CI_Upload Class Reference

List of all members.

Public Member Functions
	CI_Upload ($props=array())
	Constructor.
	initialize ($config=array())
	Initialize preferences.
	do_upload ($field= 'userfile')
	Perform the file upload.
	data ()
	Finalized Data Array.
	set_upload_path ($path)
	Set Upload Path.
	set_filename ($path, $filename)
	Set the file name.
	set_max_filesize ($n)
	Set Maximum File Size.
	set_max_width ($n)
	Set Maximum Image Width.
	set_max_height ($n)
	Set Maximum Image Height.
	set_allowed_types ($types)
	Set Allowed File Types.
	set_image_properties ($path= '')
	Set Image Properties.
	set_xss_clean ($flag=FALSE)
	Set XSS Clean.
	is_image ()
	Validate the image.
	is_allowed_filetype ()
	Verify that the filetype is allowed.
	is_allowed_filesize ()
	Verify that the file is within the allowed size.
	is_allowed_dimensions ()
	Verify that the image is within the allowed width/height.
	validate_upload_path ()
	Validate Upload Path.
	get_extension ($filename)
	Extract the file extension.
	clean_file_name ($filename)
	Clean the file name for security.
	do_xss_clean ()
	Runs the file through the XSS clean function.
	set_error ($msg)
	Set an error message.
	display_errors ($open= '< p >', $close= '</p >')
	Display the error message.
	mimes_types ($mime)
	List of Mime Types.
	_prep_filename ($filename)
	Prep Filename.
Public Attributes
	$max_size = 0
	$max_width = 0
	$max_height = 0
	$allowed_types = ""
	$file_temp = ""
	$file_name = ""
	$orig_name = ""
	$file_type = ""
	$file_size = ""
	$file_ext = ""
	$upload_path = ""
	$overwrite = FALSE
	$encrypt_name = FALSE
	$is_image = FALSE
	$image_width = ''
	$image_height = ''
	$image_type = ''
	$image_size_str = ''
	$error_msg = array()
	$mimes = array()
	$remove_spaces = TRUE
	$xss_clean = FALSE
	$temp_prefix = "temp_file_"

---

Detailed Description

Definition at line 27 of file Upload.php.

---

Member Function Documentation

CI_Upload::_prep_filename

(

$

filename

)

Prep Filename.

Prevents possible script execution from Apache's handling of files multiple extensions http://httpd.apache.org/docs/1.3/mod/mod_mime.html#multipleext

private

Parameters:

string

Returns:

string

Definition at line 848 of file Upload.php.

References mimes_types().

Referenced by do_upload().

        {
                if (strpos($filename, '.') === FALSE)
                {
                        return $filename;
                }
                
                $parts          = explode('.', $filename);
                $ext            = array_pop($parts);
                $filename       = array_shift($parts);
                                
                foreach ($parts as $part)
                {
                        if ($this->mimes_types(strtolower($part)) === FALSE)
                        {
                                $filename .= '.'.$part.'_';
                        }
                        else
                        {
                                $filename .= '.'.$part;
                        }
                }
                
                $filename .= '.'.$ext;
                
                return $filename;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::CI_Upload

(

$

props = array()

)

Constructor.

public

Definition at line 58 of file Upload.php.

References initialize(), and log_message().

        {
                if (count($props) > 0)
                {
                        $this->initialize($props);
                }
                
                log_message('debug', "Upload Class Initialized");
        }

Here is the call graph for this function:

CI_Upload::clean_file_name

(

$

filename

)

Clean the file name for security.

public

Parameters:

string

Returns:

string

Definition at line 679 of file Upload.php.

Referenced by do_upload().

        {
                $bad = array(
                                                "<!--",
                                                "-->",
                                                "'",
                                                "<",
                                                ">",
                                                '"',
                                                '&',
                                                '$',
                                                '=',
                                                ';',
                                                '?',
                                                '/',
                                                "%20",
                                                "%22",
                                                "%3c",          // <
                                                "%253c",        // <
                                                "%3e",          // >
                                                "%0e",          // >
                                                "%28",          // (
                                                "%29",          // )
                                                "%2528",        // (
                                                "%26",          // &
                                                "%24",          // $
                                                "%3f",          // ?
                                                "%3b",          // ;
                                                "%3d"           // =
                                        );
                                        
                foreach ($bad as $val)
                {
                        $filename = str_replace($val, '', $filename);
                }

                return stripslashes($filename);
        }

Here is the caller graph for this function:

CI_Upload::data

(

)

Finalized Data Array.

