OSDN Git Service

PKWK_READONLY prohibits basic_auth
[pukiwiki/pukiwiki.git] / plugin / attach.inc.php
index 2b0c8b9..da7e139 100644 (file)
 <?php
-/////////////////////////////////////////////////
-// PukiWiki - Yet another WikiWikiWeb clone.
-//
-//  $Id: attach.inc.php,v 1.31 2003/07/27 14:15:29 arino Exp $
+// PukiWiki - Yet another WikiWikiWeb clone
+//  $Id: attach.inc.php,v 1.71 2005/01/30 12:02:37 henoheno Exp $
 //
+// File attach plugin
 
 /*
- ¥×¥é¥°¥¤¥ó attach
-
- changed by Y.MASUI <masui@hisec.co.jp> http://masui.net/pukiwiki/
- modified by PANDA <panda@arino.jp> http://home.arino.jp/
+ Changed by Y.MASUI <masui@hisec.co.jp> http://masui.net/pukiwiki/
+ Modified by PANDA <panda@arino.jp> http://home.arino.jp/
 */
 
-// upload dir(must set end of /)
-if (!defined('UPLOAD_DIR'))
-{
-       define('UPLOAD_DIR','./attach/');
-}
-
-// max file size for upload on PHP(PHP default 2MB)
-ini_set('upload_max_filesize','2M');
+// Max file size for upload on PHP (PHP default: 2MB)
+ini_set('upload_max_filesize', '2M');
 
-// max file size for upload on script of PukiWiki(default 1MB)
-define('MAX_FILESIZE',1000000);
+// Max file size for upload on script of PukiWikiX_FILESIZE
+define('PLUGIN_ATTACH_MAX_FILESIZE', (1024 * 1024)); // default: 1MB
 
 // ´ÉÍý¼Ô¤À¤±¤¬ÅºÉÕ¥Õ¥¡¥¤¥ë¤ò¥¢¥Ã¥×¥í¡¼¥É¤Ç¤­¤ë¤è¤¦¤Ë¤¹¤ë
-define('ATTACH_UPLOAD_ADMIN_ONLY',FALSE); // FALSE or TRUE
+define('PLUGIN_ATTACH_UPLOAD_ADMIN_ONLY', FALSE); // FALSE or TRUE
+
 // ´ÉÍý¼Ô¤À¤±¤¬ÅºÉÕ¥Õ¥¡¥¤¥ë¤òºï½ü¤Ç¤­¤ë¤è¤¦¤Ë¤¹¤ë
-define('ATTACH_DELETE_ADMIN_ONLY',FALSE); // FALSE or TRUE
+define('PLUGIN_ATTACH_DELETE_ADMIN_ONLY', FALSE); // FALSE or TRUE
+
+// ´ÉÍý¼Ô¤¬ÅºÉÕ¥Õ¥¡¥¤¥ë¤òºï½ü¤¹¤ë¤È¤­¤Ï¡¢¥Ð¥Ã¥¯¥¢¥Ã¥×¤òºî¤é¤Ê¤¤
+// PLUGIN_ATTACH_DELETE_ADMIN_ONLY=TRUE¤Î¤È¤­Í­¸ú
+define('PLUGIN_ATTACH_DELETE_ADMIN_NOBACKUP', FALSE); // FALSE or TRUE
 
 // ¥¢¥Ã¥×¥í¡¼¥É/ºï½ü»þ¤Ë¥Ñ¥¹¥ï¡¼¥É¤òÍ׵᤹¤ë(ADMIN_ONLY¤¬Í¥Àè)
-define('ATTACH_PASSWORD_REQUIRE',FALSE); // FALSE or TRUE
+define('PLUGIN_ATTACH_PASSWORD_REQUIRE', FALSE); // FALSE or TRUE
 
-// file icon image
-if (!defined('FILE_ICON'))
-{
-       define('FILE_ICON','<img src="./image/file.png" width="20" height="20" alt="file" style="border-width:0px" />');
-}
+// ¥Õ¥¡¥¤¥ë¤Î¥¢¥¯¥»¥¹¸¢
+define('PLUGIN_ATTACH_FILE_MODE', 0644);
+//define('PLUGIN_ATTACH_FILE_MODE', 0604); // for XREA.COM
+
+// File icon image
+define('PLUGIN_ATTACH_FILE_ICON', '<img src="' . IMAGE_DIR .  'file.png"' .
+       ' width="20" height="20" alt="file"' .
+       ' style="border-width:0px" />');
 
 // mime-type¤òµ­½Ò¤·¤¿¥Ú¡¼¥¸
-define('ATTACH_CONFIG_PAGE_MIME','plugin/attach/mime-type');
+define('PLUGIN_ATTACH_CONFIG_PAGE_MIME', 'plugin/attach/mime-type');
 
 //-------- convert
 function plugin_attach_convert()
 {
        global $vars;
-       
-       if (!ini_get('file_uploads'))
-       {
-               return 'file_uploads disabled';
-       }
-       
+
+       $page = isset($vars['page']) ? $vars['page'] : '';
+
        $nolist = $noform = FALSE;
-       
-       if (func_num_args() > 0)
-       {
-               foreach (func_get_args() as $arg)
-               {
+       if (func_num_args() > 0) {
+               foreach (func_get_args() as $arg) {
                        $arg = strtolower($arg);
                        $nolist |= ($arg == 'nolist');
                        $noform |= ($arg == 'noform');
                }
        }
+
        $ret = '';
-       if (!$nolist)
-       {
-               $obj = &new AttachPages($vars['page']);
-               $ret .= $obj->toString($vars['page'],TRUE);
+       if (! $nolist) {
+               $obj  = & new AttachPages($page);
+               $ret .= $obj->toString($page, TRUE);
        }
-       if (!$noform)
-       {
-               $ret .= attach_form($vars['page']);
+       if (! $noform) {
+               $ret .= attach_form($page);
        }
-       
+
        return $ret;
 }
 
