diff --git a/client_files.php b/client_files.php index ae337b03..97e6ac3a 100644 --- a/client_files.php +++ b/client_files.php @@ -14,7 +14,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_

Files

- +
@@ -108,7 +108,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
+ + diff --git a/post/file.php b/post/file.php index 3692882b..99185a2e 100644 --- a/post/file.php +++ b/post/file.php @@ -4,28 +4,30 @@ * ITFlow - GET/POST request handler for client files/uploads */ -if (isset($_POST['add_file'])) { +if (isset($_POST['add_files'])) { $client_id = intval($_POST['client_id']); - $file_name = sanitizeInput($_POST['new_name']); - - $extarr = explode('.', $_FILES['file']['name']); - $file_extension = sanitizeInput(strtolower(end($extarr))); - - // If the user-inputted name is empty, revert to the name of the file on disk/uploaded - if (empty($file_name)) { - $file_name = sanitizeInput($_FILES['file']['name']); - } - + if (!file_exists("uploads/clients/$client_id")) { mkdir("uploads/clients/$client_id"); } - //Check to see if a file is attached - if ($_FILES['file']['tmp_name'] != '') { + for ($i = 0; $i < count($_FILES['file']['name']); $i++) { + // Extract file details for this iteration + $single_file = [ + 'name' => $_FILES['file']['name'][$i], + 'type' => $_FILES['file']['type'][$i], + 'tmp_name' => $_FILES['file']['tmp_name'][$i], + 'error' => $_FILES['file']['error'][$i], + 'size' => $_FILES['file']['size'][$i] + ]; - if ($file_reference_name = checkFileUpload($_FILES['file'], array('jpg', 'jpeg', 'gif', 'png', 'webp', 'pdf', 'txt', 'md', 'doc', 'docx', 'odt', 'csv', 'xls', 'xlsx', 'ods', 'pptx', 'odp', 'zip', 'tar', 'gz', 'xml', 'msg', 'json', 'wav', 'mp3', 'ogg', 'mov', 'mp4', 'av1'))) { + if ($file_reference_name = checkFileUpload($single_file, array('jpg', 'jpeg', 'gif', 'png', 'webp', 'pdf', 'txt', 'md', 'doc', 'docx', 'odt', 'csv', 'xls', 'xlsx', 'ods', 'pptx', 'odp', 'zip', 'tar', 'gz', 'xml', 'msg', 'json', 'wav', 'mp3', 'ogg', 'mov', 'mp4', 'av1'))) { + + $file_tmp_path = $_FILES['file']['tmp_name'][$i]; - $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = sanitizeInput($_FILES['file']['name'][$i]); + $extarr = explode('.', $_FILES['file']['name'][$i]); + $file_extension = sanitizeInput(strtolower(end($extarr))); // directory in which the uploaded file will be moved $upload_file_dir = "uploads/clients/$client_id/"; @@ -38,17 +40,12 @@ if (isset($_POST['add_file'])) { //Logging $file_id = intval(mysqli_insert_id($mysqli)); mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'File', log_action = 'Upload', log_description = '$file_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $file_id"); - - $_SESSION['alert_message'] = 'File successfully uploaded.'; - } else { - $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; } } - + // Redirect at the end, after processing all files header("Location: " . $_SERVER["HTTP_REFERER"]); - } if (isset($_POST['delete_file'])) {