<?

/*
         _____   ____ |__|  |__   ____ _____ ___  __ ____   ____ 
        /  ___\ / ___\|  |  |  \_/ __ \\__  \\  \/ // __ \ /    \
        \  \___/ /_/  >  |   Y  \  ___/ / __ \\   /\  ___/|   |  \
         \___  >___  /|__|___|  /\___  >____  /\_/  \___  >___|  /
             \/_____/         \/     \/     \/          \/     \/
*/

	// get variables for fields on upload screen
	$thefile = $_FILES['thefile'];
	$tos = $_POST['tos'];

	$currentip = $_SERVER['REMOTE_ADDR'];
	$messages = "";

	// check for blocked ip address
	if ($currentip != "") {
		$link = mysql_connect($db_server, $db_user, $db_password) or die("Could not connect to the database.");
		mysql_select_db($db_name) or die("Could not select the database.");
		$query = "select ip from blocked where ip = '$currentip'";
	    $result = mysql_query($query) or die("Query failed.");
		$num_rows = mysql_num_rows($result);
		if ($num_rows > 0) {
			$messages .= "Your IP address (" . $currentip . ") has been blocked from using this service.<br><br>";
		}
	}

	// check for a file
	if (!isset($thefile) || $thefile['name'] == "") {
		$messages .= "You must select a file to upload using the &quot;Browse&quot; button.<br><br>";
	}

	// check to see if tos was read
	if ($tos == "") {
		$messages .= "You must check the box stating you agree to our terms.<br><br>";
	}

	if ($messages == "") {
		// check for valid file type
		if (!in_array_nocase($thefile['type'], $valid_mime_types)) {
			$messages .= "<em>" . $thefile['name'] . "</em> is not in a valid format (" . $valid_mime_types_display . ").<br><br>";
		}

		// check for valid file extension
		$thefile['name'] = strtolower($thefile['name']);
		$file_ext = substr($thefile['name'], strlen($thefile['name']) - 3, strlen($thefile['name']));
		// fix for JPEG names files
		if ($file_ext == "peg") {
			$file_ext = "jpg";
		}
		if (!in_array_nocase($file_ext, $valid_file_ext)) {
			$messages .= "<em>" . $thefile['name'] . "</em> (".$file_ext.") does not have a valid file extension (" . $valid_mime_types_display . ").<br><br>";
		}

		// check for valid file size
		if ($thefile['size'] > ($max_file_size_kb * 1024)) {
			$messages .= "<em>" . $thefile['name'] . "</em> is bigger than the allowed file size of " . $max_file_size_kb . " K.<br><br>";
		}
	}

	// save the file, if no error messages
	if ($messages == "") {
		$max_file_size_byes = $max_file_size_kb * 1024;

		// SAVE THE PICTURE
		$newFileName = newImageName($thefile['name']);
		$newFile = $server_dir . $newFileName;
		$newFileUrl = $image_url . $newFileName;
		$newFileUrlLink = $server_save_directory . $newFileName;
		if ($file_ext == "jpg" || $file_ext == "png" || $file_ext == "gif") {
			$tnFileName = "tn_" . substr($newFileName, 0, strlen($newFileName) - 3) . "jpg";
			$tnFile = $server_dir . $tnFileName;
			$tnFileUrl = $image_url . $tnFileName;
		} else {
			$tnFileName = "";
			$tnFile = "";
			$tnFileUrl = "";
		}
		$filesize = $thefile['size'];
		$newID = "";
		if (!@copy($thefile['tmp_name'], $newFile)) {
			$messages .= "An unexpected error prevented your file from being saved. Please try again.";
		} else {
			// add to database
			$query = "INSERT INTO images (filename, tn_filename, filepath, ip, filesize) VALUES ('$newFileName', '$tnFileName', '$server_save_directory', '$currentip', $filesize)";
			mysql_query($query) or die("Database entry failed.");
			$newID = mysql_insert_id();
		}

		if ($file_ext == "jpg" || $file_ext == "png" || $file_ext == "gif") {
			if ($file_ext == "jpg") {
				$source_id = imagecreatefromjpeg($newFile);
			} elseif ($file_ext == "png") {
				$source_id = imagecreatefrompng($newFile);
			} elseif ($file_ext == "gif") {
				$source_id = imagecreatefromgif($newFile);
			}

			$true_width = imagesx($source_id);
			$true_height = imagesy($source_id);

			// create thumb
			if ($true_width > $thumbnail_size_max || $true_height > $thumbnail_size_max) {
				if ($true_width >= $true_height) {
					$dest_width = $thumbnail_size_max;
					$dest_height = ($dest_width / $true_width) * $true_height;
				} else {
					$dest_height = $thumbnail_size_max;
					$dest_width = ($dest_height / $true_height) * $true_width;
				}
				if ($thefile['type'] == "image/jpeg" || $thefile['type'] == "image/pjpeg") {
					$target_id = imagecreatetruecolor($dest_width, $dest_height);
				} elseif ($thefile['type'] == "image/png" || $thefile['type'] == "image/x-png") {
					$target_id = imagecreatetruecolor($dest_width, $dest_height);
				} else {
					$target_id = imagecreatetruecolor($dest_width, $dest_height);
				}
				$target_pic = imagecopyresized($target_id, $source_id, 0, 0, 0, 0, $dest_width, $dest_height, $true_width, $true_height);
	
				// create a thumbnail in JPEG format
				imagejpeg($target_id, $tnFile, $thumbnail_quality);
	
				imagedestroy($target_id);
			} else {
				copy($newFile, $tnFile);
			}
		}
	}
	mysql_close($link);

	// create URL links to display to user
	$showURL1 = false;  // image on hosted page - image only
	$showURL2 = false;  // direct link to file - all
	$showURL3 = false;  // HTML for img - image only
	$showURL4 = false;  // [img][/img] tags - image only
	$showURL5 = false;  // thumbnail pic - image only

	// determine flags
	$showURL2 = true;
	if ($file_ext == "jpg" || $file_ext == "gif" || $file_ext == "png" || $file_ext == "bmp") {
		$showURL1 = true;
		$showURL3 = true;
		$showURL4 = true;
	}
	if ($file_ext == "jpg" || $file_ext == "gif" || $file_ext == "png") {
		$showURL5 = true;
	}

	function newImageName($fname) {
		$timestamp = time();
		$new_image_file_ext = substr($fname, strlen($fname) - 3, strlen($fname));
		if ($new_image_file_ext == "peg") {
			$ext = ".jpg";
		} else {
			$ext = "." . $new_image_file_ext;
		}
		$newfilename = randString() . substr($timestamp, strlen(timestamp) - 4, strlen(timestamp)) . $ext;
		return $newfilename;
	}

	function randString() {
		$newstring="";
		while(strlen($newstring) < 3) {
			$randnum = mt_rand(0,61);
			if ($randnum < 10) {
				$newstring .= chr($randnum + 48);
			} elseif ($randnum < 36) {
				$newstring .= chr($randnum + 55);
			} else {
				$newstring .= chr($randnum + 61);
			}
		}
		return $newstring;
	}

	function in_array_nocase($item, $array) {
		$item = &strtoupper($item);
		foreach($array as $element) {
			if ($item == strtoupper($element)) {
				return true; 
			}
		}
		return false;
	} 

?>