MediaUploader.php

Go to the documentation of this file.

<?php
/*
 You may not change or alter any portion of this comment or credits
 of supporting developers from this source code or any supporting source code
 which is considered copyrighted (c) material of the original comment or credit authors.

 This program is distributed in the hope that it will be useful,
 but WITHOUT ANY WARRANTY; without even the implied warranty of
 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
*/

namespace Xoops\Core;

class MediaUploader
{
    public $allowUnknownTypes = false;

    public $mediaName;

    public $mediaType;

    public $mediaSize;

    public $mediaTmpName;

    public $mediaError;

    public $mediaRealType = '';

    public $uploadDir = '';

    public $allowedMimeTypes = array();

    public $deniedMimeTypes = array(
        'application/x-httpd-php'
    );

    public $maxFileSize = 0;

    public $maxWidth;

    public $maxHeight;

    public $targetFileName;

    public $prefix;

    public $errors = array();

    public $savedDestination;

    public $savedFileName;

    //public $extensionToMime = array();

    public $checkImageType = true;

    public $extensionsToBeSanitized = array(
        'php', 'phtml', 'phtm', 'php3', 'php4', 'cgi', 'pl', 'asp', 'php5'
    );

    public $imageExtensions = array(
        1 => 'gif', 2 => 'jpg', 3 => 'png', 4 => 'swf', 5 => 'psd', 6 => 'bmp', 7 => 'tif', 8 => 'tif', 9 => 'jpc',
        10 => 'jp2', 11 => 'jpx', 12 => 'jb2', 13 => 'swf', 14 => 'iff', 15 => 'wbmp', 16 => 'xbm'
    );

    public function __construct($uploadDir, $allowedMimeTypes, $maxFileSize = 0, $maxWidth = null, $maxHeight = null)
    {
        if (is_array($allowedMimeTypes)) {
            $this->allowedMimeTypes = $allowedMimeTypes;
        }
        $this->uploadDir = $uploadDir;
        $this->maxFileSize = intval($maxFileSize);
        if (isset($maxWidth)) {
            $this->maxWidth = intval($maxWidth);
        }
        if (isset($maxHeight)) {
            $this->maxHeight = intval($maxHeight);
        }
    }

    public function fetchMedia($media_name, $index = null)
    {
        if (!isset($_FILES[$media_name])) {
            $this->setErrors(\XoopsLocale::E_FILE_NOT_FOUND);
            return false;
        } else {
            if (is_array($_FILES[$media_name]['name']) && isset($index)) {
                $index = intval($index);
                $this->mediaName = (get_magic_quotes_gpc()) ? stripslashes($_FILES[$media_name]['name'][$index])
                    : $_FILES[$media_name]['name'][$index];
                $this->mediaType = $_FILES[$media_name]['type'][$index];
                $this->mediaSize = $_FILES[$media_name]['size'][$index];
                $this->mediaTmpName = $_FILES[$media_name]['tmp_name'][$index];
                $this->mediaError = !empty($_FILES[$media_name]['error'][$index])
                    ? $_FILES[$media_name]['error'][$index] : 0;
            } else {
                $media_name = $_FILES[$media_name];
                $this->mediaName = (get_magic_quotes_gpc()) ? stripslashes($media_name['name']) : $media_name['name'];
                $this->mediaType = $media_name['type'];
                $this->mediaSize = $media_name['size'];
                $this->mediaTmpName = $media_name['tmp_name'];
                $this->mediaError = !empty($media_name['error']) ? $media_name['error'] : 0;
            }
        }

        $path_parts = pathinfo($this->mediaName);
        $ext = (isset($path_parts['extension'])) ? $path_parts['extension'] : '';
        $this->mediaRealType = \Xoops\Core\MimeTypes::findType($ext);

