PHP AuditAction函数代码示例

 /**
  * get AliasFile-instance
  *
  * @param $inFile the path to stats-file
  * @param $user the user
  * @param $fluxCfg torrent-flux config-array
  * @param $clientType client-type
  * @return $aliasFileInstance AliasFile-instance
  */
 function getAliasFileInstance($inFile, $user = "", $fluxCfg, $clientType = '')
 {
     // check if file is a sane file
     if (ereg("(\\.\\.\\/)", $inFile) || !preg_match('/^[a-zA-Z0-9._\\/]+(stat)$/', $inFile)) {
         AuditAction($fluxCfg["constants"]["error"], "Invalid AliasFile : " . $fluxCfg["user"] . " tried to access " . $inFile);
         global $argv;
         if (isset($argv)) {
             die("Invalid AliasFile : " . $inFile);
         } else {
             showErrorPage("Invalid AliasFile : <br>" . htmlentities($inFile, ENT_QUOTES));
         }
     }
     // damn dirty but does php (< 5) have reflection or something like
     // class-by-name ?
     if (isset($clientType) && $clientType != '') {
         $clientClass = $clientType;
         $fluxCfg["btclient"] = $clientType;
     } else {
         $clientClass = $fluxCfg["btclient"];
     }
     $classFile = 'AliasFile.' . $clientClass . '.php';
     if (is_file($classFile)) {
         include_once $classFile;
         switch ($clientClass) {
             case "tornado":
                 return new AliasFileTornado($inFile, $user, serialize($fluxCfg));
                 break;
             case "transmission":
                 return new AliasFileTransmission($inFile, $user, serialize($fluxCfg));
                 break;
         }
     }
 }

/**
 * UpdateUserProfile
 *
 * @param $user_id
 * @param $pass1
 * @param $hideOffline
 * @param $theme
 * @param $language
 */
function UpdateUserProfile($user_id, $pass1, $hideOffline, $theme, $language)
{
    global $cfg, $db;
    if (empty($hideOffline) || $hideOffline == "" || !isset($hideOffline)) {
        $hideOffline = "0";
    }
    // update values
    $rec = array();
    if ($pass1 != "") {
        $rec['password'] = md5($pass1);
        AuditAction($cfg["constants"]["update"], $cfg['_PASSWORD']);
    }
    $sql = "select * from tf_users where user_id = " . $db->qstr($user_id);
    $rs = $db->Execute($sql);
    if ($db->ErrorNo() != 0) {
        dbError($sql);
    }
    $rec['hide_offline'] = $hideOffline;
    $rec['theme'] = $theme;
    $rec['language_file'] = $language;
    $sql = $db->GetUpdateSQL($rs, $rec);
    if ($sql != "") {
        $result = $db->Execute($sql);
        if ($db->ErrorNo() != 0) {
            dbError($sql);
        }
        // flush session-cache
        cacheFlush($cfg["user"]);
    }
}

 /**
  * get AliasFile-instance
  *
  * @param $inFile the path to stats-file
  * @param $user the user
  * @param $fluxCfg torrent-flux config-array
  * @param $clientType client-type
  * @return $aliasFileInstance AliasFile-instance
  */
 function getAliasFileInstance($inFile, $user = "", $fluxCfg, $clientType = '')
 {
     // check if file is a sane file
     if (strpos($inFile, "../") !== false || !preg_match('/^[a-zA-Z0-9._\\-\\/]+(stat)$/', $inFile)) {
         AuditAction($fluxCfg["constants"]["error"], "Invalid AliasFile : " . $fluxCfg["user"] . " tried to access " . $inFile);
         global $argv;
         if (isset($argv)) {
             die("Invalid AliasFile");
         } else {
             showErrorPage("Invalid AliasFile");
         }
     }
     // damn dirty but does php (< 5) have reflection or something like
     // class-by-name ?
     if (isset($clientType) && $clientType != '') {
         $clientClass = $clientType;
         $fluxCfg["btclient"] = $clientType;
     } else {
         $clientClass = $fluxCfg["btclient"];
     }
     switch ($clientClass) {
         case "tornado":
             require_once 'AliasFile.tornado.php';
             return new AliasFileTornado($inFile, $user, serialize($fluxCfg));
         case "transmission":
             require_once 'AliasFile.transmission.php';
             return new AliasFileTransmission($inFile, $user, serialize($fluxCfg));
     }
 }