 //-------- action
 function plugin_attach_action()
 {
-       global $vars;
-       
-       if (array_key_exists('openfile',$vars))
-       {
-               $vars['pcmd'] = 'open';
+       global $vars, $_attach_messages;
+
+       // Backward compatible
+       if (isset($vars['openfile'])) {
                $vars['file'] = $vars['openfile'];
+               $vars['pcmd'] = 'open';
        }
-       if (array_key_exists('delfile',$vars))
-       {
-               $vars['pcmd'] = 'delete';
+       if (isset($vars['delfile'])) {
                $vars['file'] = $vars['delfile'];
+               $vars['pcmd'] = 'delete';
        }
-       if (array_key_exists('attach_file',$_FILES))
-       {
-               $pass = array_key_exists('pass',$vars) ? md5($vars['pass']) : NULL;
-               return attach_upload($_FILES['attach_file'],$vars['refer'],$pass);
-       }
-       
-       $age = array_key_exists('age',$vars) ? $vars['age'] : 0;
-       $pcmd = array_key_exists('pcmd',$vars) ? $vars['pcmd'] : '';
-       
-       switch ($pcmd)
-       {
-               case 'info':    return attach_info();
-               case 'delete':  return attach_delete();
-               case 'open':    return attach_open();
-               case 'list':    return attach_list();
-               case 'freeze':  return attach_freeze(TRUE);
-               case 'unfreeze':return attach_freeze(FALSE);
-               case 'upload':  return attach_showform();
-       }
-       if ($vars['page'] == '' or !is_page($vars['page']))
-       {
+
+       $pcmd  = isset($vars['pcmd'])  ? $vars['pcmd']  : '';
+       $refer = isset($vars['refer']) ? $vars['refer'] : '';
+       $pass  = isset($vars['pass'])  ? $vars['pass']  : NULL;
+       $page  = isset($vars['page'])  ? $vars['page']  : '';
+
+       if ($refer != '' && is_pagename($refer)) {
+               if(in_array($pcmd, array('info', 'open', 'list'))) {
+                       check_readable($refer);
+               } else {
+                       check_editable($refer);
+               }
+       }
+
+       // Dispatch
+       if (isset($_FILES['attach_file'])) {
+               // Upload
+               return attach_upload($_FILES['attach_file'], $refer, $pass);
+       }
+       switch ($pcmd) {
+       case 'delete':  /*FALLTHROUGH*/
+       case 'freeze':
+       case 'unfreeze':
+               if (PKWK_READONLY) die_message('PKWK_READONLY prohibits editing');
+       }
+       switch ($pcmd) {
+       case 'info'     : return attach_info();
+       case 'delete'   : return attach_delete();
+       case 'open'     : return attach_open();
+       case 'list'     : return attach_list();
+       case 'freeze'   : return attach_freeze(TRUE);
+       case 'unfreeze' : return attach_freeze(FALSE);
+       case 'upload'   : return attach_showform();
+       }
+       if ($page == '' || ! is_page($page)) {
                return attach_list();
+       } else {
+               return attach_showform();
        }
-       
-       return attach_showform();
 }
+
 //-------- call from skin
 function attach_filelist()
 {
-       global $vars,$_attach_messages;
-       
-       $obj = &new AttachPages($vars['page'],0);
+       global $vars, $_attach_messages;
 
-       if (!array_key_exists($vars['page'],$obj->pages))
-       {
+       $page = isset($vars['page']) ? $vars['page'] : '';
+
+       $obj = & new AttachPages($page, 0);
+
+       if (! isset($obj->pages[$page])) {
                return '';
+       } else {
+               return $_attach_messages['msg_file'] . ': ' .
+               $obj->toString($page, TRUE) . "\n";
        }
-       return $_attach_messages['msg_file'].': '.$obj->toString($vars['page'],TRUE)."\n";
 }
+
 //-------- ¼ÂÂÎ
-//¥Õ¥¡¥¤¥ë¥¢¥Ã¥×¥í¡¼¥É
-function attach_upload($file,$page,$pass=NULL)
+// ¥Õ¥¡¥¤¥ë¥¢¥Ã¥×¥í¡¼¥É
+// $pass = NULL : ¥Ñ¥¹¥ï¡¼¥É¤¬»ØÄꤵ¤ì¤Æ¤¤¤Ê¤¤
+// $pass = TRUE : ¥¢¥Ã¥×¥í¡¼¥Éµö²Ä
+function attach_upload($file, $page, $pass = NULL)
 {
-// $pass=NULL : ¥Ñ¥¹¥ï¡¼¥É¤¬»ØÄꤵ¤ì¤Æ¤¤¤Ê¤¤
-// $pass=TRUE : ¥¢¥Ã¥×¥í¡¼¥Éµö²Ä
-       global $adminpass,$_attach_messages;
-       
-       if ($file['tmp_name'] == '' or !is_uploaded_file($file['tmp_name']))
-       {
+       global $_attach_messages;
+
+       if (PKWK_READONLY) die_message('PKWK_READONLY prohibits editing');
+
+       // Check query-string
+       $query = 'plugin=attach&amp;pcmd=info&amp;refer=' . rawurlencode($page) .
+               '&amp;file=' . rawurlencode($file['name']);
+
+       if (PKWK_QUERY_STRING_MAX && strlen($query) > PKWK_QUERY_STRING_MAX) {
+               pkwk_common_headers();
+               echo('Query string (page name and/or file name) too long');
+               exit;
+       } else if (! is_page($page)) {
+               die_message('No such page');
+       } else if ($file['tmp_name'] == '' || ! is_uploaded_file($file['tmp_name'])) {
                return array('result'=>FALSE);
-       }               
-       if ($file['size'] > MAX_FILESIZE)
-       {
-               return array('result'=>FALSE,'msg'=>$_attach_messages['err_exceed']);
-       }
-       if (!is_pagename($page) or ($pass !== TRUE and !is_editable($page)))
-       {
-               return array('result'=>FALSE,'msg'=>$_attach_messages['err_noparm']);
-       }
-       if (ATTACH_UPLOAD_ADMIN_ONLY and $pass !== TRUE
-               and ($pass === NULL or $pass != $adminpass))
-       {
-               return array('result'=>FALSE,'msg'=>$_attach_messages['err_adminpass']);
+       } else if ($file['size'] > PLUGIN_ATTACH_MAX_FILESIZE) {
+               return array(
+                       'result'=>FALSE,
+                       'msg'=>$_attach_messages['err_exceed']);
+       } else if (! is_pagename($page) || ($pass !== TRUE && ! is_editable($page))) {
+               return array(
+                       'result'=>FALSE,'
+                       msg'=>$_attach_messages['err_noparm']);
+       } else if (PLUGIN_ATTACH_UPLOAD_ADMIN_ONLY && $pass !== TRUE &&
+                 ($pass === NULL || ! pkwk_login($pass))) {
+               return array(
+                       'result'=>FALSE,
+                       'msg'=>$_attach_messages['err_adminpass']);
        }
-       
-       $obj = &new AttachFile($page,$file['name']);    
-       
+
+       $obj = & new AttachFile($page, $file['name']);
        if ($obj->exist)
-       {
-               return array('result'=>FALSE,'msg'=>$_attach_messages['err_exists']);
-       }
-       move_uploaded_file($file['tmp_name'],$obj->filename);
-       
+               return array('result'=>FALSE,
+                       'msg'=>$_attach_messages['err_exists']);
+
+       if (move_uploaded_file($file['tmp_name'], $obj->filename))
+               chmod($obj->filename, PLUGIN_ATTACH_FILE_MODE);
+
        if (is_page($page))
-       {
                touch(get_filename($page));
-       }
-       
+
        $obj->getstatus();
-       $obj->status['pass'] = ($pass !== TRUE and $pass !== NULL) ? $pass : '';
+       $obj->status['pass'] = ($pass !== TRUE && $pass !== NULL) ? md5($pass) : '';
        $obj->putstatus();
 
