file.php

一款文件上传程序

<?php
header('Cache-control: max-age=2592000');
header('Expires: '.gmdate('D, d M Y H:i:s \G\M\T',time()+2592000));
$chunk=20480; // bytes
@set_time_limit(0);
@ignore_user_abort(true);
@set_magic_quotes_runtime(0);
require'includes/db.class.php';
require'includes/functions_mime.inc.php';
require'includes/mysql.class.php';
require'includes/configs.inc.php';
extract($UPL['MYSQL'],EXTR_OVERWRITE);
$M=new mysqlDB($host,$username,$password,$database,0);
function out($f){header('Content-type: image/gif');@readfile($f);exit;}
$DB=new DB;if($DB->open('data/settings/upl_settings.php'))$UFD=$DB->get('userfiles_dir');else exit("Couldn't open ".UPLOADER_SETTINGS);$DB->close();
$userid=@$_GET['userid']?(int)$_GET['userid']:exit('No userid.');
$FILE=@$_GET['file']?$_GET['file']:exit('No file.');
$ACT=@$_GET['action'];
if(get_magic_quotes_gpc()){$FILE=stripslashes($FILE);}
if(strstr($FILE,'../'))exit('Access Denied');
$PATH="$UFD/$userid/$FILE";

if(isset($_SERVER['REQUEST_URI'])&&$ACT!='download')
{
	$fname=basename(rawurldecode($_SERVER['REQUEST_URI']));
	if(strstr($fname,'../'))exit('Access Denied');
	$PATH="$UFD/$userid/".dirname($FILE)."/$fname";
	$FILE=$fname;
	clearstatcache();
}
if(is_file($PATH))
{
	$size=filesize($PATH);
	if(!$M->query(sprintf("SELECT bw_reset_last,bw_reset_period,bw_reset_auto,bw_used,bw_max,bw_xfer_rate FROM uploader_users WHERE userid=%d LIMIT 1;", $userid)))exit($M->error());
	if($M->getRowCount())
	{
		$uinfo=$M->getAssoc();
		$M->free();
		$bw_used=$uinfo['bw_used'];
		$bw_max=$uinfo['bw_max']*1024;
		if($bw_max!=0&&$bw_used>$bw_max)
		{
			if($uinfo['bw_reset_auto'])
			{
				$lstrst=(time()-$uinfo['bw_reset_last'])/86400; // days
				if($lstrst>=$uinfo['bw_reset_period'])
				{
					$M->query(sprintf("UPDATE uploader_users SET bw_reset_last='%s', bw_used=0 WHERE userid=%d;",time(),$userid));
					$bw_used=0;
				}
				else out('data/bandwidth_exceeded.gif');
			}else out('data/bandwidth_exceeded.gif');
		}
		# Send & update
		header('Content-disposition: '.($ACT=='download'?'attachment;':'').'filename="'.(basename($FILE)).'";');
		header('Content-type: '.mime_type($PATH));
		header('Content-length: '.$size);
		$speed=$uinfo['bw_xfer_rate'];
		$sleep=$speed?floor(($chunk/($speed*1024))*1000000):0;
		$sent=0;
		if(false===($fp=fopen($PATH,'rb')))exit;
		do{$buf=fread($fp,$chunk);$sent+=strlen($buf);print$buf;flush();usleep($sleep);}while(!feof($fp)&&!connection_aborted());
		fclose($fp);
		$M->query(sprintf("UPDATE uploader_users SET bw_used=bw_used+%f WHERE userid=%d;",$sent/1024,$userid));
	}
	else exit('Could not open user data.');
}
else out('data/file_not_found.gif');
?>