Home Explore Help
Register Sign In
Pentium44
/
SOFM
Watch 1
Star 0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Branch: master
Branches Tags
SOFM
/
upload.php

upload.php 7.5 KB
Permalink History Raw

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189 
  1. <?php
    2. 

  2. 

  3. session_start();
    4. 

  4. 

  5. if(!isset($_SESSION['hostz-user']) or !isset($_SESSION['hostz-passwd'])) { exit(1); }
    6. 

  6. 

  7. $username = $_SESSION['hostz-user'];
    8. 

  8. $password = $_SESSION['hostz-passwd'];
    9. 

  9. 

  10. // check if user is valid
    11. 

  11. include_once("users/$username.php");
    12. 

  12. 

  13. // config variables
    14. 

  14. include_once("config.php");
    15. 

  15. 

  16. // get filesize for uploaded files
    17. 

  17. function tomb($size, $precision = 2)
    18. 

  18. {
    19. 

  19.     $base = log($size) / log(1024);
    20. 

  20.     $suffixes = array('', 'KB', 'MB', 'GB', 'TB');   
    21. 

  21. 

  22.     return round(pow(1024, $base - floor($base)), $precision) . $suffixes[floor($base)];
    23. 

  23. }
    24. 

  24. 

  25. if($password!=$user_password)
    26. 

  26. {
    27. 

  27. 	$_SESSION['hostz-user'] = null;
    28. 

  28. 	$_SESSION['hostz-passwd'] = null;
    29. 

  29. 	exit(1);
    30. 

  30. }
    31. 

  31. echo "<html>";
    32. 

  32. for($i=0; $i<count($_FILES["file"]["name"]); $i++)
    33. 

  33. {
    34. 

  34. 	$temp = explode(".", $_FILES["file"]["name"][$i]);
    35. 

  35. 	$extension = end($temp);
    36. 

  36. 	if ((($_FILES["file"]["type"][$i] == "image/gif")
    37. 

  37. 	|| ($_FILES["file"]["type"][$i] == "image/x-gif")
    38. 

  38. 	|| ($_FILES["file"]["type"][$i] == "image/jpeg")
    39. 

  39. 	|| ($_FILES["file"]["type"][$i] == "image/x-jpeg")
    40. 

  40. 	|| ($_FILES["file"]["type"][$i] == "image/x-jpg")
    41. 

  41. 	|| ($_FILES["file"]["type"][$i] == "image/jpg")
    42. 

  42. 	|| ($_FILES["file"]["type"][$i] == "image/pjpeg")
    43. 

  43. 	|| ($_FILES["file"]["type"][$i] == "image/x-png")
    44. 

  44. 	|| ($_FILES["file"]["type"][$i] == "image/bmp")
    45. 

  45. 	|| ($_FILES["file"]["type"][$i] == "image/x-icon")
    46. 

  46. 	|| ($_FILES["file"]["type"][$i] == "text/css")
    47. 

  47. 	|| ($_FILES["file"]["type"][$i] == "application/octet-stream")
    48. 

  48. 	|| ($_FILES["file"]["type"][$i] == "text/html")
    49. 

  49. 	|| ($_FILES["file"]["type"][$i] == "application/vnd.android.package-archive")
    50. 

  50. 	|| ($_FILES["file"]["type"][$i] == "text/htm")
    51. 

  51. 	|| ($_FILES["file"]["type"][$i] == "text/xhtml")
    52. 

  52. 	|| ($_FILES["file"]["type"][$i] == "text/xml")
    53. 

  53. 	|| ($_FILES["file"]["type"][$i] == "application/xhtml+xml")
    54. 

  54. 	|| ($_FILES["file"]["type"][$i] == "application/xml")
    55. 

  55. 	|| ($_FILES["file"]["type"][$i] == "text/plain")
    56. 

  56. 	|| ($_FILES["file"]["type"][$i] == "application/octet-stream")
    57. 

  57. 	|| ($_FILES["file"]["type"][$i] == "application/x-gunzip")
    58. 

  58. 	|| ($_FILES["file"]["type"][$i] == "application/x-gzip-compressed")
    59. 

  59. 	|| ($_FILES["file"]["type"][$i] == "application/x-rar-compressed")
    60. 

  60. 	|| ($_FILES["file"]["type"][$i] == "application/x-rar")
    61. 

  61. 	|| ($_FILES["file"]["type"][$i] == "application/octet-stream")
    62. 

  62. 	|| ($_FILES["file"]["type"][$i] == "application/x-7z-compressed")
    63. 

  63. 	|| ($_FILES["file"]["type"][$i] == "application/x-7z")
    64. 

  64. 	|| ($_FILES["file"]["type"][$i] == "application/x-compress")
    65. 

