From a939588cf2b18ef65d1551bbf3158570d0b14c19 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Tue, 21 Sep 2021 22:22:55 -0400 Subject: [PATCH] New File upload logic complete Breaking changes New db dump --- client_files.php | 10 +- companies.php | 2 +- db.sql | 4 +- edit_company_modal.php | 4 +- edit_expense_modal.php | 2 +- edit_user_modal.php | 4 +- expenses.php | 4 +- guest_view_invoice.php | 6 +- guest_view_quote.php | 6 +- invoice.php | 5 +- post.php | 552 ++++++++++++++++++++++++++++++++--------- quote.php | 7 +- recurring_invoice.php | 3 +- settings-user.php | 4 +- setup.php | 93 ++++++- top_nav.php | 4 +- users.php | 2 +- view_file_modal.php | 4 +- 18 files changed, 549 insertions(+), 167 deletions(-) diff --git a/client_files.php b/client_files.php index 3219278e..1bf60aac 100644 --- a/client_files.php +++ b/client_files.php @@ -32,6 +32,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_ while($row = mysqli_fetch_array($sql_files_images)){ $file_id = $row['file_id']; $file_name = $row['file_name']; + $file_reference_name = $row['file_reference_name']; $file_ext = $row['file_ext']; ?> @@ -39,12 +40,12 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_
- + ">
- - + " download="" class="text-white float-left ml-1"> +
@@ -66,6 +67,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_ while($row = mysqli_fetch_array($sql_files_other)){ $file_id = $row['file_id']; $file_name = $row['file_name']; + $file_reference_name = $row['file_reference_name']; $file_ext = $row['file_ext']; if($file_ext == 'pdf'){ $file_icon = "file-pdf"; @@ -87,7 +89,7 @@ $num_of_files = mysqli_num_rows($sql_files_images) + mysqli_num_rows($sql_files_ - + " download="" class="text-secondary float-left ml-1"> diff --git a/companies.php b/companies.php index 72fe7a01..2f641e31 100644 --- a/companies.php +++ b/companies.php @@ -103,7 +103,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); - + "> diff --git a/db.sql b/db.sql index ffb2e03f..5e9621de 100644 --- a/db.sql +++ b/db.sql @@ -404,7 +404,7 @@ DROP TABLE IF EXISTS `files`; /*!40101 SET character_set_client = utf8 */; CREATE TABLE `files` ( `file_id` int(11) NOT NULL AUTO_INCREMENT, - `reference_file_name` varchar(200) DEFAULT NULL, + `file_reference_name` varchar(200) DEFAULT NULL, `file_name` varchar(200) NOT NULL, `file_ext` varchar(200) DEFAULT NULL, `file_created_at` datetime NOT NULL, @@ -1064,4 +1064,4 @@ CREATE TABLE `vendors` ( /*!40101 SET COLLATION_CONNECTION=@OLD_COLLATION_CONNECTION */; /*!40111 SET SQL_NOTES=@OLD_SQL_NOTES */; --- Dump completed on 2021-09-09 23:14:42 +-- Dump completed on 2021-09-21 22:22:21 diff --git a/edit_company_modal.php b/edit_company_modal.php index 41ba25f7..94fdd5c1 100644 --- a/edit_company_modal.php +++ b/edit_company_modal.php @@ -9,7 +9,7 @@
- +
@@ -134,7 +134,7 @@
- + ">
diff --git a/edit_expense_modal.php b/edit_expense_modal.php index 1b786ca7..8cb74418 100644 --- a/edit_expense_modal.php +++ b/edit_expense_modal.php @@ -10,7 +10,7 @@
- +
diff --git a/edit_user_modal.php b/edit_user_modal.php index e39c07f4..e324201f 100644 --- a/edit_user_modal.php +++ b/edit_user_modal.php @@ -9,12 +9,12 @@
- + ">
- + " height="128" width="128"> diff --git a/expenses.php b/expenses.php index bfe6e30f..aec6551c 100644 --- a/expenses.php +++ b/expenses.php @@ -173,7 +173,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); if(empty($expense_receipt)){ $receipt_attached = ""; }else{ - $receipt_attached = ""; + $receipt_attached = ""; } ?> @@ -193,7 +193,7 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli,"SELECT FOUND_ROWS()")); - Reciept + " download="">Download
- + ">
diff --git a/guest_view_quote.php b/guest_view_quote.php index 0e59ba19..df1697bd 100644 --- a/guest_view_quote.php +++ b/guest_view_quote.php @@ -56,8 +56,8 @@ if(isset($_GET['quote_id'], $_GET['url_key'])){ $company_email = $row['company_email']; $company_logo = $row['company_logo']; if(!empty($company_logo)){ - $company_logo_base64 = base64_encode(file_get_contents($row['company_logo'])); - } + $company_logo_base64 = base64_encode(file_get_contents("uploads/settings/$company_id/$company_logo")); + } $quote_footer = $row['quote_footer']; $ip = get_ip(); @@ -98,7 +98,7 @@ if(isset($_GET['quote_id'], $_GET['url_key'])){
- + ">

Quote