Returns an associative array containing all of the information related to the upload, allowing the developer easy access in one array.

public

Returns:

array

Definition at line 298 of file Upload.php.

References is_image().

        {
                return array (
                                                'file_name'                     => $this->file_name,
                                                'file_type'                     => $this->file_type,
                                                'file_path'                     => $this->upload_path,
                                                'full_path'                     => $this->upload_path.$this->file_name,
                                                'raw_name'                      => str_replace($this->file_ext, '', $this->file_name),
                                                'orig_name'                     => $this->orig_name,
                                                'file_ext'                      => $this->file_ext,
                                                'file_size'                     => $this->file_size,
                                                'is_image'                      => $this->is_image(),
                                                'image_width'           => $this->image_width,
                                                'image_height'          => $this->image_height,
                                                'image_type'            => $this->image_type,
                                                'image_size_str'        => $this->image_size_str,
                                        );
        }

Here is the call graph for this function:

CI_Upload::display_errors	(	$	open = '<p>',
		$	close = '</p>'
	)

Display the error message.

public

Parameters:

	string
	string

Returns:

string

Definition at line 799 of file Upload.php.

        {
                $str = '';
                foreach ($this->error_msg as $val)
                {
                        $str .= $open.$val.$close;
                }
        
                return $str;
        }

CI_Upload::do_upload

(

$

field = 'userfile'

)

Perform the file upload.

public

Returns:

bool

Definition at line 135 of file Upload.php.

References _prep_filename(), clean_file_name(), do_xss_clean(), get_extension(), is_allowed_dimensions(), is_allowed_filesize(), is_allowed_filetype(), set_error(), set_filename(), set_image_properties(), and validate_upload_path().

        {
                // Is $_FILES[$field] set? If not, no reason to continue.
                if ( ! isset($_FILES[$field]))
                {
                        $this->set_error('upload_no_file_selected');
                        return FALSE;
                }
                
                // Is the upload path valid?
                if ( ! $this->validate_upload_path())
                {
                        // errors will already be set by validate_upload_path() so just return FALSE
                        return FALSE;
                }
                                                
                // Was the file able to be uploaded? If not, determine the reason why.
                if ( ! is_uploaded_file($_FILES[$field]['tmp_name']))
                {
                        $error = ( ! isset($_FILES[$field]['error'])) ? 4 : $_FILES[$field]['error'];

                        switch($error)
                        {
                                case 1: // UPLOAD_ERR_INI_SIZE
                                        $this->set_error('upload_file_exceeds_limit');
                                        break;
                                case 2: // UPLOAD_ERR_FORM_SIZE
                                        $this->set_error('upload_file_exceeds_form_limit');
                                        break;
                                case 3: // UPLOAD_ERR_PARTIAL
                                   $this->set_error('upload_file_partial');
                                        break;
                                case 4: // UPLOAD_ERR_NO_FILE
                                   $this->set_error('upload_no_file_selected');
                                        break;
                                case 6: // UPLOAD_ERR_NO_TMP_DIR
                                        $this->set_error('upload_no_temp_directory');
                                        break;
                                case 7: // UPLOAD_ERR_CANT_WRITE
                                        $this->set_error('upload_unable_to_write_file');
                                        break;
                                case 8: // UPLOAD_ERR_EXTENSION
                                        $this->set_error('upload_stopped_by_extension');
                                        break;
                                default :   $this->set_error('upload_no_file_selected');
                                        break;
                        }

                        return FALSE;
                }

                // Set the uploaded data as class variables
                $this->file_temp = $_FILES[$field]['tmp_name'];         
                $this->file_name = $this->_prep_filename($_FILES[$field]['name']);
                $this->file_size = $_FILES[$field]['size'];             
                $this->file_type = preg_replace("/^(.+?);.*$/", "\\1", $_FILES[$field]['type']);
                $this->file_type = strtolower($this->file_type);
                $this->file_ext  = $this->get_extension($_FILES[$field]['name']);
                
