* Cleanup

php/cbsd.php

@@ -58,13 +58,6 @@ class CBSD {
 	{
 		$cmd='cbsd media mode=register name=%s path=%s type=%s';
 		$res=self::run($cmd, array($file, $path.$file, $ext));
-		if($res['error']){
-			$arr['error']=true;
-			$arr['error_message']='File image not registered!';
-		} else {
-			$arr['error']=false;
-		}
-
 		echo json_encode($arr);
 	}
 }

public/download.php

@@ -1,6 +1,5 @@
 <?php
-if(isset($_GET['file']))
+if(isset($_GET['file'])){
-{
 	$file=$_GET['file'];
 	$filename=$file;
 }else{
@@ -9,8 +8,9 @@ if(isset($_GET['file']))
 }
 
 $res=$clonos->userAutologin();
-if(isset($res['id']) && $res['id']>0)
+
-{
+if(isset($res['id']) && $res['id']>0){
+
 	$file=$clonos->media_import.$file;
 
 	header('Content-disposition: attachment; filename='.$filename);

public/upload.php

@@ -4,101 +4,90 @@ header('Content-Type: application/json');
 require_once("../php/cbsd.php");
 
 $cmd='';
+$status = '';
 
-if($_SERVER['REQUEST_METHOD'] === 'POST')
+if($_SERVER['REQUEST_METHOD'] === 'POST'){
-{
-	//$ppath=realpath('').'/media/';
 	$path=realpath('').'/media/';
-	if(isset($_POST['uplace']))
+	if(isset($_POST['uplace'])){
-	{
 		$res=strpos($_POST['uplace'],'jailscontainers');
-		if($res!==false)
+		if($res!==false){
-		{
-			//$ppath='/media_import/';
 			$path=$clonos->media_import;
 			$cmd='import';
 		}
 		$res=strpos($_POST['uplace'],'imported');
-		if($res!==false)
+		if($res!==false){
-		{
 			$path=$clonos->media_import;
 			$cmd='import';
 		}
 	}
-	//$path=realpath('').$ppath;
-	if(is_uploaded_file($_FILES['file']['tmp_name']))
-	{
-		$ext = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
-		$file = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_FILENAME));
-		$uid = uniqid();
-		$date = time();
 
-		$returnJson[]=array('filepath'=>$path);
+	// https://www.php.net/manual/en/features.file-upload.php
-		
+	// Undefined | Multiple Files | $_FILES Corruption Attack
-		//$filename=$path.$filename.'-'.$uid.".".$ext;
+	// If this request falls under any of them, treat it invalid.
-		$file=$file.'.'.$ext;
+	if (
-		$filename=$path.$file;	//.'.'.$ext;
+		!isset($_FILES['file']['error']) ||
-		if (move_uploaded_file($_FILES['file']['tmp_name'], $filename))
+		is_array($_FILES['file']['error'])
-		{
+	) {
-			$status = 'ok';	//'Successfully uploaded!';
+		echo json_encode(array('status' => 'Upload Fail: An error occurred!';));
-			if($cmd=='import')
+		exit;
-			{
-				$res=CBSD::run('task owner=%s mode=new /usr/local/bin/cbsd jimport jname=%s' inter=0', [$clonos->getUserName(), $filename]);
 	}
-		}else{
+
+	if(is_uploaded_file($_FILES['file']['tmp_name'])){
+		$basename = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_BASENAME));
+
+		if (move_uploaded_file($_FILES['file']['tmp_name'], $path.$basename)){
+			$status = 'ok';	//'Successfully uploaded!';
+			if($cmd=='import'){
+				$res=CBSD::run('task owner=%s mode=new /usr/local/bin/cbsd jimport jname=%s inter=0', [$clonos->getUserName(), $path.$basename]);
+			}
+		} else {
 			$status = 'Upload Fail: Unknown error occurred!';
 		}
 	}
-	//echo '<pre>';print_r($_POST);
 }
-if($status!='ok') {echo json_encode(array('status' => $status));exit;}
+
-return;
+if($status!='ok'){
+	echo json_encode(array('status' => $status));
+	exit;
+}
+return; # TODO ?!
 
 $valid_exts = array('image/jpeg', 'image/jpg', 'image/png', 'image/gif'); // valid extensions
 $max_size = 30000 * 1024; // max file size in bytes
 
-$json = array();
+if ( $_SERVER['REQUEST_METHOD'] === 'POST' ){
-	if ( $_SERVER['REQUEST_METHOD'] === 'POST' )
+	for($i=0;$i<count($_FILES['file']['tmp_name']);$i++){
-	{
-		for($i=0;$i<count($_FILES['file']['tmp_name']);$i++)
-		{
 		$path="/media/";
 
-			if(is_uploaded_file($_FILES['file']['tmp_name'][$i]) )
+		if(is_uploaded_file($_FILES['file']['tmp_name'][$i]) ){
-			{
 			// get uploaded file extension
 			$ext = strtolower(pathinfo($_FILES['file']['name'][$i], PATHINFO_EXTENSION));
 			// looking for format and size validity
-				if (in_array($ext, $valid_exts) AND $_FILES['file']['size'][$i] < $max_size)
+			if (in_array($ext, $valid_exts) AND $_FILES['file']['size'][$i] < $max_size){
-				{
 				// unique file path
 				$uid = uniqid();
 				$date = date('Y-m-d-H-i-s');
 				$path = $path ."image_" .$date. '_' . $uid . "." .$ext;
 
-					$returnJson[]= array("filepath"=>$path);
-
 				$filename = "image_" . $date . "_" .$uid . "." . $ext;
 				//$this->createthumb($i,$filename);
 
 				// move uploaded file from temp to uploads directory
-					if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $path))
+				if (move_uploaded_file($_FILES['file']['tmp_name'][$i], $path)){
-					{
 					$status = 'ok';	//'Successfully uploaded!';
 					//perform sql updates here
-					}else{
+				} else {
 					$status = 'Upload Fail: Unknown error occurred!';
 				}
-				}else{
+			} else {
 				$status = 'Upload Fail: Unsupported file format or It is too large to upload!';
 			}
-			}else{
+		} else {
 			$status = 'Upload Fail: File not uploaded!';
 		}
 	}
-	}else{
+} else {
 	$status = 'Bad request!';
-	}
+}
 
-	echo json_encode(array('status' => $status));
+echo json_encode(array('status' => $status));
-	//echo json_encode($json);