<?php

#############################################################################
#                              Site@School Download module
# Site@School is a website management system designed for schools.
# This is a download module which can be used in Site@School.
#
# coded by Fred Stuurman (fc.stuurman@hccnet.nl)
############################################################################
# upload.php: last changed 12/10/2006  version 2.4.10
#                  by Fred Stuurman (fc.stuurman@hccnet.nl)
#$Id: upload.php,v 1.2 2006/10/15 19:08:54 fstuurman Exp $
############################################################################
#                        LICENSE INFORMATION
# Copyright (C) 2002 - 2006 Municipality of Amsterdam, City District
#  'de Baarsjes', Amsterdam, the Netherlands.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
##############################################################################
if (!defined('IN_SAS'))
{
	die("Hacking attempt");
}

if (IsSet ($_GET['savedownload']))
{
	$savedownload = $_GET['savedownload'];
}

if (IsSet ($_POST['category']))
{
	$category = intval($_POST['category']);
}

if (IsSet ($_POST['description']))
{
	$description = $_POST['description'];
}
if (IsSet ($_POST['creator']))
{
	$creator = $_POST['creator'];
}
if (IsSet ($_POST['category_title']))
{
	$category_title = $_POST['category_title'];
}

if (IsSet ($_SESSION['userid']))
{
	$userid = $_SESSION['userid'];
}
$usertype = $_SESSION['usertype'];

load_language($cmsdir . '/', 'sn_downloads'); //load language file

if (IsSet ($userid) AND $usertype == "teacher") //only valid when teacher is logged in
{
	$query = "SELECT dbtables FROM $table_modules WHERE location='sn_downloads'";
	$result = mysql_query($query) or die_script($query, mysql_error());
	$moduletables = mysql_result($result, 0);
	unset ($query);
	unset ($result);
	$moduletables = explode(",", $moduletables);
	$downloads_table = "$moduletables[0]";
	$downloads_cattable = "$moduletables[1]";

	if ($savedownload == "new")
	{
		$exists = 0; // 0 is doesn't exists, 1 = exists , 2 exists in category
		$filename = $_FILES["file"]["name"];
		$store_filename = md5($filename);
		$write_path = "$serverpath/$media/downloads/" . $category . "/" . $store_filename;

		if (IsSet ($_FILES["file"]["name"]))
		{
			$temp_file = $_FILES["file"]["tmp_name"];
		}

		if (file_exists($write_path)) //file exists in downloads directory on server?
		{
			$exists = 1;
		}

		$result1 = mysql_query("SELECT id FROM $downloads_table WHERE filename='$filename' AND category = '$category'");

		if (mysql_num_rows($result1) > 0) //does file already exists in category?
		{
			$exists = 2;
		}

		if ($exists == 0)
		{
			$write_path = $media . "/downloads/" . $category;
			if (!sas_move_uploaded_file($write_path, $filename, $temp_file))
				//if(!move_uploaded_file($temp,$write_path))
			{
				print "<b>There has been an error uploading the file.</b><br>";
			}
			else
			{
				$file_rename = remove_special_characters($filename); //we remove special characters from filename
				rename($serverpath . "/" . $media . "/downloads/" . $category . "/" . $file_rename, $serverpath . "/" . $media . "/downloads/" . $category . "/" . $store_filename);
				print $sas_lang['download_module_filename'] . " <b>" . $filename . "</b> " . $sas_lang['download_module_file_saved'] . "<p>";

				//make entry in downloads table for new file.
				mysql_query("INSERT INTO $downloads_table (id, description, category, creator, filename, date, stored_file) 
									VALUES (NULL, '$description', '$category', '$creator', '$filename', NOW(), md5('$filename'))");
				
			}
		}
		elseif ($exists == 2) //does file already exists in category : overwrite?
		{
			$id = mysql_result($result1, 0);
			mysql_query("UPDATE $downloads_table SET description='$description' WHERE id='$id'");
			mysql_query("UPDATE $downloads_table SET creator='$creator' WHERE id='$id'");
			mysql_query("UPDATE $downloads_table SET category='$category' WHERE id='$id'");
			mysql_query("UPDATE $downloads_table SET date=NOW() WHERE id='$id'");
			print $sas_lang['download_module_filename'] . " <b>" . $filename . "</b><br>" . $sas_lang['download_module_file_replaced'];
		}
		else
		{
			print "<b>" . $sas_lang['download_module_file_exists'] . "</b>";
		}

		print "<br><input type=\"button\" value=\"$sas_lang[goback]\" name=\"backbutton\" onClick=\"javascript:history.go(-1)\" class=\"backbutton\">";
	}
	else
	{
		print "<h3>" . $sas_lang['download_module_add'] . "<br></h3>";
		print "<FORM METHOD=\"POST\" enctype=\"multipart/form-data\" ACTION=\"index.php?section=$section&page=$page&savedownload=new\"><br>";

		print "<span class=\"text\">" . $sas_lang['category'] . "<br><select size=\"1\" name=\"category\">";
		$query = "SELECT id,title FROM $downloads_cattable";
		$result = mysql_query($query) or die_script($query, mysql_error());
		while ($dwnl_category_list = mysql_fetch_array($result))
		{
			print "<option value=\"$dwnl_category_list[0]\">$dwnl_category_list[1]</option>";
		}
		print "</select><br><br>";

		print "<span class=\"text\">" . $sas_lang['download_module_creator'] . "<br>
					<input type=text name=\"creator\" size=40 class=\"textfield\"><br><br>";
		print $sas_lang['download_module_description'] . "<br><textarea name=\"description\" ROWS=2 COLS=60></textarea><br><br>";
		print "<span class=text>" . $sas_lang['uploadfile'] . ":</span><br><input type=file name=file size=50 class=textfield><br><br>";

		print "<br><input type=\"button\" value=\"&nbsp;&nbsp;&nbsp;" . $sas_lang['cancel'] . "\" name=\"backbutton\"
					onClick=\"javascript:parent.location='index.php?option=modulemanager&module=$module';\" class=\"backbutton\">";
		print "&nbsp;<input type=\"submit\" value=\"&nbsp;&nbsp;&nbsp;" . $sas_lang['save'] . "\" name=\"savebutton\" class=\"savebutton\">";
		print "</span></form>";
	}
}
else
{
	print "<b>$sas_lang[noaccess] <br>" . $sas_lang['noaccess_introduction'] . "</b>";
}
?>