$res .= "<imgurl>" .
($feature->imgpath ?
- full_url_from_imgpath ($feature->imgpath)
+ image_url_from_imgpath ($feature->imgpath)
: "") .
"</imgurl>";
(!move_uploaded_file ($file ["tmp_name"], $dest))) {
server_error ();
}
+ $mini_dest = getthumbsdir () . "/mini_" . basename_safe ($dest);
+
+ if (!create_thumbnail_or_copy ($dest, $mini_dest)) {
+ server_error ();
+ }
}
- return basename($dest);
+ return basename_safe ($dest);
}
function img_check_upload ($file) {
}
function delete_image_if_unused ($imgpath, $con) {
+ if (!isset ($imgpath) || (strlen ($imgpath) == 0)) {
+ return;
+ }
if ($con->imgpath_exists ($imgpath)) {
- return false;
+ return;
}
+
$path = UPLOADDIR . "/" . $imgpath;
- if (file_exists($path)) {
+ if (file_exists ($path)) {
unlink ($path);
- return true;
- } else {
- return false;
+ }
+
+ $thumb_path = getthumbsdir () . "/mini_" . $imgpath;
+ if (file_exists ($thumb_path)) {
+ unlink ($thumb_path);
}
}
while ($counter < 1000) {
if (!file_exists ($filename) &&
- !($con->imgpath_exists (basename ($filename)))) {
+ !($con->imgpath_exists (basename_safe ($filename)))) {
return $filename;
} else {
$counter++;
return null;
}
-function main ($con) {
- if (!isset ($_POST ["request"])) {
- request_error ();
- }
- if ($_POST ["request"] == "auth") {
- $pwd = unquote ($_POST["password"]);
- $user = "admin";
+function check_auth ($con, $pwd, $cookie_name, $auth_only) {
+ $authentificated = false;
+ $user = "admin";
+
+ if ($pwd) {
if ($con->checkpwdmd5 ($user, md5 ($pwd))) {
// cookie will be valid for 2 weeks. I've chosen that value
// arbitrarily, and it may change in the future.
$time = time () + 14 * 60 * 24 * 60;
- $cookie_name = sprintf ("%sauth", DBPREFIX);
setcookie ($cookie_name, md5 ($pwd), $time, "" , "", false, true);
- success_auth ();
+ $authentificated = true;
+ if ($auth_only) {
+ success_auth ();
+ }
} else {
unauthorized_error ();
}
}
- if (!($con->checkpwdmd5 ("admin",
- $_COOKIE [sprintf ("%sauth", DBPREFIX)]))) {
+
+ if (!$authentificated && !($con->checkpwdmd5 ($user,
+ $_COOKIE [$cookie_name]))) {
unauthorized_error ();
}
+}
+
+function main ($con) {
+ if (!isset ($_POST ["request"])) {
+ request_error ();
+ }
+
+ $pwd = unquote ($_POST["password"]);
+ $cookie_name = sprintf ("%sauth", DBPREFIX);
+ // does user only want authentication or does he want to do other things
+ $auth_only = ($_POST ["request"] == "auth");
+ check_auth ($con, $pwd, $cookie_name, $auth_only);
switch ($_POST ["request"]) {
case "update":
if ($_POST ["keep_img"] == "yes") {
$imgpath = $feature->imgpath;
} else {
+ request_error ();
$imgpath = save_uploaded_file ($_FILES ["image_file"], $con);
}
success_feature ($new_feature, "update");
break;
case "add":
+ request_error ();
$imgpath = save_uploaded_file ($_FILES ["image_file"], $con);
$lon = $_POST ["lon"];
success_feature ($feature, "add");
break;
case "del":
+ request_error ();
$id = $_POST ["fid"];
$feature = $con->getfeature ($id);
if (!isset ($feature)) {