<?php
/*
 * check file extension of upload file
 * required finfo_open extension for php
 * 
 * See more at:
 * http://hungred.com/useful-information/secure-file-upload-check-list-php/#sthash.drlxs1Cd.dpuf
 * http://hackers2devnull.blogspot.hk/2013/05/how-to-shell-server-via-image-upload.html
 * 
 */

class Uploader {

	/* 
	 * filename
	 * The filename of the uploaded file.
	 * destination
	 * The destination of the moved file. 
	 */
	var $uploadFile;
	var $destination;
	var $filename;
	var $fullpath;
	var $checked = false;
	//var $isImage = true;
	var $success = false;
	
	var $AllowedContentType;
	var $AllowedExtension;	

	/*predefined sets*/
	//CONTENT TYPE
	static $MIME_XXX = array('application/octet-stream'); //unknown type
	
	static $MIME_IMG = array('image/x-bmp', 'image/gif', 'image/jpeg', 
						'image/pjeg', 'image/png', 'image/x-png');
	
	static $MIME_TXT = array('text/plain', 'text/xml', 'text/html');
	
	static $MIME_DOC = array('application/pdf','application/postscript', 'application/rtf', 'application/vnd.ms-office',
						'application/msword', 'application/vnd.openxmlformats-officedocument.wordprocessingml.document', 
						'application/vnd.ms-excel', 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet', 
						'application/vnd.ms-powerpoint', 'application/vnd.openxmlformats-officedocument.presentationml.presentation',); 
	
	static $MIME_ZIP = array('application/gzip', 'application/x-gzip', 'application/zip', 'application/x-zip-compressed', 
						'application/x-7z-compressed', 'application/x-rar-compressed');

	//EXTENSION
	static $EXT_IMG = array('bmp', 'gif', 'jpeg', 'png');	
	static $EXT_TXT = array('txt', 'xml', 'html', 'htm');	
	static $EXT_DOC = array('pdf', 'ps', 'rtf', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx');	
	static $EXT_ZIP = array('gz', 'zip', '7z', 'rar');	
	
	static $INVALID_FILENAME_REGEX = '/(php|htaccess|htpasswd)/i';
	
	static $VALID_CHARS_REGEX = '.A-Za-z0-9_-\s ';// Characters allowed in the file name (in a Regular Expression format) 
	
	
	//const IMG = 'IMG';
	
	//do something like $u = new Uploader($_FILES["pimgfile"]);
	public function Uploader($uploadFile, $setting=null){
		if(empty($setting)){ //allow image
			$this->AllowedContentType = self::$MIME_IMG;
			$this->AllowedExtension = self::$EXT_IMG;
		}else{ //setup whitelist
			$this->AllowedContentType = $setting['MIME'];
			$this->AllowedExtension = $setting['EXT'];
		}
		//vdump($this->AllowedContentType, $this->AllowedExtension);
		//$uploadFile['name'], $uploadFile['tmp_name'], $uploadFile['size'], $uploadFile['type'], 
		$this->uploadFile = $uploadFile;
		//vdump($this->uploadFile);

		if (isset($this->uploadFile['error']) && $this->uploadFile['error'] != 0) {
			echo $this->uploadFile['error'];
			exit(0);
		} else if (!isset($this->uploadFile['tmp_name']) || !@is_uploaded_file($this->uploadFile['tmp_name'])) {
			echo 'Upload failed is_uploaded_file test.';
			exit(0);
		} else if (!isset($this->uploadFile['name'])) {
			echo 'File has no name.';
			exit(0);
		}		
		
		$this->filename = preg_replace('/[^'.self::$VALID_CHARS_REGEX.']|\.+$/i', '', strtolower(basename($this->uploadFile['name'])));
				
	}
	
	public function check(){
		$this->checked = false;
		$t0 = self::check_filename($this->uploadFile['name']);
		$t1 = $this->_check_contentType();
		$t2 = $this->_check_imageMIME();
		$t3 = $this->_check_extension();
		$this->checked = ($t0 && $t1 && $t2 && $t3);
		//vdump($t1, $t2, $t3, $this->checked);
		return $this->checked;
	}
	
	protected function _check_contentType(){				
		$ct = finfo_file(finfo_open(FILEINFO_MIME_TYPE), $this->uploadFile['tmp_name']);	
		//vdump('CT check', $ct, $this->AllowedContentType);			
		//if finfo_file is not working
		//use param: $setting['MIME'] = array_merge(Uploader::$MIME_DOC, Uploader::$MIME_XXX);		
		//if( in_array(strtolower($this->uploadFile['type']), $this->AllowedContentType) ){
		if( in_array(strtolower($ct), $this->AllowedContentType) ){
			return true;
		}else{
			print "Invalid Content Type $ct <br/>";
			return false;
		}		
	}
	
	protected function _check_imageMIME(){
		if(in_array(strtolower($this->uploadFile['type']), self::$MIME_IMG)){
			$imageinfo = getimagesize( $this->uploadFile['tmp_name']);
			//vdump('image MIME check', $imageinfo);
			
			if( in_array(strtolower($imageinfo['mime']), $this->AllowedContentType) ){
				return true;
			}else{
				print "Invalid Image Content Type : ".$imageinfo['mime']."<br/>";
				return false;
			}			
		}
		return true;
	}
	
	protected function _check_extension(){
// 		$extension = end(explode('.', $this->uploadFile['name']));
		$extension = pathinfo($this->uploadFile['name'], PATHINFO_EXTENSION);
		//$extension = $file_parts['extension'];
		//vdump('EXT check', $extension, $this->AllowedExtension);	
		if(!in_array(strtolower($extension), $this->AllowedExtension)){
			print "Invalid Extension: $extension <br/>";
			return false;
		}	
		return true;
	}

	public function save($destination, $chmod=null){
		if(self::check_filename($this->filename)==false){
			return false;
		}
		$this->destination = $destination;
		$this->fullpath = $this->destination . $this->filename;
		//vdump("Saving", $this->filename, $this->fullpath);
		$this->success = move_uploaded_file($this->uploadFile['tmp_name'], $this->fullpath);
		if($chmod){ //some permission like "0644"
			@chmod($this->fullpath, $chmod);
		}
		return $this->success;
	}
			
	/*
	 * simple static method to upload at once 
	 * always rename the upload file to prevent overwrite system file: .htaccess etc.
	 */
	public static function quick_save($uploadFile, $destination, $filename=null, $setting=null){		
		$f = new Uploader($uploadFile, $setting);
		$f->filename = $filename;
		//$f->destination = $destination;
		if( $f->check() && $f->save($destination) ){
			return $f;
		}else{
			return false;
		}		
	}
	
	public static function check_filename($filename, $filter_regex=null){
		if(empty($filter_regex)){
			$filter_regex = self::$INVALID_FILENAME_REGEX;
		}
		$error = preg_match($filter_regex, $filename, $matched);
		if($error){
			print "Invalid Filename <br/>";
		}
		//vdump($filter_regex, $matched);
		return !$error;
	}
}