<?php
/*
这是一个上传脚本SWFUpload ，试图妥善处理上传文件 
在一个安全的方式。 

注： 

SWFUpload没有派MIME类型。在我看来，这是玉自MIME类型没有优于 
文件扩展名，并很可能更糟，因为它可以不同的操作系统操作系统和浏览器浏览器（同一文件） 。 
生命中最好的事情是嗅出内容的文件，但可资源密集，是困难的，仍然可以欺骗或不准确的。 
接受上传永远不能100 ％安全。 

你不能保证SWFUpload是真正的来源上传。恶意用户 
可能会从一个上传工具，将无效或伪造的中继资料档案。 
该脚本应妥善处理好这一点。 

该脚本不应超过写现有的档案。 

该脚本应去除无效字符的文件名或拒绝该文件。 

该脚本不应该允许的档案保存，可以再上执行的Web服务器（如。 PHP文件） 。 
为了保持简单的事情，我们将使用许可延长为允许的文件扩展名。哪些文件应该允许 
取决于您的服务器配置。延长白名单_not_并列您SWFUpload file_types设置 

为了取得更好的安全上传的文件应存放在Web服务器之外的文档根目录。下载的文件 
应该可以通过下载脚本，代理人从文件系统的网络服务器。这样可防止 
用户执行恶意上传的文件。它还给开发者的控制权即将离任的模仿型， 
准入限制，等等然而，这是范围以外的该脚本。 

SWFUpload每个文件传送作为一个单独的邮政，而不是几个文件在一个职位。这是一个更好的 
方法在我的意见，因为它更好地处理文件大小限制，例如，如果post_max_size是100 MB的，我两个60后的档案然后甲基溴 
后注定要失败（ 2x60MB = 120MB ） 。在SWFupload每个60甲基溴是作为单独发布后，我们入住的限度内。这个 
还简化了上传脚本，因为我们只处理一个单一的文件。 

该脚本应妥善处理的情况后过大或张贴档案大于 
我们定义的最大值。这些价值观念无关的SWFUpload file_size_limit设置。
	
*/

// Code for Session Cookie workaround
	if (isset($_POST["PHPSESSID"])) {
		session_id($_POST["PHPSESSID"]);
	} else if (isset($_GET["PHPSESSID"])) {
		session_id($_GET["PHPSESSID"]);
	}

	session_start();

// Check post_max_size (http://us3.php.net/manual/en/features.file-upload.php#73762)
	$POST_MAX_SIZE = ini_get('post_max_size');
	$unit = strtoupper(substr($POST_MAX_SIZE, -1));
	$multiplier = ($unit == 'M' ? 1048576 : ($unit == 'K' ? 1024 : ($unit == 'G' ? 1073741824 : 1)));

	if ((int)$_SERVER['CONTENT_LENGTH'] > $multiplier*(int)$POST_MAX_SIZE && $POST_MAX_SIZE) {
		header("HTTP/1.1 500 Internal Server Error");
		echo "POST exceeded maximum allowed size.";
		exit(0);
	}

// Settings
	$save_path = "../import/".date(Y)."".date(m)."".date(d)."网友上传/";				// The path were we will save the file (getcwd() may not be reliable and should be tested in your environment)
		//建立文件夹
	create($save_path);
	$upload_name = "Filedata";
	$max_file_size_in_bytes = 2147483647;				// 2GB in bytes
	$extension_whitelist = array("jpg", "gif", "png");	// Allowed file extensions
	$valid_chars_regex = '.A-Z0-9_ !@#$%^&()+={}\[\]\',~`-';				// Characters allowed in the file name (in a Regular Expression format)

// Other variables	
	$MAX_FILENAME_LENGTH = 260;
	$file_name = "";
	$file_extension = "";
	$uploadErrors = array(
        0=>"There is no error, the file uploaded with success",
        1=>"The uploaded file exceeds the upload_max_filesize directive in php.ini",
        2=>"The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form",
        3=>"The uploaded file was only partially uploaded",
        4=>"No file was uploaded",
        6=>"Missing a temporary folder"
	);


