<?php
	if ( !defined('IN_MFA') )
		die("Hacking attempt");
	
	$user->DieNotValid();
	if(! $user->has_right("upload"))
 		message_die("Right problem",$lang['norights'],"Warning");
 	
	$validated = validateObject($user->user_root_dir.$_GET['dir']);
	if(gettype($validated) != "boolean") message_die("Invalid Object",$validated);;
 
 	if(!IsSet($_GET['step']))
		$_GET['step'] = 1;
	if($_GET['step'] == 1)
	{
		$show_after_header = "<a href='index.php?dir=".$_GET['dir']."'>".$lang['back']."</a><p class='error' width='100%' align='center'>".$lang['new_request']."</p>
															<div width='100%' align='center'>
															<table border='0'>
															<form enctype='multipart/form-data' action='index.php?dir=".$verzname."&amp;mode=upload&amp;step=2' method='POST'>
																<tr>
																	<td style='text-align:left'><b>".$lang['file_name']."</b></td>
																	<td><input type='file' name='fupload'> <input type='hidden' name='MAX_FILE_SIZE' value='1000000'></td>
																</tr>
																<tr><td colspan='2' style='text-align:left'><input type='submit' name='subupload' value='Go'></td></tr>
															</form>
															</table>
															</div><p class='hr'></p>";
	}	
	if($_GET['step'] == 2)
	{
		if(IsSet($_FILES['fupload']))
		{	
			$working_user = is_locked($user->user_root_dir.$_GET['dir'].$_FILES['fupload']['name']);
			if((gettype($working_user) == "boolean")? true: (($working_user == $user->user_name)? true: false))
			{
					//IST DAS ETWA EIN SCRIPT
					for($I = 0; $I >= -1 * strlen($_FILES['fupload']['name']); $I--)
					{
						if(substr($_FILES['fupload']['name'], $I, 1) == ".") break;
					}
					$extension = strtoupper(substr($_FILES['fupload']['name'],$I + 1));
					if(($extension == "PHP" || $extension == "PHP3" || $extension == "PHP4" || $extension == "PHP5" || $extension == "ASP" || $extension == "JSP") && !$user->has_right("scripting"))
						message_die("No Access",$lang['norights']);
					
					if(FTP_USED == 1)
						ftp_put($ftp_conn_id , FTP_ROOT."/".$user->user_root_dir.$_GET['dir']."".$_FILES['fupload']['name'], $_FILES['fupload']['tmp_name'], FTP_BINARY);
					else
						copy($_FILES['fupload']['tmp_name'], ROOT_DIR."/".$user->user_root_dir.$_GET['dir']."".$_FILES['fupload']['name']);
					
					$finfo = new file_info($user->user_root_dir.$_GET['dir']."".$_FILES['fupload']['name']);
					
					if(LOG_USED == 1)
					{
						$finfo->add_action("File replaced by uploading '".$_FILES['fupload']['tmp_name']."'");
						write_in_log("File '".$_FILES['fupload']['tmp_name']."' uploaded in ".ROOT_DIR."/".$_GET['dir']."");					
					}
					$show_explorer = 1;
			}
			else
				$show_after_header = "<p class = 'error'>Nur der Benutzer, der die Datei gerade bearbeitet, darf an ihr Änderungen vornehmen!</p>
																&nbsp;<a href='index.php?dir=".$_GET['dir']."'>Zur&uuml;ck</a>";										 
		}
	}
?>
