view.php

一款文件上传程序

<?php
define ( 'NO_PERSISTENT', 0 );
define ( 'NO_AUTH_CHECK', 1 );
require_once 'includes/commons.inc.php';
$tpl_view = new Template ( TPL_DIR . 'tpl_view_image.php' );

$userid = isset ( $_GET['userid'] ) ? abs ( (int)$_GET['userid'] ) : 0;
$file = isset ( $_GET['file'] ) ? $_GET['file'] : '';
$folder = dir_name ( $file );
$fpath = $UPL['SETTINGS']['userfiles_dir'] . $userid . '/' . $file;
$furl = $UPL['SETTINGS']['userfiles_url'] . $userid . '/' . rawurlencode ( $file );

if(isset($_SERVER['REQUEST_URI']))
{
	$fname=basename(rawurldecode($_SERVER['REQUEST_URI']));
	if(strstr($fname,'../'))exit('Access Denied');
	$fpath="{$UPL['SETTINGS']['userfiles_dir']}/$userid/".dirname($file)."/$fname";
	$furl="{$UPL['SETTINGS']['userfiles_url']}/$userid/".dirname($file)."/".rawurlencode($fname);
	$file=$fname;
	clearstatcache();
}

if ( is_file ( $fpath ) )
{
	if ( !$mysqlDB->query ( "SELECT username,userid FROM uploader_users WHERE userid={$userid} LIMIT 1;" ) ) exit ( 'MYSQL error' );

	if ( $mysqlDB->getRowCount() )
	{
		$userinfo = $mysqlDB->getAssoc();
		$mysqlDB->free();

		$folder_info = get_folder_info ( dir_name ( $fpath ) );
		if ( $folder_info && $folder_info['is_public'] )
		{
			$userinfo['browse_url'] = MOD_REWRITE ? 'members/browse/' . $userinfo['userid'] . '/' . $folder : 'browse.php?action=browse&amp;userid=' . $userinfo['userid'] . ( $folder == '' ? '' : '&amp;folder='. path_encode ( $folder ) );
		}
		$tpl_view->set ( 'userinfo', $userinfo );
		$tpl_view->set ( 'fname', basename ( $file ) );
		$tpl_view->set ( 'furl', $furl );
		$tpl_view->display();
	}
}
else
{
	$tpl_message->set ( 'message', $lang_public['file_not_found'] );
	$tpl_uploader->set ( 'content', $tpl_message, 1 );
}
?>