// Validate the upload
	if (!isset($_FILES[$upload_name])) {
		HandleError("No upload found in \$_FILES for " . $upload_name);
		exit(0);
	} else if (isset($_FILES[$upload_name]["error"]) && $_FILES[$upload_name]["error"] != 0) {
		HandleError($uploadErrors[$_FILES[$upload_name]["error"]]);
		exit(0);
	} else if (!isset($_FILES[$upload_name]["tmp_name"]) || !@is_uploaded_file($_FILES[$upload_name]["tmp_name"])) {
		HandleError("Upload failed is_uploaded_file test.");
		exit(0);
	} else if (!isset($_FILES[$upload_name]['name'])) {
		HandleError("File has no name.");
		exit(0);
	}
	
// Validate the file size (Warning: the largest files supported by this code is 2GB)
	$file_size = @filesize($_FILES[$upload_name]["tmp_name"]);
	if (!$file_size || $file_size > $max_file_size_in_bytes) {
		HandleError("File exceeds the maximum allowed size");
		exit(0);
	}
	
	if ($file_size <= 0) {
		HandleError("File size outside allowed lower bound");
		exit(0);
	}


// Validate file extension
	$path_info = pathinfo($_FILES[$upload_name]['name']);
	$file_extension = $path_info["extension"];
	$is_valid_extension = false;
	foreach ($extension_whitelist as $extension) {
		if (strcasecmp($file_extension, $extension) == 0) {
			$is_valid_extension = true;
			break;
		}
	}
	if (!$is_valid_extension) {
		HandleError("Invalid file extension");
		exit(0);
	}

// Validate file name (for our purposes we'll just remove invalid characters)
	$file_name = preg_replace('/[^'.$valid_chars_regex.']|\.+$/i', "", md5($_FILES[$upload_name]['name']));
	$file_name = $file_name.".".$file_extension;
	if (strlen($file_name) == 0 || strlen($file_name) > $MAX_FILENAME_LENGTH) {
		HandleError("Invalid file name");
		exit(0);
	}


// Validate that we won't over-write an existing file
	if (file_exists($save_path . $file_name)) {
		HandleError("File with this name already exists");
		exit(0);
	}

// Validate file contents (extension and mime-type can't be trusted)
	/*
		Validating the file contents is OS and web server configuration dependant.  Also, it may not be reliable.
		See the comments on this page: http://us2.php.net/fileinfo
		
		Also see http://72.14.253.104/search?q=cache:3YGZfcnKDrYJ:www.scanit.be/uploads/php-file-upload.pdf+php+file+command&hl=en&ct=clnk&cd=8&gl=us&client=firefox-a
		 which describes how a PHP script can be embedded within a GIF image file.
		
		Therefore, no sample code will be provided here.  Research the issue, decide how much security is
		 needed, and implement a solution that meets the needs.
	*/


// Process the file
	/*
		At this point we are ready to process the valid file. This sample code shows how to save the file. Other tasks
		 could be done such as creating an entry in a database or generating a thumbnail.
		 
		Depending on your server OS and needs you may need to set the Security Permissions on the file after it has
		been saved.
	*/
	if (!@move_uploaded_file($_FILES[$upload_name]["tmp_name"], $save_path.$file_name)) {
		HandleError("File could not be saved.");
		exit(0);
	}

// Return output to the browser (only supported by SWFUpload for Flash Player 9)

	echo "File Received";
	exit(0);


/* Handles the error output.  This function was written for SWFUpload for Flash Player 8 which
cannot return data to the server, so it just returns a 500 error. For Flash Player 9 you will
want to change this to return the server data you want to indicate an error and then use SWFUpload's
uploadSuccess to check the server_data for your error indicator. */
function HandleError($message) {
	header("HTTP/1.1 500 Internal Server Error");
	echo $message;
}
function create($dir)
{
	if (!is_dir($dir))
	{
		$temp = explode('/',$dir);
		$cur_dir = '';
		for($i=0;$i<count($temp);$i++)
		{
			$cur_dir .= $temp[$i].'/';
			if (!is_dir($cur_dir))
			{
				@mkdir($cur_dir,0777);
//				@fopen("$cur_dir/index.htm","a");
			}
		}
	}
}
?>