/**
 * init
 */
function transfer_init()
{
    global $cfg, $tmpl, $transfer, $transferLabel, $ch;
    // request-var
    $transfer = tfb_getRequestVar('transfer');
    if (empty($transfer)) {
        @error("missing params", "", "", array('transfer'));
    }
    // validate transfer
    if (tfb_isValidTransfer($transfer) !== true) {
        AuditAction($cfg["constants"]["error"], "INVALID TRANSFER: " . $transfer);
        @error("Invalid Transfer", "", "", array($transfer));
    }
    // permission
    if (!$cfg['isAdmin'] && !IsOwner($cfg["user"], getOwner($transfer))) {
        AuditAction($cfg["constants"]["error"], "ACCESS DENIED: " . $transfer);
        @error("Access Denied", "", "", array($transfer));
    }
    // get label
    $transferLabel = strlen($transfer) >= 39 ? substr($transfer, 0, 35) . "..." : $transfer;
    // set transfer vars
    $tmpl->setvar('transfer', $transfer);
    $tmpl->setvar('transferLabel', $transferLabel);
    $tmpl->setvar('transfer_exists', transferExists($transfer) ? 1 : 0);
}

 /**
  * starts a client
  *
  * @param $transfer name of the transfer
  * @param $interactive (boolean) : is this a interactive startup with dialog ?
  * @param $enqueue (boolean) : enqueue ?
  */
 function start($transfer, $interactive = false, $enqueue = false)
 {
     global $cfg;
     // set vars
     $this->_setVarsForTransfer($transfer);
     // log
     $this->logMessage($this->client . "-start : " . $transfer . "\n", true);
     // FluAzu
     require_once "inc/classes/FluAzu.php";
     // do azureus special-pre-start-checks
     // check to see if fluazu is running
     if (!FluAzu::isRunning()) {
         $this->state = CLIENTHANDLER_STATE_ERROR;
         $msg = "fluazu not running, cannot start transfer " . $transfer;
         AuditAction($cfg["constants"]["error"], $msg);
         $this->logMessage($msg . "\n", true);
         array_push($this->messages, $msg);
         // write error to stat
         $sf = new StatFile($this->transfer, $this->owner);
         $sf->time_left = 'Error: fluazu down';
         $sf->write();
         // return
         return false;
     }
     // init starting of client
     $this->_init($interactive, $enqueue, true, false);
     // only continue if init succeeded (skip start / error)
     if ($this->state != CLIENTHANDLER_STATE_READY) {
         if ($this->state == CLIENTHANDLER_STATE_ERROR) {
             $msg = "Error after init (" . $transfer . "," . $interactive . "," . $enqueue . ",true," . $cfg['enable_sharekill'] . ")";
             array_push($this->messages, $msg);
             $this->logMessage($msg . "\n", true);
         }
         // return
         return false;
     }
     // build the command-string
     $content = $cfg['user'] . "\n";
     $content .= $this->savepath . "\n";
     $content .= $this->rate . "\n";
     $content .= $this->drate . "\n";
     $content .= $this->maxuploads . "\n";
     $content .= $this->superseeder . "\n";
     $content .= $this->runtime . "\n";
     $content .= $this->sharekill_param . "\n";
     $content .= $this->minport . "\n";
     $content .= $this->maxport . "\n";
     $content .= $this->maxcons . "\n";
     $content .= $this->rerequest;
     $this->command = "echo -e " . tfb_shellencode($content) . " > " . tfb_shellencode($cfg["path"] . '.fluazu/run/' . $transfer);
     $this->command .= " && ";
     $this->command .= "echo r > " . tfb_shellencode($cfg["path"] . '.fluazu/fluazu.cmd');
     if ($this->isWinOS()) {
         file_put_contents($cfg["path"] . '.fluazu/run/' . $transfer, $content);
         $this->command = "echo r > " . tfb_shellencode($cfg["path"] . '.fluazu/fluazu.cmd');
     }
     // start the client
     $this->_start();
 }

function rpc_error($errorstr, $dummy = "", $dummy = "", $response = "")
{
    global $cfg;
    AuditAction($cfg["constants"]["error"], "Transmission RPC : {$errorstr} - {$response}");
    @error($errorstr . "\n" . $response, "", "", $response, $response);
    addGrowlMessage('transmission-rpc', $errorstr . $response);
    //dbError($errorstr);
}

