Ошибка в downloads.php - PHP-Fusion SF Russian Support Site

<?php

/*---------------------------------------------------+

|	PHP-Fusion 6 Content Management System

+---------------------------------------------------------+

|	Copyright (c) 2005 Nick Jones

|	http://www.php-fusion.co.uk/

+---------------------------------------------------------+

|	Released under the terms & conditions of v2 of the

|	GNU General Public License. For details refer to

|	the included gpl.txt file or visit http://gnu.org

+---------------------------------------------------------*/

require_once "../../maincore.php";

require_once BASEDIR."subheader.php";

require_once ADMIN."navigation.php";

@include INFUSIONS."mp3/locale/Russian.php";

@include INFUSIONS."mp3/locale/Russian.php";



if (isset($mp3_id) && !isNum($mp3_id)) fallback(FUSION_SELF);

if (!isset($step)) $step = "";



$result = dbquery("SELECT * FROM ".$db_prefix."mp3_art");

if (dbrows($result) != 0) {

	if ($step == "delete") {

		$result = dbquery("DELETE FROM ".$db_prefix."mp3 WHERE mp3_id='$mp3_id'");

		redirect("admin.php");

	}

	if (isset($_POST['save_mp3'])) {



		$mp3_title = stripinput($_POST['mp3_title']);

               	$mp3_artist = stripinput($_POST['mp3_artist']);

               if ($step !== "edit") {

                if ($_FILES['upload']['error']==0)

				{

				$upload_file = $_FILES['upload']['name'];

				$upload_dir = '../../data/';

				$file_allow = array ("zip", "rar", "7z", "");

				$file_info = pathinfo($upload_file);

				if (!(in_array($file_info['extension'],$file_allow)))

				{

					echo "Разрешение ".$file_info['extension']." не является разрешенным1";

					exit;

				}

				$tmp_path = $_FILES['upload']['tmp_name'];

				$full_path_copy = $upload_dir.$upload_file;

					if (move_uploaded_file($tmp_path,$full_path_copy))

				{

					

					$dir = 'data/';

					$mp3_url = $dir.$_FILES['upload']['name'];

                	$mp3_filesize = parsebytesize($_FILES['upload']['size']);

                	$uploaded = true;

                	

                }

                }

                }

                

                if ($step == "edit") {

                	if ($reedit == "1") {

						$mp3_url = stripinput($_POST['file_url']);

					 	$mp3_filesize = stripinput($_POST['file_sz']);

					 	$uploaded = true;

					} elseif ($reedit == "2"){

						$mp3_url = stripinput($_POST['file_url']);

					 	$mp3_filesize = stripinput($_POST['file_sz']);

						unlink ("../".$download_url);

						$result = dbquery("UPDATE ".$db_prefix."mp3 SET mp3_url='$mp3_url', 



mp3_filesize='$mp3_filesize' WHERE mp3_id='$mp3_id'");

						$uploaded = true;

					} elseif ($reedit == "3"){

						$mp3_url = stripinput($_POST['file_url']);

					 	$mp3_filesize = stripinput($_POST['file_sz']);

						unlink ("../".$mp3_url);

						$result = dbquery("UPDATE ".$db_prefix."mp3 SET mp3_url='$mp3_url', 



mp3_filesize='$mp3_filesize' WHERE mp3_id='$mp3_id'");

						unset($mp3_url);

						unset($mp3_filesize);

						if ($_FILES['upload']['error']==0)

				{

				$upload_file = $_FILES['upload']['name'];

				$upload_dir = '../data/';

				$file_allow = array ("zip", "rar", "7z", "");

				$file_info = pathinfo($upload_file);

				if (!(in_array($file_info['extension'],$file_allow)))

				{

					echo "Разрешение ".$file_info['extension']." не является разрешенным2";

					exit;

				}

				$tmp_path = $_FILES['upload']['tmp_name'];

				$full_path_copy = $upload_dir.$upload_file;

					if (move_uploaded_file($tmp_path,$full_path_copy))

				{

					

					$dir = 'data/';

					$download_url = $dir.$_FILES['upload']['name'];

                	$download_filesize = parsebytesize($_FILES['upload']['size']);

                	$uploaded = true;

                	

                }

                }

					} elseif ($reedit == "4"){

					$mp3_url = stripinput($_POST['file_url']);

					 	$mp3_filesize = stripinput($_POST['file_sz']);

						unlink ("../".$mp3_url);

						$result = dbquery("UPDATE ".$db_prefix."mp3 SET mp3_url='$mp3_url', 



mp3_filesize='$mp3_filesize' WHERE mp3_id='$mp3_id'");

						unset($mp3_url);

						unset($mp3_filesize);

