1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
|
<?php
include 'config.php';
// Check if the user is logged in
if ((!isSet($_SESSION['loginname'])) || ($loggin <> '1'))
{
header("Location: login.php");
exit;
}
require("configure.php");
$index = $_POST["index"];
$companyid = $_POST["companyid"];
$parentid = $_POST["parentid"];
$levelnum = $_POST["levelnum"];
$folderid = $_POST["folderid"];
$title = htmlspecialchars($_POST["title"],ENT_QUOTES);
$nowdate = date("Y-m-d H:i:s");
//print_r($_POST);
//exit;
$sql = "select * from file_folder_permission Where folderid=:folderid AND roleid = (select roleid from file_role_user Where userid=:userid) AND p_write = '1'";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid));
if( $error = $sth->getError(array(":userid" => $_SESSION['loginid'], ":folderid" => $folderid)) ){
var_dump($error);
}
$permission_count = $sth->rowCount();
if ($_FILES['filename']['name'] == ''){
echo"<script language='javascript'>
alert('Please Upload File.');
history.back();
</script>";
exit;
} elseif ($permission_count <=0 && $_SESSION['role'] == 'User'){
echo"<script language='javascript'>
alert('You Do Not Have Permission To Upload.');
history.back();
</script>";
exit;
} else {
//New ID
$sql = "select max(fileid) as maxid from file_content";
$sth = Db::getDbh()->prepare($sql);
$sth->execute();
if( $error = $sth->getError() ){
var_dump($error);
}
$row = $sth->fetch(PDO::FETCH_ASSOC);
$fileid = $row{'maxid'}+1;
// Sort
$sql = "select max(sort) as maxid from file_content Where folderid=:folderid";
$sth = Db::getDbh()->prepare($sql);
$sth->execute(array(":folderid" => $folderid));
if( $error = $sth->getError(array(":folderid" => $folderid)) ){
var_dump($error);
}
$row = $sth->fetch(PDO::FETCH_ASSOC);
$sort = $row{'maxid'}+1;
// Upload File
$allowed_size = 10 * 1048576; //Filelimit in 10MB
if ($_FILES['filename']['name'] <> ''){
if(($_FILES['filename']['size']) <= $allowed_size) { // check the size of the file
$hash = hash('sha256', $fileid."_".$nowdate);
$file_ext = pathinfo($_FILES['filename']['name']);
move_uploaded_file ($_FILES['filename']['tmp_name'], "../file_manager/file/".$fileid.".".$file_ext['extension'])
or die ("Could not copy the file: Upload File");
$filename = $fileid.".".$file_ext['extension'];
$extension = $file_ext['extension'];
if ($title == ''){
$title = $file_ext['filename'];
}
} else {
// file is too large
?>
<script language="javascript">
alert("Files must be Under 10MB");
history.back();
</script>
<?php
exit;
}
} else {
$filename = "";
}
//Add File
$sql = "insert into file_content (fileid, companyid, folderid, refid, title, extension, filename, hash, filesize, sort, status, createby, createdate, lastupby, lastupdate, deleted) VALUES(:fileid, :companyid, :folderid, :refid, :title, :extension, :filename, :hash, :filesize, :sort, :status, :createby, :createdate, :lastupby, :lastupdate, :deleted)";
$sth = Db::getDbh()->prepare($sql);
$sql_param = array();
$sql_param[':fileid'] = $fileid;
$sql_param[':companyid'] = $companyid;
$sql_param[':folderid'] = $folderid;
$sql_param[':refid'] = '0';
$sql_param[':title'] = $title;
$sql_param[':extension'] = $extension;
$sql_param[':filename'] = $filename;
$sql_param[':hash'] = $hash;
$sql_param[':filesize'] = $_FILES['filename']['size'];
$sql_param[':sort'] = $sort;
$sql_param[':status'] = '1';
$sql_param[':createby'] = $_SESSION['loginid'];
$sql_param[':createdate'] = $nowdate;
$sql_param[':lastupby'] = $_SESSION['loginid'];
$sql_param[':lastupdate'] = $nowdate;
$sql_param[':deleted'] = '0';
$sth->execute($sql_param);
if( $error = $sth->getError($sql_param) ){
var_dump($error);
}
$dbh = null;
header("Location: index.php?index=$index&companyid=$companyid&pid=$parentid");
}
?>
|