From 4e16a36bd54c95ebc45665842582148c1a67ee34 Mon Sep 17 00:00:00 2001
From: Danang Probo Sayekti <dan@danpros.com>
Date: Fri, 10 Jul 2015 11:06:03 +0700
Subject: [PATCH] Improving image upload

Only login user can accesss the upload.php file.
---
 upload.php | 69 +++++++++++++++++++++++++++++++++++++-------------------------
 1 file changed, 41 insertions(+), 28 deletions(-)

diff --git a/upload.php b/upload.php
index 23ce27f..67c8ad1 100644
--- a/upload.php
+++ b/upload.php
@@ -1,5 +1,11 @@
 <?php
 
+require 'system/includes/dispatch.php';
+require 'system/includes/session.php';
+
+// Load the configuration file
+config('source', 'config/config.ini');
+
 $whitelist = array('jpg', 'jpeg', 'png', 'gif');
 $name      = null;
 $dir       = 'content/images/';
@@ -7,39 +13,46 @@ $error     = null;
 $timestamp = date('YmdHis');
 $path      = null;
 
-if (is_dir($dir)) {
-} else {
-    mkdir($dir, 0755, true);
-}
+if (login()) {
+ 
+    if (is_dir($dir)) {
+    } else {
+        mkdir($dir, 0755, true);
+    }
 
-if (isset($_FILES)) {
-    if (isset($_FILES['file'])) {
-        $tmp_name = $_FILES['file']['tmp_name'];
-        $name     = basename($_FILES['file']['name']);
-        $error    = $_FILES['file']['error'];
-        $path     = $dir . $timestamp . '-' . $name;
+    if (isset($_FILES)) {
+        if (isset($_FILES['file'])) {
+            $tmp_name = $_FILES['file']['tmp_name'];
+            $name     = basename($_FILES['file']['name']);
+            $error    = $_FILES['file']['error'];
+            $path     = $dir . $timestamp . '-' . $name;
 		
-        $check = getimagesize($tmp_name);
+            $check = getimagesize($tmp_name);
 		
-        if($check !== false) {
-            if ($error === UPLOAD_ERR_OK) {
-                $extension = pathinfo($timestamp . '-' . $name, PATHINFO_EXTENSION);
-                if (!in_array($extension, $whitelist)) {
-                    $error = 'Invalid file type uploaded.';
-                } else {
-                    move_uploaded_file($tmp_name, $dir . $timestamp . '-' . $name);
+            if($check !== false) {
+                if ($error === UPLOAD_ERR_OK) {
+                    $extension = pathinfo($timestamp . '-' . $name, PATHINFO_EXTENSION);
+                    if (!in_array($extension, $whitelist)) {
+                        $error = 'Invalid file type uploaded.';
+                    } else {
+                        move_uploaded_file($tmp_name, $dir . $timestamp . '-' . $name);
+                    }
                 }
+            } else {
+                $error = "File is not an image.";
             }
         }
-        else {
-            $error = "File is not an image.";
-        }
     }
-}
 
-echo json_encode(array(
-    'path' => $path,
-    'name'  => $name,
-    'error' => $error,
-));
-die();
+    echo json_encode(array(
+        'path' => $path,
+        'name'  => $name,
+        'error' => $error,
+    ));
+	
+    die();
+
+} else {
+    $login = site_url() . 'login';
+    header("location: $login");
+}
\ No newline at end of file