Add protection on upload if file already exists

htdocs/adherents/fiche.php

@@ -176,7 +176,7 @@ if ($_REQUEST["action"] == 'update' && ! $_POST["cancel"])
 					if (is_dir($conf->adherent->dir_output))
 					{
 						$newfile=$conf->adherent->dir_output . "/" . $adh->id . ".jpg";
-						if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile))
+						if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile,1) > 0)
 						{
 							$message .= '<div class="error">'.$langs->trans("ErrorFailedToSaveFile").'</div>';
 						}

htdocs/admin/company.php

@@ -65,7 +65,7 @@ if ( (isset($_POST["action"]) && $_POST["action"] == 'update')
 				{
 					create_exdir($conf->societe->dir_logos);
 				}        
-				if (dol_move_uploaded_file($_FILES["logo"]["tmp_name"],$conf->societe->dir_logos.'/'.$original_file))
+				if (dol_move_uploaded_file($_FILES["logo"]["tmp_name"],$conf->societe->dir_logos.'/'.$original_file,1) > 0)
 				{
 					dolibarr_set_const($db, "MAIN_INFO_SOCIETE_LOGO",$original_file);
 					

htdocs/admin/import/import.php

@@ -65,7 +65,7 @@ if ( $_POST["sendit"] && $conf->upload != 0)
 {
   $imp = new DolibarrImport($db);
   $imp->CreateBackupDir();  
-  if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $imp->upload_dir . "/" . $_FILES['userfile']['name']))
+  if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $imp->upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
     {
       
       $imp->ImportClients($imp->upload_dir . "/" . $_FILES['userfile']['name']);

htdocs/comm/action/document.php

@@ -75,7 +75,7 @@ if ( $_POST["sendit"] && $conf->upload )
 
     if (is_dir($upload_dir))
     {
-        if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+        if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
         {
             $mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
             //print_r($_FILES);

htdocs/comm/propal/document.php

@@ -77,7 +77,7 @@ if ($_POST["sendit"] && $conf->upload)
     
         if (is_dir($upload_dir))
         {
-            if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+            if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
             {
                 $mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
                 //print_r($_FILES);

htdocs/commande/document.php

@@ -79,7 +79,7 @@ if ($_POST["sendit"] && $conf->upload)
   
   if (is_dir($upload_dir))
     {
-      if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+      if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
 	{
 	  $mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
 	  //print_r($_FILES);

htdocs/compta/facture/document.php

@@ -79,7 +79,7 @@ if ($_POST["sendit"] && $conf->upload)
       
       if (is_dir($upload_dir))
         {
-	  if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+	  if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
             {
 	      $mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
 	      //print_r($_FILES);

htdocs/compta/prelevement/fiche.php

@@ -57,19 +57,20 @@ if ($_POST["action"] == 'infotrans')
     {      
       $dir = $conf->prelevement->dir_output.'/bon/';
 
-      if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $dir . "/" . $_FILES['userfile']['name']))
+      if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $dir . "/" . $_FILES['userfile']['name'],1) > 0)
 	{
-	  $dt = mktime(12,0,0,$_POST["remonth"],$_POST["reday"],$_POST["reyear"]);
+	  $dt = dolibarr_mktime(12,0,0,$_POST["remonth"],$_POST["reday"],$_POST["reyear"]);
 	  
 	  $bon->set_infotrans($user, $dt, $_POST["methode"]);
 	}
     }
   else
     {
-      dolibarr_syslog("Fichier invalide",LOG_WARN);
+      dolibarr_syslog("Fichier invalide",LOG_WARNING);
     }
 
