/**
 * Return a CT file for download
 */
function churchcore__filedownload()
{
    global $files_dir;
    include_once CHURCHCORE . "/churchcore_db.php";
    $mime_types = getMimeTypes();
    $file = db_query("SELECT * FROM {cc_file} f\n                    WHERE f.id=:id AND filename=:filename", array(":id" => getVar("id"), ":filename" => getVar("filename")))->fetch();
    if (preg_match('/^[0-9a-f]{64}$/i', $file->filename)) {
        $filename = "{$files_dir}/blobs/{$file->filename}";
    } else {
        $filename = "{$files_dir}/files/{$file->domain_type}/{$file->domain_id}/{$file->filename}";
    }
    //open file for binary read
    $handle = fopen($filename, "rb");
    if ($handle === false) {
        echo "Die Datei konnte nicht gelesen werden!";
    } else {
        if (isset($mime_types[substr(strrchr($file->bezeichnung, '.'), 1)])) {
            drupal_add_http_header('Content-Type', $mime_types[substr(strrchr($filename, '.'), 1)], false);
        } else {
            drupal_add_http_header('Content-Type', 'application/unknown', false);
        }
        if (getVar("type") == "download") {
            drupal_add_http_header('Content-Disposition', 'attachment;filename="' . $file->bezeichnung . '"', false);
        } else {
            drupal_add_http_header('Content-Disposition', 'inline;filename="' . $file->bezeichnung . '"', false);
        }
        drupal_add_http_header('Cache-Control', 'private', true);
        //disable output buffer and delete contents
        ob_end_clean();
        //steam all data to apache output buffer
        fpassthru($handle);
        //close file handle
        fclose($handle);
    }
}

/**
 * Returns the (known) extension and mimetype of a given filename
 *
 * If $knownonly is true (the default), then only known extensions
 * are returned.
 *
 * @author Andreas Gohr <[email protected]>
 */
function mimetype($file, $knownonly = true)
{
    $ret = array(false, false, false);
    // return array
    $mtypes = getMimeTypes();
    // known mimetypes
    $exts = join('|', array_keys($mtypes));
    // known extensions (regexp)
    if (!$knownonly) {
        $exts = $exts . '|[_\\-A-Za-z0-9]+';
        // any extension
    }
    if (preg_match('#\\.(' . $exts . ')$#i', $file, $matches)) {
        $ext = strtolower($matches[1]);
    }
    if ($ext) {
        if (isset($mtypes[$ext])) {
            if ($mtypes[$ext][0] == '!') {
                $ret = array($ext, substr($mtypes[$ext], 1), true);
            } else {
                $ret = array($ext, $mtypes[$ext], false);
            }
        } elseif (!$knownonly) {
            $ret = array($ext, 'application/octet-stream', true);
        }
    }
    return $ret;
}

/**
 * Return an CT file for download
 */
function churchcore__filedownload()
{
    global $files_dir;
    include_once CHURCHCORE . "/churchcore_db.php";
    $mime_types = getMimeTypes();
    $file = db_query("select * from {cc_file} f where f.id=:id and filename=:filename", array(":id" => $_GET["id"], ":filename" => $_GET["filename"]))->fetch();
    $filename = "{$files_dir}/files/{$file->domain_type}/{$file->domain_id}/{$file->filename}";
    $handle = fopen($filename, "rb");
    if ($handle == false) {
        echo "Die Datei konnte nicht gefunden werden!";
    } else {
        $contents = fread($handle, filesize($filename));
        fclose($handle);
        if (isset($mime_types[substr(strrchr($filename, '.'), 1)])) {
            drupal_add_http_header('Content-Type', $mime_types[substr(strrchr($filename, '.'), 1)], false);
        } else {
            drupal_add_http_header('Content-Type', 'application/unknown', false);
        }
        if (isset($_GET["type"]) && $_GET["type"] == "download") {
            drupal_add_http_header('Content-Disposition', 'attachment;filename="' . $file->bezeichnung . '"', false);
        } else {
            drupal_add_http_header('Content-Disposition', 'inline;filename="' . $file->bezeichnung . '"', false);
        }
        drupal_add_http_header('Cache-Control', 'must-revalidate, post-check=0, pre-check=0', false);
        drupal_add_http_header('Cache-Control', 'private', true);
        $content = drupal_get_header();
        echo $contents;
    }
}

