upload.php at AfterLogic WebMail Lite PHP

<?php

/*
 * AfterLogic WebMail Pro PHP by AfterLogic Corp. <hide@address.com>
 *
 * Copyright (C) 2002-2010  AfterLogic Corp. (www.afterlogic.com)
 * Distributed under the terms of the license described in COPYING
 * 
 */

	defined('WM_ROOTPATH') || define('WM_ROOTPATH', (dirname(__FILE__).'/'));
	
	header('Content-type: text/html; charset=utf-8');
	
	require WM_ROOTPATH.'common/class_session.php';
	
	$errorSymbols = array('<', '>');
	$Error_Desc = '';

	define('FILE_UPLOAD_KEY', 'fileupload');
	
	require_once(WM_ROOTPATH.'common/class_settings.php');
	require_once(WM_ROOTPATH.'common/class_account.php');
	require_once(WM_ROOTPATH.'common/class_log.php');
	require_once(WM_ROOTPATH.'common/class_convertutils.php');
	require_once(WM_ROOTPATH.'common/class_tempfiles.php');

	ConvertUtils::SetLimits();
	
	$log =& CLog::CreateInstance();
	
	@ob_start();
	
	$settings =& Settings::CreateInstance();
	$account =& Account::LoadFromDb($_SESSION[ACCOUNT_ID]);
	
	$tempFiles =& CTempFiles::CreateInstance($account);
	
	if (!$settings || !$settings->isLoad)
	{
		$Error_Desc = 'Can\'t Load Settings file';
	}
	elseif (!$settings->IncludeLang())
	{
		$Error_Desc = 'Can\'t Load Language file';
	}
	else
	{
		$Error_Desc = getGlobalError();	
	}

	$filename = '';
	$filesize = 0;
	
	if (empty($Error_Desc))
	{
		if (isset($_FILES[FILE_UPLOAD_KEY]) && is_uploaded_file($_FILES[FILE_UPLOAD_KEY]['tmp_name']))
		{
			if ($settings->EnableAttachmentSizeLimit && ($_FILES[FILE_UPLOAD_KEY]['size'] > $settings->AttachmentSizeLimit))
			{
				$Error_Desc = FileLargerAttachment;
			}
			else
			{
				$tempname = basename($_FILES[FILE_UPLOAD_KEY]['tmp_name']);
				$filename = $_FILES[FILE_UPLOAD_KEY]['name'];
				
				$idx = '';
				while ($tempFiles->IsFileExist($idx.$tempname))
				{
					$idx = ($idx === '') ? 1 : (int) $idx + 1;
				}
				
				$tempname = $idx.$tempname;

				if (!$tempFiles->MoveUploadedFile($_FILES[FILE_UPLOAD_KEY]['tmp_name'], $tempname))
				{
					switch ($_FILES[FILE_UPLOAD_KEY]['error'])
					{
						case 1:
							$Error_Desc = FileIsTooBig;
							break;
						case 2:
							$Error_Desc = FileIsTooBig;
							break;
						case 3:
							$Error_Desc = FilePartiallyUploaded;
							break;
						case 4:
							$Error_Desc = NoFileUploaded;
							break;
						case 6:
							$Error_Desc = MissingTempFolder;
							break;
						default:
							$Error_Desc = UnknownUploadError;
							break;
					}
				} 
				else
				{
					$filesize = $tempFiles->FileSize($tempname);
					if ($filesize === false)
					{
						$Error_Desc = MissingTempFile;	
					}
				}
			}
		}
		else 
		{
			$postsize = @ini_get('upload_max_filesize');
			$Error_Desc = ($postsize) ? FileLargerThan.$postsize : FileIsTooBig;
			if (isset($_FILES[FILE_UPLOAD_KEY]) && $_FILES[FILE_UPLOAD_KEY]['size'] > $settings->AttachmentSizeLimit)
			{
				$Error_Desc = FileIsTooBig;
			}
		}
	}
	
?>
	
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" />
<html>
<head>
	<title></title>
</head>
<body>
<?php
if ($Error_Desc != '')
{
	$log->WriteLine($Error_Desc, LOG_LEVEL_ERROR);
?>
<script type="text/javascript">
	alert("<?php echo ConvertUtils::ClearJavaScriptString($Error_Desc, '"');?>");
</script>
<?php

}
else 
{
	$mime = trim($_FILES[FILE_UPLOAD_KEY]['type']);
	if ($mime == 'application/octet-stream')
	{
		$mime = ConvertUtils::GetContentTypeFromFileName($filename);
	}

	$isInline = (isset($_POST['inline_image']) && $_POST['inline_image'] == '1');
	$isInline &= (strpos($mime, 'image') === 0);
	
?>
<script type="text/javascript">
	parent.LoadAttachmentHandler({
		FileName: "<?php echo ConvertUtils::ClearJavaScriptString($filename, '"');?>",
		TempName: "<?php echo ConvertUtils::ClearJavaScriptString($tempname, '"');?>",
		Size: <?php echo (int) $filesize; ?>,
		MimeType: "<?php echo ConvertUtils::ClearJavaScriptString($mime, '"'); ?>",
		Inline: <?php echo ($isInline) ? 'true' : 'false'; ?>,
		Url: "<?php echo ConvertUtils::ClearJavaScriptString('attach.php?tn='.$tempname, '"'); ?>"
	});
</script>
<?php
}
?>
</body>
</html>
<?php @ob_end_flush();