<?php

if ( ! @include_once( './mainfile.php' ) ) { exit( '!! INCLUDE ERROR. ACCESS DENIED !!' ); }
error_reporting( _E_VALUE );


/* vim: set expandtab tabstop=4 shiftwidth=4: */
// +----------------------------------------------------------------------+
// | myPHPNuke Version 188_8 RC2                                          |
// +----------------------------------------------------------------------+
// | License: GNU/GPL - http://www.gnu.org/copyleft/gpl.html              |
// +----------------------------------------------------------------------+
// | Support: http://myphpnuke.com/                                       |
// +----------------------------------------------------------------------+
// | Author: myPHPNuke Dev Team                                           |
// +----------------------------------------------------------------------+
// | Copyright: © 2001-2004 myPHPNuke Dev Team                            |
// +----------------------------------------------------------------------+
// $Id: uploadFile.php,v 1.6.2.3 2004/04/18 12:47:18 ajvwaay Exp $




function listcategories($dir)
{
    global $gallerypath, $mpnTables;

    $dossier = opendir($dir);
    $category = "";
    while ($file = readdir($dossier))
    {
        if ($file != "." && $file != ".." && $file!="thumb")
        {
            if (is_dir($dir."/".$file))
            {
                $galloc = substr($dir."/".$file, strlen("$gallerypath/"));
                $result = mysql_query("select gallid from ".$mpnTables['gallery_categories']." where galloc='$galloc'");
                if ($result)
                {
                    list($gid) = mysql_fetch_array($result);
                    $category .= "$gid ";
                }

                $category .= listcategories("$dir/$file");
            }
        }
    }
    return $category;
}


function upload_file()
{
    global $module_name, $modulepath, $anonpostpics, $maxSize, $user, $gallerypath,$limitSize, $mpnTables;

    include ("header.php");
    print "<LINK REL=\"StyleSheet\" HREF=\"$modulepath/style/style.css\" TYPE=\"text/css\">\n\n\n";
    OpenTable();
    $size = $maxSize/1000;
    $nav = navigationGall();
    echo "<table border=\"0\" width=\"100%\">
      <tr>
      <td width=\"100%\" align=\"center\">
      $nav<br>
      <font class=\"meg-title\">"._GALUPLOADMEDIA."</font>
      <br><br>
      </td>
      </tr>
      <tr><td align=\"center\">";

    if (is_user($user) || !$anonpostpics)
    {
    echo "<form enctype=\"multipart/form-data\" action=\"myegallery.php\" method=\"POST\">
              #         <input type=\"hidden\" name=\"op\" value=\"modload\">
              #         <input type=\"hidden\" name=\"name\" value=\"$module_name\">
              #         <input type=\"hidden\" name=\"file\" value=\"index\">
          <input type=\"hidden\" name=\"do\" value=\"upload\">
          <table border=\"0\" cellpadding=\"5\" cellspacing=\"0\"><tr>
          <td align=\"left\" valign=\"top\" >
          <font class=\"meg-normal\">"._GALSELECTCATEGORY."</font><br>
          <select size=\"1\" name=\"Category\">";

        $categories = listcategories("$gallerypath");
        if (isset($categories) && $categories!="")
        {
            $categories = explode(" ", trim($categories));
        while(list($key, $val) = each($categories))
            {
                if (is_user($user))
                {
                    $result = mysql_query("select gallid, gallname, parent from ".$mpnTables['gallery_categories']." where visible>0 and gallid=".$val);
                }
                else
                {
                    $result = mysql_query("select gallid, gallname, parent from ".$mpnTables['gallery_categories']." where visible>1 and gallid=".$val);
                }

                if (mysql_num_rows($result) > 0)
                {
                    list($gallid, $gallname, $parent) = mysql_fetch_row($result);
            $nbtabs = indent($gallid);
            $tab = "";
            for ($k=0; $k<$nbtabs; $k++)
                    {
                        $tab .= "&nbsp;&nbsp;";
                    }

                    echo "<option value=\"$gallid\">$tab$gallname</option>\n";
                }
            }
        }

        echo "</select><br><br>
          <font class=\"meg-normal\">"._GALMEDIANAME."<br></font>
          <input type=\"text\" name=\"MediaName\" size=\"14\" value=\"\"><br><br>
          <font class=\"meg-normal\">"._GALFILENAME."</font><br>";

    if ($limitSize)
        {
            echo "<INPUT TYPE=\"hidden\" name=\"MAX_FILE_SIZE\" value=\"$maxSize\">";
        }

        echo "<input type=\"file\" name=\"userfile\" size=\"14\"><br><br>
          <font class=\"meg-normal\">"._GALSUBMITTER."</font><br>";

        if (is_user($user))
        {
            $userdata=cookiedecode($user);
        echo "<input type=\"hidden\" name=\"Submitter\" value=\"".$userdata[1]."\">\n";
        echo "<b>".$userdata[1]."</b><br><br>";
    }
        else
        {
            echo "<input type=\"text\" name=\"Submitter\" size=\"14\"><br><br>";
        }

        echo "</td>
          <td align=\"left\" valign=\"top\"><font class=\"meg-normal\">"._GALDESCRIPTION."</font><br>
          <textarea  name=\"Description\" rows=\"10\" cols=\"25\"></textarea>
          </td></tr>\n";

           // Kiril: New Sanitizer

          echo "<input type='hidden' name='stripit_form' value='MediaName|Submitter|Description' />\n";
          echo "<input type='hidden' name='mpn_sectype' value='2' />\n";