 function get_ckgedit_ImageAllowedExtensions()
 {
     $uploadImageTypes = array();
     foreach (getMimeTypes() as $ext => $mtype) {
         if (preg_match("/image/", $mtype)) {
             $uploadImageTypes[] = $ext;
         }
     }
     return '.(' . implode('|', $uploadImageTypes) . ')$';
 }

function getMimeTypeOfFile($file)
{
    static $types;
    if (!isset($types)) {
        $types = getMimeTypes();
    }
    $ext = pathinfo($file, PATHINFO_EXTENSION);
    if (!$ext) {
        $ext = $file;
    }
    $ext = strtolower($ext);
    return isset($types[$ext]) ? $types[$ext] : null;
}

 public function handle_ajax_call_unknown(Doku_Event &$event, $param)
 {
     if ($event->data != 'plugin_imgpaste') {
         return;
     }
     global $lang;
     // get data
     global $INPUT;
     $data = $INPUT->post->str('data');
     list($type, $data) = explode(';', $data);
     if (!$data) {
         $this->fail(400, $this->getLang('e_nodata'));
     }
     // process data encoding
     $type = strtolower(substr($type, 5));
     // strip 'data:' prefix
     $data = substr($data, 7);
     // strip 'base64,' prefix
     $data = base64_decode($data);
     // check for supported mime type
     $mimetypes = array_flip(getMimeTypes());
     if (!isset($mimetypes[$type])) {
         $this->fail(415, $lang['uploadwrong']);
     }
     // prepare file names
     $tempname = $this->storetemp($data);
     $filename = $this->getConf('filename');
     $filename = str_replace(array('@NS@', '@ID@', '@USER@'), array(getNS($INPUT->post->str('id')), $INPUT->post->str('id'), $_SERVER['REMOTE_USER']), $filename);
     $filename = strftime($filename);
     $filename .= '.' . $mimetypes[$type];
     $filename = cleanID($filename);
     // check ACLs
     $auth = auth_quickaclcheck($filename);
     if ($auth < AUTH_UPLOAD) {
         $this->fail(403, $lang['uploadfail']);
     }
     // do the actual saving
     $result = media_save(array('name' => $tempname, 'mime' => $type, 'ext' => $mimetypes[$type]), $filename, false, $auth, 'copy');
     if (is_array($result)) {
         $this->fail(500, $result[0]);
     }
     //Still here? We had a successful upload
     $this->clean();
     header('Content-Type: application/json');
     $json = new JSON();
     echo $json->encode(array('message' => $lang['uploadsucc'], 'id' => $result));
     $event->preventDefault();
     $event->stopPropagation();
 }

/**
 * Returns the (known) extension and mimetype of a given filename
 *
 * @author Andreas Gohr <[email protected]>
 */
function mimetype($file)
{
    $ret = array(false, false);
    // return array
    $mtypes = getMimeTypes();
    // known mimetypes
    $exts = join('|', array_keys($mtypes));
    // known extensions (regexp)
    if (preg_match('#\\.(' . $exts . ')$#i', $file, $matches)) {
        $ext = strtolower($matches[1]);
    }
    if ($ext && $mtypes[$ext]) {
        $ret = array($ext, $mtypes[$ext]);
    }
    return $ret;
}

/**
 * Returns the (known) extension and mimetype of a given filename
 *
 * If $knownonly is true (the default), then only known extensions
 * are returned.
 *
 * @author Andreas Gohr <[email protected]>
 */
function mimetype($file, $knownonly = true)
{
    $mtypes = getMimeTypes();
    // known mimetypes
    $ext = strrpos($file, '.');
    if ($ext === false) {
        return array(false, false, false);
    }
    $ext = strtolower(substr($file, $ext + 1));
    if (!isset($mtypes[$ext])) {
        if ($knownonly) {
            return array(false, false, false);
        } else {
            return array($ext, 'application/octet-stream', true);
        }
    }
    if ($mtypes[$ext][0] == '!') {
        return array($ext, substr($mtypes[$ext], 1), true);
    } else {
        return array($ext, $mtypes[$ext], false);
    }
}