 /**
  * starts a bittorrent-client
  * @param $torrent name of the torrent
  * @param $interactive (1|0) : is this a interactive startup with dialog ?
  */
 function startTorrentClient($torrent, $interactive)
 {
     // do tornado special-pre-start-checks
     // check to see if the path to the python script is valid
     if (!is_file($this->cfg["btclient_tornado_bin"])) {
         AuditAction($this->cfg["constants"]["error"], "Error  Path for " . $this->cfg["btclient_tornado_bin"] . " is not valid");
         if (IsAdmin()) {
             $this->status = -1;
             header("location: admin.php?op=configSettings");
             return;
         } else {
             $this->status = -1;
             $this->messages .= "<b>Error</b> TorrentFlux settings are not correct (path to python script is not valid) -- please contact an admin.<br>";
             return;
         }
     }
     // prepare starting of client
     parent::prepareStartTorrentClient($torrent, $interactive);
     // prepare succeeded ?
     if ($this->status != 2) {
         $this->status = -1;
         $this->messages .= "<b>Error</b> parent::prepareStartTorrentClient(" . $torrent . "," . $interactive . ") failed<br>";
         return;
     }
     // build the command-string
     $skipHashCheck = "";
     if (!empty($this->skip_hash_check) && getTorrentDataSize($torrent) > 0) {
         $skipHashCheck = " --check_hashes 0";
     }
     $this->command = $this->runtime . " " . $this->sharekill_param . " " . $this->cfg["torrent_file_path"] . $this->alias . ".stat " . $this->owner . " --responsefile '" . $this->cfg["torrent_file_path"] . $this->torrent . "' --display_interval 5 --max_download_rate " . $this->drate . " --max_upload_rate " . $this->rate . " --max_uploads " . $this->maxuploads . " --minport " . $this->port . " --maxport " . $this->maxport . " --rerequest_interval " . $this->rerequest . " --super_seeder " . $this->superseeder . " --max_initiate " . $this->maxcons . $skipHashCheck;
     if (file_exists($this->cfg["torrent_file_path"] . $this->alias . ".prio")) {
         $priolist = explode(',', file_get_contents($this->cfg["torrent_file_path"] . $this->alias . ".prio"));
         $priolist = implode(',', array_slice($priolist, 1, $priolist[0]));
         $this->command .= " --priority " . $priolist;
     }
     $this->command .= " " . $this->cfg["btclient_tornado_options"] . " > /dev/null &";
     if ($this->cfg["AllowQueing"] && $this->queue == "1") {
         //  This file is queued.
     } else {
         // This file is started manually.
         if (!array_key_exists("pythonCmd", $this->cfg)) {
             insertSetting("pythonCmd", "/usr/bin/python");
         }
         if (!array_key_exists("debugTorrents", $this->cfg)) {
             insertSetting("debugTorrents", "0");
         }
         $pyCmd = "";
         if (!$this->cfg["debugTorrents"]) {
             $pyCmd = $this->cfg["pythonCmd"] . " -OO";
         } else {
             $pyCmd = $this->cfg["pythonCmd"];
         }
         $this->command = "cd " . $this->savepath . "; HOME=" . $this->cfg["path"] . "; export HOME;" . $this->umask . " nohup " . $this->nice . $pyCmd . " " . $this->cfg["btclient_tornado_bin"] . " " . $this->command;
     }
     // start the client
     parent::doStartTorrentClient();
 }