					$mp3_url = stripinput($_POST['mp3_url_e']);

					$mp3_filesize = stripinput($_POST['mp3_filesize_e']);

					$uploaded = true;

					}

					

				else {

						if ($_FILES['upload']['error']==0)

				{

				$upload_file = $_FILES['upload']['name'];

				$upload_dir = '../data/';

				$file_allow = array ("zip", "rar", "7z");

				$file_info = pathinfo($upload_file);

				if (!(in_array($file_info['extension'],$file_allow)))

				{

					echo "Разрешение ".$file_info['extension']." не является разрешенным3";

					exit;

				}

				$tmp_path = $_FILES['upload']['tmp_name'];

				$full_path_copy = $upload_dir.$upload_file;

					if (move_uploaded_file($tmp_path,$full_path_copy))

				{

					

					$dir = 'data/';

					$mp3_url = $dir.$_FILES['upload']['name'];

                	$mp3_filesize = parsebytesize($_FILES['upload']['size']);

                	$uploaded = true;

                	

                }

                }

					}

				

					

				}

                

                

                if (!isset($uploaded)){

					 $mp3_url = stripinput($_POST['download_url']);

					 $mp3_filesize = stripinput($_POST['download_filesize']);

			   	}		$mp3_khz = stripinput($_POST['mp3_khz']);

		$mp3_kbps = stripinput($_POST['mp3_kbps']);

		$mp3_tag = stripinput($_POST['mp3_tag']);

                $mp3_time = stripinput($_POST['mp3_time']);

		$mp3_img =stripinput($_POST['mp3_img']);

		$mp3_kinotv =stripinput($_POST['mp3_kinotv']);

		$mp3_text = stripinput($_POST['mp3_text']);

		$mp3_uploader = stripinput($_POST['mp3_uploader']);

		if ($step == "edit") {

			$mp3_datestamp = isset($_POST['update_datestamp']) ? ", mp3_datestamp='".time()."'" : "";

			$result = dbquery("UPDATE ".$db_prefix."mp3 SET mp3_title='$mp3_title',mp3_artist='$mp3_artist',  



mp3_url='$mp3_url', mp3_khz='$mp3_khz', mp3_kbps='$mp3_kbps', mp3_tag='$mp3_tag', mp3_filesize='$mp3_filesize', 



mp3_time='$mp3_time', mp3_img='$mp3_img', mp3_kinotv='$mp3_kinotv', mp3_text='$mp3_text', mp3_uploader='$mp3_uploader' 



".$mp3_datestamp." WHERE mp3_id='$mp3_id'");



			redirect("admin.php");

		} else {

			$result = dbquery("INSERT INTO ".$db_prefix."mp3 VALUES('', '$mp3_title','$mp3_artist', '$mp3_url',  



'$mp3_khz', '$mp3_kbps', '$mp3_tag', '$mp3_filesize','$mp3_time', '$mp3_img', '$mp3_kinotv', '$mp3_text', '$mp3_uploader', 



'".time()."', '0')");

			redirect("admin.php");

		}

	}

	if ($step == "edit") {

		$result = dbquery("SELECT * FROM ".$db_prefix."mp3 WHERE mp3_id='$mp3_id'");

		$data = dbarray($result);

		$mp3_title = $data['mp3_title'];

  $mp3_artist = $data['mp3_artist'];

		$mp3_url = $data['mp3_url'];

		$mp3_khz = $data['mp3_khz'];

		$mp3_kbps = $data['mp3_kbps'];

		$mp3_tag = $data['mp3_tag'];

		$mp3_filesize = $data['mp3_filesize'];

                		$mp3_time = $data['mp3_time'];

		$mp3_img = $data['mp3_img'];

		$mp3_kinotv = $data['mp3_kinotv'];

		$mp3_text = $data['mp3_text'];

		$mp3_uploader=$data['mp3_uploader'];

		$formaction = FUSION_SELF."?step=edit&artist_id=$artist_id&mp3_id=$mp3_id";

		opentable(''.$locale['MP3061'].'');

	} else {

		$mp3_title = "";

		$mp3_artist = "";

		$mp3_url = "";

		$mp3_khz = "";

		$mp3_kbps = "";

		$mp3_tag = "";

		$mp3_filesize = "";

        $mp3_time = "";

		$mp3_img ="";

		$mp3_kinotv ="";

		$mp3_text ="";

		$mp3_uploader="";

		$formaction = FUSION_SELF;

		opentable(''.$locale['MP3062'].'');

	}

 $editlist = ""; $sel = "";