-       return array('result'=>TRUE,'msg'=>$_attach_messages['msg_uploaded']);;
+       return array(
+               'result'=>TRUE,
+               'msg'=>$_attach_messages['msg_uploaded']);
 }
-//¾ÜºÙ¥Õ¥©¡¼¥à¤òɽ¼¨
-function attach_info($err='')
+
+// ¾ÜºÙ¥Õ¥©¡¼¥à¤òɽ¼¨
+function attach_info($err = '')
 {
-       global $vars,$_attach_messages;
-       
-       foreach (array('refer','file','age') as $var)
-       {
-               $$var = array_key_exists($var,$vars) ? $vars[$var] : '';
-       }
-       
-       $obj = &new AttachFile($refer,$file,$age);
-       return $obj->getstatus() ? $obj->info($err) : array('msg'=>$_attach_messages['err_notfound']);
+       global $vars, $_attach_messages;
+
+       foreach (array('refer', 'file', 'age') as $var)
+               ${$var} = isset($vars[$var]) ? $vars[$var] : '';
+
+       $obj = & new AttachFile($refer, $file, $age);
+       return $obj->getstatus() ?
+               $obj->info($err) :
+               array('msg'=>$_attach_messages['err_notfound']);
 }
-//ºï½ü
+
+// ºï½ü
 function attach_delete()
 {
-       global $vars,$_attach_messages;
-       
-       foreach (array('refer','file','age','pass') as $var)
-       {
-               $$var = array_key_exists($var,$vars) ? $vars[$var] : '';
-       }
-       
-       if (is_freeze($refer) or !is_editable($refer))
-       {
+       global $vars, $_attach_messages;
+
+       foreach (array('refer', 'file', 'age', 'pass') as $var)
+               ${$var} = isset($vars[$var]) ? $vars[$var] : '';
+
+       if (is_freeze($refer) || ! is_editable($refer)) {
                return array('msg'=>$_attach_messages['err_noparm']);
+       } else {
+               $obj = & new AttachFile($refer, $file, $age);
+               return $obj->getstatus() ?
+                       $obj->delete($pass) :
+                       array('msg'=>$_attach_messages['err_notfound']);
        }
-       
-       $obj = &new AttachFile($refer,$file,$age);
-       return $obj->getstatus() ? $obj->delete($pass) : array('msg'=>$_attach_messages['err_notfound']);
 }
-//Åà·ë
+
+// Åà·ë
 function attach_freeze($freeze)
 {
-       global $vars,$_attach_messages;
-       
-       foreach (array('refer','file','age','pass') as $var)
-       {
-               $$var = array_key_exists($var,$vars) ? $vars[$var] : '';
+       global $vars, $_attach_messages;
+
+       foreach (array('refer', 'file', 'age', 'pass') as $var) {
+               ${$var} = isset($vars[$var]) ? $vars[$var] : '';
        }
-       
-       if (is_freeze($refer) or !is_editable($refer))
-       {
+
+       if (is_freeze($refer) || ! is_editable($refer)) {
                return array('msg'=>$_attach_messages['err_noparm']);
+       } else {
+               $obj = & new AttachFile($refer, $file, $age);
+               return $obj->getstatus() ?
+                       $obj->freeze($freeze, $pass) :
+                       array('msg'=>$_attach_messages['err_notfound']);
        }
-       
-       $obj = &new AttachFile($refer,$file,$age);
-       return $obj->getstatus() ? $obj->freeze($freeze,$pass) : array('msg'=>$_attach_messages['err_notfound']);
 }
-//¥À¥¦¥ó¥í¡¼¥É
+
+// ¥À¥¦¥ó¥í¡¼¥É
 function attach_open()
 {
-       global $vars,$_attach_messages;
-       
-       foreach (array('refer','file','age') as $var)
-       {
-               $$var = array_key_exists($var,$vars) ? $vars[$var] : '';
+       global $vars, $_attach_messages;
+
+       foreach (array('refer', 'file', 'age') as $var) {
+               ${$var} = isset($vars[$var]) ? $vars[$var] : '';
        }
-       
-       $obj = &new AttachFile($refer,$file,$age);
-       return $obj->getstatus() ? $obj->open() : array('msg'=>$_attach_messages['err_notfound']);
+
+       $obj = & new AttachFile($refer, $file, $age);
+       return $obj->getstatus() ?
+               $obj->open() :
+               array('msg'=>$_attach_messages['err_notfound']);
 }
-//°ìÍ÷¼èÆÀ
+
+// °ìÍ÷¼èÆÀ
 function attach_list()
 {
-       global $vars;
-       global $_attach_messages;
-       
-       $refer = array_key_exists('refer',$vars) ? $vars['refer'] : '';
-       
-       $obj = &new AttachPages($refer);
-       
-       $msg = $_attach_messages[$refer == '' ? 'msg_listall' : 'msg_listpage'];
-       $body = ($refer == '' or array_key_exists($refer,$obj->pages)) ?
-               $obj->toString($refer,FALSE) :
+       global $vars, $_attach_messages;
+
+       $refer = isset($vars['refer']) ? $vars['refer'] : '';
+
+       $obj = & new AttachPages($refer);
+
+       $msg = $_attach_messages[($refer == '') ? 'msg_listall' : 'msg_listpage'];
+       $body = ($refer == '' || isset($obj->pages[$refer])) ?
+               $obj->toString($refer, FALSE) :
                $_attach_messages['err_noexist'];
-       return array('msg'=>$msg,'body'=>$body);
+
+       return array('msg'=>$msg, 'body'=>$body);
 }
-//¥¢¥Ã¥×¥í¡¼¥É¥Õ¥©¡¼¥à¤òɽ¼¨
+
+// ¥¢¥Ã¥×¥í¡¼¥É¥Õ¥©¡¼¥à¤òɽ¼¨ (action»þ)
 function attach_showform()
 {
-       global $vars;
-       global $_attach_messages;
-       
-       $vars['refer'] = $vars['page'];
-       $body = ini_get('file_uploads') ? attach_form($vars['page']) : 'file_uploads disabled.';
-       
-       return array('msg'=>$_attach_messages['msg_upload'],'body'=>$body);
+       global $vars, $_attach_messages;
+
+       $page = isset($vars['page']) ? $vars['page'] : '';
+       $vars['refer'] = $page;
+       $body = attach_form($page);
+
+       return array('msg'=>$_attach_messages['msg_upload'], 'body'=>$body);
 }
 