 /**
  * starts a bittorrent-client
  * @param $torrent name of the torrent
  * @param $interactive (1|0) : is this a interactive startup with dialog ?
  */
 function startTorrentClient($torrent, $interactive)
 {
     // do transmission special-pre-start-checks
     // check to see if the path to the transmission-bin is valid
     if (!is_file($this->cfg["btclient_transmission_bin"])) {
         AuditAction($this->cfg["constants"]["error"], "Error Path for " . $this->cfg["btclient_transmission_bin"] . " is not valid");
         $this->status = -1;
         if (IsAdmin()) {
             header("location: admin.php?op=configSettings");
             return;
         } else {
             $this->messages .= "<b>Error</b> TorrentFlux settings are not correct (path to transmission-bin is not valid) -- please contact an admin.<br>";
             return;
         }
     }
     // prepare starting of client
     parent::prepareStartTorrentClient($torrent, $interactive);
     // prepare succeeded ?
     if ($this->status != 2) {
         $this->status = -1;
         $this->messages .= "<b>Error</b> parent::prepareStartTorrentClient(" . $torrent . "," . $interactive . ") failed<br>";
         return;
     }
     // included in transmissioncli
     // quick-hack for transmission--1
     //if ($this->rate == 0)
     //    $this->rate = -1;
     //if ($this->drate == 0)
     //    $this->drate = -1;
     // included in transmissioncli
     // pid-file
     $this->pidFile = "\"" . $this->cfg["torrent_file_path"] . $this->alias . ".stat.pid\"";
     // build the command-string
     $this->command = "-t \"" . $this->cfg["torrent_file_path"] . $this->alias . ".stat\" -w " . $this->owner;
     // "new" transmission-patch has pid-file included
     $this->command .= " -z " . $this->pidFile;
     /* - bsd-workaround */
     $this->command .= " -e 5 -p " . $this->port . " -u " . $this->rate . " -c " . $this->sharekill_param . " -d " . $this->drate;
     $this->command .= " " . $this->cfg["btclient_transmission_options"] . "\"" . $this->cfg["torrent_file_path"] . $this->torrent;
     // standard, no shell trickery ("new" transmission-patch has pid-file included) :
     $this->command .= '" &> /dev/null &';
     /* - bsd-workaround */
     // <begin shell-trickery> to write the pid of the client into the pid-file
     // * b4rt :
     //$this->command .= '" &> /dev/null & echo $! > "'. $this->pidFile .'"';
     // * lord_nor :
     //$this->command .= '" > /dev/null & echo $! & > "'. $this->pidFile .'"'; /* + bsd-workaround */
     // <end shell-trickery>
     if ($this->cfg["AllowQueing"] && $this->queue == "1") {
         //  This file is queued.
     } else {
         // This file is started manually.
         $this->command = "cd " . $this->savepath . "; HOME=" . $this->cfg["path"] . "; export HOME;" . $this->umask . " nohup " . $this->nice . $this->cfg["btclient_transmission_bin"] . " " . $this->command;
     }
     // start the client
     parent::doStartTorrentClient();
 }

function SecurityCleanPath($string)
{
    global $cfg;
    if (empty($string)) {
        return $string;
    }
    $array = array("<", ">", "\\", "//", "..", "'");
    foreach ($array as $char) {
        $string = str_replace($char, NULL, $string);
    }
    if (strtolower(substr($string, -4)) == ".txt" || strtolower(substr($string, -4)) == ".nfo") {
        // we are good
    } else {
        AuditAction($cfg["constants"]["error"], "Not a text or NFO: " . $string);
        die("Invalid file specified.  Action has been logged.");
    }
    return $string;
}

/**
 * init
 */
function transfer_init()
{
    global $cfg, $tmpl, $transfer, $transferLabel, $ch;
    // request-var
    $transfer = tfb_getRequestVar('transfer');
    if (empty($transfer)) {
        @error("missing params", "", "", array('transfer'));
    }
    if ($cfg["transmission_rpc_enable"] && isHash($transfer)) {
        require_once 'inc/functions/functions.rpc.transmission.php';
        $theTorrent = getTransmissionTransfer($transfer, array('hashString', 'id', 'name'));
        if (is_array($theTorrent)) {
            $transferLabel = strlen($theTorrent[name]) >= 39 ? substr($theTorrent[name], 0, 35) . "..." : $theTorrent[name];
            $tmpl->setvar('transfer', $theTorrent[hashString]);
            $tmpl->setvar('transferLabel', $transferLabel);
            $tmpl->setvar('transfer_exists', 0);
            return;
            // We really don't need this. Only the hash is a unique way of finding transfers. So all transfer operations should use the hash.
            /*
            			//tf compatible... erk
            			$transfer = getTransferFromHash($transfer);
            			if (empty($transfer))
            				$transfer = $theTorrent[name];
            */
        }
    }
    // validate transfer
    if (tfb_isValidTransfer($transfer) !== true) {
        AuditAction($cfg["constants"]["error"], "INVALID TRANSFER: " . $transfer);
        @error("Invalid Transfer", "", "", array($transfer));
    }
    // permission
    if (!$cfg['isAdmin'] && !IsOwner($cfg["user"], getOwner($transfer))) {
        AuditAction($cfg["constants"]["error"], "ACCESS DENIED: " . $transfer);
        @error("Access Denied", "", "", array($transfer));
    }
    // get label
    $transferLabel = preg_replace("#\\.torrent\$#", "", $transfer);
    $transferLabel = strlen($transferLabel) >= 39 ? substr($transferLabel, 0, 35) . "..." : $transferLabel;
    // set transfer vars
    $tmpl->setvar('transfer', $transfer);
    $tmpl->setvar('transferLabel', $transferLabel);
    $tmpl->setvar('transfer_exists', transferExists($transfer) ? 1 : 0);
}