  65. 	|| ($_FILES["file"]["type"][$i] == "application/x-compressed")
    66. 

  66. 	|| ($_FILES["file"]["type"][$i] == "application/x-tar")
    67. 

  67. 	|| ($_FILES["file"]["type"][$i] == "application/x-tar-compressed")
    68. 

  68. 	|| ($_FILES["file"]["type"][$i] == "application/x-gtar")
    69. 

  69. 	|| ($_FILES["file"]["type"][$i] == "application/x-tgz")
    70. 

  70. 	|| ($_FILES["file"]["type"][$i] == "application/tgz")
    71. 

  71. 	|| ($_FILES["file"]["type"][$i] == "application/tar")
    72. 

  72. 	|| ($_FILES["file"]["type"][$i] == "application/gzip")
    73. 

  73. 	|| ($_FILES["file"]["type"][$i] == "application/x-gzip")
    74. 

  74. 	|| ($_FILES["file"]["type"][$i] == "application/x-zip")
    75. 

  75. 	|| ($_FILES["file"]["type"][$i] == "application/zip")
    76. 

  76. 	|| ($_FILES["file"]["type"][$i] == "application/x-zip-compressed")
    77. 

  77. 	|| ($_FILES["file"]["type"][$i] == "text/c")
    78. 

  78. 	|| ($_FILES["file"]["type"][$i] == "text/cpp")
    79. 

  79. 	|| ($_FILES["file"]["type"][$i] == "text/lua")
    80. 

  80. 	|| ($_FILES["file"]["type"][$i] == "text/py")
    81. 

  81. 	|| ($_FILES["file"]["type"][$i] == "text/x-lua")
    82. 

  82. 	|| ($_FILES["file"]["type"][$i] == "text/x-c")
    83. 

  83. 	|| ($_FILES["file"]["type"][$i] == "audio/mp3")
    84. 

  84. 	|| ($_FILES["file"]["type"][$i] == "audio/x-mp3")
    85. 

  85. 	|| ($_FILES["file"]["type"][$i] == "audio/mpeg")
    86. 

  86. 	|| ($_FILES["file"]["type"][$i] == "audio/x-mpeg")
    87. 

  87. 	|| ($_FILES["file"]["type"][$i] == "audio/mpeg3")
    88. 

  88. 	|| ($_FILES["file"]["type"][$i] == "audio/x-mpeg3")
    89. 

  89. 	|| ($_FILES["file"]["type"][$i] == "audio/wav")
    90. 

  90. 	|| ($_FILES["file"]["type"][$i] == "audio/wave")
    91. 

  91. 	|| ($_FILES["file"]["type"][$i] == "audio/x-wav")
    92. 

  92. 	|| ($_FILES["file"]["type"][$i] == "audio/ogg")
    93. 

  93. 	|| ($_FILES["file"]["type"][$i] == "audio/x-ogg")
    94. 

  94. 	|| ($_FILES["file"]["type"][$i] == "video/mp4")
    95. 

  95. 	|| ($_FILES["file"]["type"][$i] == "video/ogg")
    96. 

  96. 	|| ($_FILES["file"]["type"][$i] == "video/webm")
    97. 

  97. 	|| ($_FILES["file"]["type"][$i] == "application/json")
    98. 

  98. 	|| ($_FILES["file"]["type"][$i] == "application/pdf")
    99. 

  99. 	|| ($_FILES["file"]["type"][$i] == "image/svg+xml")
    100. 

  100. 	|| ($_FILES["file"]["type"][$i] == "application/rtf")
    101. 

  101. 	|| ($_FILES["file"]["type"][$i] == "font/ttf")
    102. 

  102. 	|| ($_FILES["file"]["type"][$i] == "font/otf")
    103. 

  103. 	|| ($_FILES["file"]["type"][$i] == "video/x-flv")
    104. 

  104. 	|| ($_FILES["file"]["type"][$i] == "video/mp4v-es")
    105. 

  105. 	|| ($_FILES["file"]["type"][$i] == "application/x-python")
    106. 

  106. 	|| ($_FILES["file"]["type"][$i] == "text/x-python")
    107. 

  107. 	|| ($_FILES["file"]["type"][$i] == "text/python")
    108. 

  108. 	|| ($_FILES["file"]["type"][$i] == "application/x-compressed")
    109. 

  109. 	|| ($_FILES["file"]["type"][$i] == "text/javascript")
    110. 

  110. 	|| ($_FILES["file"]["type"][$i] == "application/x-shockwave-flash")
    111. 

  111. 	|| ($_FILES["file"]["type"][$i] == "application/x-javascript")
    112. 

  112. 	|| ($_FILES["file"]["type"][$i] == "application/bzip2")
    113. 

  113. 	|| ($_FILES["file"]["type"][$i] == "application/x-bzip")
    114. 

