Source for file Upload.php
Documentation is available at Upload.php
// ********************************************** //
// This software is licensed by the LGPL
// -> http://www.gnu.org/copyleft/lesser.txt
// (c) 2001- 2004 by Tomas Von Veschler Cox //
// ********************************************** //
* Pear File Uploader class. Easy and secure managment of files
* submitted via HTML Forms.
* - you can add error msgs in your language in the HTTP_Upload_Error class
* - try to think a way of having all the Error system in other
* file and only include it when an error ocurrs
* -- Notes for users HTTP_Upload >= 0.9.0 --
* Error detection was enhanced, so you no longer need to
* check for PEAR::isError() in $upload->getFiles() or call
* $upload->isMissing(). Instead you'll
* get the error when do a check for $file->isError().
* $upload = new HTTP_Upload('en');
* $file = $upload->getFiles('i_dont_exist_in_form_definition');
* if ($file->isError()) {
* die($file->getMessage());
define('HTTP_UPLOAD_DEFAULT_CHMOD', 0660 );
* Error Class for HTTP_Upload
* @author Tomas V.V.Cox <cox@idecnet.com>
* @see http://vulcanonet.com/soft/index.php?pack=uploader
* Selected language for error messages
* Whether HTML entities shall be encoded automatically
* Creates a new PEAR_Error
* @param string $lang The language selected for error code messages
$this->lang = ($lang !== null ) ? $lang : $this->lang;
$this->html = ($html !== false ) ? $html : $this->html;
$raw_size = ini_get('upload_max_filesize');
$ini_size = intval($raw_size);
case 'G': $ini_size *= 1024;
case 'M': $ini_size *= 1024;
case 'K': $ini_size *= 1024;
$maxsize = (isset ($_POST['MAX_FILE_SIZE'])) ?
$_POST['MAX_FILE_SIZE'] : null;
$maxsize = (isset ($HTTP_POST_VARS['MAX_FILE_SIZE'])) ?
$HTTP_POST_VARS['MAX_FILE_SIZE'] : null;
if (empty ($maxsize) || ($maxsize > $ini_size)) {
$this->_maxsize = $maxsize;
$this->_loadLanguage ('en');
$this->_loadLanguage ($lang);
self ::__construct ($lang, $html);
* @param string $e_code type of error
* @return string Error message
if (!empty ($this->error_codes[$this->lang][$e_code])) {
$this->error_codes[$this->lang][$e_code];
if (!empty ($this->error_codes[$this->lang]['ERROR'])) {
$error = $this->error_codes[$this->lang]['ERROR'];
$error = $this->error_codes['en']['ERROR'];
* Overwrites the PEAR::raiseError method
* @param string $e_code type of error
* @return object PEAR_Error a PEAR-Error object
return PEAR ::raiseError ($this->errorCode($e_code), $e_code);
* Loads language strings into error codes variable
* @param string $lang Language code (2-letter or pt_BR)
* @return mixed PEAR_Error on error, boolean true if all went well
function _loadLanguage ($lang)
$maxsize = $this->_maxsize;
$local = dirname(__FILE__ ) . '/../data/' . $lang . '.php';
include_once 'PEAR/Config.php';
$dataf = PEAR_Config ::singleton ()->get ('data_dir')
. '/HTTP_Upload/' . $lang . '.php';
//that's a bad error here
return PEAR ::raiseError ('Language file could not be loaded');
if (!isset ($errorCodes[$lang])) {
'No language found in ' . $lang . ' language file'
$this->error_codes[$lang] = $errorCodes[$lang];
* This class provides an advanced file uploader system
* for file uploads made from html forms
* @author Tomas V.V.Cox <cox@idecnet.com>
* @see http://vulcanonet.com/soft/index.php?pack=uploader
* Contains an array of "uploaded files" objects
* Whether the files array has already been built or not
* Contains the desired chmod for uploaded files
var $_chmod = HTTP_UPLOAD_DEFAULT_CHMOD;
* Specially used if the naming mode is 'seq'
* Contains file naming information
var $_modeNameSeq = array (
* @param string $lang Language to use for reporting errors
* @see Upload_Error::error_codes
$this->post_files = $_FILES;
if (isset ($_SERVER['CONTENT_TYPE'])) {
$this->content_type = $_SERVER['CONTENT_TYPE'];
global $HTTP_POST_FILES, $HTTP_SERVER_VARS;
$this->post_files = $HTTP_POST_FILES;
if (isset ($HTTP_SERVER_VARS['CONTENT_TYPE'])) {
$this->content_type = $HTTP_SERVER_VARS['CONTENT_TYPE'];
self ::__construct ($lang);
* - not given, function will return array of upload_file objects
* - is int, will return the $file position in upload_file objects array
* - is string, will return the upload_file object corresponding
* to $file name of the form. For ex:
* if form is <input type="file" name="userfile">
* to get this file use: $upload->getFiles('userfile')
* @return mixed array or object (see @param $file above) or Pear_Error
//build only once for multiple calls
$files = &$this->_buildFiles ();
if (PEAR ::isError ($files)) {
// there was an error with the form.
