function alt_from_resource($source, $target, $name = '', $delete = false)
{
    // Copy a resource as an alt file of another resource
    // alt is the source resource, $ref is the target resource that will get the new alternate
    global $view_title_field;
    $srcdata = get_resource_data($source);
    $srcext = $srcdata['file_extension'];
    $srcpath = get_resource_path($source, true, "", false, $srcext);
    if ($name == '') {
        $name = sql_value("select value from resource_data where resource_type_field = '{$view_title_field}' and resource = '{$source}'", 'Untitled');
    }
    $description = '';
    if (!file_exists($srcpath)) {
        echo "ERROR: File not found.";
        return false;
    } else {
        $file_size = filesize_unlimited($srcpath);
        $altid = add_alternative_file($target, $name, $description = "", $file_name = "", $file_extension = "", $file_size, $alt_type = '');
        $newpath = get_resource_path($target, true, "", true, $srcext, -1, 1, false, '', $altid);
        copy($srcpath, $newpath);
        # Preview creation for alternative files (enabled via config)
        global $alternative_file_previews;
        if ($alternative_file_previews) {
            create_previews($target, false, $srcext, false, false, $altid);
        }
        if ($delete) {
            // we are supposed to delete the original resource when we're done
            # Not allowed to edit this resource? They shouldn't have been able to get here.
            if (!get_edit_access($source, $srcdata["archive"], false, $srcdata) || checkperm('D')) {
                exit("Permission denied.");
            } else {
                delete_resource($source);
            }
        }
        return true;
    }
}

<div class="clearerleft"> </div>
<?php if ($errors!="") { ?><div class="FormError">!! <?php echo $errors?> !!</div><?php } ?>
</div>
<?php } ?>

<?php if ($list_recipients){?>
<div class="Question">
<label for="list_recipients"><?php echo $lang["list-recipients-label"]; ?></label><input type=checkbox id="list_recipients" name="list_recipients">
<div class="clearerleft"> </div>
</div>
<?php } ?>

<?php if($useraccess==0)
	{
	$resourcedata=get_resource_data($ref,true);
	if(get_edit_access($ref,$resource['archive'],false,$resource))
		{?>
		<div class="Question">
		<label for="grant_internal_access"><?php echo $lang["internal_share_grant_access"] ?></label>
		<input type=checkbox id="grant_internal_access" name="grant_internal_access" onClick="if(this.checked){jQuery('#question_internal_access').slideDown();}else{jQuery('#question_internal_access').slideUp()};">
		<div class="clearerleft"> </div>
		</div>
		<?php
		}
	}?>


<?php if(!hook("replaceemailaccessselector")){?>
<div class="Question" id="question_access">
<label for="access"><?php echo $lang["externalselectresourceaccess"]?></label>
<select class="stdwidth" name="access" id="access">

 function allow_multi_edit($collection)
 {
     global $resource;
     # Returns true or false, can all resources in this collection be edited by the user?
     # also applies edit filter, since it uses get_resource_access
     if (!is_array($collection)) {
         // collection is an array of resource data
         $collection = do_search("!collection" . $collection);
     }
     for ($n = 0; $n < count($collection); $n++) {
         $resource = $collection[$n];
         if (!get_edit_access($collection[$n]["ref"], $collection[$n]["archive"], false, $collection[$n])) {
             return false;
         }
     }
     if (hook('denyaftermultiedit', '', array($collection))) {
         return false;
     }
     return true;
     # Updated: 2008-01-21: Edit all now supports multiple types, so always return true.
     /*
     $types=sql_query("select distinct r.resource_type from collection_resource c left join resource r on c.resource=r.ref where c.collection='$collection'");
     if (count($types)!=1) {return false;}
     