 //-------- ¥µ¡¼¥Ó¥¹
-//mime-type¤Î·èÄê
+// mime-type¤Î·èÄê
 function attach_mime_content_type($filename)
 {
-       $type = 'application/octet-stream'; //default
-       
-       if (!file_exists($filename))
-       {
-               return $type;
-       }
+       $type = 'application/octet-stream'; // default
+
+       if (! file_exists($filename)) return $type;
+
        $size = @getimagesize($filename);
-       if (is_array($size))
-       {
-               switch ($size[2])
-               {
-                       case 1:
-                               return 'image/gif';
-                       case 2:
-                               return 'image/jpeg';
-                       case 3:
-                               return 'image/png';
-                       case 4:
-                               return 'application/x-shockwave-flash';
+       if (is_array($size)) {
+               switch ($size[2]) {
+                       case 1: return 'image/gif';
+                       case 2: return 'image/jpeg';
+                       case 3: return 'image/png';
+                       case 4: return 'application/x-shockwave-flash';
                }
        }
-       
-       if (!preg_match('/_([0-9A-Z]+)$/',$filename,$matches))
-       {
+
+       $matches = array();
+       if (! preg_match('/_((?:[0-9A-F]{2})+)(?:\.\d+)?$/', $filename, $matches))
                return $type;
-       }
+
        $filename = decode($matches[1]);
-       
+
        // mime-type°ìÍ÷ɽ¤ò¼èÆÀ
-       $config = new Config(ATTACH_CONFIG_PAGE_MIME);
+       $config = new Config(PLUGIN_ATTACH_CONFIG_PAGE_MIME);
        $table = $config->read() ? $config->get('mime-type') : array();
        unset($config); // ¥á¥â¥êÀáÌó
-       
-       foreach ($table as $row)
-       {
+
+       foreach ($table as $row) {
                $_type = trim($row[0]);
-               $exts = preg_split('/\s+|,/',trim($row[1]),-1,PREG_SPLIT_NO_EMPTY);
-               
-               foreach ($exts as $ext)
-               {
-                       if (preg_match("/\.$ext$/i",$filename))
-                       {
-                               return $_type;
-                       }
+               $exts = preg_split('/\s+|,/', trim($row[1]), -1, PREG_SPLIT_NO_EMPTY);
+               foreach ($exts as $ext) {
+                       if (preg_match("/\.$ext$/i", $filename)) return $_type;
                }
        }
-       
+
        return $type;
 }
-//¥¢¥Ã¥×¥í¡¼¥É¥Õ¥©¡¼¥à
+
+// ¥¢¥Ã¥×¥í¡¼¥É¥Õ¥©¡¼¥à¤Î½ÐÎÏ
 function attach_form($page)
 {
-       global $script,$vars;
-       global $_attach_messages;
-       
+       global $script, $vars, $_attach_messages;
+
        $r_page = rawurlencode($page);
        $s_page = htmlspecialchars($page);
        $navi = <<<EOD
@@ -333,26 +346,23 @@ function attach_form($page)
   </span><br />
 EOD;
 
