[svn r15113] Removed useless and dangerous upload scripts in other languages

skala
Yannick Warnier 17 years ago
parent ab1c62d22a
commit 6324e43a3f
  1. 230
      main/inc/lib/fckeditor/editor/filemanager/upload/asp/class_upload.asp
  2. 43
      main/inc/lib/fckeditor/editor/filemanager/upload/asp/config.asp
  3. 25
      main/inc/lib/fckeditor/editor/filemanager/upload/asp/io.asp
  4. 108
      main/inc/lib/fckeditor/editor/filemanager/upload/asp/upload.asp
  5. 26
      main/inc/lib/fckeditor/editor/filemanager/upload/aspx/upload.aspx
  6. 94
      main/inc/lib/fckeditor/editor/filemanager/upload/cfm/config.cfm
  7. 164
      main/inc/lib/fckeditor/editor/filemanager/upload/cfm/upload.cfm
  8. 53
      main/inc/lib/fckeditor/editor/filemanager/upload/lasso/config.lasso
  9. 152
      main/inc/lib/fckeditor/editor/filemanager/upload/lasso/upload.lasso

@ -1,230 +0,0 @@
<!--
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: class_upload.asp
* These are the classes used to handle ASP upload without using third
* part components (OCX/DLL).
*
* File Authors:
* NetRube (netrube@126.com)
-->
<%
'**********************************************
' File: NetRube_Upload.asp
' Version: NetRube Upload Class Version 2.1 Build 20050228
' Author: NetRube
' Email: NetRube@126.com
' Date: 02/28/2005
' Comments: The code for the Upload.
' This can free usage, but please
' not to delete this copyright information.
' If you have a modification version,
' Please send out a duplicate to me.
'**********************************************
' 文件名: NetRube_Upload.asp
' 版本: NetRube Upload Class Version 2.1 Build 20050228
' 作者: NetRube(网络乡巴佬)
' 电子邮件: NetRube@126.com
' 日期: 2005年02月28日
' 声明: 文件上传类
' 本上传类可以自由使用,但请保留此版权声明信息
' 如果您对本上传类进行修改增强,
' 请发送一份给俺。
'**********************************************
Class NetRube_Upload
Public File, Form
Private oSourceData
Private nMaxSize, nErr, sAllowed, sDenied
Private Sub Class_Initialize
nErr = 0
nMaxSize = 1048576
Set File = Server.CreateObject("Scripting.Dictionary")
File.CompareMode = 1
Set Form = Server.CreateObject("Scripting.Dictionary")
Form.CompareMode = 1
Set oSourceData = Server.CreateObject("ADODB.Stream")
oSourceData.Type = 1
oSourceData.Mode = 3
oSourceData.Open
End Sub
Private Sub Class_Terminate
Form.RemoveAll
Set Form = Nothing
File.RemoveAll
Set File = Nothing
oSourceData.Close
Set oSourceData = Nothing
End Sub
Public Property Get Version
Version = "NetRube Upload Class Version 1.0 Build 20041218"
End Property
Public Property Get ErrNum
ErrNum = nErr
End Property
Public Property Let MaxSize(nSize)
nMaxSize = nSize
End Property
Public Property Let Allowed(sExt)
sAllowed = sExt
End Property
Public Property Let Denied(sExt)
sDenied = sExt
End Property
Public Sub GetData
Dim aCType
aCType = Split(Request.ServerVariables("HTTP_CONTENT_TYPE"), ";")
If aCType(0) <> "multipart/form-data" Then
nErr = 1
Exit Sub
End If
Dim nTotalSize
nTotalSize = Request.TotalBytes
If nTotalSize < 1 Then
nErr = 2
Exit Sub
End If
If nMaxSize > 0 And nTotalSize > nMaxSize Then
nErr = 3
Exit Sub
End If