// Create a faked upload embedding the error
$files_code = $files->getCode ();
$this->lang, $this->_chmod);
foreach ($this->files as $obj) {
return $this->files[$file];
if (isset ($this->files['_error'])) {
return $this->files['_error'];
// developer didn't specify this name in the form
// warn him about it with a faked upload
* Creates the list of the uploaded file
* @return array of HTTP_Upload_File objects for every file
if (!isset ($this->content_type) ||
strpos($this->content_type, 'multipart/form-data') !== 0 )
// In 4.1 $_FILES isn't initialized when no uploads
// XXX (cox) afaik, in >= 4.1 and < 4.3 only
if (PEAR ::isError ($error)) {
// map error codes from 4.2.0 $_FILES['userfile']['error']
// Parse $_FILES (or $HTTP_POST_FILES)
foreach ($this->post_files as $userfile => $value) {
foreach ($value['name'] as $key => $val) {
$err = $value['error'][$key];
if (isset ($err) && $err !== 0 && isset ($uploadError[$err])) {
$error = $uploadError[$err];
$tmp_name = $value['tmp_name'][$key];
$size = $value['size'][$key];
$type = $value['type'][$key];
$formname = $userfile . " [$key]";
$formname, $type, $size, $error, $this->lang, $this->_chmod);
if (isset ($err) && $err !== 0 && isset ($uploadError[$err])) {
$error = $uploadError[$err];
$tmp_name = $value['tmp_name'];
$formname, $type, $size, $error, $this->lang, $this->_chmod);
* Checks if the user submited or not some file
* @return mixed False when are files or PEAR_Error when no files
* @see Read the note in the source code about this function
if (count($this->post_files) < 1 ) {
//we also check if at least one file has more than 0 bytes :)
foreach ($this->post_files as $userfile => $value) {
foreach ($value['name'] as $key => $val) {
$size += $value['size'][$key];
} elseif (!empty ($value['name'])) { //one file
$error = $value['error'];
if ($error !== null && $error != 2 && $size == 0 ) {
* Sets the chmod to be used for uploaded files
* @param int Desired mode
* This class provides functions to work with the uploaded file
* @author Tomas V.V.Cox <cox@idecnet.com>
* @see http://vulcanonet.com/soft/index.php?pack=uploader
* Assoc array with file properties
* If user haven't selected a mode, by default 'safe' will be used
* It's a common security risk in pages who has the upload dir
* under the document root (remember the hack of the Apache web?)
* @see HTTP_Upload_File::setValidExtensions()
var $_extensionsCheck = array ('php', 'phtm', 'phtml', 'php3', 'inc');
* @see HTTP_Upload_File::setValidExtensions()
var $_extensionsMode = 'deny';
* Whether to use case-sensitive extension checks or not
* @see HTTP_Upload_File::setValidExtensions()
var $_extensionsCaseSensitive = true;
* Contains the desired chmod for uploaded files
var $_chmod = HTTP_UPLOAD_DEFAULT_CHMOD;
* @param string $name destination file name
* @param string $tmp temp file name
* @param string $formname name of the form
* @param string $type Mime type of the file
* @param string $size size of the file
* @param string $error error on upload
* @param string $lang used language for errormessages
function __construct($name = null , $tmp = null , $formname = null ,
$type = null , $size = null , $error = null ,
$lang = null , $chmod = HTTP_UPLOAD_DEFAULT_CHMOD )
|| ($error != 'TOO_LARGE' && $error != 'DEV_NO_DEF_FILE' && $size == 0 )
} elseif ($tmp == 'none' || $name == '_error' && $error == 'DEV_NO_DEF_FILE') {
// strpos needed to detect files without extension
if (($pos = strrpos($name, '.')) !== false ) {
$ext = substr($name, $pos + 1 );
if (isset ($_POST['MAX_FILE_SIZE']) &&
$size > $_POST['MAX_FILE_SIZE']) {
if (isset ($HTTP_POST_VARS['MAX_FILE_SIZE']) &&
$size > $HTTP_POST_VARS['MAX_FILE_SIZE']) {
'form_name' => $formname,
$type = null , $size = null , $error = null ,
$lang = null , $chmod = HTTP_UPLOAD_DEFAULT_CHMOD )
self ::__construct ($name, $tmp, $formname, $type, $size, $error, $lang, $chmod);
* Sets the name of the destination file
* @param string $mode A valid mode: 'uniq', 'seq', 'safe' or 'real' or a file name
* @param string $prepend A string to prepend to the name
* @param string $append A string to append to the name
* @return string The modified name of the destination file
function setName($mode, $prepend = null , $append = null )
$name .= '.' . $this->upload['ext'];
if (($pos = strrpos($name, '.')) !== false ) {
$name = $this->upload['real'];
$this->_modeNameSeq['flag'] = true;
$this->_modeNameSeq['prepend'] = $prepend;
$this->_modeNameSeq['append'] = $append;
$this->upload['name'] = $prepend . $name . $append;
* Sequence file names in the form: userGuide[1].pdf, userGuide[2].pdf ...
