file_is_forSale==0){ $uploadPath = VMPATH_ROOT.DS.$path_folder; } else { $uploadPath = $path_folder; } vmdebug('Entering vmUploader uploadFile '.$urlfolder.' => '.$uploadPath); $app = vmFactory::getApplication(); switch ($media['error']) { case 0: $isimage = null; if(self::checkUploadFile($uploadPath, $media, $overwrite, $isimage)) { $obj->file_mimetype = $media['type']; $obj->media_published = 1; $obj->file_name = $media['name']; $obj->is_image = $isimage; if(vmAccess::manager('core')){ VmInfo(vmText::sprintf('COM_VIRTUEMART_FILE_UPLOAD_OK',$uploadPath)); } else { VmInfo(vmText::sprintf('COM_VIRTUEMART_FILE_UPLOAD_OK',$media['name'])); } return $media['name']; } else { return false; } case 1: //uploaded file exceeds the upload_max_filesize directive in php.ini $app->enqueueMessage(vmText::sprintf('COM_VIRTUEMART_PRODUCT_FILES_ERR_UPLOAD_MAX_FILESIZE',$media['name'],$media['tmp_name']), 'warning'); break; case 2: //uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the html form $app->enqueueMessage(vmText::sprintf('COM_VIRTUEMART_PRODUCT_FILES_ERR_MAX_FILE_SIZE',$media['name'],$media['tmp_name']), 'warning'); break; case 3: //uploaded file was only partially uploaded $app->enqueueMessage(vmText::sprintf('COM_VIRTUEMART_PRODUCT_FILES_ERR_PARTIALLY',$media['name'],$media['tmp_name']), 'warning'); break; case 4: //no file was uploaded //$vmLogger->warning( "You have not selected a file/image for upload." ); break; default: //a default error, just in case! :) //$vmLogger->warning( "There was a problem with your upload." ); break; } return false; } static function checkUploadFile($uploadPath, &$media, $overwrite, &$isimage){ //Sadly it does not work to upload unicode files, // the � for example is stored on windows as ä, this seems to be a php issue (maybe a config setting) /* $dotPos = strrpos($media['name'],'.'); $safeMediaName = vmFile::makeSafe( $media['name'] ); if($dotPos!==FALSE){ $mediaPure = substr($media['name'],0,$dotPos); $mediaExtension = strtolower(substr($media['name'],$dotPos)); } */ vRequest::vmCheckToken(); $media['name'] = vmFile::makeSafe( $media['name'] ); $mediaPure = JFile::stripExt($media['name']); $mediaExtension = strtolower(JFile::getExt($media['name'])); if(empty($mediaExtension)){ vmError('Invalid media; no extension '.$media['name']); return false; } $media['name'] = $mediaPure.'.'.$mediaExtension; $trusted = false; if(VmMediaHandler::isImage(null, $mediaExtension)){ vmdebug('checkUploadFile, this is an image'); $isimage = 1; $checked = false; //Lets compar image type by different functions and real extension if(function_exists('exif_imagetype')) { $type = exif_imagetype($media['tmp_name']); vmdebug('Checking extension by filename against exif_imagetype '.$mediaExtension.' '.image_type_to_extension($type)); if( !self::checkMediaType($type,$mediaExtension) ) { vmError('Invalid media by exif_imagetype, image type does not fit to extension '.$media['name'].' recognised '.image_type_to_extension($type)); return false; } else { $checked = true; } } if(function_exists('getimagesize')) { $img = getimagesize($media['tmp_name']); vmdebug('Checking extension by filename against getimagesize '.$mediaExtension.' '.image_type_to_extension($img[2])); if( !self::checkMediaType($img[2],$mediaExtension) ) { vmError('Invalid media by getimagesize, image type does not fit to extension '.$media['name'].' recognised '.image_type_to_extension($img[2])); return false; } else { $checked = true; } } if(!$checked){ vmError('Please enable exif_imagetype or getimagesize in your php.ini, to check the image type for secure image upload'); } } else { if(VmConfig::get('media_trusteduploader',0)){ $trusted = vmAccess::manager('media.trusteduploader'); } $isimage = 0; //if(!vmAccess::manager('media.potdang')){ $m2ext = self::getMime2ExtArray(); $realMime = self::getMimeType($media['tmp_name']); vmdebug('Checking extension by filename against with getMimeType '.$mediaExtension.' '.$realMime); if(isset($m2ext[$realMime])){ $rExt = $m2ext[$realMime]; $hless = self::getSafeExt2MimeArray(); if(!isset($hless[$rExt])){ vmWarn('Invalid media mime, file type does not fit to mime '.$media['name']); if(!vmAccess::manager('media.potdang')){ vmError('You are not allowed to upload this file'); return false; } } else { vmdebug('Uploading file mime checked',$hless[$rExt]); } } else { vmWarn('Invalid file has no mime '.$media['name']); if(!vmAccess::manager('media.potdang')){ vmError('You are not allowed to upload this file'); return false; } } /*} else { vmdebug('Uploading file ',$media['name']); }*/ } if(!$overwrite){ $i = 0; while (file_exists($uploadPath.$mediaPure.'.'.$mediaExtension) and $i<20) { $mediaPure = $mediaPure.rand(1,9); $i++; } if($i>=20){ vmError('Could not upload file, would overwrite existing '.$media['name']); return false; } } $uploaded = JFile::upload($media['tmp_name'], $uploadPath.$media['name'], false, $trusted); if(!$uploaded){ return false; } return $media['name']; } static function checkMediaType($type,$ext){ if($type === IMAGETYPE_JPEG){ if($ext!='jpg' and $ext!='jpeg') return false; } else if($type){ if( '.'.$ext!=image_type_to_extension($type) ) return false; } else { return false; } return true; } static function getMimeType($p){ if (version_compare(PHP_VERSION, '5.3.0') < 0) return false; if (function_exists('mime_content_type')) { $mimeType = mime_content_type($p); vmdebug('getMimeType by mime_content_type',$mimeType); return $mimeType; } if (!function_exists('finfo_open')){ vmError('Please enable php_fileinfo.dll for more secure MIME-TYPE recognition, uploading file stopped','Could not recognise MIME, uploading stopped'); return false; } else { $finfo = new finfo(FILEINFO_MIME_TYPE); $mimeType = $finfo->file($p); vmdebug('getMimeType by finfo',$mimeType); return $mimeType; } } }