oSourceData.Write Request.BinaryRead(nTotalSize)
oSourceData.Position = 0
Dim oTotalData, oFormStream, sFormHeader, sFormName, bCrLf, nBoundLen, nFormStart, nFormEnd, nPosStart, nPosEnd, sBoundary
oTotalData = oSourceData.Read
bCrLf = ChrB(13) & ChrB(10)
sBoundary = MidB(oTotalData, 1, InStrB(1, oTotalData, bCrLf) - 1)
nBoundLen = LenB(sBoundary) + 2
nFormStart = nBoundLen
Set oFormStream = Server.CreateObject("ADODB.Stream")
Do While (nFormStart + 2) < nTotalSize
nFormEnd = InStrB(nFormStart, oTotalData, bCrLf & bCrLf) + 3
With oFormStream
.Type = 1
.Mode = 3
.Open
oSourceData.Position = nFormStart
oSourceData.CopyTo oFormStream, nFormEnd - nFormStart
.Position = 0
.Type = 2
.CharSet = "UTF-8"
sFormHeader = .ReadText
.Close
End With
nFormStart = InStrB(nFormEnd, oTotalData, sBoundary) - 1
nPosStart = InStr(22, sFormHeader, " name=", 1) + 7
nPosEnd = InStr(nPosStart, sFormHeader, """")
sFormName = Mid(sFormHeader, nPosStart, nPosEnd - nPosStart)
If InStr(45, sFormHeader, " filename=", 1) > 0 Then
Set File(sFormName) = New NetRube_FileInfo
File(sFormName).FormName = sFormName
File(sFormName).Start = nFormEnd
File(sFormName).Size = nFormStart - nFormEnd - 2
nPosStart = InStr(nPosEnd, sFormHeader, " filename=", 1) + 11
nPosEnd = InStr(nPosStart, sFormHeader, """")
File(sFormName).ClientPath = Mid(sFormHeader, nPosStart, nPosEnd - nPosStart)
File(sFormName).Name = Mid(File(sFormName).ClientPath, InStrRev(File(sFormName).ClientPath, "\") + 1)
File(sFormName).Ext = LCase(Mid(File(sFormName).Name, InStrRev(File(sFormName).Name, ".") + 1))
nPosStart = InStr(nPosEnd, sFormHeader, "Content-Type: ", 1) + 14
nPosEnd = InStr(nPosStart, sFormHeader, vbCr)
File(sFormName).MIME = Mid(sFormHeader, nPosStart, nPosEnd - nPosStart)
Else
With oFormStream
.Type = 1
.Mode = 3
.Open
oSourceData.Position = nPosEnd
oSourceData.CopyTo oFormStream, nFormStart - nFormEnd - 2
.Position = 0
.Type = 2
.CharSet = "UTF-8"
Form(sFormName) = .ReadText
.Close
End With
End If
nFormStart = nFormStart + nBoundLen
Loop
oTotalData = ""
Set oFormStream = Nothing
End Sub
Public Sub SaveAs(sItem, sFileName)
If File(sItem).Size < 1 Then
nErr = 2
Exit Sub
End If
If Not IsAllowed(File(sItem).Ext) Then
nErr = 4
Exit Sub
End If
Dim oFileStream
Set oFileStream = Server.CreateObject("ADODB.Stream")
With oFileStream
.Type = 1
.Mode = 3
.Open
oSourceData.Position = File(sItem).Start
oSourceData.CopyTo oFileStream, File(sItem).Size
.Position = 0
.SaveToFile sFileName, 2
.Close
End With
Set oFileStream = Nothing
End Sub
Private Function IsAllowed(sExt)
Dim oRE
Set oRE = New RegExp
oRE.IgnoreCase = True
oRE.Global = True
If sDenied = "" Then
oRE.Pattern = sAllowed
IsAllowed = (sAllowed = "") Or oRE.Test(sExt)
Else
oRE.Pattern = sDenied
IsAllowed = Not oRE.Test(sExt)
End If
Set oRE = Nothing
End Function
End Class
Class NetRube_FileInfo
Dim FormName, ClientPath, Path, Name, Ext, Content, Size, MIME, Start
End Class
%>

@ -1,43 +0,0 @@
<!--
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: config.asp
* Configuration file for the File Manager Connector for ASP.
