<?php
if(!defined('__KIMS__')) exit;

include_once $g['path_core'].'function/thumb.func.php';
include_once $g['dir_module'].'var/var.php';

$sessArr = explode('_', (string)$sess_Code, 2);
if (count($sessArr) !== 2 || empty($_SESSION['upsescode'])
	|| !hash_equals((string)$_SESSION['upsescode'], (string)$sessArr[0])
	|| (int)$sessArr[1] !== (int)$my['uid']) exit;

$configuredUploadLimit = max((int)$d['upload']['maxsize_file'], (int)$d['upload']['maxsize_img']) * 1024 * 1024;
$uploaded = kimsq_validate_upload($_FILES['Filedata'] ?? array(), $configuredUploadLimit);
if (!$uploaded) exit;

$tmpcode	= $sessArr[0];
$mbruid		= (int)$my['uid'];
$fserver	= $d['upload']['use_fileserver'];
$url		= $fserver ? $d['upload']['ftp_urlpath'] : $g['url_root'].'/files/';
$name		= strtolower($uploaded['name']);
$size		= $uploaded['size'];
$width		= 0;
$height		= 0;
$caption	= trim($caption);
$down		= 0;
$d_regis	= $date['totime'];
$d_update	= '';
$fileExt	= $uploaded['extension'] === 'jpeg' ? 'jpg' : $uploaded['extension'];
$imageExt	= array('jpg','gif','png','bmp','webp');
$type		= $uploaded['is_image'] && in_array($fileExt, $imageExt, true) ? 2 : getFileType($fileExt);
$tmpname	= bin2hex(random_bytes(16)).($type === 2 ? '.'.$fileExt : '');
$hidden		= $type === 2 ? 1 : 0;

$blockedExtensions = preg_split('/[\s,]+/', strtolower((string)$d['upload']['ext_cut']), -1, PREG_SPLIT_NO_EMPTY);
if (in_array($fileExt, $blockedExtensions, true)) exit;
$maxMegabytes = $type === 2 ? (int)$d['upload']['maxsize_img'] : (int)$d['upload']['maxsize_file'];
if ($maxMegabytes > 0 && $size > $maxMegabytes * 1024 * 1024) exit;

/* Never trust the client-supplied saveDir. */
$saveDir	= $g['path_file'];
$savePath1	= $saveDir.substr($date['today'],0,4);
$savePath2	= $savePath1.'/'.substr($date['today'],4,2);
$savePath3	= $savePath2.'/'.substr($date['today'],6,2);
$folder		= substr($date['today'],0,4).'/'.substr($date['today'],4,2).'/'.substr($date['today'],6,2);
$saveFile	= $savePath3.'/'.$tmpname;
$savePaths	= array($savePath1,$savePath2,$savePath3);

if ($fserver)
{
	$FTP_CONNECT = @ftp_connect($d['upload']['ftp_host'], $d['upload']['ftp_port']);
	if (!$FTP_CONNECT || !@ftp_login($FTP_CONNECT, $d['upload']['ftp_user'], $d['upload']['ftp_pass'])) exit;
	if($d['upload']['ftp_pasv']) ftp_pasv($FTP_CONNECT, true);
	if (!@ftp_chdir($FTP_CONNECT, $d['upload']['ftp_folder'])) exit;

	$ftpBase = rtrim((string)$d['upload']['ftp_folder'],'/').'/';
	$ftpPaths = array(
		substr($date['today'],0,4),
		substr($date['today'],0,4).'/'.substr($date['today'],4,2),
		$folder
	);
	foreach ($ftpPaths as $ftpPath) @ftp_mkdir($FTP_CONNECT,$ftpBase.$ftpPath);

	if ($type === 2)
	{
		$thumbname = md5($tmpname).'.'.$fileExt;
		$thumbFile = $g['path_tmp'].'backup/'.$thumbname;
		ResizeWidth($uploaded['tmp_name'], $thumbFile, 150);
		$IM = getimagesize($uploaded['tmp_name']);
		$width = $IM[0];
		$height = $IM[1];
		@ftp_put($FTP_CONNECT, $d['upload']['ftp_folder'].$folder.'/'.$thumbname, $thumbFile, FTP_BINARY);
		@unlink($thumbFile);
	}
	if (!@ftp_put($FTP_CONNECT, $d['upload']['ftp_folder'].$folder.'/'.$tmpname, $uploaded['tmp_name'], FTP_BINARY)) exit;
	ftp_close($FTP_CONNECT);
}
else
{
	foreach ($savePaths as $savePath)
	{
		if (!is_dir($savePath) && !mkdir($savePath,0750,true) && !is_dir($savePath)) exit;
	}

	if (!move_uploaded_file($uploaded['tmp_name'], $saveFile)) exit;
	@chmod($saveFile, 0640);
	if ($type === 2)
	{
		$thumbname = md5($tmpname).'.'.$fileExt;
		$thumbFile = $savePath3.'/'.$thumbname;
		ResizeWidth($saveFile, $thumbFile, 150);
		@chmod($thumbFile, 0640);
		$IM = getimagesize($saveFile);
		$width = $IM[0];
		$height = $IM[1];
	}
}

$mingid = getDbCnt($table['s_upload'],'min(gid)','');
$gid = $mingid ? $mingid - 1 : 100000000;

$QKEY = "gid,hidden,tmpcode,site,mbruid,type,ext,fserver,url,folder,name,tmpname,thumbname,size,width,height,caption,down,d_regis,d_update,cync";
$QVAL = "'$gid','$hidden','$tmpcode','$s','$mbruid','$type','$fileExt','$fserver','$url','$folder','$name','$tmpname','$thumbname','$size','$width','$height','$caption','$down','$d_regis','$d_update','$cync'";
getDbInsert($table['s_upload'],$QKEY,$QVAL);
getDbUpdate($table['s_numinfo'],'upload=upload+1',"date='".$date['today']."' and site=".$s);

if ($gid == 100000000) db_query("OPTIMIZE TABLE ".$table['s_upload'],$DB_CONNECT);

if ($upType == 'normal')
{
	getLink($g['s'].'/?r='.$r.'&m='.$m.'&mod='.$mod.'&gparam='.$gparam.($cupload?'&cupload='.$cupload:''),'','','');
}
exit;
?>