          // End Sanitizer

          echo "<tr><td align=\"center\" colspan=\"2\"><input class=\"button\" type=\"submit\" value=\"Upload\" name=\"add\"></td></tr>
          </table>
          </form>
          <table border=\"0\">
          <tr>
          <td align=\"center\">
          <font class=\"meg-normal\">";
    if ($limitSize)
        {
            echo _GALMAXSIZEPOST." $size kb <br>";
        }

        echo _GALCLICKONCE."</font></td></tr></table>";
    }
    else
    {
        echo "<p align=\"center\"><font class=\"meg-normal\">"._GALREGISTER2POSTPICS."</font></p>";
    echo "</td></tr></table>";
    CloseTable();
    print '<p align="right">'
             .'<font class="meg-sub">'
         .sprintf(_GALCOPYRIGHT, _GALVERSION, "$baseurl?op=modload&amp;name=$module_name&amp;file=credits")
         .'</font>'
         .'</p>';
    }

    echo "</td></tr></table>";
    CloseTable();
    include ("footer.php");
}


function Add($gid, $file, $submitter, $medianame, $description, $userfile, $userfile_name, $userfile_size)
{
    global $user, $GalleryPictureName, $modulepath, $mpnTables;


    $file = traite_nom_fichier($file);
    $sql = "select img from ".$mpnTables['gallery_pictures']." where gid=$gid and img='$file'";

    $result = mysql_query($sql);
    $numrows = @mysql_num_rows($result);
    $navgall = navigationGall();

    if ($file==$GalleryPictureName || $numrows>0)
    {
        galleryHeader();
    OpenTable();
    print '<table border="0" width="100%" align="center" cellpadding="0">'
          .'<tr><td>'.$navgall;

    echo "<br>";
    echo "<center><b>"._GALPICALREADYEXT."</b><br><br>"
        .""._GOBACK."";

    print '</td></tr></table>';
    CloseTable();
    print '<p align="right">'
             .'<font class="meg-sub">'
         .sprintf(_GALCOPYRIGHT, _GALVERSION, "$baseurl?op=modload&amp;name=$module_name&amp;file=credits")
         .'</font>'
         .'</p>';

    include("footer.php");
    }
    else
    {
        if (is_user())
        {
            $cookie = cookiedecode();
            $submitter = $cookie[1];
        }

    // Check if Media Name exist
        if (!isset($medianame) ||$medianame=="")
        {
            galleryHeader();
            echo "<br>";
            OpenTable();
            print '<table border="0" width="100%" align="center" cellpadding="0">'
         .'<tr><td>'.$navgall;

            echo "<br>";
            echo "<center><b>"._GALPICNONAME."</b><br><br>"
               .""._GOBACK."";

            print '</td></tr></table>';
            CloseTable();
            print '<p align="right">'
                 .'<font class="meg-sub">'
                .sprintf(_GALCOPYRIGHT, _GALVERSION, "$baseurl?op=modload&amp;name=$module_name&amp;file=credits")
         .'</font>'
         .'</p>';

            include("footer.php");
        }
        else // Check if Description exist
        {
            if (!isset($description) || $description=="")
            {
        galleryHeader();
        echo "<br>";
        OpenTable();
        print '<table border="0" width="100%" align="center" cellpadding="0">'
                     .'<tr><td>'.$navgall;

        echo "<center><b>"._GALPICNODESC."</b><br><br>"
                    .""._GOBACK."";

        print '</td></tr></table>';
        CloseTable();
        print '<p align="right">'
                     .'<font class="meg-sub">'
                     .sprintf(_GALCOPYRIGHT, _GALVERSION, "$baseurl?op=modload&amp;name=$module_name&amp;file=credits")
                     .'</font>'
                     .'</p>';

        include("footer.php");
        }
        else // Check if Description exist
            {
                if (!isset($submitter) || $submitter=="")
                {
                    galleryHeader();
                    echo "<br>";
                    OpenTable();
                    print '<table border="0" width="100%" align="center" cellpadding="0">'
                         .'<tr><td>'.$navgall;

                    echo "<br>";
                    echo "<center><b>"._GALPICNOSUBMITTER."</b><br><br>"
                .""._GOBACK."";

                    print '</td></tr></table>';
                    CloseTable();

                    print '<p align="right">'
                 .'<font class="meg-sub">'
                 .sprintf(_GALCOPYRIGHT, _GALVERSION, "$baseurl?op=modload&amp;name=$module_name&amp;file=credits")
                 .'</font>'
                 .'</p>';

                    include("footer.php");
                }
                else
                {
                    $ext = substr($file, (strrpos($file,'.') +  1));
                    list($type) = mysql_fetch_row(mysql_query("SELECT filetype FROM ".$mpnTables['gallery_media_types']." WHERE extension='$ext'"));
                    $wdir = "/";

                    if ($type == 1)
                    {
                        $size = getimagesize($_FILES['userfile']['tmp_name']);
                    }
                    else
                    {
                        switch($type)
                        {
                            case 3 :
                $size[0] = 320;
                $size[1] = 240;
                break;
                default:
                $size[0] = 0;
                $size[1] = 0;
                break;
                        }
                    }

                    $basedir = "$modulepath/temp";
                    $wdir = "/";
                    $upload_return = UploadFile($basedir, $_FILES['userfile'], $_FILES['userfile']['name'], $_FILES['userfile']['size']);
                    if ($upload_return==0)
                    {
                        $medianame = traite_nom_fichier($medianame);

            $sql = "insert into ".$mpnTables['gallery_pictures_newpicture']." (pid, gid, img, counter, submitter, date, name, description, votes, rate, extension, width, height) values(NULL, $gid, '$file', 0, '$submitter', now(), '$medianame', '$description', 0, 0, '$ext', ".$size[0].", ".$size[1].")";

            mysql_query($sql);
                    }
            else
                    {
                        return $upload_return;
                    }

                    return 0;
                }
            }
        }
    }
}

?>
