2 # FCKeditor - The text editor for internet
3 # Copyright (C) 2003-2006 Frederico Caldeira Knabben
5 # Licensed under the terms of the GNU Lesser General Public License:
6 # http://www.opensource.org/licenses/lgpl-license.php
8 # For further information visit:
9 # http://www.fckeditor.net/
11 # "Support Open Source software. What about a donation today?"
13 # File Name: upload_fck.pl
14 # This is the File Manager Connector for Perl.
17 # Takashi Yamaguchi (jack@omakase.net)
24 # File size max(unit KB)
25 $MAX_CONTENT_SIZE = 30000;
27 # Filelock (1=use,0=not use)
31 # upload Content-Type list
32 my %UPLOAD_CONTENT_TYPE_LIST = (
33 'image/(x-)?png' => 'png', # PNG image
34 'image/p?jpe?g' => 'jpg', # JPEG image
35 'image/gif' => 'gif', # GIF image
36 'image/x-xbitmap' => 'xbm', # XBM image
38 'image/(x-(MS-)?)?bmp' => 'bmp', # Windows BMP image
39 'image/pict' => 'pict', # Macintosh PICT image
40 'image/tiff' => 'tif', # TIFF image
41 'application/pdf' => 'pdf', # PDF image
42 'application/x-shockwave-flash' => 'swf', # Shockwave Flash
44 'video/(x-)?msvideo' => 'avi', # Microsoft Video
45 'video/quicktime' => 'mov', # QuickTime Video
46 'video/mpeg' => 'mpeg', # MPEG Video
47 'video/x-mpeg2' => 'mpv2', # MPEG2 Video
49 'audio/(x-)?midi?' => 'mid', # MIDI Audio
50 'audio/(x-)?wav' => 'wav', # WAV Audio
51 'audio/basic' => 'au', # ULAW Audio
52 'audio/mpeg' => 'mpga', # MPEG Audio
54 'application/(x-)?zip(-compressed)?' => 'zip', # ZIP Compress
56 'text/html' => 'html', # HTML
57 'text/plain' => 'txt', # TEXT
58 '(?:application|text)/(?:rtf|richtext)' => 'rtf', # RichText
60 'application/msword' => 'doc', # Microsoft Word
61 'application/vnd.ms-excel' => 'xls', # Microsoft Excel
66 # Upload is permitted.
67 # A regular expression is possible.
68 my %UPLOAD_EXT_LIST = (
70 'p?jpe?g|jpe|jfif|pjp' => 'JPEG image',
74 'bmp|dib|rle' => 'Windows BMP image',
75 'pi?ct' => 'Macintosh PICT image',
76 'tiff?' => 'TIFF image',
78 'swf' => 'Shockwave Flash',
80 'avi' => 'Microsoft Video',
81 'moo?v|qt' => 'QuickTime Video',
82 'm(p(e?gv?|e|v)|1v)' => 'MPEG Video',
83 'mp(v2|2v)' => 'MPEG2 Video',
85 'midi?|kar|smf|rmi|mff' => 'MIDI Audio',
86 'wav' => 'WAVE Audio',
87 'au|snd' => 'ULAW Audio',
88 'mp(e?ga|2|a|3)|abs' => 'MPEG Audio',
90 'zip' => 'ZIP Compress',
91 'lzh' => 'LZH Compress',
92 'cab' => 'CAB Compress',
95 'rtf|rtx' => 'RichText',
103 my $CHARCODE = 'sjis';
105 $TRANS_2BYTE_CODE = 0;
107 ##############################################################################
115 ##############################################################################
118 eval("use File::Copy;");
119 eval("use File::Path;");
124 mkdir($img_dir,0777);
125 chmod(0777,$img_dir);
127 undef $img_data_exists;
129 undef @NEWFNAME_DATA;
131 if($ENV{'CONTENT_LENGTH'} > 10000000 || $ENV{'CONTENT_LENGTH'} > $MAX_CONTENT_SIZE * 1024) {
135 "Transmitting size is too large.MAX <strong>%d KB</strong> Now Size <strong>%d KB</strong>(<strong>%d bytes</strong> Over)",
137 int($ENV{'CONTENT_LENGTH'} / 1024),
138 $ENV{'CONTENT_LENGTH'} - $MAX_CONTENT_SIZE * 1024
144 if($ENV{'CONTENT_TYPE'} =~ /multipart\/form-data/) {
146 return unless($ENV{'CONTENT_LENGTH'});
149 # STDIN A pause character is detected.'(MacIE3.0 boundary of $ENV{'CONTENT_TYPE'} cannot be trusted.)