*
* File Authors:
* Frederico Caldeira Knabben (fredck@fckeditor.net)
-->
<%
' SECURITY: You must explicitelly enable this "uploader" (set it to "True").
Dim ConfigIsEnabled
ConfigIsEnabled = False
' Path to user files relative to the document root.
Dim ConfigUserFilesPath
ConfigUserFilesPath = "/UserFiles/"
' Allowed and Denied extensions configurations.
Dim ConfigAllowedExtensions, ConfigDeniedExtensions
Set ConfigAllowedExtensions = CreateObject( "Scripting.Dictionary" )
Set ConfigDeniedExtensions = CreateObject( "Scripting.Dictionary" )
ConfigAllowedExtensions.Add "File", ""
ConfigDeniedExtensions.Add "File", "php|php3|php5|phtml|asp|aspx|ascx|jsp|cfm|cfc|pl|bat|exe|dll|reg|cgi"
ConfigAllowedExtensions.Add "Image", "jpg|gif|jpeg|png|bmp"
ConfigDeniedExtensions.Add "Image", ""
ConfigAllowedExtensions.Add "Flash", "swf|fla"
ConfigDeniedExtensions.Add "Flash", ""
%>

@ -1,25 +0,0 @@
<!--
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: io.asp
* This file include IO specific functions used by the ASP Uploader.
*
* File Authors:
* Frederico Caldeira Knabben (fredck@fckeditor.net)
-->
<%
Function RemoveExtension( fileName )
RemoveExtension = Left( fileName, InStrRev( fileName, "." ) - 1 )
End Function
%>

@ -1,108 +0,0 @@
<%@ CodePage=65001 Language="VBScript"%>
<%
Option Explicit
%>
<!--
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: upload.asp
* This is the "File Uploader" for ASP.
*
* File Authors:
* Frederico Caldeira Knabben (fredck@fckeditor.net)
-->
<!--#include file="config.asp"-->
<!--#include file="io.asp"-->
<!--#include file="class_upload.asp"-->
<%
' This is the function that sends the results of the uploading process.
Function SendResults( errorNumber, fileUrl, fileName, customMsg )
Response.Write "<script type=""text/javascript"">"
Response.Write "window.parent.OnUploadCompleted(" & errorNumber & ",""" & Replace( fileUrl, """", "\""" ) & """,""" & Replace( fileName, """", "\""" ) & """,""" & Replace( customMsg , """", "\""" ) & """) ;"
Response.Write "</script>"
Response.End
End Function
%>
<%
' Check if this uploader has been enabled.
If ( ConfigIsEnabled = False ) Then
SendResults "1", "", "", "This file uploader is disabled. Please check the ""editor/filemanager/upload/asp/config.asp"" file"
End If
' The the file type (from the QueryString, by default 'File').
Dim resourceType
If ( Request.QueryString("Type") <> "" ) Then
resourceType = Request.QueryString("Type")
Else
resourceType = "File"
End If
' Create the Uploader object.
Dim oUploader
Set oUploader = New NetRube_Upload
oUploader.MaxSize = 0
oUploader.Allowed = ConfigAllowedExtensions.Item( resourceType )
oUploader.Denied = ConfigDeniedExtensions.Item( resourceType )
oUploader.GetData
If oUploader.ErrNum > 1 Then
SendResults "202", "", "", ""
Else
Dim sFileName, sFileUrl, sErrorNumber, sOriginalFileName, sExtension
sFileName = ""
sFileUrl = ""
sErrorNumber = "0"
' Map the virtual path to the local server path.