     $status=sql_query("select distinct r.archive from collection_resource c left join resource r on c.resource=r.ref where c.collection='$collection'");
     if (count($status)!=1) {return false;}	
     
     return true;
     */
 }

$offset = getvalescaped("offset", "", true);
$order_by = getvalescaped("order_by", "");
$archive = getvalescaped("archive", "", true);
$restypes = getvalescaped("restypes", "");
if (strpos($search, "!") !== false) {
    $restypes = "";
}
$default_sort = "DESC";
if (substr($order_by, 0, 5) == "field") {
    $default_sort = "ASC";
}
$sort = getval("sort", $default_sort);
# Fetch resource data.
$resource = get_resource_data($ref);
# Not allowed to edit this resource?
if ((!get_edit_access($ref, $resource["archive"], false, $resource) || checkperm('A')) && $ref > 0) {
    exit("Permission denied.");
}
hook("pageevaluation");
# Handle deleting a file
if (getval("filedelete", "") != "") {
    delete_alternative_file($ref, getvalescaped("filedelete", ""));
}
include "../include/header.php";
?>
<div class="BasicsBox">
<p>
<a onClick="return CentralSpaceLoad(this,true);" href="<?php 
echo $baseurl_short;
?>
pages/edit.php?ref=<?php 

    foreach ($fields as $field) {
        if ($field["fref"] == $display_field_below_preview) {
            $displaycondition = check_view_display_condition($fields, $df);
            if ($displaycondition) {
                $previewcaption = $fields[$df];
                // Remove from the array so we don't display it twice
                unset($fields[$df]);
                //Reorder array
                $fields = array_values($fields);
            }
        }
        $df++;
    }
}
# Load edit access level (checking edit permissions - e0,e-1 etc. and also the group 'edit filter')
$edit_access = get_edit_access($ref, $resource["archive"], $fields, $resource);
if ($k != "") {
    $edit_access = 0;
}
function check_view_display_condition($fields, $n)
{
    #Check if field has a display condition set
    $displaycondition = true;
    if ($fields[$n]["display_condition"] != "") {
        //echo $fields[$n]["display_condition"] . "<br>";
        $fieldstocheck = array();
        #' Set up array to use in jQuery script function
        $s = explode(";", $fields[$n]["display_condition"]);
        $condref = 0;
        foreach ($s as $condition) {
            $displayconditioncheck = false;

function get_resource_access($resource)
	{
	# $resource may be a resource_data array from a search, in which case, many of the permissions checks are already done.	
		
	# Returns the access that the currently logged-in user has to $resource.
	# Return values:
	# 0 = Full Access (download all sizes)
	# 1 = Restricted Access (download only those sizes that are set to allow restricted downloads)
	# 2 = Confidential (no access)
	
	# Load the 'global' access level set on the resource
	# In the case of a search, resource type and global,group and user access are passed through to this point, to avoid multiple unnecessary get_resource_data queries.
	# passthru signifies that this is the case, so that blank values in group or user access mean that there is no data to be found, so don't check again .
	$passthru="no";

	// get_resource_data doesn't contain permissions, so fix for the case that such an array could be passed into this function unintentionally.
	if (is_array($resource) && !isset($resource['group_access']) && !isset($resource['user_access'])){$resource=$resource['ref'];}
	
	if (!is_array($resource)){
	$resourcedata=get_resource_data($resource,true);
	}
	else {
	$resourcedata=$resource;
	$passthru="yes";
	}
	$ref=$resourcedata['ref'];
	$access=$resourcedata["access"];
	$resource_type=$resourcedata['resource_type'];
	
	global $k;
	if ($k!="")
		{
		# External access - check how this was shared.
		$extaccess=sql_value("select access value from external_access_keys where resource=".$ref." and access_key='" . escape_check($k) . "'",-1);
		if ($extaccess!=-1) {return $extaccess;}
		}
	
	if (checkperm("v"))
		{
		# Permission to access all resources
		# Always return 0
		return 0; 
		}

	if ($access==3)
		{
		# Load custom access level
		if ($passthru=="no"){ 
			global $usergroup;
			$access=get_custom_access($resource,$usergroup);
			//echo "checked group access: ".$access;
			} 
		else {
			$access=$resource['group_access'];
		}
	}

	if ($access == 1 && get_edit_access($ref, $resourcedata['archive']))
		{
		# If access is restricted and user has edit access, grant open access.
		$access = 0;
		}

	global $open_access_for_contributor, $userref;
	if ($open_access_for_contributor && $access == 1 && $resourcedata['created_by'] == $userref)
		{
		# If access is restricted and user has contributed resource, grant open access.
		$access = 0;
		}