diff --git a/invoice.php b/invoice.php index fac8e135..5dfd3d8d 100644 --- a/invoice.php +++ b/invoice.php @@ -49,6 +49,7 @@ if(isset($_GET['invoice_id'])){ if($client_net_terms == 0){ $client_net_terms = $config_default_net_terms; } + $company_id = $row['company_id']; $company_name = $row['company_name']; $company_country = $row['company_country']; $company_address = $row['company_address']; @@ -60,7 +61,7 @@ if(isset($_GET['invoice_id'])){ $company_website = $row['company_website']; $company_logo = $row['company_logo']; if(!empty($company_logo)){ - $company_logo_base64 = base64_encode(file_get_contents($row['company_logo'])); + $company_logo_base64 = base64_encode(file_get_contents("uploads/settings/$company_id/$company_logo")); } $sql_history = mysqli_query($mysqli,"SELECT * FROM history WHERE history_invoice_id = $invoice_id ORDER BY history_id DESC"); @@ -170,7 +171,7 @@ if(isset($_GET['invoice_id'])){
- + ">
diff --git a/post.php b/post.php index be2f0049..eaebbbab 100644 --- a/post.php +++ b/post.php @@ -46,14 +46,48 @@ if(isset($_POST['add_user'])){ mkdir("uploads/users/$user_id"); } - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/users/$user_id/"; - $path = $path . time() . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/users/$user_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + //Set Avatar + mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } - //Set Avatar - mysqli_query($mysqli,"UPDATE users SET user_avatar = '$path' WHERE user_id = $user_id"); //Create Permissions mysqli_query($mysqli,"INSERT INTO permissions SET permission_level = $level, permission_default_company = $company, permission_companies = $company, user_id = $user_id"); @@ -75,19 +109,58 @@ if(isset($_POST['edit_user'])){ $new_password = trim($_POST['new_password']); $company = intval($_POST['company']); $level = intval($_POST['level']); - $path = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['current_avatar_path']))); + $existing_file_name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name']))); - if($_FILES['file']['tmp_name']!='') { - //delete old avatar file - unlink($path); - //Update with new path - $path = "uploads/users/$user_id/"; - $path = $path . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); + if(!file_exists("uploads/users/$user_id/")) { + mkdir("uploads/users/$user_id"); + } + + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/users/$user_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + //Delete old file + unlink("uploads/users/$user_id/$existing_file_name"); + + mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } - mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email', user_password = '$password', user_avatar = '$path', user_updated_at = NOW() WHERE user_id = $user_id"); + mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email', user_password = '$password', user_updated_at = NOW() WHERE user_id = $user_id"); if(!empty($new_password)){ $new_password = md5($new_password); @@ -112,19 +185,54 @@ if(isset($_POST['edit_profile'])){ $name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['name']))); $email = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['email']))); $new_password = trim($_POST['new_password']); - $path = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['current_avatar_path']))); + $existing_file_name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name']))); - if($_FILES['file']['tmp_name']!='') { - //delete old avatar file - unlink($path); - //Update with new path - $path = "uploads/users/$user_id/"; - $path = $path . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/users/$user_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + //Delete old file + unlink("uploads/users/$user_id/$existing_file_name"); + + mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } - mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email', user_avatar = '$path', user_updated_at = NOW() WHERE user_id = $user_id"); + mysqli_query($mysqli,"UPDATE users SET user_name = '$name', user_email = '$email', user_updated_at = NOW() WHERE user_id = $user_id"); if(!empty($new_password)){ $new_password = md5($new_password); @@ -236,14 +344,46 @@ if(isset($_POST['add_company'])){ mkdir("uploads/settings/$company_id"); mkdir("uploads/tmp/$company_id"); - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/settings/$company_id/"; - $path = $path . time() . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); - - mysqli_query($mysqli,"UPDATE companies SET company_logo = '$path' WHERE company_id = $company_id"); + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/settings/$company_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + mysqli_query($mysqli,"UPDATE companies SET company_logo = '$new_file_name' WHERE company_id = $company_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } mysqli_query($mysqli,"INSERT INTO settings SET company_id = $company_id, config_default_country = '$country', config_default_currency = '$currency_code', config_invoice_prefix = 'INV-', config_invoice_next_number = 1, config_recurring_prefix = 'REC-', config_recurring_next_number = 1, config_invoice_overdue_reminders = '1,3,7', config_quote_prefix = 'QUO-', config_quote_next_number = 1, config_api_key = '$config_api_key', config_recurring_auto_send_invoice = 1, config_default_net_terms = 7, config_send_invoice_reminders = 0, config_enable_cron = 0, config_ticket_next_number = 1, config_base_url = '$config_base_url'"); @@ -270,20 +410,58 @@ if(isset($_POST['edit_company'])){ $website = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['website']))); $currency_code = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['currency_code']))); - $path = strip_tags(mysqli_real_escape_string($mysqli,$_POST['current_file_path'])); + $existing_file_name = strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name'])); if(!file_exists("uploads/settings/$company_id/")) { mkdir("uploads/settings/$company_id"); } - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/settings/$company_id/"; - $path = $path . time() . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/settings/$company_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + //Delete old file + unlink("uploads/settings/$company_id/$existing_file_name"); + + mysqli_query($mysqli,"UPDATE companies SET company_logo = '$new_file_name' WHERE company_id = $company_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } - mysqli_query($mysqli,"UPDATE companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_logo = '$path', company_updated_at = NOW() WHERE company_id = $company_id"); + mysqli_query($mysqli,"UPDATE companies SET company_name = '$name', company_address = '$address', company_city = '$city', company_state = '$state', company_zip = '$zip', company_country = '$country', company_phone = '$phone', company_email = '$email', company_website = '$website', company_updated_at = NOW() WHERE company_id = $company_id"); mysqli_query($mysqli,"UPDATE settings SET config_default_currency = '$currency_code', config_default_country = '$country' WHERE company_id = $company_id"); @@ -1654,14 +1832,51 @@ if(isset($_POST['add_expense'])){ $description = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['description']))); $reference = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['reference']))); - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/expenses/$session_company_id/"; - $path = $path . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); - } + mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = '$amount', expense_currency_code = '$config_default_currency', expense_account_id = $account, expense_vendor_id = $vendor, expense_category_id = $category, expense_description = '$description', expense_reference = '$reference', expense_created_at = NOW(), company_id = $session_company_id"); - mysqli_query($mysqli,"INSERT INTO expenses SET expense_date = '$date', expense_amount = '$amount', expense_currency_code = '$config_default_currency', expense_account_id = $account, expense_vendor_id = $vendor, expense_category_id = $category, expense_description = '$description', expense_reference = '$reference', expense_receipt = '$path', expense_created_at = NOW(), company_id = $session_company_id"); + $expense_id = mysqli_insert_id($mysqli); + + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png', 'pdf'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 9097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/expenses/$session_company_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + mysqli_query($mysqli,"UPDATE expenses SET expense_receipt = '$new_file_name' WHERE expense_id = $expense_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } + } //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'Expense', log_action = 'Created', log_description = '$description', log_created_at = NOW(), company_id = $session_company_id, log_user_id = $session_user_id"); @@ -1682,18 +1897,54 @@ if(isset($_POST['edit_expense'])){ $category = intval($_POST['category']); $description = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['description']))); $reference = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['reference']))); - $path = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['expense_receipt']))); + $existing_file_name = trim(strip_tags(mysqli_real_escape_string($mysqli,$_POST['existing_file_name']))); - if($_FILES['file']['tmp_name']!='') { - //remove old receipt - unlink($path); - $path = "uploads/expenses/$session_company_id/"; - $path = $path . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png', 'pdf'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 9097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/expenses/$session_company_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + //Delete old file + unlink("uploads/expenses/$session_company_id/$existing_file_name"); + + mysqli_query($mysqli,"UPDATE expenses SET expense_receipt = '$new_file_name' WHERE expense_id = $expense_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } - mysqli_query($mysqli,"UPDATE expenses SET expense_date = '$date', expense_amount = '$amount', expense_account_id = $account, expense_vendor_id = $vendor, expense_category_id = $category, expense_description = '$description', expense_reference = '$reference', expense_receipt = '$path', expense_updated_at = NOW() WHERE expense_id = $expense_id AND company_id = $session_company_id"); + mysqli_query($mysqli,"UPDATE expenses SET expense_date = '$date', expense_amount = '$amount', expense_account_id = $account, expense_vendor_id = $vendor, expense_category_id = $category, expense_description = '$description', expense_reference = '$reference', expense_updated_at = NOW() WHERE expense_id = $expense_id AND company_id = $session_company_id"); $_SESSION['alert_message'] = "Expense modified"; @@ -1711,7 +1962,7 @@ if(isset($_GET['delete_expense'])){ $row = mysqli_fetch_array($sql); $expense_receipt = $row['expense_receipt']; - unlink($expense_receipt); + unlink("uploads/expenses/$session_company_id/$expense_receipt"); mysqli_query($mysqli,"DELETE FROM expenses WHERE expense_id = $expense_id AND company_id = $session_company_id"); @@ -3169,12 +3420,12 @@ if(isset($_POST['add_contact'])){ if($_FILES['file']['tmp_name'] != ''){ // get details of the uploaded file + $file_error = 0; $file_tmp_path = $_FILES['file']['tmp_name']; $file_name = $_FILES['file']['name']; $file_size = $_FILES['file']['size']; $file_type = $_FILES['file']['type']; - $file_name_cmps = explode(".", $file_name); - $file_extension = strtolower(end($file_name_cmps)); + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); // sanitize file-name $new_file_name = md5(time() . $file_name) . '.' . $file_extension; @@ -3182,21 +3433,28 @@ if(isset($_POST['add_contact'])){ // check if file has one of the following extensions $allowed_file_extensions = array('jpg', 'gif', 'png'); - if(in_array($file_extension, $allowed_file_extensions)){ + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ // directory in which the uploaded file will be moved $upload_file_dir = "uploads/clients/$session_company_id/$client_id/"; $dest_path = $upload_file_dir . $new_file_name; - if(move_uploaded_file($file_tmp_path, $dest_path)){ - mysqli_query($mysqli,"UPDATE contacts SET contact_photo = '$new_file_name' WHERE contact_id = $contact_id"); + move_uploaded_file($file_tmp_path, $dest_path); + + mysqli_query($mysqli,"UPDATE contacts SET contact_photo = '$new_file_name' WHERE contact_id = $contact_id"); - $_SESSION['alert_message'] = 'File successfully uploaded.'; - }else{ - $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; - } + $_SESSION['alert_message'] = 'File successfully uploaded.'; }else{ - $_SESSION['alert_message'] = 'Upload failed. Allowed file types: ' . implode(',', $allowed_file_extensions); - $_SESSION['alert_type'] = 'danger'; + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; } } @@ -3237,14 +3495,14 @@ if(isset($_POST['edit_contact'])){ //Check to see if a file is attached if($_FILES['file']['tmp_name'] != ''){ - - // get details of the uploaded file + + // get details of the uploaded file + $file_error = 0; $file_tmp_path = $_FILES['file']['tmp_name']; $file_name = $_FILES['file']['name']; $file_size = $_FILES['file']['size']; $file_type = $_FILES['file']['type']; - $file_name_cmps = explode(".", $file_name); - $file_extension = strtolower(end($file_name_cmps)); + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); // sanitize file-name $new_file_name = md5(time() . $file_name) . '.' . $file_extension; @@ -3252,24 +3510,31 @@ if(isset($_POST['edit_contact'])){ // check if file has one of the following extensions $allowed_file_extensions = array('jpg', 'gif', 'png'); - if(in_array($file_extension, $allowed_file_extensions)){ + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ // directory in which the uploaded file will be moved $upload_file_dir = "uploads/clients/$session_company_id/$client_id/"; $dest_path = $upload_file_dir . $new_file_name; - if(move_uploaded_file($file_tmp_path, $dest_path)){ - mysqli_query($mysqli,"UPDATE contacts SET contact_photo = '$new_file_name' WHERE contact_id = $contact_id"); + move_uploaded_file($file_tmp_path, $dest_path); - //Delete old file - unlink("uploads/clients/$session_company_id/$client_id/$existing_file_name"); + //Delete old file + unlink("uploads/clients/$session_company_id/$client_id/$existing_file_name"); + + mysqli_query($mysqli,"UPDATE contacts SET contact_photo = '$new_file_name' WHERE contact_id = $contact_id"); - $_SESSION['alert_message'] = 'File successfully uploaded.'; - }else{ - $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; - } + $_SESSION['alert_message'] = 'File successfully uploaded.'; }else{ - $_SESSION['alert_message'] = 'Upload failed. Allowed file types: ' . implode(',', $allowed_file_extensions); - $_SESSION['alert_type'] = 'danger'; + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; } } @@ -3383,12 +3648,12 @@ if(isset($_POST['add_location'])){ if($_FILES['file']['tmp_name'] != ''){ // get details of the uploaded file + $file_error = 0; $file_tmp_path = $_FILES['file']['tmp_name']; $file_name = $_FILES['file']['name']; $file_size = $_FILES['file']['size']; $file_type = $_FILES['file']['type']; - $file_name_cmps = explode(".", $file_name); - $file_extension = strtolower(end($file_name_cmps)); + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); // sanitize file-name $new_file_name = md5(time() . $file_name) . '.' . $file_extension; @@ -3396,21 +3661,28 @@ if(isset($_POST['add_location'])){ // check if file has one of the following extensions $allowed_file_extensions = array('jpg', 'gif', 'png'); - if(in_array($file_extension, $allowed_file_extensions)){ + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ // directory in which the uploaded file will be moved $upload_file_dir = "uploads/clients/$session_company_id/$client_id/"; $dest_path = $upload_file_dir . $new_file_name; - if(move_uploaded_file($file_tmp_path, $dest_path)){ - mysqli_query($mysqli,"UPDATE locations SET location_photo = '$new_file_name' WHERE location_id = $location_id"); + move_uploaded_file($file_tmp_path, $dest_path); + + mysqli_query($mysqli,"UPDATE locations SET location_photo = '$new_file_name' WHERE location_id = $location_id"); - $_SESSION['alert_message'] = 'File successfully uploaded.'; - }else{ - $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; - } + $_SESSION['alert_message'] = 'File successfully uploaded.'; }else{ - $_SESSION['alert_message'] = 'Upload failed. Allowed file types: ' . implode(',', $allowed_file_extensions); - $_SESSION['alert_type'] = 'danger'; + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; } } @@ -3454,14 +3726,14 @@ if(isset($_POST['edit_location'])){ //Check to see if a file is attached if($_FILES['file']['tmp_name'] != ''){ - - // get details of the uploaded file + + // get details of the uploaded file + $file_error = 0; $file_tmp_path = $_FILES['file']['tmp_name']; $file_name = $_FILES['file']['name']; $file_size = $_FILES['file']['size']; $file_type = $_FILES['file']['type']; - $file_name_cmps = explode(".", $file_name); - $file_extension = strtolower(end($file_name_cmps)); + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); // sanitize file-name $new_file_name = md5(time() . $file_name) . '.' . $file_extension; @@ -3469,24 +3741,31 @@ if(isset($_POST['edit_location'])){ // check if file has one of the following extensions $allowed_file_extensions = array('jpg', 'gif', 'png'); - if(in_array($file_extension, $allowed_file_extensions)){ + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ // directory in which the uploaded file will be moved $upload_file_dir = "uploads/clients/$session_company_id/$client_id/"; $dest_path = $upload_file_dir . $new_file_name; - if(move_uploaded_file($file_tmp_path, $dest_path)){ - mysqli_query($mysqli,"UPDATE locations SET location_photo = '$new_file_name' WHERE location_id = $location_id"); + move_uploaded_file($file_tmp_path, $dest_path); - //Delete old file - unlink("uploads/clients/$session_company_id/$client_id/$existing_file_name"); + //Delete old file + unlink("uploads/clients/$session_company_id/$client_id/$existing_file_name"); + + mysqli_query($mysqli,"UPDATE locations SET location_photo = '$new_file_name' WHERE location_id = $location_id"); - $_SESSION['alert_message'] = 'File successfully uploaded.'; - }else{ - $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; - } + $_SESSION['alert_message'] = 'File successfully uploaded.'; }else{ - $_SESSION['alert_message'] = 'Upload failed. Allowed file types: ' . implode(',', $allowed_file_extensions); - $_SESSION['alert_type'] = 'danger'; + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; } } @@ -4401,18 +4680,48 @@ if(isset($_POST['add_file'])){ mkdir("uploads/clients/$session_company_id/$client_id"); } - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/clients/$session_company_id/$client_id/"; - $path = $path . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); - $ext = pathinfo($path); - $ext = $ext['extension']; + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); + // sanitize file-name + $file_reference_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png', 'pdf', 'doc', 'docx', 'xls', 'xlsx', 'zip', 'tar', 'gz'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/clients/$session_company_id/$client_id/"; + $dest_path = $upload_file_dir . $file_reference_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + mysqli_query($mysqli,"INSERT INTO files SET file_reference_name = '$file_reference_name', file_name = '$file_name', file_ext = '$file_extension', file_created_at = NOW(), file_client_id = $client_id, company_id = $session_company_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } - mysqli_query($mysqli,"INSERT INTO files SET file_name = '$path', file_ext = '$ext', file_created_at = NOW(), file_client_id = $client_id, company_id = $session_company_id"); - //Logging mysqli_query($mysqli,"INSERT INTO logs SET log_type = 'File', log_action = 'Uploaded', log_description = '$path', log_created_at = NOW(), company_id = $session_company_id, log_user_id = $session_user_id"); @@ -4427,9 +4736,10 @@ if(isset($_GET['delete_file'])){ $sql_file = mysqli_query($mysqli,"SELECT * FROM files WHERE file_id = $file_id AND company_id = $session_company_id"); $row = mysqli_fetch_array($sql_file); - $file_name = $row['file_name']; + $client_id = $row['file_client_id']; + $file_reference_name = $row['file_reference_name']; - unlink($file_name); + unlink("uploads/clients/$session_company_id/$client_id/$file_reference_name"); mysqli_query($mysqli,"DELETE FROM files WHERE file_id = $file_id AND company_id = $session_company_id"); diff --git a/quote.php b/quote.php index 2b2b915f..d94ee342 100644 --- a/quote.php +++ b/quote.php @@ -44,6 +44,7 @@ if(isset($_GET['quote_id'])){ if($client_net_terms == 0){ $client_net_terms = $config_default_net_terms; } + $company_id = $row['company_id']; $company_name = $row['company_name']; $company_country = $row['company_country']; $company_address = $row['company_address']; @@ -55,8 +56,8 @@ if(isset($_GET['quote_id'])){ $company_website = $row['company_website']; $company_logo = $row['company_logo']; if(!empty($company_logo)){ - $company_logo_base64 = base64_encode(file_get_contents($row['company_logo'])); - } + $company_logo_base64 = base64_encode(file_get_contents("uploads/settings/$company_id/$company_logo")); + } $sql_history = mysqli_query($mysqli,"SELECT * FROM history WHERE history_quote_id = $quote_id ORDER BY history_id DESC"); @@ -146,7 +147,7 @@ if(isset($_GET['quote_id'])){