150 my $Boundary = <STDIN>;
151 $Boundary =~ s/\x0D\x0A//;
152 $Boundary = quotemeta($Boundary);
154 if(/^\s*Content-Disposition:/i) {
155 my($name,$ContentType,$FileName);
157 if(/\bname="([^"]+)"/i || /\bname=([^\s:;]+)/i) {
160 $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
163 if(/\bfilename="([^"]*)"/i || /\bfilename=([^\s:;]*)/i) {
164 $FileName = $1 || 'unknown';
169 if(/^\s*Content-Type:\s*"([^"]+)"/i || /^\s*Content-Type:\s*([^\s:;]+)/i) {
176 last if(/^$Boundary/o);
180 $value =~s /\x0D\x0A$//;
182 if($FileName || $ContentType) {
183 $img_data_exists = 1;
191 ) = &CheckContentType(\$value,$FileName,$ContentType);
193 $FORM{$name} = $FileName;
194 $new_fname = $FileName;
195 push(@NEWFNAME_DATA,"$FileName\t$Ext\t$Length\t$ImageWidth\t$ImageHeight\t$ContentName");
197 # Multi-upload correspondence
198 push(@NEWFNAMES,$new_fname);
199 open(OUT,">$img_dir/$new_fname");
201 eval "flock(OUT,2);" if($PM{'flock'} == 1);
203 eval "flock(OUT,8);" if($PM{'flock'} == 1);
208 $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
209 &Encode(\$value,'trans');
210 $FORM{$name} .= "\0" if(defined($FORM{$name}));
211 $FORM{$name} .= $value;
215 last if($lastline =~ /^$Boundary\-\-/o);
217 } elsif($ENV{'CONTENT_LENGTH'}) {
218 read(STDIN,$Buffer,$ENV{'CONTENT_LENGTH'});
220 foreach(split(/&/,$Buffer),split(/&/,$ENV{'QUERY_STRING'})) {
221 my($name, $value) = split(/=/);
223 $name =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
225 $value =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
228 &Encode(\$value,'trans');
229 $FORM{$name} .= "\0" if(defined($FORM{$name}));
230 $FORM{$name} .= $value;
236 ##############################################################################
244 ##############################################################################
248 my($DATA,$FileName,$ContentType) = @_;
249 my($Ext,$ImageWidth,$ImageHeight,$ContentName,$Infomation);
250 my $DataLength = length($$DATA);
252 # An unknown file type
257 || /^application\/(x-)?macbinary$/i
258 || /^application\/applefile$/i
259 || /^application\/octet-stream$/i
261 || /^x-unknown-content-type/i
264 # MacBinary(Mac Unnecessary data are deleted.)
265 if($UnknownType || $ENV{'HTTP_USER_AGENT'} =~ /Macintosh|Mac_/) {
266 if($DataLength > 128 && !unpack("C",substr($$DATA,0,1)) && !unpack("C",substr($$DATA,74,1)) && !unpack("C",substr($$DATA,82,1)) ) {
267 my $MacBinary_ForkLength = unpack("N", substr($$DATA, 83, 4)); # ForkLength Get
268 my $MacBinary_FileName = quotemeta(substr($$DATA, 2, unpack("C",substr($$DATA, 1, 1))));
269 if($MacBinary_FileName && $MacBinary_ForkLength && $DataLength >= $MacBinary_ForkLength + 128
270 && ($FileName =~ /$MacBinary_FileName/i || substr($$DATA,102,4) eq 'mBIN')) { # DATA TOP 128byte MacBinary!!