   Header("Location: fiche.php?id=".$_GET["id"]);
+  exit;
 }
 
 if ($_POST["action"] == 'infocredit')

htdocs/contrat/document.php

@@ -80,7 +80,7 @@ if ($_POST["sendit"] && $conf->upload)
 
     if (is_dir($upload_dir))
     {
-        if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+        if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
         {
             $mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
             //print_r($_FILES);

htdocs/ecm/docmine.php

@@ -94,14 +94,14 @@ if ( $_POST["sendit"] && $conf->upload != 0)
   
   if (is_dir($upload_dir))
   {
-  	$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']);
+  	$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0);
-  	if ($result == 1)
+  	if ($result > 0)
   	{
     	//$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
     	//print_r($_FILES);
     	$result=$ecmdir->changeNbOfFiles('+');
     }
-    else if (!$result)
+    else if ($result < 0)
     {
     	// Echec transfert (fichier depassant la limite ?)
     	$mesg = '<div class="error">'.$langs->trans("ErrorFileNotUploaded").'</div>';

htdocs/ecm/docother.php

@@ -50,13 +50,13 @@ if ( $_POST["sendit"] && $conf->upload != 0)
   
   if (is_dir($upload_dir))
   {
-  	$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']);
+  	$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0);
-  	if ($result == 1)
+  	if ($result > 0)
     {
     	$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
     	//print_r($_FILES);
     }
-    else if (!$result)
+    else if ($result < 0)
     {
     	// Echec transfert (fichier d?passant la limite ?)
     	$mesg = '<div class="error">'.$langs->trans("ErrorFileNotUploaded").'</div>';

htdocs/fourn/facture/document.php

@@ -82,7 +82,7 @@ if ($_POST['sendit'] && $conf->upload)
     
         if (is_dir($upload_dir))
         {
-            if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . '/' . $_FILES['userfile']['name']))
+            if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . '/' . $_FILES['userfile']['name'],0) > 0)
             {
                 $mesg = '<div class="ok">'.$langs->trans('FileTransferComplete').'</div>';
                 //print_r($_FILES);

htdocs/lib/functions.lib.php

@@ -1526,17 +1526,19 @@ function dolibarr_print_error($db='',$error='')
 
 
 /**
- \brief  Deplacer les fichiers telecharg<72>s, apres quelques controles divers
+ *	\brief  Deplacer les fichiers telecharg<72>s, apres quelques controles divers
- \param	src_file	fichier source
+ *	\param	src_file			Source filename
- \param	dest_file	fichier de destination
+ *	\param	dest_file			Target filename
- \return int         true=Deplacement OK, false=Pas de deplacement ou KO
+ * 	\param	allowoverwrite		Overwrite if exists
+ *	\return int         		>0 if OK, <0 if KO, Name of virus if virus found
  */
-function dol_move_uploaded_file($src_file, $dest_file)
+function dol_move_uploaded_file($src_file, $dest_file, $allowoverwrite)
 {
 	global $conf;
 
 	$file_name = $dest_file;
 
+	// If we need to make a virus scan
 	if ($conf->global->MAIN_USE_AVSCAN)
 	{
 		$malware = dol_avscan_file($src_file);
@@ -1544,21 +1546,21 @@ function dol_move_uploaded_file($src_file, $dest_file)
 	}
 
 	// Security:
-	// On renomme les fichiers avec extention executable car si on a mis le rep
+	// On renomme les fichiers avec extention script web car si on a mis le rep
 	// documents dans un rep de la racine web (pas bien), cela permet d'executer
 	// du code a la demande.
 	if (eregi('\.htm|\.html|\.php|\.pl|\.cgi$',$file_name))
 	{
-		$file_name.= '.txt';
+		$file_name.= '.noexe';
 	}
 
 	// Security:
-	// On interdit les remont<6E>es de repertoire ainsi que les pipe dans
+	// On interdit les remont<6E>es de repertoire ainsi que les pipes dans
 	// les noms de fichiers.
 	if (eregi('\.\.',$src_file) || eregi('[<>|]',$src_file))
 	{
 		dolibarr_syslog("Refused to deliver file ".$src_file);
-		return false;
+		return -1;
 	}
 
 	// Security:
@@ -1567,12 +1569,31 @@ function dol_move_uploaded_file($src_file, $dest_file)
 	if (eregi('\.\.',$dest_file) || eregi('[<>|]',$dest_file))
 	{
 		dolibarr_syslog("Refused to deliver file ".$dest_file);
-		return false;
+		return -1;
 	}
 
-	$return=move_uploaded_file($src_file, $file_name);
+	// Check if destination file already exists
+	if (! $allowoverwrite)
+	{
+		if (file_exists($file_name))
+		{
+			dolibarr_syslog("Functions.lib::dol_move_uploaded_file File ".$file_name." already exists", LOG_WARNING);
+			return -2;			
+		}
+	}
 	