- + ">

Quote

diff --git a/recurring_invoice.php b/recurring_invoice.php index 57745856..695d91d4 100644 --- a/recurring_invoice.php +++ b/recurring_invoice.php @@ -53,6 +53,7 @@ if(isset($_GET['recurring_id'])){ $status = "Inactive"; $status_badge_color = "secondary"; } + $company_id = $row['company_id']; $company_name = $row['company_name']; $company_country = $row['company_country']; $company_address = $row['company_address']; @@ -111,7 +112,7 @@ if(isset($_GET['recurring_id'])){
- + ">

Recurring Invoice
ly

diff --git a/settings-user.php b/settings-user.php index 61b28048..c5635290 100644 --- a/settings-user.php +++ b/settings-user.php @@ -22,13 +22,13 @@ $sql_recent_logs = mysqli_query($mysqli,"SELECT * FROM logs - +
- + " class="img-circle img-fluid">

diff --git a/setup.php b/setup.php index 3233f21d..cca1892d 100644 --- a/setup.php +++ b/setup.php @@ -162,14 +162,48 @@ if(isset($_POST['add_user'])){ mkdir("uploads/users/$user_id"); - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/users/$user_id/"; - $path = $path . time() . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); - } + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); - mysqli_query($mysqli,"UPDATE users SET user_avatar = '$path' WHERE user_id = $user_id"); + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/users/$user_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + //Set Avatar + mysqli_query($mysqli,"UPDATE users SET user_avatar = '$new_file_name' WHERE user_id = $user_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } + } $_SESSION['alert_message'] = "User $user_name created!"; @@ -205,13 +239,46 @@ if(isset($_POST['add_company_settings'])){ mkdir("uploads/settings/$company_id"); mkdir("uploads/tmp/$company_id"); - if($_FILES['file']['tmp_name']!='') { - $path = "uploads/settings/$company_id/"; - $path = $path . time() . basename( $_FILES['file']['name']); - $file_name = basename($path); - move_uploaded_file($_FILES['file']['tmp_name'], $path); + //Check to see if a file is attached + if($_FILES['file']['tmp_name'] != ''){ + + // get details of the uploaded file + $file_error = 0; + $file_tmp_path = $_FILES['file']['tmp_name']; + $file_name = $_FILES['file']['name']; + $file_size = $_FILES['file']['size']; + $file_type = $_FILES['file']['type']; + $file_extension = strtolower(end(explode('.',$_FILES['file']['name']))); - mysqli_query($mysqli,"UPDATE companies SET company_logo = '$path' WHERE company_id = $company_id"); + // sanitize file-name + $new_file_name = md5(time() . $file_name) . '.' . $file_extension; + + // check if file has one of the following extensions + $allowed_file_extensions = array('jpg', 'gif', 'png'); + + if(in_array($file_extension,$allowed_file_extensions) === false){ + $file_error = 1; + } + + //Check File Size + if($file_size > 2097152){ + $file_error = 1; + } + + if($file_error == 0){ + // directory in which the uploaded file will be moved + $upload_file_dir = "uploads/settings/$company_id/"; + $dest_path = $upload_file_dir . $new_file_name; + + move_uploaded_file($file_tmp_path, $dest_path); + + mysqli_query($mysqli,"UPDATE companies SET company_logo = '$new_file_name' WHERE company_id = $company_id"); + + $_SESSION['alert_message'] = 'File successfully uploaded.'; + }else{ + + $_SESSION['alert_message'] = 'There was an error moving the file to upload directory. Please make sure the upload directory is writable by web server.'; + } } //Create Permissions diff --git a/top_nav.php b/top_nav.php index 1dc21825..957a21ff 100644 --- a/top_nav.php +++ b/top_nav.php @@ -37,7 +37,7 @@ - + " class="user-image img-circle"> @@ -48,7 +48,7 @@ - " class="img-circle"> + " class="img-circle">

diff --git a/users.php b/users.php index a43bf594..a2632d10 100644 --- a/users.php +++ b/users.php @@ -121,7 +121,7 @@ - + "> diff --git a/view_file_modal.php b/view_file_modal.php index a4888ab0..bd5035ac 100644 --- a/view_file_modal.php +++ b/view_file_modal.php @@ -2,14 +2,14 @@

-
+
- + ">