271 $$DATA = substr($$DATA,128,$MacBinary_ForkLength);
272 my $ResourceLength = $DataLength - $MacBinary_ForkLength - 128;
273 $DataLength = $MacBinary_ForkLength;
278 # A file name is changed into EUC.
279 # &jcode::convert(\$FileName,'euc',$FormCodeDefault);
280 # &jcode::h2z_euc(\$FileName);
281 $FileName =~ s/^.*\\//; # Windows, Mac
282 $FileName =~ s/^.*\///; # UNIX
283 $FileName =~ s/&/&/g;
284 $FileName =~ s/"/"/g;
285 $FileName =~ s/</</g;
286 $FileName =~ s/>/>/g;
288 # if($CHARCODE ne 'euc') {
289 # &jcode::convert(\$FileName,$CHARCODE,'euc');
292 # An extension is extracted and it changes into a small letter.
294 if($FileName =~ /\.(\w+)$/) {
296 $FileExt =~ tr/A-Z/a-z/;
299 # Executable file detection (ban on upload)
300 if($$DATA =~ /^MZ/) {
304 if(!$Ext && ($UnknownType || $ContentType =~ /^text\//i || $ContentType =~ /^application\/(?:rtf|richtext)$/i || $ContentType =~ /^image\/x-xbitmap$/i)
305 && ! $$DATA =~ /[\000-\006\177\377]/) {
306 # $$DATA =~ s/\x0D\x0A/\n/g;
307 # $$DATA =~ tr/\x0D\x0A/\n\n/;
310 # $$DATA =~ /<\s*SCRIPT(?:.|\n)*?>/i
311 # || $$DATA =~ /<\s*(?:.|\n)*?\bONLOAD\s*=(?:.|\n)*?>/i
312 # || $$DATA =~ /<\s*(?:.|\n)*?\bONCLICK\s*=(?:.|\n)*?>/i
314 # $Infomation = '(JavaScript contains)';
316 # if($$DATA =~ /<\s*TABLE(?:.|\n)*?>/i
317 # || $$DATA =~ /<\s*BLINK(?:.|\n)*?>/i
318 # || $$DATA =~ /<\s*MARQUEE(?:.|\n)*?>/i
319 # || $$DATA =~ /<\s*OBJECT(?:.|\n)*?>/i
320 # || $$DATA =~ /<\s*EMBED(?:.|\n)*?>/i
321 # || $$DATA =~ /<\s*FRAME(?:.|\n)*?>/i
322 # || $$DATA =~ /<\s*APPLET(?:.|\n)*?>/i
323 # || $$DATA =~ /<\s*FORM(?:.|\n)*?>/i
324 # || $$DATA =~ /<\s*(?:.|\n)*?\bSRC\s*=(?:.|\n)*?>/i
325 # || $$DATA =~ /<\s*(?:.|\n)*?\bDYNSRC\s*=(?:.|\n)*?>/i
327 # $Infomation = '(the HTML tag which is not safe is included)';
330 if($FileExt =~ /^txt$/i || $FileExt =~ /^cgi$/i || $FileExt =~ /^pl$/i) { # Text File
332 } elsif($ContentType =~ /^text\/html$/i || $FileExt =~ /html?/i || $$DATA =~ /<\s*HTML(?:.|\n)*?>/i) { # HTML File
334 } elsif($ContentType =~ /^image\/x-xbitmap$/i || $FileExt =~ /^xbm$/i) { # XBM(x-BitMap) Image
336 my ($XbmWidth, $XbmHeight);
337 if($$DATA =~ /\#define\s*$XbmName\_width\s*(\d+)/i) {
340 if($$DATA =~ /\#define\s*$XbmName\_height\s*(\d+)/i) {
343 if($XbmWidth && $XbmHeight) {
345 $ImageWidth = $XbmWidth;
346 $ImageHeight = $XbmHeight;
354 if(!$Ext && ($UnknownType || $ContentType =~ /^image\//i)) {
356 if($$DATA =~ /^\x89PNG\x0D\x0A\x1A\x0A/) {
357 if(substr($$DATA, 12, 4) eq 'IHDR') {