-       if (!(bool)ini_get('file_uploads'))
-       {
-               return $navi;
-       }
-       
-       $maxsize = MAX_FILESIZE;
-       $msg_maxsize = sprintf($_attach_messages['msg_maxsize'],number_format($maxsize/1000)."KB");
+       if (! ini_get('file_uploads')) return '#attach(): file_uploads disabled<br />' . $navi;
+       if (! is_page($page))          return '#attach(): No such page<br />'          . $navi;
+
+       $maxsize = PLUGIN_ATTACH_MAX_FILESIZE;
+       $msg_maxsize = sprintf($_attach_messages['msg_maxsize'], number_format($maxsize/1024) . 'KB');
 
        $pass = '';
-       if (ATTACH_PASSWORD_REQUIRE or ATTACH_UPLOAD_ADMIN_ONLY)
-       {
-               $title = $_attach_messages[ATTACH_UPLOAD_ADMIN_ONLY ? 'msg_adminpass' : 'msg_password'];
-               $pass = '<br />'.$title.': <input type="password" name="pass" size="8" />';
+       if (PLUGIN_ATTACH_PASSWORD_REQUIRE || PLUGIN_ATTACH_UPLOAD_ADMIN_ONLY) {
+               $title = $_attach_messages[PLUGIN_ATTACH_UPLOAD_ADMIN_ONLY ? 'msg_adminpass' : 'msg_password'];
+               $pass = '<br />' . $title . ': <input type="password" name="pass" size="8" />';
        }
        return <<<EOD
 <form enctype="multipart/form-data" action="$script" method="post">
  <div>
   <input type="hidden" name="plugin" value="attach" />
-  <input type="hidden" name="pcmd" value="post" />
-  <input type="hidden" name="refer" value="$s_page" />
+  <input type="hidden" name="pcmd"   value="post" />
+  <input type="hidden" name="refer"  value="$s_page" />
   <input type="hidden" name="max_file_size" value="$maxsize" />
   $navi
   <span class="small">
@@ -365,140 +375,134 @@ EOD;
 </form>
 EOD;
 }
+
 //-------- ¥¯¥é¥¹
-//¥Õ¥¡¥¤¥ë
+// ¥Õ¥¡¥¤¥ë
 class AttachFile
 {
-       var $page,$file,$age,$basename,$filename,$logname;
+       var $page, $file, $age, $basename, $filename, $logname;
        var $time = 0;
        var $size = 0;
        var $time_str = '';
        var $size_str = '';
-       var $status = array('count'=>array(0),'age'=>'','pass'=>'','freeze'=>FALSE);
-       
-       function AttachFile($page,$file,$age=0)
+       var $status = array('count'=>array(0), 'age'=>'', 'pass'=>'', 'freeze'=>FALSE);
+
+       function AttachFile($page, $file, $age = 0)
        {
                $this->page = $page;
-               $this->file = basename($file);
-               $this->age = is_numeric($age) ? $age : 0;
-               
-               $this->basename = UPLOAD_DIR.encode($page).'_'.encode($this->file);
-               $this->filename = $this->basename . ($age ? '.'.$age : '');
-               $this->logname = $this->basename.'.log';
-               $this->exist = file_exists($this->filename);
-               $this->time = $this->exist ? filemtime($this->filename) - LOCALZONE : 0;
-               $this->md5hash = $this->exist ? md5_file($this->filename) : '';
+               $this->file = preg_replace('#^.*/#','',$file);
+               $this->age  = is_numeric($age) ? $age : 0;
+
+               $this->basename = UPLOAD_DIR . encode($page) . '_' . encode($this->file);
+               $this->filename = $this->basename . ($age ? '.' . $age : '');
+               $this->logname  = $this->basename . '.log';
+               $this->exist    = file_exists($this->filename);
+               $this->time     = $this->exist ? filemtime($this->filename) - LOCALZONE : 0;
+               $this->md5hash  = $this->exist ? md5_file($this->filename) : '';
        }
+
        // ¥Õ¥¡¥¤¥ë¾ðÊó¼èÆÀ
        function getstatus()
        {
-               if (!$this->exist)
-               {
-                       return FALSE;
-               }
+               if (! $this->exist) return FALSE;
+
                // ¥í¥°¥Õ¥¡¥¤¥ë¼èÆÀ
-               if (file_exists($this->logname))
-               {
+               if (file_exists($this->logname)) {
                        $data = file($this->logname);
-                       foreach ($this->status as $key=>$value)
-                       {
+                       foreach ($this->status as $key=>$value) {
                                $this->status[$key] = chop(array_shift($data));
                        }
-                       $this->status['count'] = explode(',',$this->status['count']);
+                       $this->status['count'] = explode(',', $this->status['count']);
                }
-               $this->time_str = get_date('Y/m/d H:i:s',$this->time);
-               $this->size = filesize($this->filename);
-               $this->size_str = sprintf('%01.1f',round($this->size)/1000,1).'KB';
-               $this->type = attach_mime_content_type($this->filename);
-               
+               $this->time_str = get_date('Y/m/d H:i:s', $this->time);
+               $this->size     = filesize($this->filename);
+               $this->size_str = sprintf('%01.1f', round($this->size/1024, 1)) . 'KB';
+               $this->type     = attach_mime_content_type($this->filename);
+
                return TRUE;
        }
-       //¥¹¥Æ¡¼¥¿¥¹Êݸ
+
+       // ¥¹¥Æ¡¼¥¿¥¹Êݸ
        function putstatus()
        {
-               $this->status['count'] = join(',',$this->status['count']);
-               $fp = fopen($this->logname,'wb')
-                       or die_message('cannot write '.$this->logname);
-               flock($fp,LOCK_EX);
-               foreach ($this->status as $key=>$value)
-               {
-                       fwrite($fp,$value."\n");
+               $this->status['count'] = join(',', $this->status['count']);
+               $fp = fopen($this->logname, 'wb') or
+                       die_message('cannot write ' . $this->logname);
+               set_file_buffer($fp, 0);
+               flock($fp, LOCK_EX);
+               rewind($fp);
+               foreach ($this->status as $key=>$value) {
+                       fwrite($fp, $value . "\n");
                }
-               flock($fp,LOCK_UN);
+               flock($fp, LOCK_UN);
                fclose($fp);
        }
+
        // ÆüÉÕ¤ÎÈæ³Ó´Ø¿ô
-       function datecomp($a,$b)
-       {
+       function datecomp($a, $b) {
                return ($a->time == $b->time) ? 0 : (($a->time > $b->time) ? -1 : 1);
        }
-       function toString($showicon,$showinfo)
+
+       function toString($showicon, $showinfo)
        {
-               global $script,$date_format,$time_format,$weeklabels;
-               global $_attach_messages;
-               
+               global $script, $_attach_messages;
+
                $this->getstatus();
-               $param  = '&amp;file='.rawurlencode($this->file).'&amp;refer='.rawurlencode($this->page).
-                       ($this->age ? '&amp;age='.$this->age : '');
-               $title = $this->time_str.' '.$this->size_str;
-               $label = ($showicon ? FILE_ICON : '').htmlspecialchars($this->file);
-               if ($this->age)
-               {
-                       $label .= ' (backup No.'.$this->age.')';
+               $param  = '&amp;file=' . rawurlencode($this->file) . '&amp;refer=' . rawurlencode($this->page) .
+                       ($this->age ? '&amp;age=' . $this->age : '');
+               $title = $this->time_str . ' ' . $this->size_str;
