Друзья, подскажите пожалуйста. Попал ко мне в руки код, который должен производить загрузку изображений на сервер, но каким-то чудом он загружает любые файлы независимо от их расширения
<?php
require_once('../common.php');
require_once('./secure.php');
if (!empty($_GET['exit'])){
session_unset();
session_destroy();
header('Location: ./index.php');
exit('Bye!');
}
if (empty($_SESSION['forum_upload_dir']) || empty($_SESSION['forum_upload_url'])){
exit('Bye!');
}
$forum_upload_dir = $_SESSION['forum_upload_dir'];
$forum_upload_url = $_SESSION['forum_upload_url'];
if (!empty($_GET['delfile'])){
if (file_exists($forum_upload_dir.$_GET['delfile'])){
unlink($forum_upload_dir.$_GET['delfile']);
header('Location: ./index.php');
exit('Bye!');
}
}
if (!empty($_FILES['newfile'])){
$file_name = $_FILES['newfile']['name'];
$full_path = $forum_upload_dir.$file_name;
$http_path = $forum_upload_url.$file_name;
if (move_uploaded_file($_FILES['newfile']['tmp_name'], $full_path)){
resize_image($full_path);
header('Location: ./index.php?u=1');
}else{
header('Location: ./index.php');
}
exit('Bye!');
}
?><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>Менеджер файлов</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<script src="./jquery.js" type="text/javascript"></script>
<style>
body {
font-family: Verdana, Sans Serif;
font-size: 15px;
padding: 0;
margin: 0;
}
background-color:
border-bottom: 1px solid
padding: 5px 10px;
font-size: 14px;
margin: 0 0 10px 0;
}
div.uploaded-files{
float: left;
border: 1px solid
margin: 5px;
height: 150px;
position: relative;
cursor: pointer;
min-width: 150px;
text-align: center;
}
div.uploaded-files > div.act-panel{
position: absolute;
background-color:
opacity: 0.75;
width: 100%;
height: 100%;
left: 0px;
top: 0px;
display: none;
}
div.act-panel a{
display: inline-block;
font-size: 12px;
margin-top: 75px;
font-weight: bold;
}
div.uploaded-files img{
max-height: 150px;
}
div.uploaded-files p{
width: 100%;
margin: 0;
text-align: center;
position: absolute;
bottom: 0;
background-color:
opacity: 0.7;
font-size: 12px;
font-weight: bold;
padding: 4px 0;
white-space: nowrap;
}
div.noimages{
font-size: 22px;
font-weight: bold;
border: 1px solid
margin: 20px 40px;
padding: 25px 10px;
background-color:
color:
box-shadow: 3px 3px 2px
-moz-box-shadow: 3px 3px 2px
-webkit-box-shadow: 3px 3px 2px
}
margin-left: 100px;
}
</style>
<script type="text/javascript">
function show_act_panel(sender){
$(sender).children(".act-panel").show();
}
function hide_act_panel(sender){
$(sender).children(".act-panel").hide();
}
function delete_file(filename){
if (confirm('Удалить файл "'+filename+'" ?')){
document.location.assign('./index.php?delfile='+filename);
}
}
</script>
</head>
<body>
<form id="upload-form" action="" method="post" enctype="multipart/form-data">Загрузить новый файл: <input type="hidden"
name="MAX_FILE_SIZE" value="485760"><input type="file" name="newfile"><button type="submit">Загрузить</button><a
id="exit-link" href="./?exit=1">Выход</a></form>
<?php
$uploaded_files = array();
if ($handle = opendir($forum_upload_dir)){
while (false !== ($file_name = readdir($handle))){
if ($file_name != '.' && $file_name != '..'){
$extension = pathinfo($forum_upload_dir.$file_name, PATHINFO_EXTENSION);
$uploaded_files[] = array('name' => $file_name, 'extension' => strtoupper($extension));
}
}
closedir($handle);
usort($uploaded_files, "cmp_uploaded_files");
}
function cmp_uploaded_files($a, $b){
if ($a['name'] == $b['name']){
return 0;
}
return ($a['name'] < $b['name']) ? -1 : 1;
}
foreach ($uploaded_files as $file_data){
if ($file_data['extension'] == 'JPG' || $file_data['extension'] == 'JPEG' || $file_data['extension'] == 'GIF' ||
$file_data['extension'] == 'PNG' || $file_data['extension'] == 'BMP'){
$inside_code = '<img src="'.$forum_upload_url.$file_data['name'].'" />';
}else{
$inside_code = '<div class="noimages">'.$file_data['extension'].'</div>';
}
echo '<div class="uploaded-files" onmouseover="show_act_panel(this)" onmouseout="hide_act_panel(this)"
style="cursor: default"><div class="act-panel"><a href="javascript:delete_file(\''.$file_data
['name'].'\')">Удалить</a></div>'.$inside_code.'<p>'.$file_data['name'].'</p></div>';
}
if (!empty($_GET['u'])){
echo '<script type="text/javascript">alert(\'Файл загружен!\')</script>';
}
?>
</body>
</html>