Dim sServerDir
sServerDir = Server.MapPath( ConfigUserFilesPath )
If ( Right( sServerDir, 1 ) <> "\" ) Then
sServerDir = sServerDir & "\"
End If
Dim oFSO
Set oFSO = Server.CreateObject( "Scripting.FileSystemObject" )
' Get the uploaded file name.
sFileName = oUploader.File( "NewFile" ).Name
sExtension = oUploader.File( "NewFile" ).Ext
sOriginalFileName = sFileName
Dim iCounter
iCounter = 0
Do While ( True )
Dim sFilePath
sFilePath = sServerDir & sFileName
If ( oFSO.FileExists( sFilePath ) ) Then
iCounter = iCounter + 1
sFileName = RemoveExtension( sOriginalFileName ) & "(" & iCounter & ")." & sExtension
sErrorNumber = "201"
Else
oUploader.SaveAs "NewFile", sFilePath
If oUploader.ErrNum > 0 Then SendResults "202", "", "", ""
Exit Do
End If
Loop
Response.Write( sFilePath )
sFileUrl = ConfigUserFilesPath & sFileName
SendResults sErrorNumber, sFileUrl, sFileName, ""
End If
Set oUploader = Nothing
%>

@ -1,26 +0,0 @@
<%@ Page language="c#" Inherits="FredCK.FCKeditorV2.Uploader" AutoEventWireup="false" %>
<%--
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: upload.aspx
* This is the Uploader for ASP.NET.
*
* The code of this page if included in the FCKeditor.Net package,
* in the FredCK.FCKeditorV2.dll assemblyfile. So to use it you must
* include that DLL in your "bin" directory.
*
* To download the FCKeditor.Net package, go to our official web site:
* http://www.fckeditor.net
*
* File Authors:
* Frederico Caldeira Knabben (fredck@fckeditor.net)
--%>

@ -1,94 +0,0 @@
<!---
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: config.cfm
* Configuration file for the ColdFusion File Uploader.
*
* File Authors:
* Wim Lemmens (didgiman@gmail.com)
--->
<cfscript>
config = StructNew();
// SECURITY: You must explicitelly enable this "uploader".
config.enabled = false;
// Path to uploaded files relative to the document root.
config.userFilesPath = "/UserFiles/";
config.serverPath = ""; // use this to force the server path if FCKeditor is not running directly off the root of the application or the FCKeditor directory in the URL is a virtual directory or a symbolic link / junction
config.allowedExtensions = StructNew();
config.deniedExtensions = StructNew();
config.allowedExtensions["File"] = "";
config.deniedExtensions["File"] = "php,asp,aspx,ascx,jsp,cfm,cfc,pl,bat,exe,com,dll,vbs,js,reg";
config.allowedExtensions["Image"] = "png,gif,jpg,jpeg,bmp";
config.deniedExtensions["Image"] = "";
config.allowedExtensions["Flash"] = "swf,fla";
config.deniedExtensions["Flash"] = "";
</cfscript>
<!--- code to maintain backwards compatibility with previous version of cfm connector --->
<cfif isDefined("application.userFilesPath")>
<cflock scope="application" type="readonly" timeout="5">
<cfset config.userFilesPath = application.userFilesPath>
</cflock>
<cfelseif isDefined("server.userFilesPath")>
<cflock scope="server" type="readonly" timeout="5">
<cfset config.userFilesPath = server.userFilesPath>
</cflock>
</cfif>
<!--- look for config struct in request, application and server scopes --->
<cfif isDefined("request.FCKeditor") and isStruct(request.FCKeditor)>
<cfset variables.FCKeditor = request.FCKeditor>
<cfelseif isDefined("application.FCKeditor") and isStruct(application.FCKeditor)>
<cflock scope="application" type="readonly" timeout="5">
<cfset variables.FCKeditor = duplicate(application.FCKeditor)>
</cflock>
<cfelseif isDefined("server.FCKeditor") and isStruct(server.FCKeditor)>
<cflock scope="server" type="readonly" timeout="5">
<cfset variables.FCKeditor = duplicate(server.FCKeditor)>
</cflock>
</cfif>
<cfif isDefined("FCKeditor")>
<!--- copy key values from external to local config (i.e. override default config as required) --->
<cfscript>
function structCopyKeys(stFrom, stTo) {
for ( key in stFrom ) {
if ( isStruct(stFrom[key]) ) {
structCopyKeys(stFrom[key],stTo[key]);
} else {
stTo[key] = stFrom[key];
}
}
}
structCopyKeys(FCKeditor, config);
</cfscript>
</cfif>

@ -1,164 +0,0 @@
<!---
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* "Support Open Source software. What about a donation today?"
