PHP Safe::is_uploaded_file方法代码示例

    Safe::header('Status: 401 Unauthorized', TRUE, 401);
    Logger::error(i18n::s('You are not allowed to perform this operation.'));
    // process uploaded data
} elseif (isset($_SERVER['REQUEST_METHOD']) && $_SERVER['REQUEST_METHOD'] == 'POST') {
    // nothing has been uploaded
    if (!$_FILES['upload']['name'] || $_FILES['upload']['name'] == 'none') {
        Logger::error(i18n::s('Nothing has been received.'));
    } else {
        // access the temporary uploaded file
        $id = $_FILES['upload']['tmp_name'];
        $name = $_FILES['upload']['name'];
        // zero bytes transmitted
        $_REQUEST['file_size'] = $_FILES['upload']['size'];
        if (!$_FILES['upload']['size']) {
            Logger::error(i18n::s('Nothing has been received.'));
        } elseif (!Safe::is_uploaded_file($id)) {
            Logger::error(i18n::s('Possible file attack.'));
        }
    }
    // look in archives available locally
} else {
    if (isset($_REQUEST['id'])) {
        $id = $_REQUEST['id'];
    } elseif (isset($context['arguments'][0])) {
        $id = $context['arguments'][0];
    }
    // fight against hackers
    $id = preg_replace(FORBIDDEN_IN_PATHS, '', strip_tags($id));
    $name = basename($id);
    // scope is limited to the inbox
    if ($id) {

             $enclosure = '"';
             break;
         case 'single':
             $enclosure = "'";
             break;
     }
 }
 // no table name has been provided
 if (!$_REQUEST['table_name']) {
     $context['text'] .= '<p>' . i18n::s('No table name has been provided.') . "</p>\n";
 } elseif (!$_FILES['upload']['name'] || $_FILES['upload']['name'] == 'none') {
     $context['text'] .= '<p>' . i18n::s('Nothing has been received.') . "</p>\n";
 } elseif (!$_FILES['upload']['size']) {
     $context['text'] .= '<p>' . i18n::s('Nothing has been received.') . "</p>\n";
     // check provided upload name
 } elseif (!Safe::is_uploaded_file($_FILES['upload']['tmp_name'])) {
     $context['text'] .= '<p>' . i18n::s('Possible file attack.') . "</p>\n";
 } elseif (!($handle = Safe::fopen($_FILES['upload']['tmp_name'], 'rb'))) {
     $context['text'] .= '<p>' . sprintf(i18n::s('Impossible to read %s.'), $_FILES['upload']['tmp_name']) . "</p>\n";
 } elseif (!($tokens = fgetcsv($handle, 2048, $delimiter, $enclosure))) {
     $context['text'] .= '<p>' . sprintf(i18n::s('No headers to read from %s.'), $_FILES['upload']['name']) . "</p>\n";
 } else {
     // importing data
     $context['text'] .= '<p>' . sprintf(i18n::s('Importing data into %s from %s...'), $_REQUEST['table_name'], $_FILES['upload']['name']) . "</p>\n";
     // ensure enough execution time
     Safe::set_time_limit(30);
     // drop the table, if it already exists
     $query = "DROP TABLE IF EXISTS " . SQL::escape($_REQUEST['table_name']);
     SQL::query($query);
     // create a table
     $query = "CREATE TABLE " . SQL::escape($_REQUEST['table_name']) . " (\n";

 /**
  * process uploaded file
  *
  * This function processes files from the temporary directory, and put them at their definitive
  * place.
  *
  * It returns FALSE if there is a disk error, or if some virus has been detected, or if
  * the operation fails for some other reason (e.g., file size).
  *
  * @param array usually, $_FILES['upload']
  * @param string target location for the file
  * @param mixed reference to the target anchor, of a function to parse every file individually
  * @return mixed file name or array of file names or FALSE if an error has occured
  */
 public static function upload($input, $file_path, $target = NULL, $overlay = NULL)
 {
     global $context, $_REQUEST;
     // size exceeds php.ini settings -- UPLOAD_ERR_INI_SIZE
     if (isset($input['error']) && $input['error'] == 1) {
         Logger::error(i18n::s('The size of this file is over limit.'));
     } elseif (isset($input['error']) && $input['error'] == 2) {
         Logger::error(i18n::s('The size of this file is over limit.'));
     } elseif (isset($input['error']) && $input['error'] == 3) {
         Logger::error(i18n::s('No file has been transmitted.'));
     } elseif (isset($input['error']) && $input['error'] == 4) {
         Logger::error(i18n::s('No file has been transmitted.'));
     } elseif (!$input['size']) {
         Logger::error(i18n::s('No file has been transmitted.'));
     }
     // do we have a file?
     if (!isset($input['name']) || !$input['name'] || $input['name'] == 'none') {
         return FALSE;
     }
     // access the temporary uploaded file
     $file_upload = $input['tmp_name'];
     // $_FILES transcoding to utf8 is not automatic
     $input['name'] = utf8::encode($input['name']);
     // enhance file name
     $file_name = $input['name'];
     $file_extension = '';
     $position = strrpos($input['name'], '.');
     if ($position !== FALSE) {
         $file_name = substr($input['name'], 0, $position);
         $file_extension = strtolower(substr($input['name'], $position + 1));
     }
     $input['name'] = $file_name;
     if ($file_extension) {
         $input['name'] .= '.' . $file_extension;
     }
     // ensure we have a file name
     $file_name = utf8::to_ascii($input['name']);
     // uploads are not allowed
     if (!Surfer::may_upload()) {
         Logger::error(i18n::s('You are not allowed to perform this operation.'));
     } elseif (!Files::is_authorized($input['name'])) {
         Logger::error(i18n::s('This type of file is not allowed.'));
     } elseif ($file_path && !Safe::is_uploaded_file($file_upload)) {
         Logger::error(i18n::s('Possible file attack.'));
     } else {
         // create folders
         if ($file_path) {
             Safe::make_path($file_path);
         }
         // sanity check
         if ($file_path && $file_path[strlen($file_path) - 1] != '/') {
             $file_path .= '/';
         }
         // move the uploaded file
         if ($file_path && !Safe::move_uploaded_file($file_upload, $context['path_to_root'] . $file_path . $file_name)) {
             Logger::error(sprintf(i18n::s('Impossible to move the upload file to %s.'), $file_path . $file_name));
         } else {
             // process the file where it is
             if (!$file_path) {
                 $file_path = str_replace($context['path_to_root'], '', dirname($file_upload));
                 $file_name = basename($file_upload);
             }
             // check against viruses
             $result = Files::has_virus($context['path_to_root'] . $file_path . '/' . $file_name);
             // no virus has been found in this file
             if ($result == 'N') {
                 $context['text'] .= Skin::build_block(i18n::s('No virus has been found.'), 'note');
             }
             // this file has been infected!
             if ($result == 'Y') {
                 // delete this file immediately
                 Safe::unlink($file_path . '/' . $file_name);
                 Logger::error(i18n::s('This file has been infected by a virus and has been rejected!'));
                 return FALSE;
             }
             // explode a .zip file
             include_once $context['path_to_root'] . 'shared/zipfile.php';
             if (preg_match('/\\.zip$/i', $file_name) && isset($_REQUEST['explode_files'])) {
                 $zipfile = new zipfile();
                 // check files extracted from the archive file
                 function explode_callback($name)
                 {
                     global $context;
                     // reject all files put in sub-folders
                     if (($path = substr($name, strlen($context['uploaded_path'] . '/'))) && strpos($path, '/') !== FALSE) {
                         Safe::unlink($name);
//.........这里部分代码省略.........