forbird creation or deletion of item; forbids adding or deleting an image

[syp.git] / api.php

diff --git a/api.php b/api.php
index 93f27bde6bd5e658a5a0a7af32c297754abe76f0..76eef437929e267d71adb56e78fccf1191a0e2c7 100644 (file)
--- a/api.php
+++ b/api.php
@@ -20,7 +20,7 @@ function success_feature ($feature, $request) {
 
     $res .= "<imgurl>" .
              ($feature->imgpath ? 
-                    full_url_from_filename ($feature->imgpath)
+                    full_url_from_imgpath ($feature->imgpath)
                     : "") .
              "</imgurl>";
 
@@ -99,7 +99,7 @@ function save_uploaded_file ($file, $con) {
             server_error ();
         }
     }
-    return basename($dest);
+    return basename_safe ($dest);
 }
 
 function img_check_upload ($file) {
@@ -116,6 +116,9 @@ function img_check_upload ($file) {
 }
 
 function delete_image_if_unused ($imgpath, $con) {
+    if (!isset ($imgpath) || (strlen ($imgpath) == 0)) {
+        return;
+    }
     if ($con->imgpath_exists ($imgpath)) {
         return false;
     }
@@ -145,7 +148,7 @@ function unique_file ($dirname, $relpath, $con) {
 
    while ($counter < 1000) {
        if (!file_exists ($filename) && 
-           !($con->imgpath_exists (basename ($filename)))) {
+           !($con->imgpath_exists (basename_safe ($filename)))) {
            return $filename;
        } else {
             $counter++;
@@ -192,6 +195,7 @@ function main ($con) {
             if ($_POST ["keep_img"] == "yes") {
                 $imgpath = $feature->imgpath;
             } else {
+                request_error ();
                 $imgpath = save_uploaded_file ($_FILES ["image_file"], $con);
             }
 
@@ -201,7 +205,7 @@ function main ($con) {
             $description = unquote ($_POST ["description"]);
 
             try {
-                $new_feature = new feature ($id, $lon, $lat, $imgpath, $title, $description);
+                $new_feature = new feature ($id, $lon, $lat, $imgpath, $title, $description, 0);
             } catch (Exception $e) {
                 request_error ();
             }
@@ -232,6 +236,7 @@ function main ($con) {
             success_feature ($new_feature, "update");
         break;
         case "add":
+            request_error ();
             $imgpath = save_uploaded_file ($_FILES ["image_file"], $con);
 
             $lon = $_POST ["lon"];
@@ -239,7 +244,7 @@ function main ($con) {
             $title = unquote ($_POST ["title"]);
             $description = unquote ($_POST ["description"]);
             try {
-                $feature = new feature (null, $lon, $lat, $imgpath, $title, $description);
+                $feature = new feature (null, $lon, $lat, $imgpath, $title, $description, 0);
             } catch (Exception $e) {
                 request_error ();
             }
@@ -251,6 +256,7 @@ function main ($con) {
             success_feature ($feature, "add");
         break;
         case "del":
+            request_error ();
             $id = $_POST ["fid"];
             $feature = $con->getfeature ($id);
             if (!isset ($feature)) {