 function getFilePro($path, $showPre = false)
 {
     if (!file_exists($path)) {
         return $this->err->catchErr($this->getSysMsg(1001, $path));
     }
     $pre['name'] = basename($path);
     $pre['path'] = $path;
     $pre['isDir'] = is_dir($path) ? true : false;
     if ($showPre) {
         $pre['lastName'] = substr(strrchr($pre['name'], "."), 1);
         if ($pre['isDir']) {
             $pre['type'] = "文件夹";
         } else {
             include_once dirname(__FILE__) . '/mimetypes.inc.php';
             $mimeTypes = getMimeTypes();
             $pre['type'] = isset($mimeTypes[strtolower($pre['lastName'])]) ? $mimeTypes[strtolower($pre['lastName'])] : $pre['lastName'] . " 文件";
         }
         $fileSize = $pre['isDir'] ? "" : filesize($path);
         $permissions = $this->getFilePermissions(fileperms($path));
         $lastModified = date("Y-m-d H:i:s", filemtime($path));
         $pre['size'] = $fileSize;
         $pre['formatSize'] = $this->formatSize($fileSize);
         $pre['permissions'] = $permissions;
         $pre['lastModified'] = $lastModified;
     }
     return $pre;
 }

/**
 * Handles media file uploads
 *
 * This generates an action event and delegates to _media_upload_action().
 * Action plugins are allowed to pre/postprocess the uploaded file.
 * (The triggered event is preventable.)
 *
 * Event data:
 * $data[0]     fn_tmp: the temporary file name (read from $_FILES)
 * $data[1]     fn: the file name of the uploaded file
 * $data[2]     id: the future directory id of the uploaded file
 * $data[3]     imime: the mimetype of the uploaded file
 *
 * @triggers MEDIA_UPLOAD_FINISH
 * @author Andreas Gohr <[email protected]>
 * @author Michael Klier <[email protected]>
 * @return mixed false on error, id of the new file on success
 */
function media_upload($ns, $auth)
{
    if ($auth < AUTH_UPLOAD) {
        return false;
    }
    if (!checkSecurityToken()) {
        return false;
    }
    require_once DOKU_INC . 'inc/confutils.php';
    global $lang;
    global $conf;
    // get file and id
    $id = $_POST['id'];
    $file = $_FILES['upload'];
    if (empty($id)) {
        $id = $file['name'];
    }
    // check extensions
    list($fext, $fmime) = mimetype($file['name']);
    list($iext, $imime) = mimetype($id);
    if ($fext && !$iext) {
        // no extension specified in id - read original one
        $id .= '.' . $fext;
        $imime = $fmime;
    } elseif ($fext && $fext != $iext) {
        // extension was changed, print warning
        msg(sprintf($lang['mediaextchange'], $fext, $iext));
    }
    // get filename
    $id = cleanID($ns . ':' . $id);
    $fn = mediaFN($id);
    // get filetype regexp
    $types = array_keys(getMimeTypes());
    $types = array_map(create_function('$q', 'return preg_quote($q,"/");'), $types);
    $regex = join('|', $types);
    // because a temp file was created already
    if (preg_match('/\\.(' . $regex . ')$/i', $fn)) {
        //check for overwrite
        if (@file_exists($fn) && (!$_POST['ow'] || $auth < AUTH_DELETE)) {
            msg($lang['uploadexist'], 0);
            return false;
        }
        // check for valid content
        $ok = media_contentcheck($file['tmp_name'], $imime);
        if ($ok == -1) {
            msg(sprintf($lang['uploadbadcontent'], ".{$iext}"), -1);
            return false;
        } elseif ($ok == -2) {
            msg($lang['uploadspam'], -1);
            return false;
        } elseif ($ok == -3) {
            msg($lang['uploadxss'], -1);
            return false;
        }
        // prepare event data
        $data[0] = $file['tmp_name'];
        $data[1] = $fn;
        $data[2] = $id;
        $data[3] = $imime;
        // trigger event
        return trigger_event('MEDIA_UPLOAD_FINISH', $data, '_media_upload_action', true);
    } else {
        msg($lang['uploadwrong'], -1);
    }
    return false;
}