+               $label = ($showicon ? PLUGIN_ATTACH_FILE_ICON : '') . htmlspecialchars($this->file);
+               if ($this->age) {
+                       $label .= ' (backup No.' . $this->age . ')';
                }
                $info = $count = '';
-               if ($showinfo)
-               {
-                       $_title = str_replace('$1',rawurlencode($this->file),$_attach_messages['msg_info']);
-                       $info = "\n<span class=\"small\">[<a href=\"$script?plugin=attach&amp;pcmd=info$param\" title=\"$_title\">{$_attach_messages['btn_info']}</a>]</span>";
-                       $count = ($showicon and !empty($this->status['count'][$this->age])) ?
-                               sprintf($_attach_messages['msg_count'],$this->status['count'][$this->age]) : '';
+               if ($showinfo) {
+                       $_title = str_replace('$1', rawurlencode($this->file), $_attach_messages['msg_info']);
+                       $info = "\n<span class=\"small\">[<a href=\"$script?plugin=attach&amp;pcmd=info$param\" title=\"$_title\">{$_attach_messages['btn_info']}</a>]</span>\n";
+                       $count = ($showicon && ! empty($this->status['count'][$this->age])) ?
+                               sprintf($_attach_messages['msg_count'], $this->status['count'][$this->age]) : '';
                }
                return "<a href=\"$script?plugin=attach&amp;pcmd=open$param\" title=\"$title\">$label</a>$count$info";
        }
+
        // ¾ðÊóɽ¼¨
        function info($err)
        {
-               global $script,$_attach_messages;
-               
+               global $script, $_attach_messages;
+
                $r_page = rawurlencode($this->page);
                $s_page = htmlspecialchars($this->page);
                $s_file = htmlspecialchars($this->file);
-               $s_err = ($err == '') ? '' : '<p style="font-weight:bold">'.$_attach_messages[$err].'</p>';
-               
-               if ($this->age)
-               {
+               $s_err = ($err == '') ? '' : '<p style="font-weight:bold">' . $_attach_messages[$err] . '</p>';
+
+               if ($this->age) {
                        $msg_freezed = '';
-                       $msg_delete  = '<input type="radio" name="pcmd" value="delete" />'.$_attach_messages['msg_delete'];
-                       $msg_delete .= $_attach_messages['msg_require'];
-                       $msg_delete .= '<br />';
+                       $msg_delete  = '<input type="radio" name="pcmd" value="delete" />' .
+                               $_attach_messages['msg_delete'] .
+                               $_attach_messages['msg_require'] . '<br />';
                        $msg_freeze  = '';
-               }
-               else
-               {
-                       if ($this->status['freeze'])
-                       {
+               } else {
+                       if ($this->status['freeze']) {
                                $msg_freezed = "<dd>{$_attach_messages['msg_isfreeze']}</dd>";
-                               $msg_delete = '';
-                               $msg_freeze  = '<input type="radio" name="pcmd" value="unfreeze" />'.$_attach_messages['msg_unfreeze'];
-                               $msg_freeze .= $_attach_messages['msg_require'].'<br />';
-                       }
-                       else
-                       {
+                               $msg_delete  = '';
+                               $msg_freeze  = '<input type="radio" name="pcmd" value="unfreeze" />' .
+                                       $_attach_messages['msg_unfreeze'] .
+                                       $_attach_messages['msg_require'] . '<br />';
+                       } else {
                                $msg_freezed = '';
-                               $msg_delete = '<input type="radio" name="pcmd" value="delete" />'.$_attach_messages['msg_delete'];
-                               if (ATTACH_DELETE_ADMIN_ONLY or $this->age)
-                               {
+                               $msg_delete = '<input type="radio" name="pcmd" value="delete" />' .
+                                       $_attach_messages['msg_delete'];
+                               if (PLUGIN_ATTACH_DELETE_ADMIN_ONLY || $this->age)
                                        $msg_delete .= $_attach_messages['msg_require'];
-                               }
                                $msg_delete .= '<br />';
-                               $msg_freeze  = '<input type="radio" name="pcmd" value="freeze" />'.$_attach_messages['msg_freeze'];
-                               $msg_freeze .= "{$_attach_messages['msg_require']}<br />";
+                               $msg_freeze  = '<input type="radio" name="pcmd" value="freeze" />' .
+                                       $_attach_messages['msg_freeze'] .
+                                       $_attach_messages['msg_require'] . '<br />';
                        }
                }
-               $info = $this->toString(TRUE,FALSE);
-               
-               $retval = array('msg'=>sprintf($_attach_messages['msg_info'],htmlspecialchars($this->file)));
+               $info = $this->toString(TRUE, FALSE);
+
+               $retval = array('msg'=>sprintf($_attach_messages['msg_info'], htmlspecialchars($this->file)));
                $retval['body'] = <<< EOD
 <p class="small">
  [<a href="$script?plugin=attach&amp;pcmd=list&amp;refer=$r_page">{$_attach_messages['msg_list']}</a>]
@@ -532,82 +536,89 @@ $s_err
 EOD;
                return $retval;
        }
+
        function delete($pass)
        {
-               global $adminpass,$_attach_messages;
-                               
-               if ($this->status['freeze'])
-               {
-                       return attach_info('msg_isfreeze');
-               }
-               
-               if (md5($pass) != $adminpass)
-               {
-                       if (ATTACH_DELETE_ADMIN_ONLY or $this->age)
-                       {
+               global $_attach_messages;
+
+               if ($this->status['freeze']) return attach_info('msg_isfreeze');
+
+               if (! pkwk_login($pass)) {
+                       if (PLUGIN_ATTACH_DELETE_ADMIN_ONLY || $this->age) {
                                return attach_info('err_adminpass');
-                       }
-                       else if (ATTACH_PASSWORD_REQUIRE and md5($pass) != $this->status['pass'])
-                       {
+                       } else if (PLUGIN_ATTACH_PASSWORD_REQUIRE &&
+                               md5($pass) != $this->status['pass']) {
                                return attach_info('err_password');
                        }
                }
-               //¥Ð¥Ã¥¯¥¢¥Ã¥×
-               if ($this->age)
-               {
+
+               // ¥Ð¥Ã¥¯¥¢¥Ã¥×
+               if ($this->age ||
+                       (PLUGIN_ATTACH_DELETE_ADMIN_ONLY && PLUGIN_ATTACH_DELETE_ADMIN_NOBACKUP)) {
                        @unlink($this->filename);
-               }
-               else
-               {
-                       do
-                       {
+               } else {
+                       do {
                                $age = ++$this->status['age'];
