<?php
include("libs.php");
include(dirname(dirname(__FILE__))."/./includes/base.php");
include(dirname(dirname(__FILE__))."/./configs/config.php");
include(dirname(dirname(__FILE__))."/./configs/db_config.php");
$phpcolor = new mysql();
$phpcolor->open();
if(isset($_GET['uid']) and eregi("^[0-9]+$",$_GET['uid']))
{
  $phpcolor->table="user";
  $phpcolor->field="passwd";
  $phpcolor->where="id='".$_GET['uid']."'";
  $userv=$phpcolor->exist(1);
  if($_GET["pwd"]!=md5($userv['passwd'].$core_scode))
    exit();
}
else
  exit();
if(isset($_GET['id']) and !eregi("^[0-9]+$",$_GET['id']))
  exit();
date_default_timezone_set('PRC');
if($_COOKIE['core_user_rank']!="2" && ($core_baropen==0 || (strtotime($core_opentime1) > (strtotime(date('H:i'))+$core_time*3600) || strtotime($core_opentime2) < (strtotime(date('H:i'))+$core_time*3600) && $core_opentime1!=$core_opentime2)))
  exit();
if (!file_exists('install/install.lock'))
  exit();
header('Content-Type:text/html;charset=GB2312');
$phpcolor->table="album";
$phpcolor->field="belong";
$phpcolor->where="id = '".$_GET['id']."'";
$rs = $phpcolor->exist(1);
if($rs['belong']!=$_GET['uid'])
  exit();
if($_FILES['Filedata']["error"]>0)
  exit();
if(!file_exists('upload/album/'.$_GET['uid']))
  mkdir('upload/album/'.$_GET['uid'], 0777);
if(!file_exists('upload/album/'.$_GET['uid'].'/'.$_GET['id']))
  mkdir('upload/album/'.$_GET['uid'].'/'.$_GET['id'], 0777);
$oldname=$_FILES["Filedata"]["name"];
$fileextensionname=strtolower(eregi_replace(".+(\..+)","\\1",$oldname));
$filename = time().random(4).$fileextensionname;
$file_name = iconv("UTF-8","GB2312",$oldname);
move_uploaded_file($_FILES['Filedata']['tmp_name'], "upload/album/".$_GET['uid']."/".$_GET['id']."/".$filename);
$time=date('Y-m-d H:i:s',strtotime(date('Y-m-d H:i:s'))+$core_time*3600);
$phpcolor->table="picture";
$phpcolor->field="name,introduction,filename,filesize,uid,belong,uptime";
$phpcolor->where="'".$file_name."','','".$filename."','".$_FILES['Filedata']["size"]."','".$_GET['uid']."','".$_GET['id']."','".$time."'";
$phpcolor->write();
$rsid=mysql_insert_id();
$phpcolor->newswrite($rsid,$time,$userv['id'],2);
?>