<?php

/**
 * DokuWiki media passthrough file
 *
 * @license    GPL 2 (http://www.gnu.org/licenses/gpl.html)
 * @author     Andreas Gohr <[email protected]>
 */
if (!defined('DOKU_INC')) {
    define('DOKU_INC', dirname(__FILE__) . '/../../');
}
define('DOKU_DISABLE_GZIP_OUTPUT', 1);
require_once DOKU_INC . 'inc/init.php';
//close session
session_write_close();
$mimetypes = getMimeTypes();
//get input
$MEDIA = stripctl(getID('media', false));
// no cleaning except control chars - maybe external
$CACHE = calc_cache($_REQUEST['cache']);
$WIDTH = (int) $_REQUEST['w'];
$HEIGHT = (int) $_REQUEST['h'];
list($EXT, $MIME, $DL) = mimetype($MEDIA, false);
if ($EXT === false) {
    $EXT = 'unknown';
    $MIME = 'application/octet-stream';
    $DL = true;
}
// check for permissions, preconditions and cache external files
list($STATUS, $STATUSMESSAGE) = checkFileStatus($MEDIA, $FILE);
// prepare data for plugin events

 /**
  * Uploads a file to the wiki.
  *
  * Michael Klier <[email protected]>
  */
 function putAttachment($id, $file, $params)
 {
     $id = cleanID($id);
     global $conf;
     global $lang;
     $auth = auth_quickaclcheck(getNS($id) . ':*');
     if ($auth >= AUTH_UPLOAD) {
         if (!isset($id)) {
             return new IXR_ERROR(1, 'Filename not given.');
         }
         $ftmp = $conf['tmpdir'] . '/' . md5($id . clientIP());
         // save temporary file
         @unlink($ftmp);
         $buff = base64_decode($file);
         io_saveFile($ftmp, $buff);
         // get filename
         list($iext, $imime, $dl) = mimetype($id);
         $id = cleanID($id);
         $fn = mediaFN($id);
         // get filetype regexp
         $types = array_keys(getMimeTypes());
         $types = array_map(create_function('$q', 'return preg_quote($q,"/");'), $types);
         $regex = join('|', $types);
         // because a temp file was created already
         if (preg_match('/\\.(' . $regex . ')$/i', $fn)) {
             //check for overwrite
             $overwrite = @file_exists($fn);
             if ($overwrite && (!$params['ow'] || $auth < AUTH_DELETE)) {
                 return new IXR_ERROR(1, $lang['uploadexist'] . '1');
             }
             // check for valid content
             $ok = media_contentcheck($ftmp, $imime);
             if ($ok == -1) {
                 return new IXR_ERROR(1, sprintf($lang['uploadexist'] . '2', ".{$iext}"));
             } elseif ($ok == -2) {
                 return new IXR_ERROR(1, $lang['uploadspam']);
             } elseif ($ok == -3) {
                 return new IXR_ERROR(1, $lang['uploadxss']);
             }
             // prepare event data
             $data[0] = $ftmp;
             $data[1] = $fn;
             $data[2] = $id;
             $data[3] = $imime;
             $data[4] = $overwrite;
             // trigger event
             return trigger_event('MEDIA_UPLOAD_FINISH', $data, array($this, '_media_upload_action'), true);
         } else {
             return new IXR_ERROR(1, $lang['uploadwrong']);
         }
     } else {
         return new IXR_ERROR(1, "You don't have permissions to upload files.");
     }
 }