	# Check for user-specific access (overrides any other restriction)
	global $userref;

	if ($passthru=="no"){
		$userspecific=get_custom_access_user($resource,$userref);	
		//echo "checked user access: ".$userspecific;
		} 
	else {
		$userspecific=$resourcedata['user_access'];
		}

		
	if ($userspecific!="")
		{
		return $userspecific;
		}
		
	global $usersearchfilter, $search_filter_strict; 
	if ((trim($usersearchfilter)!="") && $search_filter_strict)
		{
		# A search filter has been set. Perform filter processing to establish if the user can view this resource.		
		# Always load metadata, because the provided metadata may be missing fields due to permissions.
		$metadata=get_resource_field_data($ref,false,false);
				
		for ($n=0;$n<count($metadata);$n++)
			{
			$name=$metadata[$n]["name"];
			$value=$metadata[$n]["value"];			
			if ($name!="")
//.........这里部分代码省略.........

    $ref = $items[0];
} else {
    $multiple = false;
}
# Fetch resource data.
$resource = get_resource_data($ref);
# Allow alternative configuration settings for this resource type.
resource_type_config_override($resource["resource_type"]);
# If upload template, check if the user has upload permission.
if ($ref < 0 && !(checkperm("c") || checkperm("d"))) {
    $error = $lang['error-permissiondenied'];
    error_alert($error);
    exit;
}
# Check edit permission.
if (!get_edit_access($ref, $resource["archive"], false, $resource)) {
    # The user is not allowed to edit this resource or the resource doesn't exist.
    $error = $lang['error-permissiondenied'];
    error_alert($error);
    exit;
}
if (getval("regen", "") != "") {
    sql_query("update resource set preview_attempts=0 WHERE ref='" . $ref . "'");
    create_previews($ref, false, $resource["file_extension"]);
}
if (getval("regenexif", "") != "") {
    extract_exif_comment($ref);
}
# Establish if this is a metadata template resource, so we can switch off certain unnecessary features
$is_template = isset($metadata_template_resource_type) && $resource["resource_type"] == $metadata_template_resource_type;
hook("editbeforeheader");

	$multiple=false;
	}

# Fetch resource data.
$resource=get_resource_data($ref);

# If upload template, check if the user has upload permission.
if ($ref<0 && !(checkperm("c") || checkperm("d")))
    {
    $error=$lang['error-permissiondenied'];
    error_alert($error);
    exit();
    }

# Check edit permission.
if (!get_edit_access($ref,$resource["archive"]))
    {
    # The user is not allowed to edit this resource or the resource doesn't exist.
    $error=$lang['error-permissiondenied'];
    error_alert($error);
    exit();
    }

if (getval("regen","")!="")
	{
	create_previews($ref,false,$resource["file_extension"]);
	}

if (getval("regenexif","")!="")
	{
	extract_exif_comment($ref);

include "../include/db.php";
include "../include/authenticate.php"; 
include "../include/general.php";
include "../include/resource_functions.php";
include "../include/header.php";

if ($disable_geocoding){exit("Geomapping disabled.");}

# Fetch resource data.
$ref = getvalescaped('ref','',true);
if ($ref=='') {die;}
$resource=get_resource_data($ref);
if ($resource==false) {die;}

# Not allowed to edit this resource?
if (!get_edit_access($ref,$resource["archive"])) {exit ("Permission denied.");}

?>
<?php

if (isset($_POST['submit'])) 
    {
    $s=explode(",",getvalescaped('geo-loc',''));
    if (count($s)==2) 
		{    
        $mapzoom=getvalescaped('map-zoom','');        
		if ($mapzoom>=2 && $mapzoom<=21)
			{
    			sql_query("update resource set geo_lat='" . escape_check($s[0]) . "',geo_long='" . escape_check($s[1]) . "',mapzoom='" . escape_check($mapzoom) . "' where ref='$ref'");    
			}
		else