	$result2 = dbquery("SELECT * FROM ".$db_prefix."mp3_art ORDER BY title");

	if (dbrows($result2) != 0) {

		while ($data2 = dbarray($result2)) {

			if ($step == "edit") $sel = ($data['mp3_artist'] == $data2['id'] ? " selected" : "");

			$editlist .= "<option value='".$data2['id']."'$sel>".$data2['title']."</option>\n";

		}

	}



	echo "

 <center><a href='mp3_cats.php'>".$locale['MP3063']."</a></center>



 <form name='inputform' method='post' action='$formaction'>

<table align='center' cellpadding='0' cellspacing='0' width='460'>

<tr>

<td width='80' class='tbl'>".$locale['MP3064']."</td>

<td class='tbl'><input type='text' name='mp3_title' value='$mp3_title' class='textbox' style='width:380px;'></td>

</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3065']."</td>

<td class='tbl'><select name='mp3_artist' class='textbox'>

$editlist</select></td>

</tr>

<tr>";

if ($step !== "edit"){

echo "<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>Загрузить с компьютера:</td>

</tr>

<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'><input type='file' class='textbox' style='width:380px;' name='upload' /></td>

</tr>

<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>";

$post_max_size = (ini_get('file_uploads')==0) ? $locale['ic_006'] : @ini_get('post_max_size');

echo "Максимальный размер загрузки: ".$post_max_size;

echo "<br /><br /></td>

</tr>

<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>или указать url и размер в ручную</td>

</tr><tr>

<td width='80' class='tbl'>".$locale['482']."</td>

<td class='tbl'><input type='text' name='mp3_url' value='$mp3_url' class='textbox' style='width:380px;'></td>

<tr>

<td width='80' class='tbl'>".$locale['487']."</td>

<td class='tbl'><input type='text' name='mp3_filesize' value='$mp3_filesize' class='textbox' style='width:150px;'></td>

</tr>";

} elseif ($step == "edit") {

echo "<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>

<input type=hidden name='file_url' VALUE='$mp3_url'>

<input type=hidden name='file_sz' VALUE='$mp3_filesize'>

".@$report = empty($mp3_url) ? "Ссылка на файл не указана" : "Файл $mp3_url ($mp3_filesize)"."

$report</td>

</tr>";

	if ($mp3_url != "" & file_exists("../".$mp3_url)) {

		echo "<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>

<input type=radio name=reedit VALUE='1' checked> Оставить без изменений<br />

<input type=radio name=reedit VALUE='2'> Удалить<br />

<input type=radio name=reedit VALUE='3'> Заменить<br />

<input type='file' class='textbox' style='width:380px;' name='upload' /><br />

<input type=radio name=reedit VALUE='4'> Заменить файлом с сети<br />

<input type='text' name='mp3_url_e' value='' class='textbox' style='width:380px;'><br />

Размер файла:<br />

<input type='text' name='mp3_filesize_e' value='' class='textbox' style='width:150px;'>

</td>

</tr>";

	} else {

echo "<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>заменить фалом с компьютера:</td>

</tr>

<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'><input type='file' class='textbox' style='width:380px;' name='upload' /></td>

</tr>

<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>";

$post_max_size = (ini_get('file_uploads')==0) ? $locale['ic_006'] : @ini_get('post_max_size');

echo "Максимальный размер загрузки: ".$post_max_size;

echo "<br /><br /></td>

</tr>

<tr>

<td width='80' class='tbl'> </td>

<td class='tbl'>или указать url и размер в ручную</td>

</tr><tr>

<td width='80' class='tbl'>".$locale['482']."</td>

<td class='tbl'><input type='text' name='mp3_url' value='$mp3_url' class='textbox' style='width:380px;'></td>

<tr>

<td width='80' class='tbl'>".$locale['487']."</td>

<td class='tbl'><input type='text' name='mp3_filesize' value='$mp3_filesize' class='textbox' style='width:150px;'></td>

</tr>";

	}

	

}

echo "</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3067']."</td>

<td class='tbl'><input type='text' name='mp3_khz' value='$mp3_khz' class='textbox' style='width:150px;'> khz</td>

</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3068']."</td>

<td class='tbl'><input type='text' name='mp3_kbps' value='$mp3_kbps' class='textbox' style='width:150px;'> kbps</td>

</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3069']."</td>

<td class='tbl'>

<select name='mp3_tag' class='textbox'>

<option value='".$locale['MP3070']."'>".$locale['MP3070']."</option><option 



value='".$locale['MP3071']."'>".$locale['MP3071']."</option></select></td>

</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3073']."</td>

<td class='tbl'><input type='text' name='mp3_time' value='$mp3_time' class='textbox' style='width:150px;'></td>

