Hi.
I'm having trouble with a simple uploader. I based this on an image uploader I wrote earlier that works fine, but now I need to create a directory for the user if it doesn't already exist (which is maybe where the problem is?)...anyway, sometimes this works, but other times an upload will completely wipe the directory. This is why I think it's creating a new (and empty) directory and overwriting the old one.
I also notice that when running a readdir() loop, I'm not getting all the files...even when they did upload properly. Only sometimes does it read any at all...and only sometimes does it give me all of them. I'm trying to tackle one problem at a time (hoping one will fix the other...) so the deleting other files on an upload attempt seems to be the most pressing issue...
I'm having real trouble pinning down where the problem is.
Any help is appreciated.
Here's the code...
<?php
session_start();
ini_set("display_errors","1"); //I'm not getting any errors...
ERROR_REPORTING(E_ALL);
$camefrom=$_SERVER['HTTP_REFERER'];
$stickernumber=$_SESSION['stickernumber'];
$usersfile=$_SESSION['stickernumber'];
$userfilename=$_POST['userfilename'];
if ($userfilename=="")
{
$_SESSION['uploadermsg']="Please name your file.";
header("location:$camefrom");
exit;
}
else{
//remove spaces...
$userfilename = str_replace(" ", "_", "$userfilename");
// Clean bad characters...
$badchars = array('!', '@', '#', '$', '%', '^', '&', '*', '+', '=', '-');
$userfilename = str_replace($badchars, "", "$userfilename");
}
$filename = $_FILES["filetoupload"]["name"];
if ($filename!="")
{
$filename = str_replace('.', '.', $filename, $numofdots);
if ($numofdots>=2)
{
$_SESSION['err']="Upload failed because it had more than one file type ending!";
header('location:$camefrom');
exit;
}
$filename = explode('.', $filename);
//now find file type depending on $filename[1]
$fileend=strtolower($filename[1]); //put it in lower case...
if ($fileend=="jpg"){$filetype=".jpg";}
if ($fileend=="jpeg"){$filetype=".jpeg";}
if ($fileend=="png"){$filetype=".png";}
if ($fileend=="gif"){$filetype=".gif";}
if ($fileend=="bmp"){$filetype=".bmp";}
if ($fileend=="txt"){$filetype=".txt";}
if ($fileend=="doc"){$filetype=".doc";}
if ($fileend=="docx"){$filetype=".docx";}
if ($fileend=="xls"){$filetype=".xls";}
if ($fileend=="xlsx"){$filetype=".xlsx";}
if ($fileend=="pdf"){$filetype=".pdf";}
if ($fileend!="jpg" && $fileend!="jpeg" && $fileend!="png" && $fileend!="gif" && $fileend!="bmp" && $fileend!="txt" && $fileend!="doc" && $fileend!="docx" && $fileend!="xls" && $fileend!="xlsx" && $fileend!="pdf")
{
$_SESSION['err']="Upload failed: Unknown File Type!";
$_SESSION['errrpt']="You tried to upload a \".$fileend\" file.";
$_SESSION['errsol']="The following files are supported <br>
IMAGES: .jpg | .jpeg | .png | .bmp | .gif <br>
FILES: .txt | .doc | .docx | .xls | .xlsx | .pdf <br>";
header("location:$camefrom");
exit;
}
$filenamearray = array($filename[0], $filename[1]);
$filename = implode('.', $filenamearray);
$filesize=$_FILES['filetoupload']['size'];
if (is_dir("user_uploads/$usersfile"))
{
$dir = "user_uploads/$usersfile";
}else{
mkdir("user_uploads/$stickernumber", 0777); //for some reason, this creates a dir with 0755 permissions...
chmod("user_uploads/$stickernumber", 0777); //this fixed it...
$dir = "user_uploads/$usersfile";
}
$size_in_bytes = disk_total_space($dir);
$total_bytes_to_use=2097152;
$filesizeavail=("$total_bytes_to_use" - "$filesize");
$target = "user_uploads/$usersfile/$userfilename"."$filetype";
if ($filesize>$filesizeavail)
{
$_SESSION['err']="Upload failed: You don't have enough space!";
$_SESSION['errrpt']="Your file size was $filesize bytes";
$_SESSION['errsol']="You have $filesizeavail bytes available.";
header ("location:$camefrom");
exit;
}
if ($filesize==0)
{
$_SESSION['err']="Image upload failed: Error during security checks.";
$_SESSION['errrpt']="For client security, the specific error can not be shown.";
$_SESSION['errsol']="Try reducing your file size to less than than your available file size.";
header ("location:$camefrom");
exit;
}
//If everything is ok we try to save it to the server
$tmp_name=$_FILES['filetoupload']['tmp_name'];
if(move_uploaded_file($tmp_name, $target))
{
$_SESSION['uploadermsg']="Upload Successful.";
header("location:$camefrom");
exit;
}
else
{
$_SESSION['err']="Image upload failed: Error moving or renaming file.";
$_SESSION['errrpt']="An unspecified error occured while moving or renaming your image.";
$_SESSION['errsol']="Please try again before emailing this error and your file to support@emergencysticker.com.";
header("location:$camefrom");
exit;
}
header("location:$camefrom");//this ends if($filename)
exit;
}
header("location:$camefrom");//this ends the rest of the page...
exit;
?>
Oh no! I found it.
I didn't end my <form> on the readdir() loop that gave the file list and options to download or delete from the previous page (where the uploader is...) which made the "Upload" button actually function as the "Delete" button.
Repeat after me...
"Owa tadoo fus iam"
The previous code works...despite it's obvious security holes. Maybe it'll help another newbie...
...I hope you all get a nice chuckle out of this one... :p
