We launched new forums in March 2019—join us there. In a hurry for help with your website? Get Help Now!
    • 29181
    • 480 Posts
    dev_cw :

    have you ever done anything like this, and did you run into any trouble along the way.

    I would like to do something similar.

    In particular I would like to know about any possible security issues I would need to watch out for.

    Thanks for any pointers.
    Taff
      Adrian Lawley: www.adrianlawley.com
      • 7231
      • 4,205 Posts
      Taff, I did not do this yet. I was sure that I had read a post about this but I could not find it again (really need to start bookmarking posts).

      As far as security it depends on your specifications. By default php will store the uploaded file in a temporary space where you can manipulate it before moving it to the final destination. Normally I will rename the document to a random name (with a timestamp) which is a good way to keep it safe. Not to mention the velidation testing to make sure it is an approved format. You can get a good idea about how this works by looking at the FileUpload snippet. There are a number of security issues you could consider as well depending on the level of security you need.

      Here is the php manual with some good docs for handling uploaded files:
      http://www.php.net/features.file-upload

      I will continue to search for the eForm info for uploading files I swear I saw someplace.
        [font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

        Something is happening here, but you don't know what it is.
        Do you, Mr. Jones? - [bob dylan]
        • 29181
        • 480 Posts
        OK, thanks for the swift reply.
          Adrian Lawley: www.adrianlawley.com
          • 30223
          • 1,010 Posts
          A simple function should let you save the uploaded file instead of attaching it using the eFormOnBeforeMailSent event
          [!eform .... eFormOnBeforeMailSent=`onBeforeMailSentFunction` !] 

          <?php
          function onBeforeMailSentFunction(&$fields){
            //manipulate directly from the $_FILES array!
            //eform does limited validation on uploaded files (see documentation)
            //The fact that this code runs means that eform validated everything OK
            //Do extra validation here if needed - you can set the $fields['validationmessage'] 
            //with some message and return false from the function to indicate an error
            
            $filename = $_FILES['myfile']['name'];
            //create unique filename (of sorts) if you want
            $filename = uniqid('upload_').substr($filename,strrpos($filename,'.'));
            $destination = '/whatever/your/path/is/' . $filename; //make sure folder is writable!
            //try to move the uploaded file
            if( @move_uploaded_file($_FILES['file']['tmp_name'], $destination))
            {
              //have a [+moved_file_name+] place holder in your report to see the new filename
              $fields['moved_file_name'] =  $filename;
              return true;
            }else{
              $fields['validationmessage'] = "Could not save the uploaded file.";
              return false;
            }
          }
          ?>
          

            • 29181
            • 480 Posts
            Thanks TobyL, that will come in handy!

            I actually used http://www.verot.net/php_class_upload.htm

            in conjunction with that piece of code. It does the checking filetype, filesize, and can even do some image manipulation. I then used your placeholder to mail it to the person in charge of receiving all the imagery.

            All in all a great solution, I was more than a little worried about security, but with that class and your eForm snippet, things are well...I hope!

            Thanks again,
            Taff
              Adrian Lawley: www.adrianlawley.com
              • 7231
              • 4,205 Posts
              Taff: How did you use the class in the code? That class looks cool, with auto thumbnails and all. Thanks for pointing it out.
                [font=Verdana]Shane Sponagle | [wiki] Snippet Call Anatomy | MODx Developer Blog | [nettuts] Working With a Content Management Framework: MODx

                Something is happening here, but you don&#39;t know what it is.
                Do you, Mr. Jones? - [bob dylan]
                • 29181
                • 480 Posts
                It was quite simple actually, which is what I like most about MODx, embedding classes takes minutes.

                This is the code I am using it resizes the image to 150px, and also duplicates it to give it one of those "I’m sitting on a shiny surface"
                affairs.

                It even allows me to use the errors in MODx too.


