<?php

/**
 * Copyright (C) 2011-2016 Visman (mio.visman@yandex.ru)
 * License: http://www.gnu.org/licenses/gpl.html GPL version 2 or higher
 */

if (isset($_GET['delete'])) //????
	define('PUN_QUIET_VISIT', 1);

define('PUN_ROOT', dirname(__FILE__).'/');
require PUN_ROOT.'include/common.php';

if ($pun_user['g_read_board'] == '0')
	message($lang_common['No view'], false, '403 Forbidden');

if ($pun_user['is_guest'] || !isset($pun_user['g_up_ext']) || empty($pun_config['o_uploadile_other']))
	message($lang_common['Bad request'], false, '404 Not Found');

require PUN_ROOT.'include/upload.php';

define('PLUGIN_REF', pun_htmlspecialchars('upfiles.php'));
define('PLUGIN_NF', 25);

$request = $container->get('Request');

if (! $request->isGet('id'))
{
	$id = $pun_user['id'];

	define('PUN_HELP', 1);
	define('PLUGIN_URL', PLUGIN_REF);
	define('PLUGIN_URLD', PLUGIN_URL.'?');
	$page_title = array(pun_htmlspecialchars($pun_config['o_board_title']), $lang_up['popup_title']);
	$fpr = false;
	$extsup = $pun_user['g_up_ext'];
	$limit = $pun_user['g_up_limit'];
	$maxsize = $pun_user['g_up_max'];
	$upload = $pun_user['upload'];
}
else
{
	$id = $request->getInt('id', 0);
	if ($id < 2 || ($pun_user['g_id'] != PUN_ADMIN && $id != $pun_user['id']))
		message($lang_common['Bad request'], false, '404 Not Found');
		
	$result = $db->query('SELECT u.username, u.upload, g.g_up_ext, g.g_up_max, g.g_up_limit FROM '.$db->prefix.'users AS u INNER JOIN '.$db->prefix.'groups AS g ON u.group_id=g.g_id WHERE u.id='.$id) or error('Unable to fetch user information', __FILE__, __LINE__, $db->error());
	if (!$db->num_rows($result))
		message($lang_common['Bad request'], false, '404 Not Found');

	list($usname, $upload, $extsup, $maxsize, $limit) = $db->fetch_row($result);

	define('PLUGIN_URL', PLUGIN_REF.'?id='.$id);
	define('PLUGIN_URLD', PLUGIN_URL.'&amp;');
	$page_title = array(pun_htmlspecialchars($pun_config['o_board_title']), $lang_common['Profile'], $lang_up['popup_title']);
	$fpr = true;
}

if ($pun_user['g_id'] != PUN_ADMIN && $limit*$maxsize == 0)
	message($lang_common['Bad request'], false, '404 Not Found');

$prcent = ($limit == 0) ? 100 : ceil($upload*100/$limit);
$prcent = min(100, $prcent);

$dir = 'img/members/'.$id.'/';
$aconf = unserialize($pun_config['o_uploadile_other']);
$extsup = explode(',', $extsup.','.strtoupper($extsup));

// #############################################################################

// Удаление файлов
if ($request->isGet('delete'))
{
	confirm_referrer(PLUGIN_REF);

	$error = 0;

	if (is_dir(PUN_ROOT.$dir))
	{
		$file = parse_file(trim($request->getStr('delete')));
		$ext = strtolower(substr(strrchr($file, '.'), 1)); // берем расширение файла
		if ($file[0] != '.' && $ext != '' && !in_array($ext, $extforno) && is_file(PUN_ROOT.$dir.$file))
		{
			if (unlink(PUN_ROOT.$dir.$file))
			{
				if (is_file(PUN_ROOT.$dir.'mini_'.$file))
					unlink(PUN_ROOT.$dir.'mini_'.$file);
			}
			else
				$error++;
		}
		else
			$error++;

		// Считаем общий размер файлов юзера
		$upload = dir_size($dir);
		$db->query('UPDATE '.$db->prefix.'users SET upload='.$upload.' WHERE id='.$id) or error($lang_up['Error DB ins-up'], __FILE__, __LINE__, $db->error());
	}
	else
		$error++;

	if ($request->isGet('ajx'))
	{
		$db->end_transaction();
		$db->close();

		header('Content-type: text/html; charset=utf-8');
		
		if ($error)
			exit('not ok');

		exit('ok');
	}
	
	$s = $lang_up['Redirect delete'];
	if ($error)
	{
		$pun_config['o_redirect_delay'] = 5;
		$s = $lang_up['Error'].$lang_up['Error delete'];
	}
	redirect($request->getInt('p', 0) < 2 ? PLUGIN_URL : PLUGIN_URLD . 'p=' . $request->getInt('p', 0) . '#gofile', $s);
}