-	return $return;
+	// Move file
+	$return=move_uploaded_file($src_file, $file_name);
+	if ($return)
+	{
+		dolibarr_syslog("Functions.lib::dol_move_uploaded_file Success to move ".$src_file." to ".$file_name, LOG_DEBUG);
+		return 1;			
+	}
+	else 
+	{
+		dolibarr_syslog("Functions.lib::dol_move_uploaded_file Failed to mode ".$src_file." to ".$file_name, LOG_ERR);			
+		return -3;
+	}
 }
 
 

htdocs/lib/ldap.class.php

@@ -277,7 +277,7 @@ class Ldap
 		{
 			$this->error='Failed to connect to LDAP';
 			$return=-1;
-			dolibarr_syslog("Ldap::connect_bind return=".$return, LOG_WARN);
+			dolibarr_syslog("Ldap::connect_bind return=".$return, LOG_WARNING);
 		}
 		return $return;
 	}

htdocs/product.class.php

@@ -2226,7 +2226,7 @@ class Product extends CommonObject
     	$originImage = $dir . $file['name'];
     	
     	// Cree fichier en taille origine
-    	dol_move_uploaded_file($file['tmp_name'], $originImage);
+    	dol_move_uploaded_file($file['tmp_name'], $originImage, 1);
 
     	if (file_exists($originImage))
     	{

htdocs/product/document.php

@@ -86,7 +86,7 @@ if ($_POST["sendit"] && $conf->upload)
 
     if (is_dir($upload_dir))
     {
-        if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+        if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0) > 0)
         {
             $mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
             //print_r($_FILES);

htdocs/product/photos.php

@@ -53,7 +53,7 @@ if ($_FILES['userfile']['size'] > 0 && $_POST["sendit"] && $conf->upload != 0)
         $product = new Product($db);
         $result = $product->fetch($_GET["id"]);
 
-        // if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+        // if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
 
         //      var_dump($_FILES);
 

htdocs/societe/docsoc.php

@@ -19,14 +19,15 @@
  */
 
 /**
-   \file       htdocs/societe/docsoc.php
+ *  \file       htdocs/societe/docsoc.php
-   \brief      Tab for documents linked to third party
+ *  \brief      Tab for documents linked to third party
-   \ingroup    societe
+ *  \ingroup    societe
-   \version    $Id$
+ *  \version    $Id$
 */
 
 require("./pre.inc.php");
 require_once(DOL_DOCUMENT_ROOT."/lib/company.lib.php");
+require_once(DOL_DOCUMENT_ROOT."/lib/files.lib.php");
 require_once(DOL_DOCUMENT_ROOT."/html.formfile.class.php");
 
 $langs->load("companies");
@@ -34,15 +35,33 @@ $langs->load('other');
 
 $mesg = "";
 
+// Security check
+$socid = isset($_GET["socid"])?$_GET["socid"]:(! empty($_GET["id"])?$_GET["id"]:'');
+if ($user->societe_id > 0) 
+{
+	unset($_GET["action"]);
+	$action=''; 
+	$socid = $user->societe_id;
+}
+$result = restrictedArea($user, 'societe', $socid);
+
+// Get parameters
+$page=$_GET["page"];
+$sortorder=$_GET["sortorder"];
+$sortfield=$_GET["sortfield"];
+
+if (! $sortorder) $sortorder="ASC";
+if (! $sortfield) $sortfield="name";
+if ($page == -1) { $page = 0 ; }
+$offset = $conf->liste_limit * $page ;
+$pageprev = $page - 1;
+$pagenext = $page + 1;
+
 $sortorder=$_GET["sortorder"];
 $sortfield=$_GET["sortfield"];
 if (! $sortorder) $sortorder="ASC";
 if (! $sortfield) $sortfield="name";
 
-// Security check
-$socid = isset($_GET["socid"])?$_GET["socid"]:'';
-if ($user->societe_id) $socid=$user->societe_id;
-$result = restrictedArea($user, 'societe', $socid);
 
