<!-- #Include File="../../../Include/Config.asp" -->
<!--#include file="../../../Include/Cls_Upfile.asp"-->
<%
'=======================================================
' 欢迎使用《阿赛大型门户网站系统V3.0》，简称“AsaiMHV3”
' 技术支持、商业版咨询、官方唯一指定联系QQ“4941172”
' 官方网站：http://77ya.com      程序负责人：阿赛
'=======================================================
Server.ScriptTimeOut = 999999
' 参数变量
Dim sType, sTrSetting, ComeURL, today_num, strJs, sAction, sStyleName, sLanguage
Dim sChannelID, IsTrueUpfiles, DrawInfo, sTObj, UpID, F_ID, DefendThief, is_upload
Dim sAllowExt, nAllowSize, sIsReName, sUploadDir, nUploadObject, nAutoDir, sBaseUrl, sContentPath
Dim sFileExt, oFileSize, sOriginalFileName, sSaveFileName, sPathFileName, nFileNum
Dim Upload,FormName,FilePath,ChildFilePath, strSaveUrl
Dim File,F_FileName,F_ViewName,F_Filesize,F_FileExt,F_Type

Call InitUpload()	' 初始化上传变量
sAction = UCase(Cls.Code_Query("action"))

Select Case sAction
Case "REMOTE","remote"
	Call DoRemote()			' 远程自动获取
Case "SAVE"
	Call ShowForm()			' 显示上传表单
	Call DoSave()			' 存文件
Case Else
	Call ShowForm()			' 显示上传表单
End Select

Sub ShowForm()
%>
<HTML>
<HEAD>
<TITLE>AsaiMHEditor</TITLE>
<meta http-equiv="Content-Type" content="text/html; charset=gb2312">
<script language="javascript" src="../dialog/dialog.js"></script>
<link href='../language/<%=sLanguage%>.css' type='text/css' rel='stylesheet'>
<link href='../dialog/dialog.css' type='text/css' rel='stylesheet'>
</head>
<body class=upload>
<form action="?action=save&cid=<%=sChannelID%>&type=<%=sType%>&style=<%=sStyleName%>&language=<%=sLanguage%>&TObj=<%=sTObj%>" method=post name=myform enctype="multipart/form-data">
<input type=file name=uploadfile size=1 style="width:100%" onChange="originalfile.value=this.value">
<input type=hidden name=originalfile value="">
</form>
<script language=javascript>
var sAllowExt = "<%=sAllowExt%>";
// 检测上传表单
function CheckUploadForm() {
	if (!IsExt(document.myform.uploadfile.value,sAllowExt)){
		parent.UploadError('lang["ErrUploadInvalidExt"]+":'+sAllowExt+'"');
		return false;
	}
	return true
}
// 提交事件加入检测表单
var oForm = document.myform ;
oForm.attachEvent("onsubmit", CheckUploadForm) ;
if (! oForm.submitUpload) oForm.submitUpload = new Array() ;
oForm.submitUpload[oForm.submitUpload.length] = CheckUploadForm ;
if (! oForm.originalSubmit) {
	oForm.originalSubmit = oForm.submit ;
	oForm.submit = function() {
		if (this.submitUpload) {
			for (var i = 0 ; i < this.submitUpload.length ; i++) {
				this.submitUpload[i]() ;
			}
		}
		this.originalSubmit() ;
	}
}
// 上传表单已装入完成
try {
	parent.UploadLoaded();
}
catch(e){
}
</script>
</body>
</html>
<% 
End Sub 

' 初始化上传限制数据
Sub InitUpload()
	sChannelID	= Trim(Cls.Code_Query("cid"))
	sType		= UCase(Trim(Cls.Code_Query("type")))
	sStyleName	= Cls.Code_Query("style")
	sLanguage	= Cls.Code_Query("language")
	sTObj		= Trim(Cls.Code_Query("TObj"))
	if Not IsNumeric(sChannelID) And Not IsNumeric(sType) And Not IsNumeric(sStyleName) And Not IsNumeric(sLanguage) And Not IsNumeric(sTObj) then
		Call Cls.Out_Msg("错误，请勿非法操作！","javascript:history.go(-1)")
		Exit Sub
	end if
	'if sType="" Or sStyleName="" Or sLanguage="" Or sTObj="" then
	if sType="" Or sStyleName="" Or sLanguage="" then
		Call Cls.Out_Msg("错误，缺少相关参数！","javascript:history.go(-1)")
		Exit Sub
	end if
	if Not IsNumeric(sChannelID) Or sChannelID="" then
		Call Cls.Out_Msg("错误，请通过页面上的链接进行操作！","javascript:history.go(-1)")
		Exit Sub
	end if
	Call Cls.Channel_Initialize(sChannelID)
	sUploadDir	= Cls.ChannelUploadDir        '频道上传目录
	nAutoDir	= Cls.Get_ChannelSetup(Cls.ChannelSetup,16)			'自动分类 0不使用，1按年，2年-月，3年-月-日
	sUploadDir	= Replace(Cls.Web_Dir &Cls.Web_Upload & "/" & sUploadDir & "/","//","/")
	if nAutoDir=1 then sUploadDir	= CreatePath(sUploadDir)
	sContentPath	= sUploadDir
	Select Case sType
	Case "FILE"
		sAllowExt	= Cls.ChannelUpFileType(3)
	Case "MEDIA"
		sAllowExt	= Cls.ChannelUpFileType(2)
	Case "FLASH"
		sAllowExt	= Cls.ChannelUpFileType(1)
	Case Else
		sAllowExt	= Cls.ChannelUpFileType(0)
	End Select
	nAllowSize	= Cls.ChannelUpMax						'上传大小
	sIsReName	= Cls.Get_ChannelSetup(Cls.ChannelSetup,15)			'是否重命名	
	'过滤掉非法脚本文件
	sAllowExt	= FiltFileName(sAllowExt)
	sAllowExt	= FiltFileName2(sAllowExt)
End Sub