*
* File Name: upload.cfm
* This is the "File Uploader" for ColdFusion.
* Based on connector.cfm by Mark Woods (mark@thickpaddy.com)
*
* File Authors:
* Wim Lemmens (didgiman@gmail.com)
--->
<cfinclude template="config.cfm">
<cfparam name="url.type" default="File">
<cffunction name="SendResults">
<cfargument name="errorNumber" type="numeric" required="yes">
<cfargument name="fileUrl" type="string" required="no" default="">
<cfargument name="fileName" type="string" required="no" default="">
<cfargument name="customMsg" type="string" required="no" default="">
<cfoutput>
<script type="text/javascript">
window.parent.OnUploadCompleted(#errorNumber#, "#JSStringFormat(fileUrl)#", "#JSStringFormat(fileName)#", "#JSStringFormat(customMsg)#");
</script>
</cfoutput>
<cfabort><!--- Result sent, stop processing this page --->
</cffunction>
<cfif NOT config.enabled>
<cfset SendResults(1, '', '', 'This file uploader is disabled. Please check the "editor/filemanager/upload/cfm/config.cfm" file')>
<cfelse>
<cfscript>
userFilesPath = config.userFilesPath;
lAllowedExtensions = config.allowedExtensions[url.type];
lDeniedExtensions = config.deniedExtensions[url.type];
customMsg = ''; // Can be overwritten. The last value will be sent with the result
// make sure the user files path is correctly formatted
userFilesPath = replace(userFilesPath, "\", "/", "ALL");
userFilesPath = replace(userFilesPath, '//', '/', 'ALL');
if ( right(userFilesPath,1) NEQ "/" ) {
userFilesPath = userFilesPath & "/";
}
if ( left(userFilesPath,1) NEQ "/" ) {
userFilesPath = "/" & userFilesPath;
}
if (find("/",getBaseTemplatePath())) {
fs = "/";
} else {
fs = "\";
}
// Get the base physical path to the web root for this application. The code to determine the path automatically assumes that
// the "FCKeditor" directory in the http request path is directly off the web root for the application and that it's not a
// virtual directory or a symbolic link / junction. Use the serverPath config setting to force a physical path if necessary.
if ( len(config.serverPath) ) {
serverPath = config.serverPath;
} else {
serverPath = replaceNoCase(getBaseTemplatePath(),replace(cgi.script_name,"/",fs,"all"),"");
}
// map the user files path to a physical directory
userFilesServerPath = serverPath & replace(userFilesPath,"/",fs,"all");
</cfscript>
<cfset fileName = "">
<cfset fileExt = "">
<cftry>
<!--- we need to know the physical path to the current folder for all commands --->
<cfset currentFolderPath = userFilesServerPath & url.type & fs>
<!--- TODO: upload to a temp directory and move file if extension is allowed --->
<!--- first upload the file with an unique filename --->
<cffile action="upload"
fileField="NewFile"
destination="#currentFolderPath#"
nameConflict="makeunique"
mode="644"
attributes="normal">
<cfif (Len(lAllowedExtensions) AND NOT listFindNoCase(lAllowedExtensions, cffile.ServerFileExt))
OR (Len(lDeniedExtensions) AND listFindNoCase(lDeniedExtensions, cffile.ServerFileExt))>
<!--- Extension of the uploaded file is not allowed --->
<cfset errorNumber = "202">
<cffile action="delete" file="#cffile.ServerDirectory##fs##cffile.ServerFile#">
<cfelse>
<cfscript>
errorNumber = 0;
fileName = cffile.ClientFileName;
fileExt = cffile.ServerFileExt;
// munge filename for html download. Only a-z, 0-9, _, - and . are allowed
if( reFind("[^A-Za-z0-9_\-\.]", fileName) ) {
fileName = reReplace(fileName, "[^A-Za-z0-9\-\.]", "_", "ALL");
fileName = reReplace(fileName, "_{2,}", "_", "ALL");
fileName = reReplace(fileName, "([^_]+)_+$", "\1", "ALL");
fileName = reReplace(fileName, "$_([^_]+)$", "\1", "ALL");
}
// When the original filename already exists, add numbers (0), (1), (2), ... at the end of the filename.
