WebSVN – lars-tiefland.content-management – /trunk/dokumente/index1.php

<?php

//Dateianhang:;Bestellung;ID;ID;Felder:1
if (!$_REQUEST['table_foreign'] || !$_REQUEST['row_foreign'] || !$_REQUEST['data_foreign']) {
        die("Fehlende Parameter! Skript kann nicht ausgeführt werden");
}

// dokumente Modul: Ma
error_reporting(E_ALL & ~E_NOTICE);
ini_set("register_globals", "On");


define ("Range",100);
define ("modul_name",   "Warenwirtschaft");
define ("tool_name",    "bestellung");
define ("propertie",    "dokument");

// Iconverzeichnis
define ("gfxdir",               "gfx/");

require "../Online-Shop/connect2.php";
require "includes/splitModProps.function.php";


// Global select
$sql    = "SELECT * FROM dokumente";
$result = mysql_query ($sql) or die (mysql_errno().": ".mysql_error()."<hr>".nl2br($sql)."<hr>");

// Propertie Daten
// $web_rechte_fieldData = explode(";", $web_rechte[modul_name][tool_name][propertie]);
$web_rechte_fieldData = splitModProps($web_rechte);

// Upload Verzeichnis
$uploadPath = $webs['verzeichnis']."/images/dokumente/";

// Upload Felder (Einstellen im CMS: Daten;Daten;Felder:4;)
$numFields      = !isset($web_rechte_fieldData['Felder']) ? 1 : $web_rechte_fieldData['Felder'];
$fileFilter     = !isset($web_rechte_fieldData['Filter']) ? "(.jpg|.gif|.png)" : $web_rechte_fieldData['Filter'];

pre($web_rechte_fieldData);

$permissions = array
(
        "dokumente_read",
        "dokumente_delete",
        "dokumente_add"
);

// Modulkonfigurationen
// Modconf => Bestellung
$moduleTyp['Bestellung'] = array
(
        "table_foreign" =>      "Bestellung",
        "row_foreign"   =>      "ID",
        "data_foreign"  =>      "ID"
);
// Modconf => Artikel
$moduleTyp['Bestellung'] = array
(
        "table_foreign" =>      "artikel",
        "row_foreign"   =>      "ID",
        "data_foreign"  =>      "ID"
);


// DatenbankFelder
// table_foreign  row_foreign  data_foreign  document  letzte_aenderung_am  letzte_aenderung_von

if (isset($user_rechte[modul_name][tool_name][propertie]))
{
        if ($_POST['action']) {
                $error=array();
                foreach (array_keys($_FILES['file']) as $fileId)  
                {       
                        foreach (array_keys($_FILES['file'][$fileId]) AS $number) 
                        {
                                /* Fehler abfangen */
                                switch($fileId) 
                                {
                                        case 'name':
                                                if (!ereg($fileFilter,$_FILES['file'][$fileId][$number])){
                                                        $error['name'][$number]="Fehler im Dateinamen!";
                                                }
                                                $fTmpName = $fName[$fileId][$number];
                                                $fName[$fileId][$number] = $_FILES['file'][$fileId][$number];
                                                $fType[$fileId][$number] = substr($fTmpName,strrpos($fTmpName,".")-1,strlen($fTmpName));
                                                
                                                $fTmpIcon = gfxdir.$fType[$fileId][$number].".gif";
                                                $fIcon[$fileId][$number] = file_exists($fTmpIcon) ? $fTmpIcon : gfxdir."default.gif";
                                                
                                        break;
                                        case 'type':
                                        /*
                                                if (!ereg("(image)",$_FILES['file'][$fileId][$number])){
                                                        $error['type'][$number]="Fehler im Dateityp!";
                                                }
                                        */
                                        break;
                                        case 'tmp_name':
                                                //
                                        break;
                                        case 'error':
                                                if ($_FILES['file'][$fileId][$number]==1){
                                                        $error['error'][$number]="Externer Fehler beim upload!";
                                                }
                                        break;
                                        case 'size':
                                                if ($_FILES['file'][$fileId][$number]>1028000){
                                                        $error['size'][$number]="Datei zu gross fuer den Upload: > ".$_FILES['file'][$fileId][$number];
                                                }
                                        break;
                                        $i++;
                                }
                        }
                }
                // Upload
                if(sizeof($error[$fileId])==0)
                {
                        foreach (array_keys($_FILES['file']['name']) AS $number) 
                        {       
                                $file = $_FILES['file']['name'][$number];
                                if (is_uploaded_file($_FILES['file']['tmp_name'][$number])) 
                                {
                                        // $_REQUEST['table_foreign'] || !$_REQUEST['row_foreign'] || !$_REQUEST['data_foreign']
                                        // id  table_foreign  row_foreign  data_foreign  document  letzte_aenderung_am  letzte_aenderung_von  
                                        $sql = 
                                        "
                                                        REPLACE INTO dokumente 
                                                        (
                                                                table_foreign, 
                                                                row_foreign,  
                                                                data_foreign, 
                                                                document,
                                                                letzte_aenderung_am,  
                                                                letzte_aenderung_von  
                                                        ) 
                                                                VALUES 
                                                        (
                                                                '".$_REQUEST['table_foreign']."',
                                                                '".$_REQUEST['row_foreign']."',
                                                                '".$_REQUEST['data_foreign']."',
                                                                '".$file."',
                                                                NOW(),
                                                                '".$PHP_AUTH_USER."'
                                                        )
                                        ";
                                        $result = mysql_query ($sql) or die (mysql_errno().": ".mysql_error()."<hr>".nl2br($sql)."<hr>");
                                        
                                        if (!$result) {
                                                $error[] = $sql;
                                        } else {
                                                $msg[] = "Der SQL wurde ausgef&uuml;hrt";
                                        }
                                        
