+
+
+ ![]()
+
+
+
+
+
+
+
+ '.$htmlErroresGlobales.'+
'.$errorFile.'+ '.$dats.' + '; + + return $html; + } + + protected function procesaFormulario($datos) { + // Solo se pueden definir arrays como constantes en PHP >= 5.6 + global $ALLOWED_EXTENSIONS; + + $result = array(); + $ok = count($_FILES) == 1 && $_FILES['archivo']['error'] == UPLOAD_ERR_OK; + + if ( $ok ) { + $archivo = $_FILES['archivo']; + $nombre = $_FILES['archivo']['name']; + /* 1.a) Valida el nombre del archivo */ + $ok = check_file_uploaded_name($nombre) && check_file_uploaded_length($nombre) ; + /* 1.b) Sanitiza el nombre del archivo + $ok = sanitize_file_uploaded_name($nombre); + */ + /* 1.c) Utilizar un id de la base de datos como nombre de archivo */ + + /* 2. comprueba si la extensión está permitida*/ + $ok = $ok && in_array(pathinfo($nombre, PATHINFO_EXTENSION), $ALLOWED_EXTENSIONS); + + /* 3. comprueba el tipo mime del archivo correspode a una imagen image/* */ + $finfo = finfo_open(FILEINFO_MIME_TYPE); + $mimeType = finfo_file($finfo, $_FILES['archivo']['tmp_name']); + $ok = preg_match('/image\/*./', $mimeType); + finfo_close($finfo); + + if ( $ok ) { + $tmp_name = $_FILES['archivo']['tmp_name']; + + if ( !move_uploaded_file($tmp_name, FILMS_DIR.$nombre) ) { + $result[] = 'Error al mover el archivo'; + } + + // 4. Si fuese necesario guardar en la base de datos la ruta relativa $nombre del archivo + return "index.php#img=".urlencode('img/'.$nombre); + } else { + $result["errorFile"] = 'El archivo tiene un nombre o tipo no soportado'; + } + } else { + $result[] = 'Error al subir el archivo.'; + } + return $result; + } + + + /** + * Check $_FILES[][name] + * + * @param (string) $filename - Uploaded file name. + * @author Yousef Ismaeil Cliprz + * @See http://php.net/manual/es/function.move-uploaded-file.php#111412 + */ + function check_file_uploaded_name ($filename) { + return (bool) ((mb_ereg_match('/^[0-9A-Z-_\.]+$/i',$filename) === 1) ? true : false ); + } + + /** + * Sanitize $_FILES[][name]. Remove anything which isn't a word, whitespace, number + * or any of the following caracters -_~,;[](). + * + * If you don't need to handle multi-byte characters you can use preg_replace + * rather than mb_ereg_replace. + * + * @param (string) $filename - Uploaded file name. + * @author Sean Vieira + * @see http://stackoverflow.com/a/2021729 + */ + function sanitize_file_uploaded_name($filename) { + /* Remove anything which isn't a word, whitespace, number + * or any of the following caracters -_~,;[](). + * If you don't need to handle multi-byte characters + * you can use preg_replace rather than mb_ereg_replace + * Thanks @Łukasz Rysiak! + */ + $newName = mb_ereg_replace("([^\w\s\d\-_~,;\[\]\(\).])", '', $filename); + // Remove any runs of periods (thanks falstro!) + $newName = mb_ereg_replace("([\.]{2,})", '', $newName); + + return $newName; + } + + /** + * Check $_FILES[][name] length. + * + * @param (string) $filename - Uploaded file name. + * @author Yousef Ismaeil Cliprz. + * @See http://php.net/manual/es/function.move-uploaded-file.php#111412 + */ + function check_file_uploaded_length ($filename) { + return (bool) ((mb_strlen($filename,'UTF-8') < 250) ? true : false); + } +} +?> \ No newline at end of file diff --git a/assets/php/config.php b/assets/php/config.php index 709e1be..955a06a 100644 --- a/assets/php/config.php +++ b/assets/php/config.php @@ -19,6 +19,11 @@ define('FILMS_DIR', dirname(RAIZ_APP).'img/films/tmp'); define('FILMS_DIR_PROTECTED', RAIZ_APP.'img/films/tmp'); + /** + * Allowed extensions for image files. + */ + $ALLOWED_EXTENSIONS = array('gif','jpg','jpe','jpeg','png'); + /** * Utf-8 support settings, location (language and country) and time zone. */ diff --git a/assets/php/form.php b/assets/php/form.php index 3839d47..1da1a6e 100644 --- a/assets/php/form.php +++ b/assets/php/form.php @@ -95,7 +95,7 @@ abstract class Form { $opciones = array_merge($opcionesPorDefecto, $opciones); $this->ajax = $opciones['ajax']; - $this->action = $opciones['action']; + $this->action = $opciones['action']; $this->classAtt = $opciones['class']; $this->enctype = $opciones['enctype']; diff --git a/assets/php/template.php b/assets/php/template.php index 1e65e72..d4d9a3b 100644 --- a/assets/php/template.php +++ b/assets/php/template.php @@ -495,6 +495,7 @@ //Print generic Footer: function print_footer(){ $prefix = $this->prefix; + $page = $this->page; /* TODO */ $css = "{$prefix}assets/css/highContrast.css"; @@ -516,7 +517,9 @@ echo" - \n"; + + "; + if($page === "FDI-Cines") echo"\n"; } } diff --git a/contacto/includes/formContact.php b/contacto/includes/formContact.php index 81759be..04f3157 100644 --- a/contacto/includes/formContact.php +++ b/contacto/includes/formContact.php @@ -85,4 +85,5 @@ class FormContact extends Form { return $result; } -} \ No newline at end of file +} +?> \ No newline at end of file diff --git a/index.php b/index.php index b49ad5a..bf3a953 100644 --- a/index.php +++ b/index.php @@ -11,6 +11,19 @@ +