                // Convert the file size to kilobytes
                if ($this->file_size > 0)
                {
                        $this->file_size = round($this->file_size/1024, 2);
                }

                // Is the file type allowed to be uploaded?
                if ( ! $this->is_allowed_filetype())
                {
                        $this->set_error('upload_invalid_filetype');
                        return FALSE;
                }

                // Is the file size within the allowed maximum?
                if ( ! $this->is_allowed_filesize())
                {
                        $this->set_error('upload_invalid_filesize');
                        return FALSE;
                }

                // Are the image dimensions within the allowed size?
                // Note: This can fail if the server has an open_basdir restriction.
                if ( ! $this->is_allowed_dimensions())
                {
                        $this->set_error('upload_invalid_dimensions');
                        return FALSE;
                }

                // Sanitize the file name for security
                $this->file_name = $this->clean_file_name($this->file_name);

                // Remove white spaces in the name
                if ($this->remove_spaces == TRUE)
                {
                        $this->file_name = preg_replace("/\s+/", "_", $this->file_name);
                }

                /*
                 * Validate the file name
                 * This function appends an number onto the end of
                 * the file if one with the same name already exists.
                 * If it returns false there was a problem.
                 */
                $this->orig_name = $this->file_name;

                if ($this->overwrite == FALSE)
                {
                        $this->file_name = $this->set_filename($this->upload_path, $this->file_name);
                        
                        if ($this->file_name === FALSE)
                        {
                                return FALSE;
                        }
                }

                /*
                 * Move the file to the final destination
                 * To deal with different server configurations
                 * we'll attempt to use copy() first.  If that fails
                 * we'll use move_uploaded_file().  One of the two should
                 * reliably work in most environments
                 */
                if ( ! @copy($this->file_temp, $this->upload_path.$this->file_name))
                {
                        if ( ! @move_uploaded_file($this->file_temp, $this->upload_path.$this->file_name))
                        {
                                 $this->set_error('upload_destination_error');
                                 return FALSE;
                        }
                }
                
                /*
                 * Run the file through the XSS hacking filter
                 * This helps prevent malicious code from being
                 * embedded within a file.  Scripts can easily
                 * be disguised as images or other file types.
                 */
                if ($this->xss_clean == TRUE)
                {
                        $this->do_xss_clean();
                }

                /*
                 * Set the finalized image dimensions
                 * This sets the image width/height (assuming the
                 * file was an image).  We use this information
                 * in the "data" function.
                 */
                $this->set_image_properties($this->upload_path.$this->file_name);

                return TRUE;
        }

Here is the call graph for this function:

CI_Upload::do_xss_clean

(

)

Runs the file through the XSS clean function.

This prevents people from embedding malicious code in their files. I'm not sure that it won't negatively affect certain files in unexpected ways, but so far I haven't found that it causes trouble.

public

Returns:

void

Definition at line 730 of file Upload.php.

References $CI, and get_instance().

Referenced by do_upload().

        {               
                $file = $this->upload_path.$this->file_name;
                
                if (filesize($file) == 0)
                {
                        return FALSE;
                }

                if (($data = @file_get_contents($file)) === FALSE)
                {
                        return FALSE;
                }
                
                if ( ! $fp = @fopen($file, FOPEN_READ_WRITE))
                {
                        return FALSE;
                }

                $CI =& get_instance();  
                $data = $CI->input->xss_clean($data);
                
                flock($fp, LOCK_EX);
                fwrite($fp, $data);
                flock($fp, LOCK_UN);
                fclose($fp);
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::get_extension

(

$

filename

)

Extract the file extension.

public

Parameters:

string

Returns:

string

Definition at line 664 of file Upload.php.

Referenced by do_upload().

        {
                $x = explode('.', $filename);
                return '.'.end($x);
        }       

Here is the caller graph for this function:

CI_Upload::initialize

(

$

config = array()

)

Initialize preferences.

public

Parameters:

array

Returns:

void

Definition at line 77 of file Upload.php.

References $config, and $method.

Referenced by CI_Upload().