</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3187']."</td>

<td class='tbl'><input type='text' name='mp3_img' value='$mp3_img' class='textbox' style='width:150px;'></td>

</tr>

<tr>

<td width='80' class='tbl'>".$locale['MP3186']."</td>

<td class='tbl'><input type='text' name='mp3_kinotv' value='$mp3_kinotv' class='textbox' style='width:150px;'></td>

</tr>

<tr>

<td valign='top' width='80' class='tbl'>".$locale['MP3188']."</td>

<td class='tbl'><textarea name='mp3_text' rows='5' cols='70' class='textbox'>".$mp3_text."</textarea></td>

</tr>

<tr>

<td valign='top' width='80' class='tbl'>".$locale['MP3057']."</td>

<td class='tbl'><input type='hidden' name='mp3_uploader' value='".$userdata['user_name']."' readonly></td>

</tr>

<tr>

<td align='center' colspan='2' class='tbl'>";

	if ($step == "edit") echo "<input type='checkbox' name='update_datestamp' value='1'>".$locale['MP3074']."<br><br>\n";

	echo "<input type='submit' name='save_mp3' value='".$locale['MP3075']."' class='button'></td>

</tr>

</table>

</form>\n";



	closetable();

	tablebreak();

	opentable(''.$locale['MP3076'].'');

	echo "<table align='center' cellpadding='0' cellspacing='0' width='400'>\n";

	$result = dbquery("SELECT * FROM ".$db_prefix."mp3_art ORDER BY title");

	if (dbrows($result) != 0) {

		echo "<tr>

<td class='tbl2'>".$locale['MP3077']."</td>

<td align='right' class='tbl2'>".$locale['MP3078']."</td>

</tr>

<tr>

<td colspan='2' height='1'></td>

</tr>\n";

		while ($data = dbarray($result)) {

			if (!isset($id)) $id = "";

			if ($data['id'] == $id) { $p_img = "off"; $div = ""; } else { $p_img = "on"; $div = 



"style='display:none'"; }

			echo "<tr>

<td class='tbl2'>".$data['title']."</td>

<td class='tbl2' align='right'><img onclick=\"javascript:flipBox('".$data['id']."')\" 



src='".THEME."images/panel_".$p_img.".gif' name='b_".$data['id']."'></td>

</tr>\n";

			$result2 = dbquery("SELECT * FROM ".$db_prefix."mp3 WHERE mp3_artist='".$data['id']."' ORDER BY 



mp3_title");

			if (dbrows($result2) != 0) {

				echo "<tr>

<td colspan='2'>

<div id='box_".$data['id']."'".$div.">

<table cellpadding='0' cellspacing='0' width='100%'>\n";

				while ($data2 = dbarray($result2)) {

					if (!strstr($data2['mp3_url'],"http://") && !strstr($data2['mp3_url'],"../")) {

						$mp3_url = BASEDIR.$data2['mp3_url'];

					} else {

						$mp3_url = $data2['mp3_url'];

					}

					echo "<tr>\n<td class='tbl'><a href='$mp3_url' 



target='_blank'>".$data2['mp3_title']."</a></td>

<td align='right' width='100' class='tbl'><a 



href='".FUSION_SELF."?step=edit&artist_id=".$data['id']."&mp3_id=".$data2['mp3_id']."'>"

.$locale['MP3079']."</a> -

<a href='".FUSION_SELF."?step=delete&id=".$data['id']."&mp3_id=".$data2['mp3_id']."' onClick='return 



DeleteItem()'>".$locale['MP3080']."</a></td>

</tr>\n";

				}

				echo "</table>

</div>

</td>

</tr>\n";

			} else {

				echo "<tr>

<td colspan='2'>

<div id='box_".$data['id']."' style='display:none'>

<table cellpadding='0' cellspacing='0' width='100%'>

<tr>

<td class='tbl'>".$locale['MP3081']."</td>

</tr>

</table>

</div>

</td>

</tr>\n";

			}

		}

		echo "</table>\n";

		echo "<script type='text/javascript'>

function DeleteItem()

{

return confirm('".$locale['MP3082']."');

}

</script>\n";

	} else {

		echo "<tr>

<td align='center'><br>

".$locale['MP3083']."<br><br>

<a href='mp3_cats.php'>".$locale['MP3084']."<br><br></td>

</tr>

</table>\n";

	}

	closetable();

} else {

	opentable(''.$locale['MP3076'].'');

	echo "".$locale['MP3085']."";

	closetable();

}



echo "</td>\n";

require_once BASEDIR."footer.php";

?>