// Загрузка файла
else if (isset($_FILES['upfile']) && $id == $pun_user['id'])
{
	$pun_config['o_redirect_delay'] = 5;

	// Ошибка при загрузке
	if (!empty($_FILES['upfile']['error']))
	{
		switch($_FILES['upfile']['error'])
		{
			case 1: // UPLOAD_ERR_INI_SIZE
			case 2: // UPLOAD_ERR_FORM_SIZE
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Too large ini']);
				break;

			case 3: // UPLOAD_ERR_PARTIAL
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Partial upload']);
				break;

			case 4: // UPLOAD_ERR_NO_FILE
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['No file']);
				break;

			case 6: // UPLOAD_ERR_NO_TMP_DIR
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['No tmp directory']);
				break;

			default:
				// No error occured, but was something actually uploaded?
				if ($uploaded_file['size'] == 0)
					redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['No file']);
				break;
		}
	}

	if (is_uploaded_file($_FILES['upfile']['tmp_name']))
	{
		confirm_referrer(PLUGIN_REF);

		$f = pathinfo(parse_file($_FILES['upfile']['name']));
		if (empty($f['extension']))
			redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Bad type']);

		// Проверяем расширение
		$ext = strtolower($f['extension']);
		if (in_array($ext, $extforno) || !in_array($ext, $extsup))
			redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Bad type']);

		// Проверяется максимальный размер файла
		if ($_FILES['upfile']['size'] > $maxsize)
			redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Too large'].' '.pun_htmlspecialchars(file_size($maxsize)).'.');

		// Проверяем допустимое пространство
		if ($_FILES['upfile']['size'] + $upload > $limit)
			redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Error space']);

		// Проверяем картинку (флэш) на правильность
		$isimg2 = (in_array($ext, $extimage));
		$size = @getimagesize($_FILES['upfile']['tmp_name']);
		if (($size === false && $isimg2) || ($size !== false && !$isimg2))
			redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Error img']);
		if ($isimg2)
		{
			$isimge = false;
		
			if (empty($size[0]) || empty($size[1]) || empty($size[2]))
				$isimge = true;
			else if (!isset($extimage2[$size[2]]) || !in_array($ext, $extimage2[$size[2]]))
				$isimge = true;
			if ($isimge)
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Error img']);
		}

		// обрабатываем имя
		$name = str_replace('.', '_', $f['filename']);
		if (substr($name, 0, 5) == 'mini_')
			$name = substr($name, 5);
		if ($name == '')
			$name = 'none';
		if (strlen($name) > 100)
			$name = substr($name, 0, 100);
		if (is_file(PUN_ROOT.$dir.$name.'.'.$ext) || is_file(PUN_ROOT.$dir.$name.'.jpeg')) // если уже есть, переименуем
			$name = $name.'_'.parse_file(date('Ymd\-Hi', time()));

		if (!is_dir(PUN_ROOT.'img/members/'))
			mkdir(PUN_ROOT.'img/members', 0755);
		if (!is_dir(PUN_ROOT.$dir))
			mkdir(PUN_ROOT.'img/members/'.$id, 0755);

		if ($_FILES['upfile']['size'] > $aconf['pic_mass'] && $isimg2 && $gd && array_key_exists($ext,$extimageGD))
		{
			$ext_ml = img_resize($_FILES['upfile']['tmp_name'], $dir, $name, $ext, $aconf['pic_w'], $aconf['pic_h'], $aconf['pic_perc'], true);
			if ($ext_ml === false)
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Error no mod img']);

			list($name, $ext) = $ext_ml;
		}
		else
		{
			$error = isXSSattack($_FILES['upfile']['tmp_name']);
			if ($error !== false)
				redirect(PLUGIN_URL, $lang_up['Error'].$error);

			if (!@move_uploaded_file($_FILES['upfile']['tmp_name'], PUN_ROOT.$dir.$name.'.'.$ext))
				redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Move failed']);
			@chmod(PUN_ROOT.$dir.$name.'.'.$ext, 0644);
		}

		// Создание привьюшки (только для поддерживаемых GD форматов)
		if ($aconf['thumb'] == 1 && $isimg2 && $gd && array_key_exists($ext,$extimageGD))
			img_resize(PUN_ROOT.$dir.$name.'.'.$ext, $dir, 'mini_'.$name, $ext, 0, $aconf['thumb_size'], $aconf['thumb_perc']);