        $this->errors = array();
        if (intval($this->mediaSize) < 0) {
            $this->setErrors(\XoopsLocale::E_INVALID_FILE_SIZE);
            return false;
        }
        if ($this->mediaName == '') {
            $this->setErrors(\XoopsLocale::E_FILE_NAME_MISSING);
            return false;
        }
        if ($this->mediaTmpName == 'none' || !is_uploaded_file($this->mediaTmpName)) {
            $this->setErrors(\XoopsLocale::NO_FILE_UPLOADED);
            return false;
        }
        if ($this->mediaError > 0) {
            $this->setErrors(sprintf(\XoopsLocale::EF_UNEXPECTED_ERROR, $this->mediaError));
            return false;
        }
        return true;
    }

    public function setTargetFileName($value)
    {
        $this->targetFileName = strval(trim($value));
    }

    public function setPrefix($value)
    {
        $this->prefix = strval(trim($value));
    }

    public function getMediaName()
    {
        return $this->mediaName;
    }

    public function getMediaType()
    {
        return $this->mediaType;
    }

    public function getMediaSize()
    {
        return $this->mediaSize;
    }

    public function getMediaTmpName()
    {
        return $this->mediaTmpName;
    }

    public function getSavedFileName()
    {
        return $this->savedFileName;
    }

    public function getSavedDestination()
    {
        return $this->savedDestination;
    }

    public function upload($chmod = 0644)
    {
        if ($this->uploadDir == '') {
            $this->setErrors(\XoopsLocale::E_UPLOAD_DIRECTORY_NOT_SET);
            return false;
        }
        if (!is_dir($this->uploadDir)) {
            $this->setErrors(sprintf(\XoopsLocale::EF_DIRECTORY_NOT_OPENED, $this->uploadDir));
            return false;
        }
        if (!is_writeable($this->uploadDir)) {
            $this->setErrors(sprintf(\XoopsLocale::EF_DIRECTORY_WITH_WRITE_PERMISSION_NOT_OPENED, $this->uploadDir));
            return false;
        }
        $this->sanitizeMultipleExtensions();

        if (!$this->checkMaxFileSize()) {
            return false;
        }
        if (!$this->checkMaxWidth()) {
            return false;
        }
        if (!$this->checkMaxHeight()) {
            return false;
        }
        if (!$this->checkMimeType()) {
            return false;
        }
        if (!$this->checkImageType()) {
            return false;
        }
        if (count($this->errors) > 0) {
            return false;
        }
        return $this->copyFile($chmod);
    }

    protected function copyFile($chmod)
    {
        $matched = array();
        if (!preg_match("/\.([a-zA-Z0-9]+)$/", $this->mediaName, $matched)) {
            $this->setErrors(\XoopsLocale::E_INVALID_FILE_NAME);
            return false;
        }
        if (isset($this->targetFileName)) {
            $this->savedFileName = $this->targetFileName;
        } else {
            if (isset($this->prefix)) {
                $this->savedFileName = uniqid($this->prefix) . '.' . strtolower($matched[1]);
            } else {
                $this->savedFileName = strtolower($this->mediaName);
            }
        }

        $this->savedDestination = $this->uploadDir . '/' . $this->savedFileName;
        if (!move_uploaded_file($this->mediaTmpName, $this->savedDestination)) {
            $this->setErrors(sprintf(\XoopsLocale::EF_FILE_NOT_SAVED_TO, $this->savedDestination));
            return false;
        }
        // Check IE XSS before returning success
        $ext = strtolower(substr(strrchr($this->savedDestination, '.'), 1));
        if (in_array($ext, $this->imageExtensions)) {
            $info = @getimagesize($this->savedDestination);
            if ($info === false || $this->imageExtensions[(int)$info[2]] != $ext) {
                $this->setErrors(\XoopsLocale::E_SUSPICIOUS_IMAGE_UPLOAD_REFUSED);
                @unlink($this->savedDestination);
                return false;
            }
        }
        @chmod($this->savedDestination, $chmod);
        return true;
    }