 /*
  * Actions
@@ -57,21 +76,21 @@ if ( $_POST["sendit"] && $conf->upload != 0)
   
   if (is_dir($upload_dir))
   {
-  	$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']);
+  	$result = dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],0);
-  	if ($result == 1)
+  	if ($result > 0)
     {
     	$mesg = '<div class="ok">'.$langs->trans("FileTransferComplete").'</div>';
     	//print_r($_FILES);
     }
-    else if (!$result)
+    else if ($result < 0)
     {
-    	// Echec transfert (fichier d<EFBFBD>passant la limite ?)
+    	// Echec transfert (fichier depassant la limite ?)
     	$mesg = '<div class="error">'.$langs->trans("ErrorFileNotUploaded").'</div>';
     	// print_r($_FILES);
     }
     else
     {
-    	// Fichier infect<EFBFBD> par un virus
+    	// Fichier infecte par un virus
     	$mesg = '<div class="error">'.$langs->trans("ErrorFileIsInfectedWith",$result).'</div>';
     }
   }
@@ -106,44 +125,16 @@ if ($socid > 0)
 		
 		dolibarr_fiche_head($head, 'document', $langs->trans("ThirdParty"));
 		
-		/*
-	   * Confirmation de la suppression d'une ligne produit
-	   */
-	  if ($_GET['action'] == 'delete_file')
-	  {
-	    $html->form_confirm($_SERVER["PHP_SELF"].'?socid='.$socid.'&amp;urlfile='.urldecode($_GET["urlfile"]), $langs->trans('DeleteFile'), $langs->trans('ConfirmDeleteFile'), 'confirm_deletefile');
-	    print '<br>';
-	  }
 
 		// Construit liste des fichiers
-		clearstatcache();
+		$filearray=dol_dir_list($upload_dir,"files",0,'','\.meta$',$sortfield,(strtolower($sortorder)=='desc'?SORT_ASC:SORT_DESC),1);
 		$totalsize=0;
-		$filearray=array();
+		foreach($filearray as $key => $file)
-		$errorlevel=error_reporting();
-		error_reporting(0);
-		$handle=opendir($upload_dir);
-		error_reporting($errorlevel);
-		if ($handle)
 		{
-			$i=0;
+			$totalsize+=$file['size'];
-			while (($file = readdir($handle))!==false)
-			{
-				if (!is_dir($dir.$file) && substr($file, 0, 1) <> '.' && substr($file, 0, 3) <> 'CVS')
-				{
-					$filearray[$i]->name=$file;
-					$filearray[$i]->size=filesize($upload_dir."/".$file);
-					$filearray[$i]->date=filemtime($upload_dir."/".$file);
-					$totalsize+=$filearray[$i]->size;
-					$i++;
-				}
-			}
-			closedir($handle);
-		}
-		else
-		{
-			//            print '<div class="error">'.$langs->trans("ErrorCanNotReadDir",$upload_dir).'</div>';
 		}
 		  
+		
 		print '<table class="border"width="100%">';
 		
 		// Ref
@@ -164,75 +155,24 @@ if ($socid > 0)
 		
 		if ($mesg) { print "$mesg<br>"; }
 		
+		  /*
+		   * Confirmation de la suppression d'une ligne produit
+		   */
+		  if ($_GET['action'] == 'delete')
+		  {
+		    $html->form_confirm($_SERVER["PHP_SELF"].'?socid='.$_GET["id"].'&amp;urlfile='.urldecode($_GET["urlfile"]), $langs->trans('DeleteFile'), $langs->trans('ConfirmDeleteFile'), 'confirm_deletefile');
+		    print '<br>';
+		  }
+		
+		
 		// Affiche formulaire upload
        	$formfile=new FormFile($db);
 		$formfile->form_attach_new_file(DOL_URL_ROOT.'/societe/docsoc.php?socid='.$socid);
 		
-		// Affiche liste des documents existant
-		print_titre($langs->trans("AttachedFiles"));
 
