<commit_before><?php
/**
 *
 * upload page, used by xerte to upload a file
 *
 * @author <NAME>
 * @version 1.0
 * @copyright Copyright (c) 2008,2009 University of Nottingham
 * @package
 */

require_once("../../../config.php");

// Left in for now but restricted to only development mode
global $development;
if ($development == true) {
	file_put_contents('test.txt', var_export($_SESSION,TRUE));
}

if(!isset($_SESSION['toolkits_logon_username'])) {
  print "You are not logged in";
  exit(); // ?? Why was this commented out in the v1.9 release ??
}

// Perhaps this whitelist should be moved to management.php or config.php??
$media_whilelist = 'flv,mp4,mp3,jpg,jpeg,gif,png,swf'; // Pat's Wordpress list

// Make sure extension is in the whitelist
$pass = false;
$allowed = explode(',', $media_whilelist);
$extension = strtolower(pathinfo($_FILES['Filedata']['name'], PATHINFO_EXTENSION));
foreach($allowed as $ext) {
	if ($ext == $extension) {
		$pass = true;
		break;
	}
}

// Not sure if we still need these but left in for now
if (strpos($_FILES['Filedata']['name'], '../') !== false) $pass = false;
if (strpos($_FILES['Filedata']['name'], '.exe') !== false) $pass = false;
if (strpos($_FILES['Filedata']['name'], '...') !== false) $pass = false;

// Block all files that haven't met the criteria
if ($pass === false) {
  print "Invalid File Name";
  exit();
}

$new_file_name = $xerte_toolkits_site->root_file_path . $_GET['path'] . $_FILES['Filedata']['name'];

if(move_uploaded_file($_FILES['Filedata']['tmp_name'], $new_file_name)) {

}
else {

}<commit_msg>Firefox/Flash session fix and blacklist - will be replaced by blacklist and mime detection at later date...<commit_after><?php

	/**
	 *
	 * upload page, used by xerte to upload a file
	 *
	 * @author <NAME>, tweaked by <NAME>, GCU
	 * @version 1.1
	 * @copyright Copyright (c) 2008,2009 University of Nottingham
	 * @package
	 */



	/**
	 *	Tell server to use session from the querystring, in case we are in Firefox
	 */
	if ( strpos($_SERVER['QUERY_STRING'], "&") != false ) {
		$parts = explode("&", $_SERVER['QUERY_STRING']);
		session_id($parts[1]);
		session_start();
	}



	/**
	 *	Now bring in config.php
	 */
	require_once("../../../config.php");



	/**
	 *	Now we check that the session has a valid, logged in user
	 */
	if(!isset($_SESSION['toolkits_logon_username'])) {
		exit();
	}



	/**
	 *  Next we will check our blacklist of extensions
	 *  This is really not very effective - will be replaced by whitelist
	 *    and mimetype detection - feel free to add to this list
	 */
	$blacklist = explode(',', 'php,php5,pl,cgi,exe,vbs,pif,application,gadget,msi,msp,com,scr,hta,htaccess,ini,cpl,msc,jar,bat,cmd,vb,vbe,js,jse,ws,wsf,wsc,wsh,ps1,ps1xml,ps2,ps2xml,psc1,psc2,msh,msh1,msh2,mshxml,msh1xml,msh2xml,scf,lnk,inf,reg,docm,dotm,xlsm,xltm,xlam,pptm,potm,ppam,ppsm,sldm');
	$ext = strtolower(pathinfo($_FILES['Filedata']['name'], PATHINFO_EXTENSION));
	if (in_array($ext, $blacklist)) {
		exit();
	}



	// Not sure if we still need these but left in for now
	if (strpos($_FILES['Filedata']['name'], '../') !== false) exit();
	if (strpos($_FILES['Filedata']['name'], '...') !== false) exit();



	/**
	 *	If we get here then we have passed all the tests, so try to save the file
	 */
	$new_file_name = $xerte_toolkits_site->root_file_path . $_GET['path'] . $_FILES['Filedata']['name'];
	move_uploaded_file($_FILES['Filedata']['tmp_name'], $new_file_name);
{'fraction_non_alphanumeric': 0.18036595991867557, 'fraction_numerical': 0.01045599767644496, 'mean_word_length': 4.536977491961415, 'pattern_counts': {'":': 0, '<': 8, '<?xml version=': 0, '>': 8, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 5}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4417010', 'n_tokens_mistral': 1286, 'n_tokens_neox': 1191, 'n_words': 311}