Ty Clifford
106 lines
3.5 KiB
PHP
106 lines
3.5 KiB
PHP
<?php defined('BLUDIT') or die('Bludit CMS.');
|
|
header('Content-Type: application/json');
|
|
|
|
// $_POST
|
|
// ----------------------------------------------------------------------------
|
|
// (string) $_POST['username']
|
|
$username = empty($_POST['username']) ? false : $_POST['username'];
|
|
// ----------------------------------------------------------------------------
|
|
|
|
if ($username===false) {
|
|
ajaxResponse(1, 'Error in username.');
|
|
}
|
|
|
|
if ( ($login->role()!='admin') && ($login->username()!=$username) ) {
|
|
ajaxResponse(1, 'Error in username.');
|
|
}
|
|
|
|
if (!isset($_FILES['profilePictureInputFile'])) {
|
|
ajaxResponse(1, 'Error trying to upload the profile picture.');
|
|
}
|
|
|
|
// Check path traversal
|
|
if (Text::stringContains($username, DS, false)) {
|
|
$message = 'Path traversal detected.';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// Block dotfiles
|
|
if (strpos($_FILES['profilePictureInputFile']['name'], '.') === 0) {
|
|
$message = 'File type not allowed.';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// Sanitize username for filename to prevent issues with special characters
|
|
$sanitizedUsername = Text::removeSpecialCharacters($username, '-');
|
|
$sanitizedUsername = Text::removeQuotes($sanitizedUsername);
|
|
$sanitizedUsername = Text::removeSpaces($sanitizedUsername, '-');
|
|
|
|
// Check file extension
|
|
$fileExtension = Filesystem::extension($_FILES['profilePictureInputFile']['name']);
|
|
$fileExtension = Text::lowercase($fileExtension);
|
|
if (!in_array($fileExtension, $GLOBALS['ALLOWED_IMG_EXTENSION']) ) {
|
|
$message = $L->g('File type is not supported. Allowed types:').' '.implode(', ',$GLOBALS['ALLOWED_IMG_EXTENSION']);
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// Check file MIME Type
|
|
$fileMimeType = Filesystem::mimeType($_FILES['profilePictureInputFile']['tmp_name']);
|
|
if ($fileMimeType!==false) {
|
|
if (!in_array($fileMimeType, $GLOBALS['ALLOWED_IMG_MIMETYPES'])) {
|
|
$message = $L->g('File mime type is not supported. Allowed types:').' '.implode(', ',$GLOBALS['ALLOWED_IMG_MIMETYPES']);
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
}
|
|
|
|
// Tmp filename
|
|
$tmpFilename = $sanitizedUsername.'.'.$fileExtension;
|
|
|
|
// Final filename
|
|
$filename = $sanitizedUsername.'.png';
|
|
|
|
// Ensure Bludit tmp directory exists
|
|
if (!Filesystem::directoryExists(PATH_TMP)) {
|
|
if (!Filesystem::mkdir(PATH_TMP, true)) {
|
|
$message = 'Temporary directory does not exist and cannot be created.';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
}
|
|
|
|
// Move from temporary directory to uploads folder
|
|
$moved = rename($_FILES['profilePictureInputFile']['tmp_name'], PATH_TMP.$tmpFilename);
|
|
if (!$moved) {
|
|
$message = 'Error moving uploaded file to temporary directory.';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
|
|
// Resize and convert to png
|
|
$image = new Image();
|
|
if ($image->setImage(PATH_TMP.$tmpFilename, PROFILE_IMG_WIDTH, PROFILE_IMG_HEIGHT, 'crop') === false) {
|
|
Filesystem::rmfile(PATH_TMP.$tmpFilename);
|
|
$message = 'Profile picture upload failed: GD cannot decode the image (unsupported format or corrupted file).';
|
|
Log::set($message, LOG_TYPE_ERROR);
|
|
ajaxResponse(1, $message);
|
|
}
|
|
$image->saveImage(PATH_UPLOADS_PROFILES.$filename, PROFILE_IMG_QUALITY, false, true);
|
|
|
|
// Delete temporary file
|
|
Filesystem::rmfile(PATH_TMP.$tmpFilename);
|
|
|
|
// Permissions
|
|
chmod(PATH_UPLOADS_PROFILES.$filename, 0644);
|
|
|
|
ajaxResponse(0, 'Image uploaded.', array(
|
|
'filename'=>$filename,
|
|
'absoluteURL'=>DOMAIN_UPLOADS_PROFILES.$filename,
|
|
'absolutePath'=>PATH_UPLOADS_PROFILES.$filename
|
|
));
|
|
|
|
?>
|