From 7454aa005fad6d13aac8e097c25ead5d065a4c28 Mon Sep 17 00:00:00 2001
From: Krivchikov Dmitry <KrivchikovDA@gmail.com>
Date: Fri, 11 Sep 2015 17:26:20 +0300
Subject: [PATCH] =?UTF-8?q?=D0=9E=D0=B1=D1=80=D0=B0=D0=B1=D0=BE=D1=82?=
 =?UTF-8?q?=D0=BA=D0=B0=20=D0=BE=D1=88=D0=B8=D0=B1=D0=BE=D0=BA=20=D0=BF?=
 =?UTF-8?q?=D1=80=D0=B8=20=D0=B7=D0=B0=D0=B3=D1=80=D1=83=D0=B7=D0=BA=D0=B5?=
 =?UTF-8?q?=20=D0=BA=D0=B0=D1=80=D1=82=D0=B8=D0=BD=D0=BE=D0=BA=20=D0=B4?=
 =?UTF-8?q?=D0=BB=D1=8F=20=D1=81=D1=82=D0=B0=D1=82=D0=B5=D0=B9;=20=D0=BF?=
 =?UTF-8?q?=D1=80=D0=BE=D0=B2=D0=B5=D1=80=D0=BA=D0=B0=20=D0=B7=D0=B0=D0=B3?=
 =?UTF-8?q?=D1=80=D1=83=D0=B6=D0=B0=D0=B5=D0=BC=D1=8B=D1=85=20=D1=84=D0=B0?=
 =?UTF-8?q?=D0=B9=D0=BB=D0=BE=D0=B2-=D0=BA=D0=B0=D1=80=D1=82=D0=B8=D0=BD?=
 =?UTF-8?q?=D0=BE=D0=BA?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 ground/controllers/ImagesController.php |  8 +++-
 ground/views/articles/edit.php          | 53 ++++++++++++++-----------
 2 files changed, 36 insertions(+), 25 deletions(-)

diff --git a/ground/controllers/ImagesController.php b/ground/controllers/ImagesController.php
index 81f9f8e..28671d9 100644
--- a/ground/controllers/ImagesController.php
+++ b/ground/controllers/ImagesController.php
@@ -52,7 +52,13 @@ class ImagesController extends Controller
 			$uploaddir = App::getBasedir() . '../public/photos/articles/';
 			$fileName = (string)$_FILES['photo']['name'];
 			$temp = pathinfo($fileName);
-			$extension = strtolower($temp['extension']) ? strtolower($temp['extension']) : 'jpg';
+			$extension = strtolower($temp['extension']);
+
+			if (array_search($extension, array('jpg','jpeg','png')) === FALSE || getimagesize($_FILES['photo']['tmp_name']) === false) {
+				print 'error';
+				die;
+			}
+
 			$photo = $userId . strtolower('_' . substr(md5($fileName . time()), 0, 5) . '.' . $extension);
 			if (move_uploaded_file($_FILES['photo']['tmp_name'], $uploaddir . $photo)) {
 				ArticlePhotos::model()->add(array(
diff --git a/ground/views/articles/edit.php b/ground/views/articles/edit.php
index 3cd0638..05a483d 100644
--- a/ground/views/articles/edit.php
+++ b/ground/views/articles/edit.php
@@ -1,5 +1,10 @@
 <script>
 	function updatePhotobank() {
+		if (document.getElementById("hiddenframe").contentWindow.document.body.innerText == 'error') {
+			alert('Ошибка при загрузке.');
+			return false;
+		}
+
 		$('#photo').val('');
 		$('#caption').val('');
 		$.getJSON("/json/getmyartphotos", function (data) {
@@ -8,37 +13,37 @@
 				$("<img/> ", {
 					"class": "my-new-list",
 					src: '/photos/articles/small/' + val.name,
-					title: 'img #'+val.id+' :: '+val.caption,
+					title: 'img #' + val.id + ' :: ' + val.caption,
 					photoId: val.id
 				}).appendTo('#photobank');
 			});
 
 			$("#photobank img").on("click", function () {
 				articleText = document.getElementById('articleText');
-				imgText = '\n[img|#'+$(this).attr('photoid')+']\n';
+				imgText = '\n[img|#' + $(this).attr('photoid') + ']\n';
 				insertAtCursor(articleText, imgText);
 			});
 		});
 	}
 
-function insertAtCursor(myField, myValue) {
-    //IE support
-    if (document.selection) {
-        myField.focus();
-        sel = document.selection.createRange();
-        sel.text = myValue;
-    }
-    //MOZILLA and others
-    else if (myField.selectionStart || myField.selectionStart == '0') {
-        var startPos = myField.selectionStart;
-        var endPos = myField.selectionEnd;
-        myField.value = myField.value.substring(0, startPos)
-            + myValue
-            + myField.value.substring(endPos, myField.value.length);
-    } else {
-        myField.value += myValue;
-    }
-}
+	function insertAtCursor(myField, myValue) {
+		//IE support
+		if (document.selection) {
+			myField.focus();
+			sel = document.selection.createRange();
+			sel.text = myValue;
+		}
+		//MOZILLA and others
+		else if (myField.selectionStart || myField.selectionStart == '0') {
+			var startPos = myField.selectionStart;
+			var endPos = myField.selectionEnd;
+			myField.value = myField.value.substring(0, startPos)
+					+ myValue
+					+ myField.value.substring(endPos, myField.value.length);
+		} else {
+			myField.value += myValue;
+		}
+	}
 </script>
 <div id="pageSmoothBackground" style="background-image: url(<?= $randomPoint->getImg('middle') ?>);"></div>
 
@@ -76,10 +81,10 @@ function insertAtCursor(myField, myValue) {
 		</div>
 		<div class="col-md-12" style="margin: 20px 0; border-top: solid 1px #bbb; border-bottom: solid 1px #bbb;">
 			<form enctype="multipart/form-data" id="articlePhotoloader" action="/images/loadPhoto" method="POST" name="loadavatar" target="hiddenframe"  class="form-inline">
-				<input type="hidden" name="MAX_FILE_SIZE" value="2097152" />
+				<input type="hidden" name="MAX_FILE_SIZE" value="5242880" />
 				<div class="form-group">
-					<label for="photo">Загрузить новое изображение</label>
-					<input id="photo" name="photo" type="file" class="form-control" />
+					<label for="photo">Загрузить новое изображение (MAX 5MB) (jpg, png)</label>
+					<input id="photo" name="photo" type="file" class="form-control" accept=".jpg,.png,.jpeg" />
 				</div>
 				<div class="form-group">
 					<input id="caption" name="caption" type="text" class="form-control" placeholder="Описание (по желанию)" />
@@ -90,6 +95,6 @@ function insertAtCursor(myField, myValue) {
 			</form>
 		</div>
 		<div class="col-md-12" id="photobank"></div>
-		<iframe id=hiddenframe name="hiddenframe" style="width:0px; height:0px; border:0px" onload="updatePhotobank()"></iframe>
+		<iframe id="hiddenframe" name="hiddenframe" style="width:0px; height:0px; border:0px" onload="updatePhotobank()"></iframe>
 	</div>
 </div>