/**
 * This generates an action event and delegates to _media_upload_action().
 * Action plugins are allowed to pre/postprocess the uploaded file.
 * (The triggered event is preventable.)
 *
 * Event data:
 * $data[0]     fn_tmp: the temporary file name (read from $_FILES)
 * $data[1]     fn: the file name of the uploaded file
 * $data[2]     id: the future directory id of the uploaded file
 * $data[3]     imime: the mimetype of the uploaded file
 * $data[4]     overwrite: if an existing file is going to be overwritten
 *
 * @triggers MEDIA_UPLOAD_FINISH
 */
function media_save($file, $id, $ow, $auth, $move)
{
    if ($auth < AUTH_UPLOAD) {
        return array("You don't have permissions to upload files.", -1);
    }
    if (!isset($file['mime']) || !isset($file['ext'])) {
        list($ext, $mime) = mimetype($id);
        if (!isset($file['mime'])) {
            $file['mime'] = $mime;
        }
        if (!isset($file['ext'])) {
            $file['ext'] = $ext;
        }
    }
    global $lang, $conf;
    // get filename
    $id = cleanID($id);
    $fn = mediaFN($id);
    // get filetype regexp
    $types = array_keys(getMimeTypes());
    $types = array_map(create_function('$q', 'return preg_quote($q,"/");'), $types);
    $regex = join('|', $types);
    // because a temp file was created already
    if (!preg_match('/\\.(' . $regex . ')$/i', $fn)) {
        return array($lang['uploadwrong'], -1);
    }
    //check for overwrite
    $overwrite = @file_exists($fn);
    $auth_ow = $conf['mediarevisions'] ? AUTH_UPLOAD : AUTH_DELETE;
    if ($overwrite && (!$ow || $auth < $auth_ow)) {
        return array($lang['uploadexist'], 0);
    }
    // check for valid content
    $ok = media_contentcheck($file['name'], $file['mime']);
    if ($ok == -1) {
        return array(sprintf($lang['uploadbadcontent'], '.' . $file['ext']), -1);
    } elseif ($ok == -2) {
        return array($lang['uploadspam'], -1);
    } elseif ($ok == -3) {
        return array($lang['uploadxss'], -1);
    }
    // prepare event data
    $data[0] = $file['name'];
    $data[1] = $fn;
    $data[2] = $id;
    $data[3] = $file['mime'];
    $data[4] = $overwrite;
    $data[5] = $move;
    // trigger event
    return trigger_event('MEDIA_UPLOAD_FINISH', $data, '_media_upload_action', true);
}

/**
 * Print the media upload form if permissions are correct
 *
 * @author Andreas Gohr <[email protected]>
 */
function media_uploadform($ns, $auth)
{
    global $lang;
    if ($auth < AUTH_UPLOAD) {
        return;
    }
    //fixme print info on missing permissions?
    // The default HTML upload form
    $form = new Doku_Form(array('id' => 'dw__upload', 'action' => DOKU_BASE . 'lib/exe/mediamanager.php', 'enctype' => 'multipart/form-data'));
    $form->addElement('<div class="upload">' . $lang['mediaupload'] . '</div>');
    $form->addElement(formSecurityToken());
    $form->addHidden('ns', hsc($ns));
    $form->addElement(form_makeOpenTag('p'));
    $form->addElement(form_makeFileField('upload', $lang['txt_upload'] . ':', 'upload__file'));
    $form->addElement(form_makeCloseTag('p'));
    $form->addElement(form_makeOpenTag('p'));
    $form->addElement(form_makeTextField('id', '', $lang['txt_filename'] . ':', 'upload__name'));
    $form->addElement(form_makeButton('submit', '', $lang['btn_upload']));
    $form->addElement(form_makeCloseTag('p'));
    if ($auth >= AUTH_DELETE) {
        $form->addElement(form_makeOpenTag('p'));
        $form->addElement(form_makeCheckboxField('ow', 1, $lang['txt_overwrt'], 'dw__ow', 'check'));
        $form->addElement(form_makeCloseTag('p'));
    }
    html_form('upload', $form);
    // prepare flashvars for multiupload
    $opt = array('L_gridname' => $lang['mu_gridname'], 'L_gridsize' => $lang['mu_gridsize'], 'L_gridstat' => $lang['mu_gridstat'], 'L_namespace' => $lang['mu_namespace'], 'L_overwrite' => $lang['txt_overwrt'], 'L_browse' => $lang['mu_browse'], 'L_upload' => $lang['btn_upload'], 'L_toobig' => $lang['mu_toobig'], 'L_ready' => $lang['mu_ready'], 'L_done' => $lang['mu_done'], 'L_fail' => $lang['mu_fail'], 'L_authfail' => $lang['mu_authfail'], 'L_progress' => $lang['mu_progress'], 'L_filetypes' => $lang['mu_filetypes'], 'L_info' => $lang['mu_info'], 'L_lasterr' => $lang['mu_lasterr'], 'O_ns' => ":{$ns}", 'O_backend' => 'mediamanager.php?' . session_name() . '=' . session_id(), 'O_maxsize' => php_to_byte(ini_get('upload_max_filesize')), 'O_extensions' => join('|', array_keys(getMimeTypes())), 'O_overwrite' => $auth >= AUTH_DELETE, 'O_sectok' => getSecurityToken(), 'O_authtok' => auth_createToken());
    $var = buildURLparams($opt);
    // output the flash uploader
    ?>
        <div id="dw__flashupload" style="display:none">
        <div class="upload"><?php 
    echo $lang['mu_intro'];
    ?>
</div>
        <?php 
    echo html_flashobject('multipleUpload.swf', '500', '190', null, $opt);
    ?>
        </div>
        <?php 
}

