do_fileupload.php at TPEngine

<?php
/* $Id: do_fileupload.php,v 0.9 drscream Exp $ */
/*
          TPEngine - PHP/MySQL Protocol System
        ==============================================
            (c) 2005 by
               Thomas Merkel      <hide@address.com>
               David Hoess	  <hide@address.com>
	       Uwe Schiber	  <hide@address.com>

          download the latest version:
            http://tpengine.sourceforge.net

          This  program is  free  software;  you can
          redistribute it and/or modify it under the
          terms of the GNU General Public License as
          published by the Free Software Foundation;
          either  version 2 of  the License,  or (at
          your option) any later version.

        ==============================================

*/
include "./inc/header.inc.php";

if(!isset($HTTP_POST_VARS['Submit']))
{
  echo '<BODY onLoad="setTimeout(window.close, 2)">';
  //echo '<BODY onLoad="setTimeout(window.close, 2)" onUnload="opener.location.replace(window.opener.location);">';
  die("denied");
}

if (@is_uploaded_file($_FILES["userfile"]["tmp_name"])) {
	$boardid = $HTTP_GET_VARS['boardid'];

	$newname = time().'.'.$_FILES["userfile"]["name"];
	$newname = ereg_replace(" ","_",$newname);
	$newname = ereg_replace("!","_",$newname);
	$newname = ereg_replace("ö","oe",$newname);
	$newname = ereg_replace("ä","ae",$newname);
	$newname = ereg_replace("ü","ue",$newname);
	$newname = ereg_replace("Ä","AE",$newname);
	$newname = ereg_replace("Ö","OE",$newname);
	$newname = ereg_replace("Ü","UE",$newname);
	$newname = ereg_replace("ß","ss",$newname);
	$newname = ereg_replace("'","_",$newname);

	tp_query("INSERT INTO ".$pref."upload_tmp (time, board_id, filename)
			VALUES(
			'".time()."',
			'".$boardid."',
			'".addslashes($newname)."')");

        copy($_FILES["userfile"]["tmp_name"], "upload/".$newname);
	
	message_redirect("Upload erfolgreich!");
}
else {
 	echo "An Error by uploading the file....";
}
?>