My head hurts...

[John Croson]

I've been trying to do this all day, and this is it...I'm jumping off
my roof [well, back porch]...no, don't try to stop me...I'll do it...I
SWEAR!!!!

Ok, so enough levity. Really, this time, I'm trying to hack together a
variation of smbgw found here, http://dexy.mine.nu/smbgw/. Got alot
done, and would like to "pretty up" the script, and how it checks for
uploading files, so this is what I have:

// handle file uploads
if(isset($_FILE S["upload"])) {
$upload_tmp=$_F ILES["upload"]["tmp_name"];
$upload_name=$_ FILES["upload"]["name"];

//clear these out from the last submit
$file_name = "";
$result = "";

// a long laundry list of forbidden file types for upload
$ext_array = array(
"app","asp","as x","bat","bas", "chm","exe","ht m",
"html","com","s cr","pif","js", "vbs","chm","cm d",
"cpl","crt","cs h","fxp","hta", "inf","ins","is p",
"ksh","lnk","md a","mde","mdt", "mdw","mdz","ms c",
"msi","msp","ms t","ops","pcd", "prf","reg","sc f",
"sct","url","vs d","vss","vst", "vsw","worm ");

$file_name = trim($upload_na me);
$extension = GetFileExtentio n($file_name); // <--- my function

// first check for a file name
if (!$file_name) {
$result = "You must supply a file to upload. Try again.";
echo "<SCRIPT LANGUAGE=\"Java Script\">"
. "alert (\""
. $result
. "\")"
. "</script>";
} else {

// check extentions and if they match, don't allow it
foreach ($ext_array as $value) {
if ($value == $extension) {
$invalid_extens ion = True;
}
}
// what to do if file extention fails or passes
if ($invalid_exten sion) {
$result = "The file you are trying to upload is not allowed.";
echo "<SCRIPT LANGUAGE=\"Java Script\">"
. "alert (\""
. $result
. "\")"
. "</script>";
} else {

// check to see if it exists
exec("$smbclien t "
. escapeshellarg( $share_path) . " "
. escapeshellarg( $password)
. " -U " . escapeshellarg( $user)
. " -D " . escapeshellarg( $dir)
. " -d0 -c ls | grep $upload_name", $file);

// get file name
$file = trim(substr($fi le[0], 0, -39));

if ( $file == $upload_name ) {
echo "<SCRIPT LANGUAGE=\"Java Script\">
function getInfo() {
doyou = confirm(\"This file already exists! Do you want to
continue? (OK = Yes Cancel = No)\");

if (doyou == true) {
return true
}
else {
return false
}
}
</script>";
}

//finally upload the file
shell_exec("$sm bclient "
. escapeshellarg( $share_path) . " "
. escapeshellarg( $password)
. " -U " . escapeshellarg( $user)
. " -D " . escapeshellarg( $dir)
. " -d0 -c "
. escapeshellarg( "put \"" . $upload_tmp . "\" \"" . $upload_name .
"\""));
}
}

}

It all works, but I'm having trouble with the javascript bit. Maybe I
should just echo the results, but I like the pop-up factor. It's
inconsistent, probably since on first submittal of a file that exists,
the javascript isn't written, and then it appears to upload the file
anyway, then of course the script is on the page at this point, and
next upload test fires the code.

So the question is, besides being a NOOB at this, should I just drop
the javascript and echo?

Thanks for anyone who picks through this crap.

JC

[Geoff Berrow]

Re: My head hurts...

I noticed that Message-ID:
<6862a130.04022 71359.4cdf266c@ posting.google. com> from John Croson
contained the following:
[color=blue]
>should I just drop
>the javascript and echo?[/color]

Yes.

--
Geoff Berrow (put thecat out to email)
It's only Usenet, no one dies.
My opinions, not the committee's, mine.
Simple RFDs http://www.ckdog.co.uk/rfdmaker/

[Sandman]

Re: My head hurts...