' 保存操作
Sub DoSave()
	ComeUrl=Request.ServerVariables("HTTP_REFERER")
	if ComeUrl="" then ComeUrl="javascript:history.go(-1)"
	strSetting = Cls.Web_UploadType
	if strSetting(0)=999 then
		Call OutScript("alert('系统未开放文件上传功能。');window.close();")
		Response.End
	end if
	if sChannelID<0 or sChannelID>999 then
		Call OutScript("alert('本频道上传功能已禁用！');window.close();")
		Response.End
	end if
	if not Cls.Post_Chk then
	        Call OutScript("alert('您从外部提交信息，操作已被禁止。');window.close();")
		Response.End
	end if
	'载入用户信息
	Call Cls.LoadUserInfo()
	'检测是否为后台管理员
	If Login_Mode ="" Then
		If Cls.Session_Get(Cls.Web_Cookies&"_Admin")="Admin" Then
			Login_Username = Cls.Session_Get(Cls.Web_Cookies&"_Admins")
			Login_Mode = "admin"  '管理员的权限
		End If
	End If
	If UserGroup_Config(8)=0 then
		Call OutScript("alert('此用户组上传功能已禁用！');window.close();")
		Response.End
	end if
	If Is_LoginTrue = False Then
		Call Cls.Out_Msg("你还没有登陆，请登陆后再上传。",ComeUrl)
	End If	
	if Up_Today_Num()=false then
		Call Cls.Out_Msg("Error：您还没有登陆 或者 您今天已上传"&Today_num&"个文件，每天只能上传"&UserGroup_Config(18)&"个文件。",ComeUrl)
		Response.End
	end if
	Set Upload = New UpFile_Cls
	InitUpLoad_Cls
	Upload.SaveUpFile
	If Upload.ErrCodes<>0 Then
		Call Cls.Out_Msg("错误："& Upload.Description ,"javascript:window.Close()")
		Response.End
	End If
	strJs=""
	On Error Resume Next
	If Upload.Count > 0 Then
		For Each FormName In Upload.UploadFiles
			Set File = Upload.UploadFiles(FormName)
			sSaveFileName = File.FileName
			F_FileName = sUploadDir & File.FileName
			sPathFileName = sContentPath & File.FileName
			Call Tmp_Upload(sPathFileName,strSetting(19))		'检查上传文件是否存在非法代码
			'创建预览及水印图片
			If Upload.PreviewType<>999 and File.FileType=1 then
				If strSetting(4)<>2 Then
					F_Viewname = sUploadDir & "Pre" & Replace(File.FileName,File.FileExt,"") & "jpg"
				End If
				Upload.CreateView F_FileName,F_Viewname,File.FileExt
			End If
			if Lcase(left(F_FileName,Len(Cls.Web_Dir & Cls.Web_Upload)))=Lcase(Cls.Web_Dir & Cls.Web_Upload) then
				strSaveUrl="{$download_dir}" & mid(F_FileName,Len(Cls.Web_Dir & Cls.Web_Upload)+1)
			elseif Lcase(left(F_FileName,Len(Cls.Web_Upload)))=Lcase(Cls.Web_Upload) then
				strSaveUrl="{$upload_dir}" & mid(F_FileName,Len(Cls.Web_Upload)+1)				
			elseif left(sPathFileName,1)="/" then
				strSaveUrl="{$web_dir}" & mid(sPathFileName,2)
			else
				strSaveUrl=Trim(sPathFileName)
			end if
			'保存数据
			Call Cls.exec("insert into AsaiMHUpload(UserName,UserIP,UpFileName,UpFileType,UpFileUrl,UpFileSize,UpFileTime) values('"&login_username&"','"&Cls.ip_sys(0)&"','"&File.FileName&"','"&File.FileExt&"','"&strSaveUrl&"','"&Cls.GetSize(File.FileSize,"b")&"','"&Cls.now_time&"')",0)
			Sql="Select id from AsaiMHUpload where UpFileUrl='"&strSaveUrl&"'"
			Set rs=Cls.exec(sql,1)
			UpID=rs(0)
			F_ID=Encrypt(UpID)		'防盗链ID生成
			If int(Format_Mid_Num(45))=0 Then
				strJs=strJs&"parent.UploadSaved('" & Replace(sPathFileName,Cls.Web_Dir&Cls.Web_Upload,Cls.Web_RealURL&Cls.Web_Dir&Cls.Web_Upload) & "');var obj=parent.dialogArguments.dialogArguments;if (!obj) obj=parent.dialogArguments;try{obj.addUploadFile('" & File.OldFileName & "','" & sSaveFileName & "','" & Replace(sPathFileName,Cls.Web_Dir&Cls.Web_Upload,Cls.Web_RealURL&Cls.Web_Dir&Cls.Web_Upload)&"');"'} catch(e){};"
				strJs=strJs & "obj.AddUploadFiles('"&sTObj&"','" & sPathFileName & "','" & sSaveFileName & "');} catch(e){};"
			Else
				strJs=strJs&"parent.UploadSaved('"&Cls.Web_Dir&"Common/ResourcesUp.Asp?id="&F_ID&"');var obj=parent.dialogArguments.dialogArguments;if (!obj) obj=parent.dialogArguments;try{obj.addUploadFile('" & File.OldFileName & "','"&F_ID&"','"&Cls.Web_Dir&"ResourcesUp.Asp?id="&F_ID&"');"'} catch(e){};"
				strJs=strJs & "obj.AddUploadFiles('"&sTObj&"','"&Cls.Web_Dir&"Common/ResourcesUp.Asp?id="&F_ID&"','"&F_ID&"');} catch(e){};"
			End If
			Set File = Nothing
		Next
		Call OutScript(strJs)
	Else
		Call OutScript("alert('请正确选择要上传的文件。');window.close();")
		Response.End
	End If
	Set Upload = Nothing
End Sub