        {
                $defaults = array(
                                                        'max_size'                      => 0,
                                                        'max_width'                     => 0,
                                                        'max_height'            => 0,
                                                        'allowed_types'         => "",
                                                        'file_temp'                     => "",
                                                        'file_name'                     => "",
                                                        'orig_name'                     => "",
                                                        'file_type'                     => "",
                                                        'file_size'                     => "",
                                                        'file_ext'                      => "",
                                                        'upload_path'           => "",
                                                        'overwrite'                     => FALSE,
                                                        'encrypt_name'          => FALSE,
                                                        'is_image'                      => FALSE,
                                                        'image_width'           => '',
                                                        'image_height'          => '',
                                                        'image_type'            => '',
                                                        'image_size_str'        => '',
                                                        'error_msg'                     => array(),
                                                        'mimes'                         => array(),
                                                        'remove_spaces'         => TRUE,
                                                        'xss_clean'                     => FALSE,
                                                        'temp_prefix'           => "temp_file_"
                                                );      
        
        
                foreach ($defaults as $key => $val)
                {
                        if (isset($config[$key]))
                        {
                                $method = 'set_'.$key;
                                if (method_exists($this, $method))
                                {
                                        $this->$method($config[$key]);
                                }
                                else
                                {
                                        $this->$key = $config[$key];
                                }                       
                        }
                        else
                        {
                                $this->$key = $val;
                        }
                }
        }

Here is the caller graph for this function:

CI_Upload::is_allowed_dimensions

(

)

Verify that the image is within the allowed width/height.

public

Returns:

bool

Definition at line 588 of file Upload.php.

References is_image().

Referenced by do_upload().

        {
                if ( ! $this->is_image())
                {
                        return TRUE;
                }

                if (function_exists('getimagesize'))
                {
                        $D = @getimagesize($this->file_temp);

                        if ($this->max_width > 0 AND $D['0'] > $this->max_width)
                        {
                                return FALSE;
                        }

                        if ($this->max_height > 0 AND $D['1'] > $this->max_height)
                        {
                                return FALSE;
                        }

                        return TRUE;
                }

                return TRUE;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::is_allowed_filesize

(

)

Verify that the file is within the allowed size.

public

Returns:

bool

Definition at line 568 of file Upload.php.

Referenced by do_upload().

        {
                if ($this->max_size != 0  AND  $this->file_size > $this->max_size)
                {
                        return FALSE;
                }
                else
                {
                        return TRUE;
                }
        }

Here is the caller graph for this function:

CI_Upload::is_allowed_filetype

(

)

Verify that the filetype is allowed.

public

Returns:

bool

Definition at line 529 of file Upload.php.

References mimes_types(), and set_error().

Referenced by do_upload().

        {
                if (count($this->allowed_types) == 0 OR ! is_array($this->allowed_types))
                {
                        $this->set_error('upload_no_file_types');
                        return FALSE;
                }
                                
                foreach ($this->allowed_types as $val)
                {
                        $mime = $this->mimes_types(strtolower($val));
                
                        if (is_array($mime))
                        {
                                if (in_array($this->file_type, $mime, TRUE))
                                {
                                        return TRUE;
                                }
                        }
                        else
                        {
                                if ($mime == $this->file_type)
                                {
                                        return TRUE;
                                }       
                        }               
                }
                
                return FALSE;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::is_image

(

)

Validate the image.

public

Returns:

bool

Definition at line 494 of file Upload.php.

Referenced by data(), is_allowed_dimensions(), and set_image_properties().

        {
                // IE will sometimes return odd mime-types during upload, so here we just standardize all
                // jpegs or pngs to the same file type.

                $png_mimes  = array('image/x-png');
                $jpeg_mimes = array('image/jpg', 'image/jpe', 'image/jpeg', 'image/pjpeg');
                
                if (in_array($this->file_type, $png_mimes))
                {
                        $this->file_type = 'image/png';
                }
                
                if (in_array($this->file_type, $jpeg_mimes))
                {
                        $this->file_type = 'image/jpeg';
                }

                $img_mimes = array(
                                                        'image/gif',
                                                        'image/jpeg',
                                                        'image/png',
                                                   );

                return (in_array($this->file_type, $img_mimes, TRUE)) ? TRUE : FALSE;
        }

Here is the caller graph for this function:

CI_Upload::mimes_types

(

$

mime

)

List of Mime Types.

