<?php

#############################################################################
#           			                   Site@School
# Site@School is a website management system designed for primary schools.
#
# About Site@School:
# Comissioned by: City District 'de Baarsjes', Amsterdam, Netherlands
# Original idea, coding (version 1.0) and design : Mark de Haan (mark@starwave.nl)
# Ideas, improvements, expansions (version 1.1 - 2.4): Fred Stuurman 
# Current coder & maintainer: Fred Stuurman (fc.stuurman@hccnet.nl)
############################################################################
# javaUpload.php: last changed 04/10/2006    version 2.4.10                                   
#                      by Fred Stuurman (fc.stuurman@hccnet.nl)
#$Id: javaUpload.php,v 1.2 2006/10/15 19:08:53 fstuurman Exp $
# This file is called by the multiple file upload applet postlet , used from http://sourceforge.net/projects/postlet/
############################################################################
#                        LICENSE INFORMATION
# Copyright (C) 2002 - 2006 Municipality of Amsterdam, City District
#  'de Baarsjes', Amsterdam, the Netherlands.
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License
# as published by the Free Software Foundation; either version 2
# of the License, or (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
# See the GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program; if not, write to the Free Software
# Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.
##############################################################################

define('IN_SAS', true);

include ("../configuration/database.inc.php");
mysql_connect("$db_server", "$db_username", "$db_password");
mysql_select_db("$db_name");

require ("session.php"); //build a session
require ("common.inc.php");

# following code gets the session id from the URL . I need to do this because
# Postlet applet uses his own session id.
# the session id is used to get the S@S session code from the session table to see if we have a session.

if (IsSet ($_GET['PHPsessid']))
{
	$PHPsessid = $_GET['PHPsessid'];
}
$PHPsessid = strip_tags($PHPsessid); //remove any tags

if (ctype_alnum($PHPsessid)) //be sure to have a alphanum as sess id
{
	$session_table = $dbprefix . "sessions";
	$query = "SELECT ses_value FROM $session_table WHERE ses_id = '" . $PHPsessid . "'";
	$result = mysql_query($query);
	$ses_value = mysql_result($result, 0); //get the session value from the sn_session table

	//get postion of the sessioncode name
	$pos = strpos($ses_value, "sessioncode|s:");
	$ses_value = substr($ses_value, $pos +14); //add 14 to get to the first posistion of the length
	$pos = strpos($ses_value, ":"); //this is the position of the ":" after the length
	$length = substr($ses_value, 0, $pos); //length of the session code
	$ses_value = substr($ses_value, $pos +2, $length); //this is the contents of the session value 

	$query = "SELECT config_value FROM $table_configuration WHERE config_key='sessioncode'";
	$result = mysql_query($query);
	$check_sessioncode = mysql_result($result, 0); //get the session code from the configuration table

	if ($check_sessioncode != $ses_value) //compare the two values
	{
		print "Go away!"; //if we don't have a session , exit!
		exit;
	}
	else
	{
		$write_path = "media" . $_GET['store_path'];
		$file_name = $_FILES['userfile']['name'];
		$temp_file = $_FILES['userfile']['tmp_name']; //this is temporary uploaded file.	

		// moveupload the file to $write_path, function is in core/common.inc.php
		sas_move_uploaded_file($write_path, $file_name, $temp_file);
	}
}
?>