<?php
define('THIS_SCRIPT', 'reg_upload');
require_once 'global.php';
$istoptable = 0;
head();
$lang = load_lang($lang, THIS_SCRIPT);
if ($userid <= 0) {	//	请登录后进行操作。
	showmsg($lang['MustLogin']);
	exit;
}
if (1 == $t) {	//	执行上传
	print <<<EOT
<table width="100%" height="100%" border=0  cellspacing="0" cellpadding="0">
<tr><td class=tablebody1 width="100%" height="100%" >
<script type="text/javascript">
parent.document.theForm.Submit.disabled=false;
parent.document.theForm.Submit2.disabled=false;
</script>
EOT;
	$uploadsetting = explode('|', $fsetting['uploadsetting']);
	if ($uploadsetting[0] <= 0) {	//	系统未开通头像上传功能！
		print $lang['err.str3'];
		exit;
	}
	$upfileinfo =& $_FILES['file1'];
	if (empty($upfileinfo) OR 4 == $upfileinfo['error']) {	//	没有文件被上传！
		print $lang['err.str0'];
		exit;
	}
	$upfileinfo['tmp_name'] = str_replace('\\\\', '\\', $upfileinfo['tmp_name']);
	if (false === is_uploaded_file(str_replace('\\\\', '\\', $upfileinfo['tmp_name']))) { // 请使用POST方式上传文件！
		print $lang['err.str1'];
		exit;
	}
	$fileext = str_replace('.','',strrchr($upfileinfo['name'],'.'));
	if (false === $fileext) {
		list(,$fileext) = explode('/',$upfileinfo['type']);
		if (strpos($fileext,'-') !== false) {
			$fileext = str_replace('-','',strstr($fileext,'-'));
		}
	}
	$lowerext = trim(strtolower($fileext));
	//关于文件后缀/文件扩展名的一劳永逸的防范说明：除了图片以外的所有文件，都将在其文件名的末尾，追加一个下划线"_"，用于提高安全性
	if (false === strpos(',gif,jpg,bmp,jpeg,png,', ",{$lowerext},")) { // 文件类型{$fileExt}不正确!您只能上传如下类型的文件：gif,jpg,bmp,jpeg,png
		print str_replace('{$fileExt}',$fileext,$lang['err.str2']);
		exit;
	}
	$upbasedir = $fsetting['forumuploadname'];
	$len = strlen($upbasedir);
	if ('/' === $upbasedir{$len - 1}) {
		$upbasedir = substr($upbasedir, 0, $lent - 1);
	}

	$filename = $userid.'_'.md5(uniqid(rand())).'.'.$lowerext;
	$destfile = $upbasedir.'/faces/'.$filename;
	$tmpfile = $upbasedir.'/tempimage/'.$filename;
	if (!move_uploaded_file($upfileinfo['tmp_name'], $tmpfile)) {	//	上传失败
		//showmsg($lang['err.str4']);
		print $lang['err.str4'];
		exit;
	}
	$jsdestfile = format_jscode($destfile);
	$jstmpfile = format_jscode($tmpfile);
print <<<EOT
<script type="text/javascript">
parent.document.images['face'].src='{$jstmpfile}';
parent.document.theForm.myface.value='{$jsdestfile}';
parent.document.forms['theForm'].tmp_uploadface.value = '{$filename}';
</script>{$lang['tpl.str1']}
</td></tr></table>
EOT;
} else {	//	上传 UI
	$PostRanNum = intval(900*rand())+1000;
	set_cookie('UploadCode', $PostRanNum, $GLOBALS['user_selected_cookiedate']);
	print <<<EOT
	<table border="0"  cellspacing="0" cellpadding="0" width="100%">
	<tr>
	<td class=tablebody1>
	<form name="form" method="post" action="reg_upload.php?t=1" enctype="multipart/form-data">
	<input type="hidden" name="UploadCode" value="{$PostRanNum}" />
	<input type="hidden" name="filepath" value="uploadFace" />
	<input type="hidden" name="act" value="upload" />
	<input type="file" name="file1" />
	<input type="hidden" name="fname" />
	<input type="submit" name="SubmitBtn" value="{$lang['tpl.str0']}" onclick="fname.value=file1.value;parent.document.theForm.Submit.disabled=true;parent.document.theForm.Submit2.disabled=true;">
	</form>
EOT;
}
footer(false);
?>