		// Считаем общий размер файлов юзера
		$upload = dir_size($dir);
		$db->query('UPDATE '.$db->prefix.'users SET upload=\''.$upload.'\' WHERE id='.$id) or error($lang_up['Error DB ins-up'], __FILE__, __LINE__, $db->error());

		$pun_config['o_redirect_delay'] = '1';
		redirect(PLUGIN_URL, $lang_up['Redirect upload']);
	}
	else
		redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Unknown failure']);
}

// Unknown failure
else if (!empty($_POST)) //????
	redirect(PLUGIN_URL, $lang_up['Error'].$lang_up['Unknown failure']);

// #############################################################################

if (!isset($page_head))
	$page_head = array();

if (file_exists(PUN_ROOT.'style/'.$pun_user['style'].'/upfiles.css'))
	$page_head['pmsnewstyle'] = '<link rel="stylesheet" type="text/css" href="style/'.$pun_user['style'].'/upfiles.css" />';
else
	$page_head['pmsnewstyle'] = '<link rel="stylesheet" type="text/css" href="style/imports/upfiles.css" />';

define('PUN_ACTIVE_PAGE', 'profile');
require PUN_ROOT.'header.php';
$tpl_main = str_replace('id="punhelp"', 'id="punupfiles"', $tpl_main);

$tabi = 0;

$vcsrf = (function_exists('csrf_hash')) ? csrf_hash() : '1';

if ($fpr)
{
	// Load the profile.php language file
	require PUN_ROOT.'lang/'.$pun_user['language'].'/profile.php';

	generate_profile_menu('upload');
}

if ($id == $pun_user['id'])
{

?>
	<div class="blockform">
		<h2><span><?php echo $lang_up['titre_2'] ?></span></h2>
		<div class="box">
			<form method="post" action="<?php echo PLUGIN_URL ?>" enctype="multipart/form-data">
				<input type="hidden" name="csrf_hash" value="<?php echo $vcsrf ?>" />
				<input type="hidden" name="MAX_FILE_SIZE" value="<?php echo $maxsize; ?>" />
				<div class="inform">
					<fieldset>
						<legend><?php echo $lang_up['legend'] ?></legend>
						<div class="infldset">
							<p><?php echo $lang_up['fichier'] ?></p>
							<input type="file" id="upfile" name="upfile" tabindex="<?php echo $tabi++ ?>" />
							<p><?php	printf($lang_up['info_2'], pun_htmlspecialchars(file_size($maxsize)), pun_htmlspecialchars(str_replace(',', ', ', $pun_user['g_up_ext']))) ?></p>
						</div>
					</fieldset>
				</div>
				<p class="buttons"><input type="submit" name="submit" value="<?php echo $lang_up['Upload'] ?>" tabindex="<?php echo $tabi++ ?>" /></p>
			</form>
		</div>
	</div>
<?php

	$tit = $lang_up['titre_4'];
}
else
{
	$tit = pun_htmlspecialchars($usname).' - '.$lang_up['upfiles'];
}

$files = $filesvar = array();
if (is_dir(PUN_ROOT.$dir))
{
	$open = opendir(PUN_ROOT.$dir);
	while (($file = readdir($open)) !== false)
	{
		if (is_file(PUN_ROOT.$dir.$file))
		{
			$ext = strtolower(substr(strrchr($file, '.'), 1));
			if (!in_array($ext, $extforno) && $file[0] != '#' && substr($file, 0, 5) != 'mini_')
			{
				$time = filemtime(PUN_ROOT.$dir.$file).$file;
				$filesvar[$time] = $dir.$file;
			}
		}
	}
	closedir($open);
	if (!empty($filesvar))
	{
		$num_pages = ceil(sizeof($filesvar) / PLUGIN_NF);
		$p = max($request->getInt('p', 1), 1);
		if ($p > $num_pages)
		{
			header('Location: '.str_replace('&amp;', '&', PLUGIN_URLD).'p='.$num_pages.'#gofile');
			exit;
		}

		$start_from = PLUGIN_NF * ($p - 1);

		// Generate paging links
		$paging_links = '<span class="pages-label">'.$lang_common['Pages'].' </span>'.paginate($num_pages, $p, PLUGIN_URL);
		$paging_links = str_replace(PLUGIN_REF.'&amp;', PLUGIN_REF.'?', $paging_links);
		$paging_links = preg_replace('%href="([^">]+)"%', 'href="$1#gofile"', $paging_links);

		krsort($filesvar);
		$files = array_slice($filesvar, $start_from, PLUGIN_NF);
		unset($filesvar);
	}
}