                <?php
                function onBeforeMailSentFunction(&$fields){
                //this is where the class is
                include('assets/snippets/upload/class.upload.php');
                //name of my upload field
                $handle = new Upload($_FILES['recipe_image']);
                
                if ($handle->uploaded) {
                       
                        // yes, the file is on the server
                        // below are some example settings which can be used if the uploaded file is an image.
                        $handle->image_resize            = true;
                        $handle->image_ratio_y           = true;
                        $handle->image_x                 = 150;
                
                        // now, we start the upload 'process'. That is, to copy the uploaded file
                        // from its temporary location to the wanted location
                        // It could be something like $handle->Process('/home/www/my_uploads/');
                         //where to save the files to
                        $handle->Process('assets/images/recipes/');
                        
                        // we check if everything went OK
                        if ($handle->processed) {
                            // everything was fine !
                            echo '<fieldset>';
                            echo '  <legend>File uploaded and resized with success</legend>';
                            echo '  <img src="assets/images/recipes/' . $handle->file_dst_name . '" />';
                            $info = getimagesize($handle->file_dst_pathname);
                            echo '  <p>' . $info['mime'] . '  -  ' . $info[0] . ' x ' . $info[1] .'  -  ' . round(filesize($handle->file_dst_pathname)/256)/4 . 'KB</p>';
                            echo '  link to the file just uploaded: <a href="assets/images/recipes/' . $handle->file_dst_name . '">' . $handle->file_dst_name . '</a><br/>';
                            echo '</fieldset>';
                        } else {
                            // one error occured
                            echo '<fieldset>';
                            echo '  <legend>file not uploaded to the wanted location</legend>';
                            echo '  Error: ' . $handle->error . '';
                            echo '</fieldset>';
                			    return false;
                        }
                
                        // we now process the image a second time, with some other settings
                        $handle->image_resize            = true;
                        $handle->image_ratio_y           = true;
                        $handle->image_x                 = 150;
                        $handle->image_reflection_height = '25%';
                        $handle->image_contrast          = 10;
                
                        $handle->Process('assets/images/recipes/');
                        
                        // we check if everything went OK
                        if ($handle->processed) {
                            // everything was fine !
                            echo '<p>Want more magic?</p>';
                            echo '<fieldset>';
                            echo '  <legend>increasing contrast and adding a reflection to make it look more tasty</legend>';
                            echo '  <img src="assets/images/recipes/' . $handle->file_dst_name . '" />';
                            $info = getimagesize($handle->file_dst_pathname);
                            echo '  <p>' . $info['mime'] . '  -  ' . $info[0] . ' x ' . $info[1] .'  -  ' . round(filesize($handle->file_dst_pathname)/256)/4 . 'KB</p>';
                            echo '  link to the file just uploaded: <a href="assets/images/recipes/' . $handle->file_dst_name . '">' . $handle->file_dst_name . '</a><br/>';
                            echo '</fieldset>';
                			$fields['recipe_image'] =  "assets/images/recipes/".$handle->file_dst_name;
                			 return true;
                        } else {
                            // one error occured
                            echo '<fieldset>';
                            echo '  <legend>file not uploaded to the required location</legend>';
                            echo '  Error: ' . $handle->error . '';
                            echo '</fieldset>';
                			    return false;
                        }
                
                        // we delete the temporary files
                        $handle-> Clean();
                
                    } else {
                        // if we're here, the upload file failed for some reasons
                        // i.e. the server didn't receive the file
                        echo '<fieldset>';
                        echo '  <legend>file not uploaded on the server</legend>';
                        echo '  Error: ' . $handle->error . '';
                        echo '</fieldset>';
                		    return false;
                    }
                }
                ?>


                The docs at the page are very good actually to make use of some of the other cool features. It may be overkill, but I like it.

                You can see it in action at http://greenmountaingringo.us/contact-us.html

                The admin also gets the image and its location mailed to them thanks to the awesome eForm $fields array.

                I will probably do away with one of those calls, once I know what exactly the client wants.

                Hth,
                Taff
                  Adrian Lawley: www.adrianlawley.com