-		/**
+		// List of document
-		 * TODO Mettre cette section dans une zone AJAX
+		$param='&socid='.$societe->id;
-		 */ 
+		$formfile->list_of_documents($filearray,$societe,'societe',$param);
-		$prefix=$socid.'/';
-		$modulepart='societe';
-		$url=$_SERVER["PHP_SELF"];
-		print '<table width="100%" class="noborder">';
-		print '<tr class="liste_titre">';
-		$param='&amp;socid='.$socid;
-		print_liste_field_titre($langs->trans("Document"),$_SERVER["PHP_SELF"],"name","",$param,'align="left"',$sortfield,$sortorder);
-		print_liste_field_titre($langs->trans("Size"),$_SERVER["PHP_SELF"],"size","",$param,'align="right"',$sortfield,$sortorder);
-		print_liste_field_titre($langs->trans("Date"),$_SERVER["PHP_SELF"],"date","",$param,'align="center"',$sortfield,$sortorder);
-		print '<td>&nbsp;</td>';
-		print '</tr>';
-		
-		function compare_file($a, $b)
-		{
-			global $sortorder;
-			global $sortfield;
-			
-			$sortorder=strtoupper($sortorder);
-			
-			if ($sortorder == 'ASC') { $retup=-1; $retdown=1; }
-			else { $retup=1; $retdown=-1; }
-			
-			if ($sortfield == 'name')
-			{
-				if ($a->name == $b->name) return 0;
-				return ($a->name < $b->name) ? $retup : $retdown;
-			}
-			if ($sortfield == 'date')
-			{
-				if ($a->date == $b->date) return 0;
-				return ($a->date < $b->date) ? $retup : $retdown;
-			}
-			if ($sortfield == 'size')
-			{
-				if ($a->size == $b->size) return 0;
-				return ($a->size < $b->size) ? $retup : $retdown;
-			}
-		}
-
-		usort($filearray,"compare_file");
-		
-		$var=true;
-		foreach($filearray as $key => $file)
-		{
-			if (!is_dir($dir.$file->name) && substr($file->name, 0, 1) <> '.' && substr($file->name, 0, 3) <> 'CVS')
-			{
-				$var=!$var;
-				print "<tr $bc[$var]><td>";
-				echo '<a href="'.DOL_URL_ROOT.'/document.php?modulepart='.$modulepart.'&type=application/binary&file='.urlencode($prefix.$file->name).'">'.$file->name.'</a>';
-				print "</td>\n";
-				print '<td align="right">'.$file->size.' '.$langs->trans("bytes").'</td>';
-				print '<td align="center">'.dolibarr_print_date($file->date,"dayhour").'</td>';
-				print '<td align="center">';
-				echo '<a href="'.$url.'?socid='.$socid.'&amp;action=delete_file&urlfile='.urlencode($file->name).'">'.img_delete().'</a>';
-				print "</td></tr>\n";
-			}
-		}
-		print "</table>";
-		// Fin de zone Ajax
 		
 		
 		print "<br><br>";

htdocs/telephonie/facturation/index.php

@@ -35,7 +35,7 @@ if ( $_POST["sendit"] && $conf->upload != 0)
       
       if (is_dir($upload_dir))
 	{
-	  if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+	  if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
 	    {
 	      $mesg = "Le fichier est valide, et a été téléchargé avec succès.\n";
 	    }

htdocs/telephonie/ligne/commande/retour/index.php

@@ -42,7 +42,7 @@ if ( $_POST["sendit"] && $conf->upload != 0)
       $nextname = $upload_dir .'/backup';
 
 
-      if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name']))
+      if (dol_move_uploaded_file($_FILES['userfile']['tmp_name'], $upload_dir . "/" . $_FILES['userfile']['name'],1) > 0)
 	{
 	  $mesg = "Le fichier est valide, et a été téléchargé avec succès.\n";
 	}

htdocs/user/fiche.php

@@ -276,7 +276,7 @@ if ($_POST["action"] == 'update' && ! $_POST["cancel"] && $caneditfield)
 			if (is_dir($conf->users->dir_output))
 			{
 				$newfile=$conf->users->dir_output . "/" . $edituser->id . ".jpg";
-				if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile))
+				if (! dol_move_uploaded_file($_FILES['photo']['tmp_name'],$newfile,1) > 0)
 				{
 					$message .= '<div class="error">'.$langs->trans("ErrorFailedToSaveFile").'</div>';
 				}