/**
 * Prints classes for file download links
 *
 * @author Andreas Gohr <[email protected]>
 */
function css_filetypes()
{
    // default style
    echo 'a.mediafile {';
    echo ' background: transparent url(' . DOKU_BASE . 'lib/images/fileicons/file.png) 0px 1px no-repeat;';
    echo ' padding-left: 18px;';
    echo ' padding-bottom: 1px;';
    echo '}';
    // additional styles when icon available
    $mimes = getMimeTypes();
    foreach (array_keys($mimes) as $mime) {
        $class = preg_replace('/[^_\\-a-z0-9]+/i', '_', $mime);
        if (@file_exists(DOKU_INC . 'lib/images/fileicons/' . $mime . '.png')) {
            echo "a.mf_{$class} {";
            echo '  background-image: url(' . DOKU_BASE . 'lib/images/fileicons/' . $mime . '.png)';
            echo '}';
        } elseif (@file_exists(DOKU_INC . 'lib/images/fileicons/' . $mime . '.gif')) {
            echo "a.mf_{$class} {";
            echo '  background-image: url(' . DOKU_BASE . 'lib/images/fileicons/' . $mime . '.gif)';
            echo '}';
        }
    }
}

function uploaldValiddate($filename, $type, array $extensiones)
{
    $filename = (string) $filename;
    $mimetypes = getMimeTypes($extensiones);
    $extension = pathinfo($filename, PATHINFO_EXTENSION);
    $return = false;
    if (array_key_exists($extension, $mimetypes) && array_search($type, $mimetypes[$extension]) !== false) {
        $return = true;
    }
    return $return;
}

/**
 * Determines the mime type of a file
 * @param $filename the system filename
 * @return string
 */
function getMimeType($filename)
{
    if (function_exists('mime_content_type')) {
        $mime = mime_content_type($filename);
    }
    if (!$mime && function_exists('finfo_file')) {
        $finfo = finfo_open(FILEINFO_MIME_TYPE);
        $type = finfo_file($finfo, $filename);
        finfo_close($finfo);
        $mime = $type;
    }
    if (!$mime && strtoupper(substr(PHP_OS, 0, 3)) !== 'WIN') {
        // linux
        $type = exec('file -b -i ' . escapeshellarg($filename), $foo, $returnCode);
        if ($returnCode === 0 && $type) {
            $type = explode(';', $type);
            $mime = $type[0];
        }
    }
    if (!$mime || preg_match('/^text\\//', $mime)) {
        $ext = strtolower(array_pop(explode('.', $filename)));
        $mime_types = getMimeTypes();
        if (array_key_exists($ext, $mime_types)) {
            $mime = $mime_types[$ext];
        }
    }
    return $mime;
}

 /**
  * @param  string  $mime
  * @return string
  */
 public function getExtByMime($mime)
 {
     return array_search($mime, getMimeTypes());
 }