This is a list of mime types. We use it to validate the "allowed types" set by the developer

public

Parameters:

string

Returns:

string

Definition at line 822 of file Upload.php.

References $mimes.

Referenced by _prep_filename(), and is_allowed_filetype().

        {
                global $mimes;
        
                if (count($this->mimes) == 0)
                {
                        if (@require_once(APPPATH.'config/mimes'.EXT))
                        {
                                $this->mimes = $mimes;
                                unset($mimes);
                        }
                }
        
                return ( ! isset($this->mimes[$mime])) ? FALSE : $this->mimes[$mime];
        }

Here is the caller graph for this function:

CI_Upload::set_allowed_types

(

$

types

)

Set Allowed File Types.

public

Parameters:

string

Returns:

void

Definition at line 432 of file Upload.php.

        {
                $this->allowed_types = explode('|', $types);
        }

CI_Upload::set_error

(

$

msg

)

Set an error message.

public

Parameters:

string

Returns:

void

Definition at line 767 of file Upload.php.

References $CI, get_instance(), and log_message().

Referenced by do_upload(), is_allowed_filetype(), set_filename(), and validate_upload_path().

        {
                $CI =& get_instance();  
                $CI->lang->load('upload');
                
                if (is_array($msg))
                {
                        foreach ($msg as $val)
                        {
                                $msg = ($CI->lang->line($val) == FALSE) ? $val : $CI->lang->line($val);                         
                                $this->error_msg[] = $msg;
                                log_message('error', $msg);
                        }               
                }
                else
                {
                        $msg = ($CI->lang->line($msg) == FALSE) ? $msg : $CI->lang->line($msg);
                        $this->error_msg[] = $msg;
                        log_message('error', $msg);
                }
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::set_filename	(	$	path,
		$	filename
	)

Set the file name.

This function takes a filename/path as input and looks for the existence of a file with the same name. If found, it will append a number to the end of the filename to avoid overwriting a pre-existing file.

public

Parameters:

	string
	string

Returns:

string

Definition at line 345 of file Upload.php.

References set_error().

Referenced by do_upload().

        {
                if ($this->encrypt_name == TRUE)
                {               
                        mt_srand();
                        $filename = md5(uniqid(mt_rand())).$this->file_ext;                     
                }
        
                if ( ! file_exists($path.$filename))
                {
                        return $filename;
                }
        
                $filename = str_replace($this->file_ext, '', $filename);
                
                $new_filename = '';
                for ($i = 1; $i < 100; $i++)
                {                       
                        if ( ! file_exists($path.$filename.$i.$this->file_ext))
                        {
                                $new_filename = $filename.$i.$this->file_ext;
                                break;
                        }
                }

                if ($new_filename == '')
                {
                        $this->set_error('upload_bad_filename');
                        return FALSE;
                }
                else
                {
                        return $new_filename;
                }
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::set_image_properties

(

$

path = ''

)

Set Image Properties.

Uses GD to determine the width/height/type of image

public

Parameters:

string

Returns:

void

Definition at line 448 of file Upload.php.

References is_image().

Referenced by do_upload().

        {
                if ( ! $this->is_image())
                {
                        return;
                }

                if (function_exists('getimagesize'))
                {
                        if (FALSE !== ($D = @getimagesize($path)))
                        {       
                                $types = array(1 => 'gif', 2 => 'jpeg', 3 => 'png');

                                $this->image_width              = $D['0'];
                                $this->image_height             = $D['1'];
                                $this->image_type               = ( ! isset($types[$D['2']])) ? 'unknown' : $types[$D['2']];
                                $this->image_size_str   = $D['3'];  // string containing height and width
                        }
                }
        }

Here is the call graph for this function:

Here is the caller graph for this function:

CI_Upload::set_max_filesize

(

$

n

)

Set Maximum File Size.

public

Parameters:

integer

Returns:

void

Definition at line 390 of file Upload.php.

        {
                $this->max_size = ( ! eregi("^[[:digit:]]+$", $n)) ? 0 : $n;
        }

CI_Upload::set_max_height

(

$

n

)

Set Maximum Image Height.

public

Parameters:

integer

Returns:

void

Definition at line 418 of file Upload.php.