* @param string $dir Destination directory
//Check if a file with the same name already exists
$name = $dir . DIRECTORY_SEPARATOR . $this->upload['real'];
//we need to strip out the extension and the '.' of the file
//e.g 'userGuide.pdf' becomes 'userGuide'
//here's the pattern we're looking for
$pattern = '/(\[)([[:digit:]]+)(\])$/';
//just incase the original filename had a sequence, we take it out
// e.g: 'userGuide[3]' should become 'userGuide'
* attempt to find a unique sequence file name
$filename = $basename . '[' . $i . '].' . $this->upload['ext'];
$check = $dir . DIRECTORY_SEPARATOR . $filename;
* Unique file names in the form: 9022210413b75410c28bef.html
* @see HTTP_Upload_File::setName()
* Format a file name to be safe
* @param string $file The string file name
* @param int $maxlen Maximun permited string lenght
* @return string Formatted file name
* @see HTTP_Upload_File::setName()
$alpha = 'AEIOUYaeiouyAEIOUaeiouAEIOUaeiouAEIOUaeiouyAaOoAaNnCcaooaTtAa';
$name = substr($name, 0 , $maxlen);
$name = strtr($name, $noalpha, $alpha);
// not permitted chars are replaced with "_"
return preg_replace('/[^a-zA-Z0-9,._\+\()\-]/', '_', $name);
* @return bool If the file was submitted correctly
if ($this->upload['error'] === null ) {
* User haven't submit a file
* @return bool If the user submitted a file or not
if ($this->upload['error'] == 'NO_USER_FILE') {
* Some error occured during upload (most common due a file size problem,
* like max size exceeded or 0 bytes long).
* @return bool If there were errors submitting the file (probably
* because the file excess the max permitted file size)
if (in_array($this->upload['error'], array ('TOO_LARGE', 'BAD_FORM','DEV_NO_DEF_FILE'))) {
* Moves the uploaded file to its destination directory.
* @param string $dir Destination directory
* @param bool $overwrite Overwrite if destination file exists?
* @return mixed True on success or PEAR_Error object on error
function moveTo($dir, $overwrite = true )
if (!$this->_evalValidExtensions ()) {
$error = & $this->raiseError('NOT_ALLOWED_EXTENSION');
$err_code = $this->_chkDirDest ($dir);
if ($err_code !== false ) {
// Use 'safe' mode by default if no other was selected
//test to see if we're working with sequence naming mode
if (isset ($this->_modeNameSeq) && isset ($this->_modeNameSeq['flag']) && $this->_modeNameSeq['flag'] === true ) {
$this->upload['name'] = $this->_modeNameSeq['prepend'] . $this->nameToSeq($dir) . $this->_modeNameSeq['append'];
$name = $dir . DIRECTORY_SEPARATOR . $this->upload['name'];
if ($overwrite !== true ) {
// copy the file and let php clean the tmp
@chmod($name, $this->_chmod);
* Check for a valid destination dir
* @param string $dir_dest Destination dir
* @return mixed False on no errors or error code on error
function _chkDirDest ($dir_dest)
* Retrive properties of the uploaded file
* @param string $name The property name. When null an assoc array with
* all the properties will be returned
* @return mixed A string or array
* @see HTTP_Upload_File::HTTP_Upload_File()
* Returns a error message, if a error occured
* (deprecated) Use getMessage() instead
* @return string a Error message
* Returns a error message, if a error occured
* @return string a Error message
* Returns an array with all valid file extensions.
* @return array Array of extensions without dot.
return $this->_extensionsCheck;
* Function to restrict the valid extensions on file uploads.
* Restrictions are applied to the name of the file on the user's
* disk, not the destination file name used at moveTo().
* @param array $exts File extensions to validate
* @param string $mode The type of validation:
* 1) 'deny' Will deny only the supplied extensions
* 2) 'accept' Will accept only the supplied extensions
* @param bool $case_sensitive whether extension check is case sensitive.
* When it is case insensitive, the extension
* is lowercased before compared to the array
$this->_extensionsCheck = $exts;
$this->_extensionsMode = $mode;
if ($case_sensitive != null ) {
$this->_extensionsCaseSensitive = $case_sensitive;
* Evaluates the validity of the extensions set by setValidExtensions.
* Checks the validity of the file extension of the original filename
* the user used for the file on his disk.
* @return bool False on non valid extension, true if they are valid
function _evalValidExtensions ()
$exts = $this->_extensionsCheck;
if (!$this->_extensionsCaseSensitive) {
if ($this->_extensionsMode == 'deny') {
Documentation generated on Mon, 11 Mar 2019 16:04:24 -0400 by phpDocumentor 1.4.4. PEAR Logo Copyright © PHP Group 2004.
|