Sources/PackageGet.php ➔ PackageUpload()

Complexity

Conditions	27
Paths	288

Size

Total Lines	89
Code Lines	50

Duplication

Lines	12
Ratio	13.48 %

Importance

Changes

0

<?php
function PackageUpload()
{
	global $txt, $scripturl, $context, $packagesdir;

	// Setup the correct template, even though I'll admit we ain't downloading ;)
	$context['sub_template'] = 'downloaded';
	$allowext = array('.zip','.tgz','.gz');
	// @todo Use FTP if the Packages directory is not writable.

	// Check the file was even sent!
	if (!isset($_FILES['package']['name']) || $_FILES['package']['name'] == '')
		fatal_lang_error('package_upload_error_nofile');
	elseif (!is_uploaded_file($_FILES['package']['tmp_name']) || (ini_get('open_basedir') == '' && !file_exists($_FILES['package']['tmp_name'])))

This code seems to be duplicated across your project.

		fatal_lang_error('package_upload_error_failed');

	// Make sure it has a sane filename.
	$_FILES['package']['name'] = preg_replace(array('/\s/', '/\.[\.]+/', '/[^\w_\.\-]/'), array('_', '.', ''), $_FILES['package']['name']);
	$extension = substr(strrchr(strtolower($_FILES['package']['name']), '.'), 0);
	if(!in_array($extension, $allowext))
	{
		fatal_lang_error('package_upload_error_supports', false, array('zip, tgz, tar.gz'));

false is of type boolean, but the function expects a string.

	}
	
	// We only need the filename...
	$extension = ($extension == '.gz') ? '.tar.gz' : $extension ;
	$packageName = time() . $extension;

	// Setup the destination and throw an error if the file is already there!
	$destination = $packagesdir . '/' . $packageName;
	// @todo Maybe just roll it like we do for downloads?
	if (file_exists($destination))
		fatal_lang_error('package_upload_error_exists');

	// Now move the file.
	move_uploaded_file($_FILES['package']['tmp_name'], $destination);
	smf_chmod($destination, 0777);

	// If we got this far that should mean it's available.
	$context['package'] = getPackageInfo($packageName);
	$context['package_server'] = '';

	// Not really a package, you lazy bum!
	if (!is_array($context['package']))
	{
		@unlink($destination);

It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

		loadLanguage('Errors');
		$txt[$context['package']] = str_replace('{MANAGETHEMEURL}', $scripturl . '?action=admin;area=theme;sa=admin;' . $context['session_var'] . '=' . $context['session_id'] . '#theme_install', $txt[$context['package']]);
		fatal_lang_error('package_upload_error_broken', false, $txt[$context['package']]);

false is of type boolean, but the function expects a string.

	}
	// Is it already uploaded, maybe?
	elseif ($dir = @opendir($packagesdir))
	{
		while ($package = readdir($dir))
		{
			if ($package == '.' || $package == '..' || $package == 'temp' || $package == $packageName || (!(is_dir($packagesdir . '/' . $package) && file_exists($packagesdir . '/' . $package . '/package-info.xml')) && substr(strtolower($package), -7) != '.tar.gz' && substr(strtolower($package), -4) != '.tgz' && substr(strtolower($package), -4) != '.zip'))

This code seems to be duplicated across your project.

				continue;

			$packageInfo = getPackageInfo($package);
			if (!is_array($packageInfo))
				continue;

			if ($packageInfo['id'] == $context['package']['id'] && $packageInfo['version'] == $context['package']['version'])
			{
				@unlink($destination);

It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

				loadLanguage('Errors');
				fatal_lang_error('package_upload_error_exists');
			}
		}
		closedir($dir);
	}

	if ($context['package']['type'] == 'modification')

This code seems to be duplicated across your project.

		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=admin;area=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['install_mod'] . ' ]</a>';
	elseif ($context['package']['type'] == 'avatar')
		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=admin;area=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['use_avatars'] . ' ]</a>';
	elseif ($context['package']['type'] == 'language')
		$context['package']['install']['link'] = '<a href="' . $scripturl . '?action=admin;area=packages;sa=install;package=' . $context['package']['filename'] . '">[ ' . $txt['add_languages'] . ' ]</a>';
	else
		$context['package']['install']['link'] = '';

	// Does a 3rd party hook want to do some additional changes?
	call_integration_hook('integrate_package_upload');

	$context['package']['list_files']['link'] = '<a href="' . $scripturl . '?action=admin;area=packages;sa=list;package=' . $context['package']['filename'] . '">[ ' . $txt['list_files'] . ' ]</a>';

	unset($context['package']['xml']);

	$context['page_title'] = $txt['package_uploaded_success'];
}