diff --git a/client_files.php b/client_files.php
index ae337b03..97e6ac3a 100644
--- a/client_files.php
+++ b/client_files.php
@@ -14,7 +14,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
@@ -108,7 +108,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
+
+
diff --git a/post/file.php b/post/file.php
index 3692882b..99185a2e 100644
--- a/post/file.php
+++ b/post/file.php
@@ -4,28 +4,30 @@
* ITFlow - GET/POST request handler for client files/uploads
*/
-if (isset($_POST['add_file'])) {
+if (isset($_POST['add_files'])) {
$client_id = intval($_POST['client_id']);
- $file_name = sanitizeInput($_POST['new_name']);
-
- $extarr = explode('.', $_FILES['file']['name']);
- $file_extension = sanitizeInput(strtolower(end($extarr)));
-
- // If the user-inputted name is empty, revert to the name of the file on disk/uploaded
- if (empty($file_name)) {
- $file_name = sanitizeInput($_FILES['file']['name']);
- }
-
+
if (!file_exists("uploads/clients/$client_id")) {
mkdir("uploads/clients/$client_id");
}
- //Check to see if a file is attached
- if ($_FILES['file']['tmp_name'] != '') {
+ for ($i = 0; $i < count($_FILES['file']['name']); $i++) {
+ // Extract file details for this iteration
+ $single_file = [
+ 'name' => $_FILES['file']['name'][$i],
+ 'type' => $_FILES['file']['type'][$i],
+ 'tmp_name' => $_FILES['file']['tmp_name'][$i],
+ 'error' => $_FILES['file']['error'][$i],
+ 'size' => $_FILES['file']['size'][$i]
+ ];
- if ($file_reference_name = checkFileUpload($_FILES['file'], array('jpg', 'jpeg', 'gif', 'png', 'webp', 'pdf', 'txt', 'md', 'doc', 'docx', 'odt', 'csv', 'xls', 'xlsx', 'ods', 'pptx', 'odp', 'zip', 'tar', 'gz', 'xml', 'msg', 'json', 'wav', 'mp3', 'ogg', 'mov', 'mp4', 'av1'))) {
+ if ($file_reference_name = checkFileUpload($single_file, array('jpg', 'jpeg', 'gif', 'png', 'webp', 'pdf', 'txt', 'md', 'doc', 'docx', 'odt', 'csv', 'xls', 'xlsx', 'ods', 'pptx', 'odp', 'zip', 'tar', 'gz', 'xml', 'msg', 'json', 'wav', 'mp3', 'ogg', 'mov', 'mp4', 'av1'))) {
+
+ $file_tmp_path = $_FILES['file']['tmp_name'][$i];
- $file_tmp_path = $_FILES['file']['tmp_name'];
+ $file_name = sanitizeInput($_FILES['file']['name'][$i]);
+ $extarr = explode('.', $_FILES['file']['name'][$i]);
+ $file_extension = sanitizeInput(strtolower(end($extarr)));
// directory in which the uploaded file will be moved
$upload_file_dir = "uploads/clients/$client_id/";
@@ -38,17 +40,12 @@ if (isset($_POST['add_file'])) {
//Logging
$file_id = intval(mysqli_insert_id($mysqli));
mysqli_query($mysqli, "INSERT INTO logs SET log_type = 'File', log_action = 'Upload', log_description = '$file_name', log_ip = '$session_ip', log_user_agent = '$session_user_agent', log_client_id = $client_id, log_user_id = $session_user_id, log_entity_id = $file_id");
-
- $_SESSION['alert_message'] = 'File successfully uploaded.';
-
} else {
-
$_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.';
}
}
-
+ // Redirect at the end, after processing all files
header("Location: " . $_SERVER["HTTP_REFERER"]);
-
}
if (isset($_POST['delete_file'])) {