-                       }
-                       while (file_exists($this->basename.'.'.$age));
-                       
-                       if (!rename($this->basename,$this->basename.'.'.$age))
-                       {
+                       } while (file_exists($this->basename . '.' . $age));
+
+                       if (! rename($this->basename,$this->basename . '.' . $age)) {
                                // ºï½ü¼ºÇÔ why?
                                return array('msg'=>$_attach_messages['err_delete']);
                        }
-                       
+
                        $this->status['count'][$age] = $this->status['count'][0];
                        $this->status['count'][0] = 0;
                        $this->putstatus();
                }
+
                if (is_page($this->page))
-               {
                        touch(get_filename($this->page));
-               }
-               
+
                return array('msg'=>$_attach_messages['msg_deleted']);
        }
-       function freeze($freeze,$pass)
+
+       function freeze($freeze, $pass)
        {
-               global $adminpass;
-               
-               if (md5($pass) != $adminpass)
-               {
-                       return attach_info('err_adminpass');
-               }
-               
+               global $_attach_messages;
+
+               if (! pkwk_login($pass)) return attach_info('err_adminpass');
+
                $this->getstatus();
                $this->status['freeze'] = $freeze;
                $this->putstatus();
-               
+
                return array('msg'=>$_attach_messages[$freeze ? 'msg_freezed' : 'msg_unfreezed']);
        }
+
        function open()
        {
                $this->getstatus();
                $this->status['count'][$this->age]++;
                $this->putstatus();
-               
-               // for japanese (???)
-               $filename = htmlspecialchars(mb_convert_encoding($this->file,'SJIS','auto'));
-               header('Content-Disposition: inline; filename="'.$filename.'"');
-               header('Content-Length: '.$this->size);
-               header('Content-Type: '.$this->type);
+               $filename = $this->file;
+
+               // Care for Japanese-character-included file name
+               if (LANG == 'ja') {
+                       switch(UA_NAME . '/' . UA_PROFILE){
+                       case 'Opera/default':
+                               // Care for using _auto-encode-detecting_ function
+                               $filename = mb_convert_encoding($filename, 'UTF-8', 'auto');
+                               break;
+                       case 'MSIE/default':
+                               $filename = mb_convert_encoding($filename, 'SJIS', 'auto');
+                               break;
+                       }
+               }
+               $filename = htmlspecialchars($filename);
+
+               ini_set('default_charset', '');
+               mb_http_output('pass');
+
+               pkwk_common_headers();
+               header('Content-Disposition: inline; filename="' . $filename . '"');
+               header('Content-Length: ' . $this->size);
+               header('Content-Type: '   . $this->type);
+
                @readfile($this->filename);
                exit;
        }
@@ -618,121 +629,125 @@ class AttachFiles
 {
        var $page;
        var $files = array();
-       
+
        function AttachFiles($page)
        {
                $this->page = $page;
        }
-       function add($file,$age)
+
+       function add($file, $age)
        {
-               $this->files[$file][$age] = &new AttachFile($this->page,$file,$age);
+               $this->files[$file][$age] = & new AttachFile($this->page, $file, $age);
        }
+
        // ¥Õ¥¡¥¤¥ë°ìÍ÷¤ò¼èÆÀ
        function toString($flat)
        {
-               if ($flat)
-               {
+               global $_title_cannotread;
+
+               if (! check_readable($this->page, FALSE, FALSE)) {
+                       return str_replace('$1', make_pagelink($this->page), $_title_cannotread);
+               } else if ($flat) {
                        return $this->to_flat();
-               }       
+               }
+
                $ret = '';
                $files = array_keys($this->files);
                sort($files);
-               foreach ($files as $file)
-               {
+
+               foreach ($files as $file) {
                        $_files = array();
-                       foreach (array_keys($this->files[$file]) as $age)
-                       {
-                               $_files[$age] = $this->files[$file][$age]->toString(FALSE,TRUE);
+                       foreach (array_keys($this->files[$file]) as $age) {
+                               $_files[$age] = $this->files[$file][$age]->toString(FALSE, TRUE);
                        }
-                       if (!array_key_exists(0,$_files))
-                       {
+                       if (! isset($_files[0])) {
                                $_files[0] = htmlspecialchars($file);
                        }
                        ksort($_files);
                        $_file = $_files[0];
                        unset($_files[0]);
                        $ret .= " <li>$_file\n";
-                       if (count($_files))
-                       {
-                               $ret .= "<ul>\n<li>".join("</li>\n<li>",$_files)."</li>\n</ul>\n";
+                       if (count($_files)) {
+                               $ret .= "<ul>\n<li>" . join("</li>\n<li>", $_files) . "</li>\n</ul>\n";
                        }
                        $ret .= " </li>\n";
                }
-               return make_pagelink($this->page)."\n<ul>\n$ret</ul>\n";
+               return make_pagelink($this->page) . "\n<ul>\n$ret</ul>\n";
        }
+
        // ¥Õ¥¡¥¤¥ë°ìÍ÷¤ò¼èÆÀ(inline)
        function to_flat()
        {
                $ret = '';
                $files = array();
-               foreach (array_keys($this->files) as $file)
-               {
-                       if (array_key_exists(0,$this->files[$file]))
-                       {
-                               $files[$file] = &$this->files[$file][0];
+               foreach (array_keys($this->files) as $file) {
+                       if (isset($this->files[$file][0])) {
+                               $files[$file] = & $this->files[$file][0];
                        }
                }
-               uasort($files,array('AttachFile','datecomp'));
-               foreach (array_keys($files) as $file)
-               {
-                       $ret .= $files[$file]->toString(TRUE,TRUE).' ';
+               uasort($files, array('AttachFile', 'datecomp'));
+               foreach (array_keys($files) as $file) {
+                       $ret .= $files[$file]->toString(TRUE, TRUE) . ' ';
                }
-               
+
                return $ret;
        }
 }
+
 // ¥Ú¡¼¥¸¥³¥ó¥Æ¥Ê
 class AttachPages
 {
        var $pages = array();
-       
-       function AttachPages($page='',$age=NULL)
+
+       function AttachPages($page = '', $age = NULL)
        {
 
