Form submit/escape hotkeys added.

[fa-stable.git] / admin / attachments.php

diff --git a/admin/attachments.php b/admin/attachments.php
index a36801d4ebc39dfe8df50e969331ac2ff80ac196..cf1c16966540a9389db1aac7392efd7d892df816 100644 (file)
--- a/admin/attachments.php
+++ b/admin/attachments.php
@@ -1,5 +1,14 @@
 <?php
-
+/**********************************************************************
+    Copyright (C) FrontAccounting, LLC.
+       Released under the terms of the GNU General Public License, GPL, 
+       as published by the Free Software Foundation, either version 3 
+       of the License, or (at your option) any later version.
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  
+    See the License here <http://www.gnu.org/licenses/gpl-3.0.html>.
+***********************************************************************/
 $path_to_root="..";
 $page_security = 8;
 
@@ -22,7 +31,7 @@ if ($view_id != -1)
                header('Content-Disposition: attachment; filename='.$row['filename']);
        else
                        header("Content-Disposition: inline");
-       echo $row["bin_data"];
+       echo file_get_contents($comp_path."/".user_company(). "/attachments/".$row['unique_name']);
        exit();
        }       
 }
@@ -37,7 +46,7 @@ if ($download_id != -1)
        header("Content-type: ".$type);
        header('Content-Length: '.$row['filesize']);
        header('Content-Disposition: attachment; filename='.$row['filename']);
-       echo $row["bin_data"];
+       echo file_get_contents($comp_path."/".user_company(). "/attachments/".$row['unique_name']);
        exit();
        }       
 }
@@ -60,27 +69,37 @@ if ($Mode == 'ADD_ITEM' || $Mode == 'UPDATE_ITEM')
        {
                //$content = base64_encode(file_get_contents($_FILES['filename']['tmp_name']));
                $tmpname = $_FILES['filename']['tmp_name'];
-               $fp      = fopen($tmpname, 'r');
-               $content = fread($fp, filesize($tmpname));
-               $content = addslashes($content);
-               fclose($fp);
 
-               //$content = addslashes(file_get_contents($_FILES['filename']['tmp_name']));
+               $dir =  $comp_path."/".user_company(). "/attachments";
+               if (!file_exists($dir))
+               {
+                       mkdir ($dir,0777);
+                       $index_file = "<?php\nheader(\"Location: ../index.php\");\n?>";
+                       $fp = fopen($dir."/index.php", "w");
+                       fwrite($fp, $index_file);
+                       fclose($fp);
+               }
+               if ($Mode == 'UPDATE_ITEM' && file_exists($dir."/".$_POST['unique_name']))
+                       unlink($dir."/".$_POST['unique_name']);
+
+               $unique_name = uniqid('');
+               move_uploaded_file($tmpname, $dir."/".$unique_name);
+               //save the file
                $filename = $_FILES['filename']['name'];
                $filesize = $_FILES['filename']['size'];
                $filetype = $_FILES['filename']['type'];
        }
        else
        {
-               $content = $filename = $filetype = "";
+               $unique_name = $filename = $filetype = "";
                $filesize = 0;
        }
        $date = date2sql(Today());
        if ($Mode == 'ADD_ITEM')
        {
-               $sql = "INSERT INTO ".TB_PREF."attachments (type_no, trans_no, description, bin_data, filename,
+               $sql = "INSERT INTO ".TB_PREF."attachments (type_no, trans_no, description, filename, unique_name,
                        filesize, filetype, tran_date) VALUES (".$_POST['filterType'].",".$_POST['trans_no'].",".
-                       db_escape($_POST['description']).",'$content', '$filename', '$filesize', '$filetype', '$date')";
+                       db_escape($_POST['description']).", '$filename', '$unique_name', '$filesize', '$filetype', '$date')";
                db_query($sql, "Attachment could not be inserted");             
                display_notification(_("Attachment has been inserted.")); 
        }
@@ -92,8 +111,8 @@ if ($Mode == 'ADD_ITEM' || $Mode == 'UPDATE_ITEM')
                        description=".db_escape($_POST['description']).", ";
                if ($filename != "")
                {
-                       $sql .= "bin_data='$content',
-                       filename='$filename',
+                       $sql .= "filename='$filename',
+                       unique_name='$unique_name',
                        filesize='$filesize',
                        filetype='$filetype', ";
                }       
@@ -106,6 +125,10 @@ if ($Mode == 'ADD_ITEM' || $Mode == 'UPDATE_ITEM')
 
 if ($Mode == 'Delete')
 {
+       $row = get_attachment($selected_id);
+       $dir =  $comp_path."/".user_company(). "/attachments";
+       if (file_exists($dir."/".$row['unique_name']))
+               unlink($dir."/".$row['unique_name']);
        $sql = "DELETE FROM ".TB_PREF."attachments WHERE id = $selected_id";
        db_query($sql, "Could not delete attachment");
        display_notification(_("Attachment has been deleted.")); 
@@ -121,7 +144,7 @@ if ($Mode == 'RESET')
 
 function viewing_controls()
 {
-    start_form(false, true);
+    start_form();
 
     start_table("class='tablestyle_noborder'");
 
@@ -170,9 +193,9 @@ function display_rows($type)
                label_cell($row['filetype']);
                label_cell(sql2date($row['tran_date']));
                edit_button_cell("Edit".$row['id'], _("Edit"));
-               edit_button_cell("view".$row['id'], _("View"));
-               edit_button_cell("download".$row['id'], _("Download"));
-               edit_button_cell("Delete".$row['id'], _("Delete"));
+               button_cell("view".$row['id'], _("View"), false, ICON_VIEW);
+               button_cell("download".$row['id'], _("Download"), false, ICON_DOWN);
+               delete_button_cell("Delete".$row['id'], _("Delete"));
        end_row();
        }       
        end_table(1);
@@ -190,7 +213,7 @@ if (isset($_POST['filterType']))
 
 start_form(true);
 
-start_table("$table_style2 width=30%");
+start_table($table_style2);
 
 if ($selected_id != -1)
 {
@@ -200,6 +223,7 @@ if ($selected_id != -1)
                $_POST['trans_no']  = $row["trans_no"];
                $_POST['description']  = $row["description"];
                hidden('trans_no', $row['trans_no']);
+               hidden('unique_name', $row['unique_name']);
                label_row(_("Transaction #"), $row['trans_no']);
        }       
        hidden('selected_id', $selected_id);
@@ -215,7 +239,7 @@ end_table(1);
 if (isset($_POST['filterType']))
        hidden('filterType', $_POST['filterType']);
 
-submit_add_or_update_center($selected_id == -1, '', true);
+submit_add_or_update_center($selected_id == -1, '', 'default');
 
 end_form();