 /**
  * updateStatFiles
  *
  * @param $transfer string torrent name
  * @return boolean
  */
 function updateStatFiles($transfer = "")
 {
     global $cfg, $db;
     //$rpc = Transmission::getInstance();
     $tfs = $this->monitorRunningTransfers();
     if (!is_array($tfs)) {
         return false;
     }
     $sql = "SELECT hash, transfer, sharekill FROM tf_transfers WHERE type='torrent' AND client = 'transmissionrpc'";
     if ($transfer != "") {
         //only update one transfer...
         $sql .= " AND transfer=" . $db->qstr($transfer);
     } else {
         $hashes = array("''");
         foreach ($tfs as $hash => $t) {
             $hashes[] = "'" . strtolower($hash) . "'";
         }
         $sql .= " AND hash IN (" . implode(',', $hashes) . ")";
     }
     $recordset = $db->Execute($sql);
     while (list($hash, $transfer, $sharekill) = $recordset->FetchRow()) {
         $hash = strtolower($hash);
         $hashes[$hash] = $transfer;
         $sharekills[$hash] = $sharekill;
     }
     //convertTimeText
     require_once "inc/functions/functions.core.php";
     foreach ($tfs as $hash => $t) {
         if (!isset($hashes[$hash])) {
             continue;
         }
         $transfer = $hashes[$hash];
         $sf = new StatFile($transfer);
         $sf->running = $t['running'];
         $sf->percent_done = round($t['percentDone'] * 100, 2);
         if ($t['status'] == 8 || $t['status'] == 9) {
             $sf->sharing = round($t['uploadRatio'] * 100, 2);
         }
         $sf->downtotal = $t['downloadedEver'];
         $sf->uptotal = $t['uploadedEver'];
         $sf->write();
     }
     //SHAREKILLS Checks
     foreach ($tfs as $hash => $t) {
         if (!isset($sharekills[$hash])) {
             continue;
         }
         if (($t['status'] == 8 || $t['status'] == 9) && $t['uploadRatio'] * 100 > $sharekills[$hash]) {
             $transfer = $hashes[$hash];
             if (stopTransmissionTransfer($hash)) {
                 AuditAction($cfg["constants"]["stop_transfer"], $this->client . "-stat. : sharekill stopped {$transfer}");
                 stopTransferSettings($transfer);
             }
         }
     }
     return true;
 }