  114. 	|| ($_FILES["file"]["type"][$i] == "application/x-bz2")
    115. 

  115. 	|| ($_FILES["file"]["type"][$i] == "application/octet")
    116. 

  116. 	|| ($_FILES["file"]["type"][$i] == "application/octet-stream")
    117. 

  117. 	|| ($_FILES["file"]["type"][$i] == "application/force-download")		
    118. 

  118. 	|| ($_FILES["file"]["type"][$i] == "image/png")
    119. 

  119. 	|| ($_FILES["file"]["type"][$i] == ""))
    120. 

  120. 	&& ($_FILES["file"]["size"][$i] < $user_max_upload)
    121. 

  121. 	&& in_array(strtolower($extension), $allowedExts))
    122. 

  122. 	{
    123. 

  123. 		if ($_FILES["file"]["error"][$i] > 0)
    124. 

  124. 		{
    125. 

  125. 			echo $_FILES["file"]["name"][$i] . " - Return Code: " . $_FILES["file"]["error"][$i] . "<br>";
    126. 

  126. 		}
    127. 

  127. 		else
    128. 

  128. 		{
    129. 

  129. 			if(isset($_GET['p']))
    130. 

  130. 			{
    131. 

  131. 				$path = $_GET['p'];
    132. 

  132. 				if(stristr($path, "../") == true)
    133. 

  133. 				{
    134. 

  134. 					echo "<meta http-equiv='refresh' content='0;url=ctrl.php?action=backtracking_error'>";
    135. 

  135. 				}
    136. 

  136. 				else if (file_exists("users/$username/$path/" . $_FILES["file"]["name"][$i]))
    137. 

  137. 				{
    138. 

  138. 					echo "Error:" . $_FILES["file"]["name"][$i] . " file exists.<br>";
    139. 

  139. 				}
    140. 

  140. 				else
    141. 

  141. 				{
    142. 

  142. 					$usage = file_get_contents("users/$username.usage");
    143. 

  143. 					$usage = $usage + $_FILES["file"]["size"][$i];
    144. 

  144. 					if($usage > $user_max_webspace) {							
    145. 

  145. 						echo "Error: Exceeding max webspace usage.<br>";
    146. 

  146. 					}							
    147. 

  147. 					else
    148. 

  148. 					{
    149. 

  149. 						$filelist = file_get_contents("users/$username.files");
    150. 

  150. 						file_put_contents("users/$username.usage", $usage);
    151. 

  151. 						move_uploaded_file($_FILES["file"]["tmp_name"][$i],
    152. 

  152. 						"users/$username/$path/" . $_FILES["file"]["name"][$i]);
    153. 

  153. 						file_put_contents("users/$username.files", $_FILES["file"]["name"][$i] . "\n" . $filelist);
    154. 

  154. 						echo "Success: " . $_FILES["file"]["name"][$i] . " Uploaded! Size: " . tomb($_FILES["file"]["size"][$i]) . "<br />\n";
    155. 

  155. 					}
    156. 

  156. 				}
    157. 

  157. 			}
    158. 

  158. 			else
    159. 

  159. 			{
    160. 

  160. 				if (file_exists("users/$username/" . $_FILES["file"]["name"][$i]))
    161. 

  161. 				{
    162. 

  162. 					echo "Error: " . $_FILES["file"]["name"][$i] . " exists.<br>";
    163. 

  163. 				}
    164. 

  164. 				else
    165. 

  165. 				{
    166. 

  166. 					$usage = file_get_contents("users/$username.usage");
    167. 

  167. 					$usage = $usage + $_FILES["file"]["size"][$i];
    168. 

  168. 					if($usage > $user_max_webspace) {
    169. 

  169. 						echo "Error: Exceeding max webspace usage.<br>";
    170. 

  170. 					}
    171. 

  171. 					else
    172. 

  172. 					{
    173. 

  173. 						file_put_contents("users/$username.usage", $usage);
    174. 

  174. 						move_uploaded_file($_FILES["file"]["tmp_name"][$i],
    175. 

  175. 						"users/$username/" . $_FILES["file"]["name"][$i]);
    176. 

  176. 						echo "Success: " . $_FILES["file"]["name"][$i] . " Uploaded! Size: " . tomb($_FILES["file"]["size"][$i]) . "<br>";						
    177. 

  177. 					}
    178. 

  178. 				}
    179. 

  179. 			}
    180. 

  180. 		}
    181. 

  181. 	}
    182. 

  182. 	else
    183. 

  183. 	{
    184. 

  184. 		echo "Error: " . $_FILES["file"]["name"][$i] . " is too large, or is a invalid filetype";
    185. 

  185. 	}
    186. 

  186. }
    187. 

  187. echo "</html>";
    188. 

  188. ?>
    189. 

  189.