    $restypes = "";
}
$default_sort = "DESC";
if (substr($order_by, 0, 5) == "field") {
    $default_sort = "ASC";
}
$sort = getval("sort", $default_sort);
$archive = getvalescaped("archive", 0, true);
$errors = array();
# The results of the save operation (e.g. required field messages)
$editaccess = get_edit_access($ref);
if (!$propose_changes_always_allow) {
    # Check user has permission.
    $proposeallowed = sql_value("select r.ref value from resource r left join collection_resource cr on r.ref='{$ref}' and cr.resource=r.ref left join user_collection uc on uc.user='{$userref}' and uc.collection=cr.collection left join collection c on c.ref=uc.collection where c.propose_changes=1", "");
}
if (!$propose_changes_always_allow && $proposeallowed == "" && !get_edit_access($ref)) {
    # The user is not allowed to edit this resource or the resource doesn't exist.
    $error = $lang['error-permissiondenied'];
    error_alert($error);
    exit;
}
if ($editaccess) {
    $userproposals = sql_query("select pc.user, u.username from propose_changes_data pc left join user u on u.ref=pc.user where resource='{$ref}' group by pc.user order by u.username asc");
    $view_user = getvalescaped("proposeuser", count($userproposals) == 0 ? $userref : $userproposals[0]["user"]);
    $proposed_changes = get_proposed_changes($ref, $view_user);
} else {
    $proposed_changes = get_proposed_changes($ref, $userref);
}
# Fetch resource data.
$resource = get_resource_data($ref);
# Load resource data

<?php

include dirname(__FILE__) . '/../../include/db.php';
include dirname(__FILE__) . '/../../include/general.php';
include dirname(__FILE__) . '/../../include/authenticate.php';
include dirname(__FILE__) . '/../../include/resource_functions.php';
$resource = getvalescaped('resource', '');
$ref = getvalescaped('ref', '');
$type = getvalescaped('type', '');
$resource_data = get_resource_data($resource);
// User should have edit access to this resource!
if (!get_edit_access($resource, $resource_data['archive'], false, $resource_data)) {
    exit('Permission denied.');
}
if ($type == 'user') {
    // Delete the user record from the database
    $query = sprintf('
			DELETE FROM resource_custom_access 
				  WHERE resource = "%s"
					AND user = "%s";
		', $resource, $ref);
} elseif ($type == 'usergroup') {
    // Delete the user record from the database
    $query = sprintf('
			DELETE FROM resource_custom_access 
				  WHERE resource = "%s"
					AND usergroup = "%s";
		', $resource, $ref);
} else {
    exit('No type');
}

<?php

include_once '../../include/db.php';
include_once '../../include/general.php';
include_once '../../include/authenticate.php';
include_once '../../include/resource_functions.php';
$ref = intval(getvalescaped('ref', '', true));
$related = intval(getvalescaped('related', '', true));
$add = getvalescaped('action', 'add') == "add";
if (!get_edit_access($ref) || !get_edit_access($related)) {
    exit($lang["error-permissiondenied"]);
}
//echo $ref;
//echo $related;
//echo ($add)?"Adding":"removing";
$update = update_related_resource($ref, $related, $add);
if (!$update) {
    exit("error");
}
exit("SUCCESS");

$restypes = getvalescaped("restypes", "");
if (strpos($search, "!") !== false) {
    $restypes = "";
}
$default_sort = "DESC";
if (substr($order_by, 0, 5) == "field") {
    $default_sort = "ASC";
}
$sort = getval("sort", $default_sort);
$resource = getvalescaped("resource", "", true);
# Fetch resource data.
$resourcedata = get_resource_data($resource);
# Load the configuration for the selected resource type. Allows for alternative notification addresses, etc.
resource_type_config_override($resourcedata["resource_type"]);
# Not allowed to edit this resource?
if ((!get_edit_access($resource, $resourcedata["archive"], false, $resourcedata) || checkperm('A')) && $resource > 0) {
    exit("Permission denied.");
}
hook("pageevaluation");
# Fetch alternative file data
$file = get_alternative_file($resource, $ref);
if ($file === false) {
    exit("Alternative file not found.");
}
if (getval("name", "") != "") {
    hook("markmanualupload");
    # Save file data
    save_alternative_file($resource, $ref);
    // Check to see if we need to notify users of this change
    if ($notify_on_resource_change_days != 0) {
        notify_resource_change($resource);