?>
	<div id="upf-block" class="block">
		<h2 id="gofile" class="block2"><span><?php echo $tit ?></span></h2>
		<div class="box">
<?php

if (empty($files))
{
	echo "\t\t\t".'<div class="inbox"><p><span>'.$lang_up['No upfiles'].'</span></p></div>'."\n";
}
else
{

?>
			<div class="inbox">
				<div id="upf-legend">
					<div style="<?php echo 'background-color: rgb('.ceil(($prcent > 50 ? 50 : $prcent)*255/50).', '.ceil(($prcent < 50 ? 50 : 100 - $prcent)*255/50).', 0); width:'.$prcent.'%;' ?>"><?php echo $prcent.'%' ?></div>
				</div>
				<p id="upf-legend-p"><?php echo sprintf($lang_up['info_4'], pun_htmlspecialchars(file_size($upload)),pun_htmlspecialchars(file_size($limit))) ?></p>
			</div>
			<div class="inbox">
				<div class="pagepost">
					<p class="pagelink conl"><?php echo $paging_links ?></p>
				</div>
			</div>
			<div class="inbox">
				<div id="upf-container">
					<ul id="upf-list">
<?php

	$height = max(intval($aconf['thumb_size']), 100);
	$regx = '%^img/members/'.$id.'/(.+)\.([0-9a-zA-Z]+)$%i';
	foreach($files as $file)
	{
		preg_match($regx, $file, $fi);
		if (!isset($fi[1]) || !isset($fi[2]) || in_array(strtolower($fi[2]), $extforno))
			continue;

		$fb = in_array(strtolower($fi[2]), array('jpg', 'jpeg', 'gif', 'png', 'bmp')) ? '" class="fancy_zoom" rel="vi001' : '';
		$size_file = file_size(filesize(PUN_ROOT.$file));
		$f = $fi[1].'.'.$fi[2];
		$m = 'mini_'.$f;
		$mini = $dir.$m;
		$fmini = (is_file(PUN_ROOT.$mini));

?>
						<li>
							<div class="upf-name" title="<?php echo pun_htmlspecialchars($f) ?>"><span><?php echo pun_htmlspecialchars(mb_strlen($f) > 20 ? mb_substr($f, 0, 18).'…' : $f) ?></span></div>
							<div class="upf-file" style="height:<?php echo $height ?>px;">
								<a href="<?php echo pun_htmlspecialchars(get_base_url(true).'/'.$file).$fb ?>">
<?php if ($fmini || $fb): ?>									<img src="<?php echo pun_htmlspecialchars($fmini ? get_base_url(true).'/'.$mini : get_base_url(true).'/'.$file) ?>" alt="<?php echo pun_htmlspecialchars((mb_strlen($fi[1]) > 15 ? mb_substr($fi[1], 0, 10).'… ' : $fi[1]).'.'.$fi[2]) ?>" />
<?php else: ?>									<span><?php echo pun_htmlspecialchars((mb_strlen($fi[1]) > 15 ? mb_substr($fi[1], 0, 10).'… ' : $fi[1]).'.'.$fi[2]) ?></span>
<?php endif; ?>
								</a>
							</div>
							<div class="upf-size"><span><?php echo pun_htmlspecialchars($size_file) ?></span></div>
							<div class="upf-but upf-delete"><a title="<?php echo $lang_up['delete'] ?>" href="<?php echo PLUGIN_URLD.'csrf_hash='.$vcsrf.($request->getInt('p', 0) < 2 ? '' : '&amp;p='.$request->getInt('p', 0)).'&amp;delete='.$f ?>" onclick="return FluxBB.upfile.del(this);"><span></span></a></div>
						</li>
<?php

	} // end foreach

?>
					</ul>
				</div>
			</div>
			<div class="inbox">
				<div class="pagepost">
					<p class="pagelink conl"><?php echo $paging_links ?></p>
				</div>
			</div>
<?php

} // end if

?>
		</div>
	</div>
<?php

if ($fpr)
	echo "\t".'<div class="clearer"></div>'."\n".'</div>'."\n";

?>
<script type="text/javascript">
/* <![CDATA[ */
if (typeof FluxBB === 'undefined' || !FluxBB) {var FluxBB = {};}