 /**
  * Inject Transfer
  *
  * @param $transferFile
  * @param $username
  * @param $options
  * @param array $extra
  * @return mixed
  */
 function _inject($transferFile, $username, $options = '', $extra = array())
 {
     global $cfg;
     // check file
     if (!@is_file($transferFile)) {
         $this->_outputError("transfer-file " . $transferFile . " is no file.\n");
         return false;
     }
     // check username
     if (!IsUser($username)) {
         $this->_outputError("username " . $username . " is no valid user.\n");
         return false;
     }
     // parse options
     $optionsSet = $this->_parseOptions(array('d' => 0, 's' => 0, 'p' => 1), $options, $extra);
     if ($optionsSet === false) {
         return false;
     }
     $profile = isset($optionsSet['p']) ? $optionsSet['p'][0] : null;
     $this->_outputMessage("Inject " . $transferFile . " for user " . $username . (!empty($profile) ? " using profile " . $profile : '') . " ...\n");
     // set user
     $cfg["user"] = $username;
     // set filename
     $transfer = basename($transferFile);
     $transfer = tfb_cleanFileName($transfer);
     // only inject valid transfers
     $msgs = array();
     if ($transfer !== false) {
         $targetFile = $cfg["transfer_file_path"] . $transfer;
         if (@is_file($targetFile)) {
             array_push($msgs, "transfer " . $transfer . ", already exists.");
         } else {
             $this->_outputMessage("copy " . $transferFile . " to " . $targetFile . " ...\n");
             if (@copy($transferFile, $targetFile)) {
                 // chmod
                 @chmod($cfg["transfer_file_path"] . $transfer, 0644);
                 // make owner entry
                 AuditAction($cfg["constants"]["file_upload"], $transfer);
                 // inject
                 $this->_outputMessage("injecting " . $transfer . " ...\n");
                 injectTransfer($transfer);
                 // delete source-file
                 if (isset($optionsSet['d'])) {
                     $this->_outputMessage("deleting source-file " . $transferFile . " ...\n");
                     @unlink($transferFile);
                 }
                 // start
                 if (isset($optionsSet['s'])) {
                     // build args for _transferStart
                     $newOptions = $this->_buildOptions('p', $optionsSet);
                     // Pass-thru option 'p'.
                     return $this->_transferStart($transfer, $newOptions[0], $newOptions[1]);
                 } else {
                     return true;
                 }
             } else {
                 array_push($msgs, "File could not be copied: " . $transferFile);
             }
         }
     } else {
         array_push($msgs, "The type of file you are injecting is not allowed.");
         array_push($msgs, "valid file-extensions: ");
         array_push($msgs, $cfg["file_types_label"]);
     }
     if (count($msgs) == 0) {
         $this->_outputMessage("done.\n");
         return true;
     } else {
         $this->_outputError("failed: " . implode("\n", $msgs) . "\n");
         return false;
     }
 }

function indexProcessUpload()
{
    global $cfg, $messages;
    $file_name = stripslashes($_FILES['upload_file']['name']);
    $file_name = str_replace(array("'", ","), "", $file_name);
    $file_name = cleanFileName($file_name);
    $ext_msg = "";
    if ($_FILES['upload_file']['size'] <= 1000000 && $_FILES['upload_file']['size'] > 0) {
        if (ereg(getFileFilter($cfg["file_types_array"]), $file_name)) {
            //FILE IS BEING UPLOADED
            if (is_file($cfg["torrent_file_path"] . $file_name)) {
                // Error
                $messages .= "<b>Error</b> with (<b>" . $file_name . "</b>), the file already exists on the server.<br><center><a href=\"" . $_SERVER['PHP_SELF'] . "\">[Refresh]</a></center>";
                $ext_msg = "DUPLICATE :: ";
            } else {
                if (move_uploaded_file($_FILES['upload_file']['tmp_name'], $cfg["torrent_file_path"] . $file_name)) {
                    chmod($cfg["torrent_file_path"] . $file_name, 0644);
                    AuditAction($cfg["constants"]["file_upload"], $file_name);
                    // init stat-file
                    injectTorrent($file_name);
                    // instant action ?
                    $actionId = getRequestVar('aid');
                    if (isset($actionId)) {
                        switch ($actionId) {
                            case 3:
                                $_REQUEST['queue'] = 'on';
                            case 2:
                                if ($cfg["enable_file_priority"]) {
                                    include_once "setpriority.php";
                                    // Process setPriority Request.
                                    setPriority(urldecode($file_name));
                                }
                                include_once "ClientHandler.php";
                                $clientHandler = ClientHandler::getClientHandlerInstance($cfg);
                                $clientHandler->startTorrentClient($file_name, 0);
                                // just a sec..
                                sleep(1);
                                break;
                        }
                    }
                } else {
                    $messages .= "<font color=\"#ff0000\" size=3>ERROR: File not uploaded, file could not be found or could not be moved:<br>" . $cfg["torrent_file_path"] . $file_name . "</font><br>";
                }
            }
        } else {
            $messages .= "<font color=\"#ff0000\" size=3>ERROR: The type of file you are uploading is not allowed.</font><br>";
        }
    } else {
        $messages .= "<font color=\"#ff0000\" size=3>ERROR: File not uploaded, check file size limit.</font><br>";
    }
    if ($messages != "") {
        // there was an error
        AuditAction($cfg["constants"]["error"], $cfg["constants"]["file_upload"] . " :: " . $ext_msg . $file_name);
    } else {
        header("location: index.php");
        exit;
    }
}