<?php

include_once "../../../include/db.php";
include_once "../../../include/authenticate.php";
include_once "../../../include/general.php";
include_once "../../../include/resource_functions.php";
include_once "../../../include/image_processing.php";
include_once "../include/transform_functions.php";
// verify that the requested ResourceID is numeric.
$ref = $_REQUEST['ref'];
if (!is_numeric($ref)) {
    echo "Error: non numeric ref.";
    exit;
}
# Load edit access level
$edit_access = get_edit_access($ref);
# Load download access level
$access = get_resource_access($ref);
$cropperestricted = in_array($usergroup, $cropper_restricteduse_groups);
// are they requesting to change the original?
if (isset($_REQUEST['mode']) && strtolower($_REQUEST['mode']) == 'original') {
    $original = true;
} else {
    $original = false;
}
// if they can't download this resource, they shouldn't be doing this
// also, if they are trying to modify the original but don't have edit access
// they should never get these errors, because the links shouldn't show up if no perms
if ($access != 0 || $original && !$edit_access) {
    include "../../../include/header.php";
    echo "Permission denied.";

 function get_resource_access($resource)
 {
     # $resource may be a resource_data array from a search, in which case, many of the permissions checks are already done.
     # Returns the access that the currently logged-in user has to $resource.
     # Return values:
     # 0 = Full Access (download all sizes)
     # 1 = Restricted Access (download only those sizes that are set to allow restricted downloads)
     # 2 = Confidential (no access)
     # Load the 'global' access level set on the resource
     # In the case of a search, resource type and global,group and user access are passed through to this point, to avoid multiple unnecessary get_resource_data queries.
     # passthru signifies that this is the case, so that blank values in group or user access mean that there is no data to be found, so don't check again .
     $passthru = "no";
     // get_resource_data doesn't contain permissions, so fix for the case that such an array could be passed into this function unintentionally.
     if (is_array($resource) && !isset($resource['group_access']) && !isset($resource['user_access'])) {
         $resource = $resource['ref'];
     }
     if (!is_array($resource)) {
         $resourcedata = get_resource_data($resource, true);
     } else {
         $resourcedata = $resource;
         $passthru = "yes";
     }
     $ref = $resourcedata['ref'];
     $access = $resourcedata["access"];
     $resource_type = $resourcedata['resource_type'];
     // Set a couple of flags now that we can check later on if we need to check whether sharing is permitted based on whether access has been specifically granted to user/group
     global $customgroupaccess, $customuseraccess;
     $customgroupaccess = false;
     $customuseraccess = false;
     global $k;
     if ($k != "") {
         # External access - check how this was shared.
         $extaccess = sql_value("select access value from external_access_keys where resource=" . $ref . " and access_key='" . escape_check($k) . "' and (expires is null or expires>now())", -1);
         if ($extaccess != -1) {
             return $extaccess;
         }
     }
     global $uploader_view_override, $userref;
     if (checkperm("z" . $resourcedata['archive']) && !($uploader_view_override && $resourcedata['created_by'] == $userref)) {
         // User has no access to this archive state
         return 2;
     }
     if (checkperm("v")) {
         # Permission to access all resources
         # Always return 0
         return 0;
     }
     if ($access == 3) {
         $customgroupaccess = true;
         # Load custom access level
         if ($passthru == "no") {
             global $usergroup;
             $access = get_custom_access($resource, $usergroup);
         } else {
             $access = $resource['group_access'];
         }
     }
     if ($access == 1 && get_edit_access($ref, $resourcedata['archive'], false, $resourcedata)) {
         # If access is restricted and user has edit access, grant open access.
         $access = 0;
     }
     global $open_access_for_contributor;
     if ($open_access_for_contributor && $access == 1 && $resourcedata['created_by'] == $userref) {
         # If access is restricted and user has contributed resource, grant open access.
         $access = 0;
     }
     # Check for user-specific and group-specific access (overrides any other restriction)
     global $userref, $usergroup;
     if ($passthru == "no") {
         $userspecific = get_custom_access_user($resource, $userref);
         $groupspecific = get_custom_access($resource, $usergroup, false);
     } else {
         $userspecific = $resourcedata['user_access'];
         $groupspecific = $resourcedata['group_access'];
     }
     if ($userspecific != "") {
         $customuseraccess = true;
         return $userspecific;
     }
     if ($groupspecific != "") {
         $customgroupaccess = true;
         return $groupspecific;
     }
     if (checkperm('T' . $resource_type)) {
         // this resource type is always confidential/hidden for this user group
         return 2;
     }
     global $usersearchfilter, $search_filter_strict;
     if (trim($usersearchfilter) != "" && $search_filter_strict) {
         # A search filter has been set. Perform filter processing to establish if the user can view this resource.
         # Always load metadata, because the provided metadata may be missing fields due to permissions.
         /*
                         