-               $dir = opendir(UPLOAD_DIR)
-                       or die('directory '.UPLOAD_DIR.' is not exist or not readable.');
-               
-               $page_pattern = ($page == '') ? '(?:[0-9A-F]{2})+' : preg_quote(encode($page),'/');
+               $dir = opendir(UPLOAD_DIR) or
+                       die('directory ' . UPLOAD_DIR . ' is not exist or not readable.');
+
+               $page_pattern = ($page == '') ? '(?:[0-9A-F]{2})+' : preg_quote(encode($page), '/');
                $age_pattern = ($age === NULL) ?
                        '(?:\.([0-9]+))?' : ($age ?  "\.($age)" : '');
                $pattern = "/^({$page_pattern})_((?:[0-9A-F]{2})+){$age_pattern}$/";
-               
-               while ($file = readdir($dir))
-               {
-                       if (!preg_match($pattern,$file,$matches))
-                       {
+
+               $matches = array();
+               while ($file = readdir($dir)) {
+                       if (! preg_match($pattern, $file, $matches))
                                continue;
-                       }
+
                        $_page = decode($matches[1]);
                        $_file = decode($matches[2]);
-                       $_age = array_key_exists(3,$matches) ? $matches[3] : 0;
-                       if (!array_key_exists($_page,$this->pages))
-                       {
-                               $this->pages[$_page] = &new AttachFiles($_page);
+                       $_age  = isset($matches[3]) ? $matches[3] : 0;
+                       if (! isset($this->pages[$_page])) {
+                               $this->pages[$_page] = & new AttachFiles($_page);
                        }
-                       $this->pages[$_page]->add($_file,$_age);
+                       $this->pages[$_page]->add($_file, $_age);
                }
                closedir($dir);
        }
-       function toString($page='',$flat=FALSE)
+
+       function toString($page = '', $flat = FALSE)
        {
-               if ($page != '')
-               {
-                       if (!array_key_exists($page,$this->pages))
-                       {
+               global $non_list;
+
+               if ($page != '') {
+                       if (! isset($this->pages[$page])) {
                                return '';
+                       } else {
+                               return $this->pages[$page]->toString($flat);
                        }
-                       return $this->pages[$page]->toString($flat);
                }
                $ret = '';
+
                $pages = array_keys($this->pages);
                sort($pages);
-               foreach ($pages as $page)
-               {
-                       $ret .= '<li>'.$this->pages[$page]->toString($flat)."</li>\n";
+
+               $non_list_pattern = '/' . $non_list . '/';
+               foreach ($pages as $page) {
+                       if (preg_match($non_list_pattern, $page)) continue;
+                       $ret .= '<li>' . $this->pages[$page]->toString($flat) . "</li>\n";
                }
-               return "\n<ul>\n".$ret."</ul>\n";
-               
+               return "\n" . '<ul>' . "\n" . $ret . '</ul>' . "\n";
        }
-}              
+}
 ?>