359 ($ImageWidth, $ImageHeight) = unpack("N2", substr($$DATA, 16, 8));
361 } elsif($$DATA =~ /^GIF8(?:9|7)a/) { # GIF89a(modified), GIF89a, GIF87a
363 ($ImageWidth, $ImageHeight) = unpack("v2", substr($$DATA, 6, 4));
364 } elsif($$DATA =~ /^II\x2a\x00\x08\x00\x00\x00/ || $$DATA =~ /^MM\x00\x2a\x00\x00\x00\x08/) { # TIFF
366 } elsif($$DATA =~ /^BM/) { # BMP
368 } elsif($$DATA =~ /^\xFF\xD8\xFF/ || $$DATA =~ /JFIF/) { # JPEG
369 my $HeaderPoint = index($$DATA, "\xFF\xD8\xFF", 0);
370 my $Point = $HeaderPoint + 2;
371 while($Point < $DataLength) {
372 my($Maker, $MakerType, $MakerLength) = unpack("C2n",substr($$DATA,$Point,4));
373 if($Maker != 0xFF || $MakerType == 0xd9 || $MakerType == 0xda) {
375 } elsif($MakerType >= 0xC0 && $MakerType <= 0xC3) {
377 ($ImageHeight, $ImageWidth) = unpack("n2", substr($$DATA, $Point + 5, 4));
378 if($HeaderPoint > 0) {
379 $$DATA = substr($$DATA, $HeaderPoint);
380 $DataLength = length($$DATA);
384 $Point += $MakerLength + 2;
391 if(!$Ext && ($UnknownType || $ContentType =~ /^audio\//i)) {
393 if($$DATA =~ /^MThd/) {
395 } elsif($$DATA =~ /^\x2esnd/) { # ULAW Audio
397 } elsif($$DATA =~ /^RIFF/ || $$DATA =~ /^ID3/ && $$DATA =~ /RIFF/) {
398 my $HeaderPoint = index($$DATA, "RIFF", 0);
399 $_ = substr($$DATA, $HeaderPoint + 8, 8);
402 if(unpack("V",substr($$DATA, $HeaderPoint + 16, 4)) == 16) {
404 } else { # RIFF WAVE MP3
407 } elsif(/^RMIDdata$/) { # RIFF MIDI
409 } elsif(/^RMP3data$/) { # RIFF MP3
412 if($ContentType =~ /^audio\//i) {
413 $Infomation .= '(RIFF '. substr($$DATA, $HeaderPoint + 8, 4). ')';
421 if($$DATA =~ /^\%PDF/) {
422 # Picture size is not measured.
424 } elsif($$DATA =~ /^FWS/) { # Shockwave Flash
426 } elsif($$DATA =~ /^RIFF/ || $$DATA =~ /^ID3/ && $$DATA =~ /RIFF/) {
427 my $HeaderPoint = index($$DATA, "RIFF", 0);
428 $_ = substr($$DATA,$HeaderPoint + 8, 8);
433 if($ContentType =~ /^video\//i) {
434 $Infomation .= '(RIFF '. substr($$DATA, $HeaderPoint + 8, 4). ')';
436 } elsif($$DATA =~ /^PK/) { # ZIP Compress File
438 } elsif($$DATA =~ /^MSCF/) { # CAB Compress File
440 } elsif($$DATA =~ /^Rar\!/) { # RAR Compress File
442 } elsif(substr($$DATA, 2, 5) =~ /^\-lh(\d+|d)\-$/) { # LHA Compress File
443 $Infomation .= "(lh$1)";
445 } elsif(substr($$DATA, 325, 25) eq "Apple Video Media Handler" || substr($$DATA, 325, 30) eq "Apple \x83\x72\x83\x66\x83\x49\x81\x45\x83\x81\x83\x66\x83\x42\x83\x41\x83\x6E\x83\x93\x83\x68\x83\x89") {
451 # Header analysis failure
453 # It will be followed if it applies for the MIME type from the browser.