                                        if (move_uploaded_file($_FILES['file']['tmp_name'][$number], $uploadPath . $file)) 
                                        {
                                                $msg[$number] = "Datei wurde kopiert nach ".$uploadPath . $file."<br>";
                                                
                                                //copy($_FILES['userfile'], $uploadPath);
                                        } else {
                                                //echo "Mögliche Dateiupload-Attacke: Dateiname '$_FILES[userfile]'.";
                                                $msg[$number] = "Dateiupload-Hack: Dateiname ".$uploadPath . $file."<br>";
                                        }
                                }
                        }
                }
        }
        
        if ($_REQUEST['action']=='unlink') {
                // Global select
                $sql = 
                "
                
                DELETE FROM dokumente WHERE     
                        table_foreign = '".$_REQUEST['table_foreign']."' 
                AND
                        row_foreign = '".$_REQUEST['row_foreign']."' 
                AND
                        data_foreign = '".$_REQUEST['data_foreign']."'
                        
                ";
                
                $result = mysql_query ($sql) or die (mysql_errno().": ".mysql_error()."<hr>".nl2br($sql)."<hr>");
                
                if ($result) {
                        $unlink=true;
                        $msg[] = "Datei wurde gel&ouml;scht";
                }
        }
?>

<html>
<head>
<title>Content-Management-System - Webagentur Niewerth</title>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
<meta name="description" content="Redaktionssystem">
<meta name="author" content="Webagentur Niewerth">
<meta name="robots" content="noindex">

<link rel=stylesheet type="text/css" href="/styles/styles.php">
<style type="text/css">
<!--
/* Anpassung Markus Niewerth */
/* Druckbarer Bereich */
@media print {
    #noprint                    { display:none; }
        .lightgray              {color: #000000; background-color: #EEEEEE; text-decoration:underline}
        .darkgray               {color: #000000; background-color: #CCCCCC; text-decoration:underline}
        .status_off             {color: #000000; text-decoration : none   ;                                                  }
        .status_red             {color: #FFFFFF; background-color: #FF0000; text-decoration:underline}
        .status_yellow          {color: #000000; background-color: #FFFF00; text-decoration:underline}
        .status_blue            {color: #FFFFFF; background-color: #0000FF; text-decoration:underline}
        .status_green           {color: #000000; background-color: #00FF00; text-decoration:underline}
        .status_white           {color: #000000; background-color: #FFFFFF; text-decoration:underline}
}

/* Sichtbarer Bereich */
@media screen {
        .lightgray              {color: #000000; background-color: #EEEEEE; text-decoration:none}
        .darkgray               {color: #000000; background-color: #CCCCCC; text-decoration:none}
        .status_off             {color: #000000; text-decoration : none ;                                               }
        .status_red             {color: #FFFFFF; background-color: #FF0000; text-decoration:none}
        .status_yellow          {color: #000000; background-color: #FFFF00; text-decoration:none}
        .status_blue            {color: #FFFFFF; background-color: #0000FF; text-decoration:none}
        .status_green           {color: #000000; background-color: #00FF00; text-decoration:none}
        .status_white           {color: #000000; background-color: #FFFFFF; text-decoration:none}
}
-->
</style>

<script>
function openerReturn()
{
        opener.formname.action = "bestellungen.php?update[current]";
        opener.formname.submit();
        self.close();
}
<?php
if((!sizeof($error) && $_POST['action']) || $unlink)
        echo "openerReturn();"
?>
</script>
<body bgcolor="#FFFFFF" leftmargin="20" topmargin="10" marginwidth="20" marginheight="10" text="#000096">
<form method="post" action="#" name="formname" enctype="multipart/form-data">
  <?php
                if ($_GET['action']=="edit" || empty($_GET['action']))
                {
   ?>
  <table width="100%" border="1" cellspacing="0" cellpadding="3" bordercolorlight="#FFFFFF" bordercolordark="#999999">
   <?php
        for($i=0;$i<$numFields;$i++) {
   ?>
    <tr>
      <td width="13%" valign="top" class="links">Datei</td>
      <td class="rechts">
        <input type="file" name="file[]" id="file[]">
      </td>
    </tr>
    <?php
                }
        ?>
    <tr>
      <td align="right" colspan="2" class="links">
        <table width="100%" border="0" cellspacing="0" cellpadding="0">
          <tr  class="links">
            <td width="13%">&nbsp;</td>
            <td width="87%" align="right">
              <!-- table_foreign  row_foreign  data_foreign  document  letzte_aenderung_am  letzte_aenderung_von  -->
              <input name="id" type="hidden" id="id" value="<?php echo $zeile['id'] ?>">
              <input name="table_foreign" type="hidden" id="table_foreign" value="<?php echo $_GET['table_foreign'] ?>">
              <input name="row_foreign" type="hidden" id="row_foreign" value="<?php echo $_GET['row_foreign'] ?>">
              <input name="data_foreign" type="hidden" id="data_foreign" value="<?php echo $_GET['data_foreign'] ?>">
              <input type="hidden" name="action" value="update">
              <input type="submit" value="OK">
              <input type="reset" name="Button" value="Zur&uuml;cksetzen">
            </td>
          </tr>
        </table>
      </td>
    </tr>
  </table>
  <?php 
       echo is_array($error)    ? nl2br(returnMessage($error))  :       "";
       echo is_array($msg)              ? nl2br(returnMessage($msg))    :       "";
        }//_POST['action']      
}else{
        echo "Zugriff verweigert!";
}
?>
</form>
</body>
Subversion-Projekte lars-tiefland.content-management

(root)/trunk/dokumente/index1.php @ 2 – Revision 1