FluxBB.upfile = (function (doc, win) {
	'use strict';

	var url, src, par, area;

	function get(elem) {
		return doc.getElementById(elem);
	}

	function createElement(elem) {
		return (doc.createElementNS) ? doc.createElementNS('http://www.w3.org/1999/xhtml', elem) : doc.createElement(elem);
	}
	
	function is_img(a) {
		return /.+\.(jpg|jpeg|png|gif|bmp)$/.test(a);
	}

	function get_us(li) {
		url = '';
		src = '';
		var div = li.getElementsByTagName('div')[1];
		if (!!div) {
			var a = div.getElementsByTagName('a')[0];
			if (!!a) {
				url = a.href;
				var	img = a.getElementsByTagName('img')[0];
				if (!!img) src = img.src;
			}
		}
	}

	function set_button(li) {
		get_us(li);
		
		if (!!url) {
			var div = createElement('div');
			div.className = 'upf-but upf-insert';
			div.innerHTML = '<a title="<?php echo $lang_up['insert'] ?>" href="#" onclick="return FluxBB.upfile.ins(this);"><span></span></a>';
			li.appendChild(div);

			if (is_img(src) && src != url) {
				div = createElement('div');
				div.className = 'upf-but upf-insert-t';
				div.innerHTML = '<a title="<?php echo $lang_up['insert_thumb'] ?>" href="#" onclick="return FluxBB.upfile.ins(this, 1);"><span></span></a>';
				li.appendChild(div);
			}
		}
	}

	function insr(s, e, t)
	{
		area.focus();
		if ('selectionStart' in area) { // all new
			var len = area.value.length,
				sp = Math.min(area.selectionStart, len), // IE bug
				ep = Math.min(area.selectionEnd, len); // IE bug
			area.value = area.value.substring(0, sp) + s + (sp == ep ? t : area.value.substring(sp, ep)) + e + area.value.substring(ep);
			area.selectionStart = ep + e.length + s.length + (sp == ep ? t.length : 0);
			area.selectionEnd = area.selectionStart;
		} else if (par.selection && par.selection.createRange) { // IE
			var sel = par.selection.createRange();
			sel.text = s + (!sel.text ? t : sel.text) + e;
			sel.select();
		}
		win.focus();
	}
	
	function cr_req() {
		if (win.XMLHttpRequest) {
			return new XMLHttpRequest();
		} else {
			try {
				return new ActiveXObject('Microsoft.XMLHTTP');
			} catch (e){}
		}
		return !1;
	}
	
	function orsc(req, ref) {
		if (req.readyState == 4)
		{
			ref.className = '';
			
			if (req.status == 200 && req.responseText == 'ok') {
				ref.parentNode.parentNode.parentNode.removeChild(ref.parentNode.parentNode);
				if (get('upf-list').getElementsByTagName('li').length == 0) {
					win.location.reload(true);
				}
			}
		}
	}

	return {

		del : function (ref) {
			if (ref.className) return !1;
			ref.className = 'upf-loading';
			
			var req = cr_req();
			if (req) {
				req.onreadystatechange=function(){orsc(req, ref);};
				req.open('GET', ref.href + '&ajx=1', true);
				req.send();

				return !1;
			} else
				return !0;
		},

		ins : function (ref, f) {

			f = f || !1;
			get_us(ref.parentNode.parentNode);

			if (f && is_img(src) && src != url) {
				insr('', '[url=' + url + '][img]' + src + '[/img][/url]', '');
			} else if (is_img(url)) {
				insr('', '[img]' + url + '[/img]', '');
			} else {
				if (f = url.match(/.*\/img\/members\/\d+\/(.+)$/)) f = f[1];
				else f = '<?php echo $lang_up['texte'] ?>';

				insr('[url=' + url + ']', '[/url]', f);
			}
			return !1;
		},

		run : function () {
			if (!win.opener) return;

			par = win.opener.document;
			area = par.getElementsByName('req_message')[0];
			if (!area) return;

			var li = get('upf-list').getElementsByTagName('li');
			for (var i in li) {
				if (!!li[i].getElementsByTagName) set_button(li[i]);
			}
		},

		init : function () {
			if (!doc.addEventListener) {
				/in/.test(doc.readyState) ? setTimeout(FluxBB.upfile.init, 100) : FluxBB.upfile.run();
			} else doc.addEventListener('DOMContentLoaded', FluxBB.upfile.run(), false);
		}
	};
}(document, window));

FluxBB.upfile.init();
/* ]]> */
</script>
<?php

require PUN_ROOT.'footer.php';