454 foreach (keys %UPLOAD_CONTENT_TYPE_LIST) {
456 if($ContentType =~ /^$_$/i) {
457 $Ext = $UPLOAD_CONTENT_TYPE_LIST{$_};
458 $ContentName = &CheckContentExt($Ext);
482 $Infomation .= ' / Header analysis failure';
484 if($Ext ne $FileExt && &CheckContentExt($FileExt) eq $ContentName) {
490 # a MIME type is unknown--It judges from an extension.
492 $ContentName = &CheckContentExt($FileExt);
495 $Infomation .= ' / MIME type is unknown('. $ContentType. ')';
501 # $ContentName = &CheckContentExt($Ext) unless($ContentName);
502 # if($Ext && $ContentName) {
503 # $ContentName .= $Infomation;
507 # "$FileName A not corresponding extension ($Ext)<BR>The extension which can be responded ". join(',', sort values(%UPLOAD_EXT_LIST))
512 # if($Ext =~ /.?html?/ && $$DATA =~ /<\!/) {
521 # $$DATA =~ s/\#\s*$_/\&\#35\;$_/ig
528 int($DataLength / 1024 + 1),
535 ##############################################################################
538 # Extension discernment
543 ##############################################################################
550 foreach (keys %UPLOAD_EXT_LIST) {
552 if($_ && $Ext =~ /^$_$/) {
553 $ContentName = $UPLOAD_EXT_LIST{$_};
561 ##############################################################################
569 ##############################################################################
573 my($value,$Trans) = @_;
575 # my $FormCode = &jcode::getcode($value) || $FormCodeDefault;
576 # $FormCodeDefault ||= $FormCode;
578 # if($Trans && $TRANS_2BYTE_CODE) {
579 # if($FormCode ne 'euc') {
580 # &jcode::convert($value, 'euc', $FormCode);
584 # "\xA3\xB0-\xA3\xB9\xA3\xC1-\xA3\xDA\xA3\xE1-\xA3\xFA",
587 # if($CHARCODE ne 'euc') {
588 # &jcode::convert($value,$CHARCODE,'euc');
591 # if($CHARCODE ne $FormCode) {
592 # &jcode::convert($value,$CHARCODE,$FormCode);
595 # if($CHARCODE eq 'euc') {
596 # &jcode::h2z_euc($value);
597 # } elsif($CHARCODE eq 'sjis') {
598 # &jcode::h2z_sjis($value);
603 ##############################################################################
611 ##############################################################################
616 local($error_message) = $_[0];
617 local($error_message2) = $_[1];
619 print "Content-type: text/html\n\n";
623 <TITLE>Error Message</TITLE></HEAD>
625 <table border="1" cellspacing="10" cellpadding="10">
626 <TR bgcolor="#0000B0">
627 <TD bgcolor="#0000B0" NOWRAP><font size="-1" color="white"><B>Error Message</B></font></TD>
631 <H4> $error_message </H4>
637 &rm_tmp_uploaded_files; # Image Temporary deletion
641 ##############################################################################
644 # Image Temporary deletion
649 ##############################################################################
651 sub rm_tmp_uploaded_files
653 if($img_data_exists == 1){
655 foreach $fname_list(@NEWFNAMES) {
656 if(-e "$img_dir/$fname_list") {
657 unlink("$img_dir/$fname_list");