    public function checkMaxFileSize()
    {
        if (!isset($this->maxFileSize)) {
            return true;
        }
        if ($this->mediaSize > $this->maxFileSize) {
            $this->setErrors(sprintf(\XoopsLocale::EF_FILE_SIZE_TO_LARGE, $this->maxFileSize, $this->mediaSize));
            return false;
        }
        return true;
    }

    public function checkMaxWidth()
    {
        if (!isset($this->maxWidth)) {
            return true;
        }
        if (false !== $dimension = getimagesize($this->mediaTmpName)) {
            if ($dimension[0] > $this->maxWidth) {
                $this->setErrors(sprintf(\XoopsLocale::EF_FILE_WIDTH_TO_LARGE, $this->maxWidth, $dimension[0]));
                return false;
            }
        } else {
            trigger_error(sprintf(\XoopsLocale::EF_IMAGE_SIZE_NOT_FETCHED, $this->mediaTmpName), E_USER_WARNING);
        }
        return true;
    }

    public function checkMaxHeight()
    {
        if (!isset($this->maxHeight)) {
            return true;
        }
        if (false !== $dimension = getimagesize($this->mediaTmpName)) {
            if ($dimension[1] > $this->maxHeight) {
                $this->setErrors(sprintf(\XoopsLocale::EF_FILE_HEIGHT_TO_LARGE, $this->maxHeight, $dimension[1]));
                return false;
            }
        } else {
            trigger_error(sprintf(\XoopsLocale::EF_IMAGE_SIZE_NOT_FETCHED, $this->mediaTmpName), E_USER_WARNING);
        }
        return true;
    }

    public function checkMimeType()
    {
        if (empty($this->mediaRealType) && empty($this->allowUnknownTypes)) {
            $this->setErrors(\XoopsLocale::E_FILE_TYPE_REJECTED);
            return false;
        }

        if ((!empty($this->allowedMimeTypes)
            && !in_array($this->mediaRealType, $this->allowedMimeTypes))
            || (!empty($this->deniedMimeTypes)
            && in_array($this->mediaRealType, $this->deniedMimeTypes))
        ) {
            $this->setErrors(sprintf(\XoopsLocale::EF_FILE_MIME_TYPE_NOT_ALLOWED, $this->mediaType));
            return false;
        }
        return true;
    }

    public function checkImageType()
    {
        if (empty($this->checkImageType)) {
            return true;
        }

        if (('image' == substr($this->mediaType, 0, strpos($this->mediaType, '/')))
            || (!empty($this->mediaRealType)
            && 'image' == substr($this->mediaRealType, 0, strpos($this->mediaRealType, '/')))
        ) {
            if (!@getimagesize($this->mediaTmpName)) {
                $this->setErrors(\XoopsLocale::E_INVALID_IMAGE_FILE);
                return false;
            }
        }
        return true;
    }

    public function sanitizeMultipleExtensions()
    {
        if (empty($this->extensionsToBeSanitized)) {
            return;
        }

        $patterns = array();
        $replaces = array();
        foreach ($this->extensionsToBeSanitized as $ext) {
            $patterns[] = "/\." . preg_quote($ext) . "\./i";
            $replaces[] = "_" . $ext . ".";
        }
        $this->mediaName = preg_replace($patterns, $replaces, $this->mediaName);
    }

    public function setErrors($error)
    {
        $this->errors[] = trim($error);
    }

    public function getErrors($ashtml = true)
    {
        if (!$ashtml) {
            return $this->errors;
        } else {
            $ret = '';
            if (count($this->errors) > 0) {
                $ret = '<h4>'
                . sprintf(\XoopsLocale::EF_ERRORS_RETURNED_WHILE_UPLOADING_FILE, $this->mediaName) . '</h4>';
                foreach ($this->errors as $error) {
                    $ret .= $error . '<br />';
                }
            }
            return $ret;
        }
    }
}