/**
 * Modify Profile Information
 *
 * @param $pid
 * @param $newProfile
 */
function modProfileInfo($pid, $newProfile)
{
    global $cfg, $db;
    // b4rt: var not used, commented this out
    //	$default_savepath = " value=\"" . ($cfg["enable_home_dirs"] != 0)
    //		? $cfg['path'].$cfg["user"].'/'
    //		: $cfg['path'].$cfg["path_incoming"].'/' . "\"";
    // in case of homedirs, ensure profile doesnt go out of savepath.
    if ($cfg["enable_home_dirs"] != 0) {
        if (substr($newProfile["savepath"], 0, strlen($cfg['path'] . $cfg["user"])) != $cfg['path'] . $cfg["user"]) {
            AuditAction($cfg["constants"]["error"], "INVALID TRANSFER DIRECTORY.: ");
            @error("Invalid directory. You can only set transfer paths within your own directory.", "", "", array());
        }
    } else {
        if (substr($newProfile["savepath"], 0, strlen($cfg['path'])) != $cfg['path']) {
            AuditAction($cfg["constants"]["error"], "INVALID TRANSFER DIRECTORY.: ");
            @error("Invalid directory. You can only set transfer paths within the root directory " . $cfg['path'] . ".", "", "", array());
        }
    }
    $sql = "UPDATE tf_trprofiles SET" . " owner = " . $db->qstr($cfg['uid']) . ", name = " . $db->qstr($newProfile["name"]) . ", minport = " . $db->qstr($newProfile["minport"]) . ", maxport = " . $db->qstr($newProfile["maxport"]) . ", maxcons = " . $db->qstr($newProfile["maxcons"]) . ", rerequest = " . $db->qstr($newProfile["rerequest"]) . ", rate = " . $db->qstr($newProfile["rate"]) . ", maxuploads = " . $db->qstr($newProfile["maxuploads"]) . ", drate = " . $db->qstr($newProfile["drate"]) . ", runtime = " . $db->qstr($newProfile["runtime"]) . ", sharekill = " . $db->qstr($newProfile["sharekill"]) . ", superseeder = " . $db->qstr($newProfile["superseeder"]) . ", public = " . $db->qstr($newProfile["public"]) . ", savepath = " . $db->qstr($newProfile["savepath"]) . " WHERE id = " . $db->qstr($pid);
    $db->Execute($sql);
    if ($db->ErrorNo() != 0) {
        dbError($sql);
    }
}

    $tmpl->setvar('_REN_FILE', $cfg['_REN_FILE']);
    $tmpl->setvar('_REN_STRING', $cfg['_REN_STRING']);
} else {
    $file = tfb_getRequestVar('fileFrom');
    $fileTo = tfb_getRequestVar('fileTo');
    $dir = tfb_getRequestVar('dir');
    $sourceDir = $cfg["path"] . $dir;
    $targetDir = $cfg["path"] . $dir . $fileTo;
    // Add slashes if magic_quotes off:
    if (get_magic_quotes_gpc() !== 1) {
        $targetDir = addslashes($targetDir);
        $sourceDir = addslashes($sourceDir);
    }
    // only valid dirs + entries with permission
    if (!(tfb_isValidPath($sourceDir) && tfb_isValidPath($sourceDir . $file) && tfb_isValidPath($targetDir) && isValidEntry($file) && isValidEntry($fileTo) && hasPermission($dir, $cfg["user"], 'w'))) {
        AuditAction($cfg["constants"]["error"], "ILLEGAL RENAME: " . $cfg["user"] . " tried to rename " . $file . " in " . $dir . " to " . $fileTo);
        @error("Illegal rename. Action has been logged.", "", "");
    }
    // Use single quote to escape mv args:
    $cmd = "mv '" . $sourceDir . $file . "' '" . $targetDir . "'";
    $cmd .= ' 2>&1';
    $handle = popen($cmd, 'r');
    $gotError = -1;
    $buff = fgets($handle);
    $gotError = $gotError + 1;
    pclose($handle);
    // template
    $tmpl->setvar('is_start', 0);
    $tmpl->setvar('messages', nl2br($buff));
    if ($gotError <= 0) {
        $tmpl->setvar('no_error', 1);