<?php
/*
+--------------------------------------------------------+
| O-BLOG - PHP Blog System                               |
| Copyright (c) 2004 phpBlog.CN                          |
| Support : http://www.phpBlog.cn                        |
| Author : ShiShiRui (shishirui@163.com)                 |
|--------------------------------------------------------+
*/
error_reporting(7);
chdir("../../");

require('global.php');
header("content-type:text/html; charset=".CHARSET);
isLogin();
$action = isset($_GET['action']) ? $_GET['action'] : "";

//判断是否允许用户上传文件
$id = intval(getcookie('ob_userid'));
$auth_char = $DB->fetch_one("SELECT `auth` FROM `".$mysql_prefix."admin` WHERE `id`=".$id);
if(strstr($auth_char,"upload") && strstr($auth_char,"doupload")) {
	$allow_user_upload = true;
} else {
	$allow_user_upload = false;
}
if(!$allow_user_upload) {
	echo "<script>alert('您没有上传附件的权利!');window.parent.$('divProcessing').style.display='none';history.back();</script>";
	die();
}

if($action == "doupload") 
{
	if (is_array($_FILES)) 
	{
		$attachment      = $_FILES['attachment']['tmp_name'];
		$attachment_name = $uploadrandomfilename ? getmainfilename($_FILES['attachment']['name'])."_".rand(10000,99999).".".getextension($_FILES['attachment']['name']) : $_FILES['attachment']['name'];
		$attachment_size = $_FILES['attachment']['size'];
	}
	if(file_exists("uploadfiles/".$attachment_name)) {
		echo "<script>alert('有同名文件存在!上传失败');window.parent.$('divProcessing').style.display='none';history.back();</script>";
		die();
	}
	if (trim($attachment) != "none" and trim($attachment) != "" and trim($attachment_name) != "") {
		if(acceptupload_in_editor()) {
			$filetype = getextension($attachment_name);
			if (in_array($filetype, $image_file_type)) {
				$fileurl = $blogurl."/uploadfiles/image/".$attachment_name;
			}
			else if (in_array($filetype, $media_file_type)){
				$fileurl = $blogurl."/uploadfiles/flash/".$attachment_name;
			}
			else{
				$fileurl = $blogurl."/uploadfiles/".$attachment_name;
			}
			
			if(in_array($filetype,$image_file_type)){
				$message="[img]".$fileurl."[/img]";
			 }elseif($filetype=="swf"){
				$message="[swf]".$fileurl."[/swf]";
			 }elseif($filetype=="mp3"){
				$message="[mp3]".$fileurl."[/mp3]";
			 }elseif($filetype=="wma"){
				$message="[wma]".$fileurl."[/wma]";
			 }elseif($filetype=="avi"||$filetype=="asf"||$filetype=="asx"||$filetype=="mpeg"){
				$message="[wmp]".$fileurl."[/wmp]";
			 }elseif($filetype=="rm"){
				$message="[rm]".$fileurl."[/rm]";
			 }else{
				$message="[url]".$fileurl."[/url]";
			 }
			echo "<script>window.parent.LoadIMG('$fileurl');</script>";
		}
	}
}
?>