对不起,你没有选择要上传的文件或文件大小为0K!');history.back(-1);</script>")
  Response.End()
Elseif Not ckFileExt(fileExt) then
  Response.Write ("<script language=javascript>alert('对不起,你上传的文件格式不符合要求!');history.back(-1);</script>")
  Response.End()
Elseif file.filesize>int(1000*1024) then    ''以KB为单位
  Response.Write ("<script language=javascript>alert('对不起,你上传的文件大小超出了限制!');history.back(-1);</script>")
  Response.End()
Else      
  randomize()
  ranNum=int(90000*rnd)+10000
  datetime=year(date()) & month(date()) & day(date()) & hour(now()) & minute(now())
  SavePathName=year(Now()) & right("0" & month(Now()),2) & "/"
  putname=upload.Form("putname")
  FileName=datetime & ranNum & "." & FileExt     '生成文件名
  file.SaveAs Server.mappath(formPath&FileName)    '保存文件
  
''===============判断上传文件是否含非法字符串start================ 
set MyFile = server.CreateObject("Scripting.FileSystemObject") 
set MyText = MyFile.OpenTextFile(Server.mappath(formPath&FileName), 1) '读取文本文件 
sTextAll = lcase(MyText.ReadAll) 
MyText.close 
set MyFile = nothing 
sStr="<%|.getfolder|.createfolder|.deletefolder|.createdirectory|.deletedirectory|.saveas|wscript.shell|script.encode|server.|.createobject|execute|activexobject|language=|<script|<iframe" 
sNoString = split(sStr,"|")  
for i=0 to ubound(sNoString) 
  if instr(sTextAll,sNoString(i)) then 
    set filedel = server.CreateObject("Scripting.FileSystemObject") 
    filedel.deletefile Server.mappath(formPath&FileName) 
    set filedel = nothing 
    Response.Write("<script>alert('图片属性有恶意代码,请重新编辑后上传！');history.back();</script>") 
    Response.End 
  end if 
next 
''=================判断上传文件是否含非法字符串end=================== 
  '启用自动缩略图开始，调用aspjpg组件：QQ:248682396
  basepic=tgzcmFile&FileName
  sl_width=t_width
  sl_height=t_height
  if tgzcmId(20)=1 then
  Call makesl (basepic,newpic,sl_width,sl_height)
  'Else
  'Response.Write "服务器不支持aspjpeg组件"
  End if
  Response.write "文件上传成功!&nbsp;[<a href='tgzcm_pic.file.htm.asp?name="&putname&"'>重新上传</a>]&nbsp;[<a href='"&formPath&FileName&"' target='_blank'>查看</a>]"
  Response.Write("<script>parent.form1."&putname&".value=''</script>")
  Response.Write("<script>parent.form1."&putname&".value='Picfile/"&SavePathName&""&FileName&"'</script>")
End If
set file=nothing
set upload=nothing   '关闭对象
%></td>
  </tr>
</table>