        {
                $this->max_height = ( ! eregi("^[[:digit:]]+$", $n)) ? 0 : $n;
        }

CI_Upload::set_max_width

(

$

n

)

Set Maximum Image Width.

public

Parameters:

integer

Returns:

void

Definition at line 404 of file Upload.php.

        {
                $this->max_width = ( ! eregi("^[[:digit:]]+$", $n)) ? 0 : $n;
        }

CI_Upload::set_upload_path

(

$

path

)

Set Upload Path.

public

Parameters:

string

Returns:

void

Definition at line 326 of file Upload.php.

        {
                $this->upload_path = $path;
        }

CI_Upload::set_xss_clean

(

$

flag = FALSE

)

Set XSS Clean.

Enables the XSS flag so that the file that was uploaded will be run through the XSS filter.

public

Parameters:

bool

Returns:

void

Definition at line 481 of file Upload.php.

        {
                $this->xss_clean = ($flag == TRUE) ? TRUE : FALSE;
        }

CI_Upload::validate_upload_path

(

)

Validate Upload Path.

Verifies that it is a valid upload path with proper permissions.

public

Returns:

bool

Definition at line 626 of file Upload.php.

References is_really_writable(), and set_error().

Referenced by do_upload().

        {
                if ($this->upload_path == '')
                {
                        $this->set_error('upload_no_filepath');
                        return FALSE;
                }
                
                if (function_exists('realpath') AND @realpath($this->upload_path) !== FALSE)
                {
                        $this->upload_path = str_replace("\\", "/", realpath($this->upload_path));
                }

                if ( ! @is_dir($this->upload_path))
                {
                        $this->set_error('upload_no_filepath');
                        return FALSE;
                }

                if ( ! is_really_writable($this->upload_path))
                {
                        $this->set_error('upload_not_writable');
                        return FALSE;
                }

                $this->upload_path = preg_replace("/(.+?)\/*$/", "\\1/",  $this->upload_path);
                return TRUE;
        }

Here is the call graph for this function:

Here is the caller graph for this function:

---

Member Data Documentation

CI_Upload::$allowed_types = ""

Definition at line 32 of file Upload.php.

CI_Upload::$encrypt_name = FALSE

Definition at line 41 of file Upload.php.

CI_Upload::$error_msg = array()

Definition at line 47 of file Upload.php.

CI_Upload::$file_ext = ""

Definition at line 38 of file Upload.php.

CI_Upload::$file_name = ""

Definition at line 34 of file Upload.php.

CI_Upload::$file_size = ""

Definition at line 37 of file Upload.php.

CI_Upload::$file_temp = ""

Definition at line 33 of file Upload.php.

CI_Upload::$file_type = ""

Definition at line 36 of file Upload.php.

CI_Upload::$image_height = ''

Definition at line 44 of file Upload.php.

CI_Upload::$image_size_str = ''

Definition at line 46 of file Upload.php.

CI_Upload::$image_type = ''

Definition at line 45 of file Upload.php.

CI_Upload::$image_width = ''

Definition at line 43 of file Upload.php.

CI_Upload::$is_image = FALSE

Definition at line 42 of file Upload.php.

CI_Upload::$max_height = 0

Definition at line 31 of file Upload.php.

CI_Upload::$max_size = 0

Definition at line 29 of file Upload.php.

CI_Upload::$max_width = 0

Definition at line 30 of file Upload.php.

CI_Upload::$mimes = array()

Definition at line 48 of file Upload.php.

Referenced by mimes_types().

CI_Upload::$orig_name = ""

Definition at line 35 of file Upload.php.

CI_Upload::$overwrite = FALSE

Definition at line 40 of file Upload.php.

CI_Upload::$remove_spaces = TRUE

Definition at line 49 of file Upload.php.

CI_Upload::$temp_prefix = "temp_file_"

Definition at line 51 of file Upload.php.

CI_Upload::$upload_path = ""

Definition at line 39 of file Upload.php.

CI_Upload::$xss_clean = FALSE

Definition at line 50 of file Upload.php.

---

The documentation for this class was generated from the following file:

• Upload.php