if( compare( cffile.ServerFileName, fileName ) ) {
counter = 0;
tmpFileName = fileName;
while( fileExists("#currentFolderPath##fileName#.#fileExt#") ) {
counter = counter + 1;
fileName = tmpFileName & '(#counter#)';
}
}
</cfscript>
<!--- Rename the uploaded file, if neccessary --->
<cfif compare(cffile.ServerFileName,fileName)>
<cfset errorNumber = "201">
<cffile
action="rename"
source="#currentFolderPath##cffile.ServerFileName#.#cffile.ServerFileExt#"
destination="#currentFolderPath##fileName#.#fileExt#"
mode="644"
attributes="normal">
</cfif>
</cfif>
<cfcatch type="Any">
<cfset errorNumber = "1">
<cfset customMsg = "An error occured: " & cfcatch.message & " - " & cfcatch.detail>
</cfcatch>
</cftry>
<cfif errorNumber EQ 0>
<!--- file was uploaded succesfully --->
<cfset SendResults(errorNumber, '#userFilesPath##url.type#/#fileName#.#fileExt#')>
<cfelseif errorNumber EQ 201>
<!--- file was changed (201), submit the new filename --->
<cfset SendResults(errorNumber, '#userFilesPath##url.type#/#fileName#.#fileExt#', replace( fileName & "." & fileExt, "'", "\'", "ALL"), customMsg)>
<cfelse>
<!--- An error occured(202). Submit only the error code and a message (if available). --->
<cfset SendResults(errorNumber, '', '', customMsg)>
</cfif>
</cfif>

@ -1,53 +0,0 @@
[//lasso
/*
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* File Name: config.php
* Configuration file for the Lasso File Uploader.
*
* File Authors:
* Jason Huck (jason.huck@corefive.com)
*/
/*.....................................................................
The connector uses the file tags, which require authentication. Enter a
valid username and password from Lasso admin for a group with file tags
permissions for uploads and the path you define in UserFilesPath below.
*/
var('connection') = array(
-username='xxxxxxxx',
-password='xxxxxxxx'
);
/*.....................................................................
Set the base path for files that users can upload and browse (relative
to server root).
Set which file extensions are allowed and/or denied for each file type.
*/
var('config') = map(
'Enabled' = false,
'UserFilesPath' = '/UserFiles/',
'AllowedExtensions' = map(
'File' = array(),
'Image' = array('jpg','gif','jpeg','png'),
'Flash' = array('swf','fla'),
'Media' = array('swf','fla','jpg','gif','jpeg','png','avi','mpg','mpeg')
),
'DeniedExtensions' = map(
'File' = array('php','asp','aspx','ascx','jsp','cfm','cfc','pl','bat','exe','dll','reg','inc','lasso','cgi','lasso','lassoapp'),
'Image' = array(),
'Flash' = array(),
'Media' = array()
)
);
]

@ -1,152 +0,0 @@
[//lasso
/*
* FCKeditor - The text editor for internet
* Copyright (C) 2003-2005 Frederico Caldeira Knabben
*
* Licensed under the terms of the GNU Lesser General Public License:
* http://www.opensource.org/licenses/lgpl-license.php
*
* For further information visit:
* http://www.fckeditor.net/
*
* File Name: upload.php
* This is the "File Uploader" for Lasso.