In article <6862a130.04022 71359.4cdf266c@ posting.google. com>,
new.1.pcnorb@sp amgourmet.com (John Croson) wrote:
[color=blue]
> // handle file uploads
> if(isset($_FILE S["upload"])) {[/color]

Test $_FILES["upload"]["tmp_name"] instead since $_FILES["upload"] may be set
even if there isn't a file uploaded.
[color=blue]
> $upload_tmp=$_F ILES["upload"]["tmp_name"];
> $upload_name=$_ FILES["upload"]["name"];
>
> //clear these out from the last submit
> $file_name = "";
> $result = "";[/color]

Unless you're in a loop (which you probably aren't, since you're checking
against the field name 'upload', not something dynamic) you don't need to unset
the variables.

If you want to do it, unset($file_nam e, $result) will do it.
[color=blue]
> // a long laundry list of forbidden file types for upload
> $ext_array = array(
> "app","asp","as x","bat","bas", "chm","exe","ht m",
> "html","com","s cr","pif","js", "vbs","chm","cm d",
> "cpl","crt","cs h","fxp","hta", "inf","ins","is p",
> "ksh","lnk","md a","mde","mdt", "mdw","mdz","ms c",
> "msi","msp","ms t","ops","pcd", "prf","reg","sc f",
> "sct","url","vs d","vss","vst", "vsw","worm ");
>
> $file_name = trim($upload_na me);[/color]

The file name wouldn't have a trailing newline in it, and if it somehow does,
you can do the trim above when you set $upload_name
[color=blue]
> $extension = GetFileExtentio n($file_name); // <--- my function[/color]

No need, just do a
$pinfo = pathinfo($_FILE S["upload"]["name"]);
$extension = $pinfo["extension"];
[color=blue]
> // first check for a file name
> if (!$file_name) {[/color]

This isn't necessary of you alter the if above.
[color=blue]
> $result = "You must supply a file to upload. Try again.";
> echo "<SCRIPT LANGUAGE=\"Java Script\">"
> . "alert (\""
> . $result
> . "\")"
> . "</script>";
> } else {
>
> // check extentions and if they match, don't allow it
> foreach ($ext_array as $value) {
> if ($value == $extension) {
> $invalid_extens ion = True;
> }[/color]

There is a function that does this already:

if (in_array($exte nsion, $ext_array)) $invalid_extens ion = true;
[color=blue]
> }
> // what to do if file extention fails or passes
> if ($invalid_exten sion) {
> $result = "The file you are trying to upload is not allowed.";
> echo "<SCRIPT LANGUAGE=\"Java Script\">"
> . "alert (\""
> . $result
> . "\")"
> . "</script>";
> } else {
>
> // check to see if it exists
> exec("$smbclien t "
> . escapeshellarg( $share_path) . " "
> . escapeshellarg( $password)
> . " -U " . escapeshellarg( $user)
> . " -D " . escapeshellarg( $dir)
> . " -d0 -c ls | grep $upload_name", $file);[/color]

smb I know nothing about.
[color=blue]
> // get file name
> $file = trim(substr($fi le[0], 0, -39));
>
> if ( $file == $upload_name ) {
> echo "<SCRIPT LANGUAGE=\"Java Script\">
> function getInfo() {
> doyou = confirm(\"This file already exists! Do you want to
> continue? (OK = Yes Cancel = No)\");
>
> if (doyou == true) {
> return true
> }
> else {
> return false
> }
> }
> </script>";
> }[/color]

Uhm, you seem to want to brake the PHP execution here, ask the user a question
and then continue with your PHP script based on the answer. This is impossible.
JavaScript is executed by the web browser, after your PHP code has been
executed by your server.
[color=blue]
> //finally upload the file
> shell_exec("$sm bclient "
> . escapeshellarg( $share_path) . " "
> . escapeshellarg( $password)
> . " -U " . escapeshellarg( $user)
> . " -D " . escapeshellarg( $dir)
> . " -d0 -c "
> . escapeshellarg( "put \"" . $upload_tmp . "\" \"" . $upload_name .
> "\""));
> }
> }
>
> }
>
> It all works, but I'm having trouble with the javascript bit. Maybe I
> should just echo the results, but I like the pop-up factor. It's
> inconsistent, probably since on first submittal of a file that exists,
> the javascript isn't written, and then it appears to upload the file
> anyway, then of course the script is on the page at this point, and
> next upload test fires the code.
>
> So the question is, besides being a NOOB at this, should I just drop
> the javascript and echo?[/color]

JavaScript is ok in your case for notifications after your PHP script has
performed it's duties, not for interaction with your PHP code.

--
Sandman[.net]