1<?php
2# MantisBT - A PHP based bugtracking system
3
4# MantisBT is free software: you can redistribute it and/or modify
5# it under the terms of the GNU General Public License as published by
6# the Free Software Foundation, either version 2 of the License, or
7# (at your option) any later version.
8#
9# MantisBT is distributed in the hope that it will be useful,
10# but WITHOUT ANY WARRANTY; without even the implied warranty of
11# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12# GNU General Public License for more details.
13#
14# You should have received a copy of the GNU General Public License
15# along with MantisBT.  If not, see <http://www.gnu.org/licenses/>.
16
17/**
18 * Update Project Document
19 *
20 * @package MantisBT
21 * @copyright Copyright 2000 - 2002  Kenzaburo Ito - kenito@300baud.org
22 * @copyright Copyright 2002  MantisBT Team - mantisbt-dev@lists.sourceforge.net
23 * @link http://www.mantisbt.org
24 *
25 * @uses core.php
26 * @uses access_api.php
27 * @uses config_api.php
28 * @uses constant_inc.php
29 * @uses database_api.php
30 * @uses file_api.php
31 * @uses form_api.php
32 * @uses gpc_api.php
33 * @uses helper_api.php
34 * @uses html_api.php
35 * @uses lang_api.php
36 * @uses print_api.php
37 * @uses utility_api.php
38 */
39
40require_once( 'core.php' );
41require_api( 'access_api.php' );
42require_api( 'config_api.php' );
43require_api( 'constant_inc.php' );
44require_api( 'database_api.php' );
45require_api( 'file_api.php' );
46require_api( 'form_api.php' );
47require_api( 'gpc_api.php' );
48require_api( 'helper_api.php' );
49require_api( 'html_api.php' );
50require_api( 'lang_api.php' );
51require_api( 'print_api.php' );
52require_api( 'utility_api.php' );
53
54form_security_validate( 'proj_doc_update' );
55
56# Check if project documentation feature is enabled.
57if( OFF == config_get( 'enable_project_documentation' ) ||
58	!file_is_uploading_enabled() ||
59	!file_allow_project_upload() ) {
60	access_denied();
61}
62
63$f_file_id = gpc_get_int( 'file_id' );
64$f_title = gpc_get_string( 'title' );
65$f_description	= gpc_get_string( 'description' );
66$f_file = gpc_get_file( 'file' );
67
68$t_project_id = file_get_field( $f_file_id, 'project_id', 'project' );
69
70access_ensure_project_level( config_get( 'upload_project_file_threshold' ), $t_project_id );
71
72if( is_blank( $f_title ) ) {
73	error_parameters( lang_get( 'title' ) );
74	trigger_error( ERROR_EMPTY_FIELD, ERROR );
75}
76
77# @todo (thraxisp) this code should probably be integrated into file_api to share methods used to store files
78
79if( isset( $f_file['tmp_name'] ) && is_uploaded_file( $f_file['tmp_name'] ) ) {
80	file_ensure_uploaded( $f_file );
81
82	$t_project_id = helper_get_current_project();
83
84	# grab the original file path and name
85	$t_disk_file_name = file_get_field( $f_file_id, 'diskfile', 'project' );
86	$t_file_path = dirname( $t_disk_file_name );
87
88	# prepare variables for insertion
89	$t_file_size = filesize( $f_file['tmp_name'] );
90	$t_max_file_size = file_get_max_file_size();
91	if( $t_file_size > $t_max_file_size ) {
92		trigger_error( ERROR_FILE_TOO_BIG, ERROR );
93	}
94
95	$t_method = config_get( 'file_upload_method' );
96	switch( $t_method ) {
97		case DISK:
98			file_ensure_valid_upload_path( $t_file_path );
99
100			if( file_exists( $t_disk_file_name ) ) {
101				file_delete_local( $t_disk_file_name );
102			}
103			if( !move_uploaded_file( $f_file['tmp_name'], $t_disk_file_name ) ) {
104				trigger_error( ERROR_FILE_MOVE_FAILED, ERROR );
105			}
106			chmod( $t_disk_file_name, config_get( 'attachments_file_permissions' ) );
107
108			$c_content = '';
109			break;
110		case DATABASE:
111			$c_content = db_prepare_binary_string( fread( fopen( $f_file['tmp_name'], 'rb' ), $f_file['size'] ) );
112			break;
113		default:
114			# @todo Such errors should be checked in the admin checks
115			trigger_error( ERROR_GENERIC, ERROR );
116	}
117	$t_query = 'UPDATE {project_file}
118		SET title=' . db_param() . ', description=' . db_param() . ', date_added=' . db_param() . ',
119			filename=' . db_param() . ', filesize=' . db_param() . ', file_type=' .db_param() . ', content=' .db_param() . '
120			WHERE id=' . db_param();
121	$t_result = db_query( $t_query, array( $f_title, $f_description, db_now(), $f_file['name'], $t_file_size, $f_file['type'], $c_content, $f_file_id ) );
122} else {
123	$t_query = 'UPDATE {project_file}
124			SET title=' . db_param() . ', description=' . db_param() . '
125			WHERE id=' . db_param();
126	$t_result = db_query( $t_query, array( $f_title, $f_description, $f_file_id ) );
127}
128
129if( !$t_result ) {
130	trigger_error( ERROR_GENERIC, ERROR );
131}
132
133form_security_purge( 'proj_doc_update' );
134
135$t_redirect_url = 'proj_doc_page.php';
136
137layout_page_header( null, $t_redirect_url );
138
139layout_page_begin( 'proj_doc_page.php' );
140
141html_operation_successful( $t_redirect_url );
142
143layout_page_end();
144