*
* File Authors:
* Jason Huck (jason.huck@corefive.com)
*/
/*.....................................................................
Include global configuration. See config.lasso for details.
*/
include('config.lasso');
/*.....................................................................
Convert query string parameters to variables and initialize output.
*/
var(
'Type' = action_param('Type'),
'CurrentFolder' = action_param('CurrentFolder'),
'ServerPath' = action_param('ServerPath'),
'NewFile' = null,
'NewFileName' = string,
'OrigFilePath' = string,
'NewFilePath' = string,
'errorNumber' = 0,
'customMsg' = ''
);
$Type == '' ? $Type = 'File';
/*.....................................................................
Calculate the path to the current folder.
*/
$ServerPath == '' ? $ServerPath = $config->find('UserFilesPath');
var('currentFolderURL' = $ServerPath
+ action_param('Type')
+ action_param('CurrentFolder')
);
/*.....................................................................
Custom tag sets the HTML response.
*/
define_tag(
'sendresults',
-namespace='fck_',
-priority='replace',
-required='errorNumber',
-type='integer',
-optional='fileUrl',
-type='string',
-optional='fileName',
-type='string',
-optional='customMsg',
-type='string',
-description='Sets the HTML response for the FCKEditor Quick Upload feature.'
);
$__html_reply__ = '\
<script type="text/javascript">
window.parent.OnUploadCompleted(' + #errorNumber + ',"'
+ string_replace(#fileUrl, -find='"', -replace='\\"') + '","'
+ string_replace(#fileName, -find='"', -replace='\\"') + '","'
+ string_replace(#customMsg, -find='"', -replace='\\"') + '");
</script>
';
/define_tag;
if($config->find('Enabled'));
/*.................................................................
Process an uploaded file.
*/
inline($connection);
/*.............................................................
Was a file actually uploaded?
*/
file_uploads->size ? $NewFile = file_uploads->get(1) | $errorNumber = 202;
if($errorNumber == 0);
/*.........................................................
Split the file's extension from the filename in order
to follow the API's naming convention for duplicate
files. (Test.txt, Test(1).txt, Test(2).txt, etc.)
*/
$NewFileName = $NewFile->find('OrigName');
$OrigFilePath = $currentFolderURL + $NewFileName;
$NewFilePath = $OrigFilePath;
local('fileExtension') = '.' + $NewFile->find('OrigExtension');
local('shortFileName') = $NewFileName->removetrailing(#fileExtension)&;
/*.........................................................
Make sure the file extension is allowed.
*/
if($config->find('DeniedExtensions')->find($Type) >> $NewFile->find('OrigExtension'));
$errorNumber = 202;
else;
/*.....................................................
Rename the target path until it is unique.
*/
while(file_exists($NewFilePath));
$NewFileName = #shortFileName + '(' + loop_count + ')' + #fileExtension;
$NewFilePath = $currentFolderURL + $NewFileName;
/while;
/*.....................................................
Copy the uploaded file to its final location.
*/
file_copy($NewFile->find('path'), $NewFilePath);
/*.....................................................
Set the error code for the response.
*/
select(file_currenterror( -errorcode));
case(0);
$OrigFilePath != $NewFilePath ? $errorNumber = 201;
case;
$errorNumber = 202;
/select;
/if;
/if;
/inline;
else;
$errorNumber = 1;
$customMsg = 'This file uploader is disabled. Please check the "editor/filemanager/upload/lasso/config.lasso" file.';
/if;
fck_sendresults(
-errorNumber=$errorNumber,
-fileUrl=$NewFilePath,
-fileName=$NewFileName,
-customMsg=$customMsg
);
]
Loading…
Cancel
Save