[Summary view] [Print] [Text view]

   1  <?php
   2  # MantisBT - A PHP based bugtracking system
   3  
   4  # MantisBT is free software: you can redistribute it and/or modify
   5  # it under the terms of the GNU General Public License as published by
   6  # the Free Software Foundation, either version 2 of the License, or
   7  # (at your option) any later version.
   8  #
   9  # MantisBT is distributed in the hope that it will be useful,
  10  # but WITHOUT ANY WARRANTY; without even the implied warranty of
  11  # MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12  # GNU General Public License for more details.
  13  #
  14  # You should have received a copy of the GNU General Public License
  15  # along with MantisBT.  If not, see <http://www.gnu.org/licenses/>.
  16  
  17  /**
  18   * @package MantisBT
  19   * @copyright Copyright (C) 2000 - 2002  Kenzaburo Ito - kenito@300baud.org
  20   * @copyright Copyright (C) 2002 - 2011  MantisBT Team - mantisbt-dev@lists.sourceforge.net
  21   * @link http://www.mantisbt.org
  22   *
  23   * @uses core.php
  24   * @uses access_api.php
  25   * @uses config_api.php
  26   * @uses constant_inc.php
  27   * @uses database_api.php
  28   * @uses file_api.php
  29   * @uses form_api.php
  30   * @uses gpc_api.php
  31   * @uses helper_api.php
  32   * @uses html_api.php
  33   * @uses lang_api.php
  34   * @uses print_api.php
  35   * @uses utility_api.php
  36   */
  37  
  38  /**
  39   * MantisBT Core API's
  40   */
  41  require_once ( 'core.php' );
  42  require_api( 'access_api.php' );
  43  require_api( 'config_api.php' );
  44  require_api( 'constant_inc.php' );
  45  require_api( 'database_api.php' );
  46  require_api( 'file_api.php' );
  47  require_api( 'form_api.php' );
  48  require_api( 'gpc_api.php' );
  49  require_api( 'helper_api.php' );
  50  require_api( 'html_api.php' );
  51  require_api( 'lang_api.php' );
  52  require_api( 'print_api.php' );
  53  require_api( 'utility_api.php' );
  54  
  55  form_security_validate( 'proj_doc_update' );
  56  
  57  # Check if project documentation feature is enabled.
  58  if ( OFF == config_get( 'enable_project_documentation' ) ||
  59      !file_is_uploading_enabled() ||
  60      !file_allow_project_upload() ) {
  61      access_denied();
  62  }
  63  
  64  $f_file_id = gpc_get_int( 'file_id' );
  65  $f_title = gpc_get_string( 'title' );
  66  $f_description    = gpc_get_string( 'description' );
  67  $f_file = gpc_get_file( 'file' );
  68  
  69  $t_project_id = file_get_field( $f_file_id, 'project_id', 'project' );
  70  
  71  access_ensure_project_level( config_get( 'upload_project_file_threshold' ), $t_project_id );
  72  
  73  if ( is_blank( $f_title ) ) {
  74      trigger_error( ERROR_EMPTY_FIELD, ERROR );
  75  }
  76  
  77  $c_file_id = db_prepare_int( $f_file_id );
  78  $c_title = db_prepare_string( $f_title );
  79  $c_description = db_prepare_string( $f_description );
  80  
  81  $t_project_file_table = db_get_table( 'project_file' );
  82  
  83  /** @todo (thraxisp) this code should probably be integrated into file_api to share methods used to store files */
  84  
  85  file_ensure_uploaded( $f_file );
  86  
  87  extract( $f_file, EXTR_PREFIX_ALL, 'v' );
  88  
  89  if ( is_uploaded_file( $v_tmp_name ) ) {
  90  
  91      $t_project_id = helper_get_current_project();
  92  
  93      # grab the original file path and name
  94      $t_disk_file_name = file_get_field( $f_file_id, 'diskfile', 'project' );
  95      $t_file_path = dirname( $t_disk_file_name );
  96  
  97      # prepare variables for insertion
  98      $c_file_name = db_prepare_string( $v_name );
  99      $c_file_type = db_prepare_string( $v_type );
 100      $t_file_size = filesize( $v_tmp_name );
 101      $t_max_file_size = (int)min( ini_get_number( 'upload_max_filesize' ), ini_get_number( 'post_max_size' ), config_get( 'max_file_size' ) );
 102      if ( $t_file_size > $t_max_file_size ) {
 103          trigger_error( ERROR_FILE_TOO_BIG, ERROR );
 104      }
 105      $c_file_size = db_prepare_int( $t_file_size );
 106  
 107      $t_method = config_get( 'file_upload_method' );
 108      switch ( $t_method ) {
 109          case FTP:
 110          case DISK:
 111              file_ensure_valid_upload_path( $t_file_path );
 112  
 113              if ( FTP == $t_method ) {
 114                  $conn_id = file_ftp_connect();
 115                  file_ftp_delete ( $conn_id, $t_disk_file_name );
 116                  file_ftp_put ( $conn_id, $t_disk_file_name, $v_tmp_name );
 117                  file_ftp_disconnect ( $conn_id );
 118              }
 119              if ( file_exists( $t_disk_file_name ) ) {
 120                  file_delete_local( $t_disk_file_name );
 121              }
 122              if ( !move_uploaded_file( $v_tmp_name, $t_disk_file_name ) ) {
 123                  trigger_error( ERROR_FILE_MOVE_FAILED, ERROR );
 124              }
 125              chmod( $t_disk_file_name, config_get( 'attachments_file_permissions' ) );
 126  
 127              $c_content = '';
 128              break;
 129          case DATABASE:
 130              $c_content = db_prepare_binary_string( fread ( fopen( $v_tmp_name, 'rb' ), $v_size ) );
 131              break;
 132          default:
 133              /** @todo Such errors should be checked in the admin checks */
 134              trigger_error( ERROR_GENERIC, ERROR );
 135      }
 136      $query = "UPDATE $t_project_file_table
 137          SET title=" . db_param() . ", description=" . db_param() . ", date_added=" . db_param() . ",
 138              filename=" . db_param() . ", filesize=" . db_param() . ", file_type=" .db_param() . ", content=" .db_param() . "
 139              WHERE id=" . db_param();
 140      $result = db_query_bound( $query, Array( $c_title, $c_description, db_now(), $c_file_name, $c_file_size, $c_file_type, $c_content, $c_file_id ) );
 141  } else {
 142      $query = "UPDATE $t_project_file_table
 143              SET title=" . db_param() . ", description=" . db_param() . "
 144              WHERE id=" . db_param();
 145      $result = db_query_bound( $query, Array( $c_title, $c_description, $c_file_id ) );
 146  }
 147  
 148  if ( !$result ) {
 149      trigger_error( ERROR_GENERIC, ERROR  );
 150  }
 151  
 152  form_security_purge( 'proj_doc_update' );
 153  
 154  $t_redirect_url = 'proj_doc_page.php';
 155  
 156  html_page_top( null, $t_redirect_url );
 157  ?>
 158  <br />
 159  <div>
 160  <?php
 161  echo lang_get( 'operation_successful' ).'<br />';
 162  print_bracket_link( $t_redirect_url, lang_get( 'proceed' ) );
 163  ?>
 164  </div>
 165  
 166  <?php
 167  html_page_bottom();