                         # ***** OLD METHOD ***** - used filter_match() - required duplication and was very difficult to implement OR matching for the field name supporting OR across fields
                         
         $metadata=get_resource_field_data($ref,false,false);
         for ($n=0;$n<count($metadata);$n++)
         	{
         	$name=$metadata[$n]["name"];
         	$value=$metadata[$n]["value"];			
//.........这里部分代码省略.........

<?php

include "../../../include/db.php";
include "../../../include/authenticate.php";
if (!checkperm("r")) {
    exit("Permission denied.");
}
include "../../../include/general.php";
include "../../../include/resource_functions.php";
$ref = getvalescaped("ref", "");
$resource = getvalescaped("resource", "");
# Check access
$edit_access = get_edit_access($resource);
if (!$edit_access) {
    exit("Access denied");
}
# Should never arrive at this page without edit access
if (getval("submitted", "") != "") {
    # Save license data
    # Construct expiry date
    $expires = getvalescaped("expires_year", "") . "-" . getvalescaped("expires_month", "") . "-" . getvalescaped("expires_day", "");
    # Construct usage
    $license_usage = "";
    if (isset($_POST["license_usage"])) {
        $license_usage = escape_check(join(", ", $_POST["license_usage"]));
    }
    if ($ref == "new") {
        # New record
        sql_query("insert into resource_license (resource,outbound,holder,license_usage,description,expires) values ('" . getvalescaped("resource", "") . "', '" . getvalescaped("outbound", "") . "', '" . getvalescaped("holder", "") . "', '{$license_usage}', '" . getvalescaped("description", "") . "', '{$expires}')");
        $ref = sql_insert_id();
        resource_log($resource, "", "", $lang["new_license"] . " " . $ref);

$default_sort = "DESC";
if (substr($order_by, 0, 5) == "field") {
    $default_sort = "ASC";
}
$sort = getval("sort", $default_sort);
$allowed_extensions = "";
if ($resource_type != "") {
    $allowed_extensions = get_allowed_extensions_by_type($resource_type);
}
$alternative = getvalescaped("alternative", "");
# Batch upload alternative files
$replace = getvalescaped("replace", "");
# Replace Resource Batch
$replace_resource = getvalescaped("replace_resource", "");
# Option to replace existing resource file
if ($replace_resource && !get_edit_access($replace_resource)) {
    $replace_resource = false;
}
# Create a new collection?
if ($collection_add == -1) {
    # The user has chosen Create New Collection from the dropdown.
    if ($collectionname == "") {
        $collectionname = "Upload " . date("YmdHis");
    }
    # Do not translate this string, the collection name is translated when displayed!
    $collection_add = create_collection($userref, $collectionname);
    if (getval("public", '0') == 1) {
        collection_set_public($collection_add);
    }
    if (strlen(getval("themestring", '')) > 0) {
        $themearr = explode('||', getval("themestring", ''));