Ty Clifford
82 lines
2.5 KiB
PHP
82 lines
2.5 KiB
PHP
<?php defined('BLUDIT') or die('Bludit CMS.');
|
|
header('Content-Type: application/json');
|
|
|
|
/*
|
|
| Upload site logo
|
|
| The final filename is the site's name and the extension is the same as the file uploaded
|
|
|
|
|
| @_FILES['inputFile'] multipart/form-data File from form
|
|
|
|
|
| @return array
|
|
*/
|
|
|
|
if (!isset($_FILES['inputFile'])) {
|
|
ajaxResponse(1, 'Error trying to upload the site logo.');
|
|
}
|
|
|
|
// Check path traversal on $filename
|
|
if (Text::stringContains($_FILES['inputFile']['name'], DS, false)) {
|
|
$message = 'Path traversal detected.';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// Block dotfiles
|
|
if (strpos($_FILES['inputFile']['name'], '.') === 0) {
|
|
$message = 'File type not allowed.';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// File extension
|
|
$fileExtension = Filesystem::extension($_FILES['inputFile']['name']);
|
|
$fileExtension = Text::lowercase($fileExtension);
|
|
if (!in_array($fileExtension, $GLOBALS['ALLOWED_IMG_EXTENSION'])) {
|
|
$message = $L->g('File type is not supported. Allowed types:') . ' ' . implode(', ', $GLOBALS['ALLOWED_IMG_EXTENSION']);
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// File MIME Type
|
|
$fileMimeType = Filesystem::mimeType($_FILES['inputFile']['tmp_name']);
|
|
if ($fileMimeType !== false) {
|
|
if (!in_array($fileMimeType, $GLOBALS['ALLOWED_IMG_MIMETYPES'])) {
|
|
$message = $L->g('File mime type is not supported. Allowed types:') . ' ' . implode(', ', $GLOBALS['ALLOWED_IMG_MIMETYPES']);
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
}
|
|
|
|
// Final filename
|
|
$filename = 'logo.' . $fileExtension;
|
|
if (Text::isNotEmpty($site->title())) {
|
|
$sanitizedTitle = Text::removeSpecialCharacters($site->title(), '-');
|
|
$sanitizedTitle = Text::removeQuotes($sanitizedTitle);
|
|
$sanitizedTitle = Text::removeSpaces($sanitizedTitle, '-');
|
|
$sanitizedTitle = trim($sanitizedTitle, '-');
|
|
if (Text::isNotEmpty($sanitizedTitle)) {
|
|
$filename = $sanitizedTitle . '.' . $fileExtension;
|
|
}
|
|
}
|
|
|
|
// Delete old image
|
|
$oldFilename = $site->logo(false);
|
|
if ($oldFilename) {
|
|
Filesystem::rmfile(PATH_UPLOADS . $oldFilename);
|
|
}
|
|
|
|
// Move from temporary directory to uploads
|
|
Filesystem::mv($_FILES['inputFile']['tmp_name'], PATH_UPLOADS . $filename);
|
|
|
|
// Permissions
|
|
chmod(PATH_UPLOADS . $filename, 0644);
|
|
|
|
// Store the filename in the database
|
|
$site->set(array('logo' => $filename));
|
|
|
|
ajaxResponse(0, 'Image uploaded.', array(
|
|
'filename' => $filename,
|
|
'absoluteURL' => DOMAIN_UPLOADS . $filename,
|
|
'absolutePath' => PATH_UPLOADS . $filename
|
|
));
|