' 自动获取远程文件[此代码无效]
Sub DoRemote()
	Dim sContent, i
	For i = 1 To Request.Form("AsaiMHEditor_UploadText").Count 
		sContent = sContent & Request.Form("AsaiMHEditor_UploadText")(i) 
	Next
	If sAllowExt <> "" Then
		sContent = ReplaceRemoteUrl(sContent, sAllowExt)
	End If
	Response.Write "<HTML><HEAD><TITLE>远程上传(AsaiMHEditor)</TITLE><meta http-equiv='Content-Type' content='text/html; charset=gb2312'></head><body>" & _
		"<input type=hidden id=UploadText value=""" & inHTML(sContent) & """>" & _
		"</body></html>"
	Call OutScriptNoBack("parent.setHTML(UploadText.value);try{parent.addUploadFile('" & sOriginalFileName & "', '" & sSaveFileName & "', '" & sPathFileName & "');} catch(e){} parent.remoteUploadOK();")
End Sub

Sub OutScriptNoBack(str)
	Response.Write "<script type=""text/javascript"">" & str & "</script>"
End Sub

Sub InitUpLoad_Cls()
	If strSetting(5)=1 Then
	       DrawInfo = strSetting(6)
	ElseIf strSetting(5)=2 Then
		DrawInfo = Replace(strSetting(11),"{$web_dir}",Cls.Web_Dir)
		'DrawInfo = strSetting(11)
	Else
		DrawInfo = ""
	End If
	If DrawInfo = "" or Cls.Get_ChannelSetup(Cls.ChannelSetup,11)=0 Then strSetting(5) = 0
	Upload.UploadType		= strSetting(0)			'设置上传组件类型
	Upload.UploadPath		= sUploadDir			'设置上传路径
	Upload.InceptFileType		= Replace(sAllowExt,"|",",")	'设置上传文件限制
	Upload.MaxSize			= Int(nAllowSize)		'单位 KB
	Upload.InceptMaxFile		= 10				'每次上传文件个数上限
	'Upload.ChkSessionName		= "UploadCode"&sChannelID&UpFileType	'防止重复提交。
	Upload.IsReName			= sIsReName			'是否重命名。
	Upload.PreviewType		= strSetting(1)			'设置预览图片组件类型
	Upload.PreviewImageWidth	= strSetting(2)			'设置预览图片宽度
	Upload.PreviewImageHeight	= strSetting(3)			'设置预览图片高度
	Upload.DrawImageWidth		= strSetting(14)		'设置水印图片或文字区域宽度
	Upload.DrawImageHeight		= strSetting(15)		'设置水印图片或文字区域高度
	Upload.DrawGraph		= strSetting(12)		'设置水印透明度
	Upload.DrawFontColor		= "#"&strSetting(8)		'设置水印文字颜色
	Upload.DrawFontFamily		= strSetting(9)			'设置水印文字字体格式
	Upload.DrawFontSize		= strSetting(7)			'设置水印文字字体大小
	Upload.DrawFontBold		= strSetting(10)		'设置水印文字是否粗体
	Upload.DrawInfo			= DrawInfo			'设置水印文字信息或图片信息
	Upload.DrawType			= strSetting(5)			'0=不加载水印 ，1=加载水印文字，2=加载水印图片
	Upload.DrawXYType		= strSetting(16)		'"0" =左上，"1"=左下,"2"=居中,"3"=右上,"4"=右下
	Upload.DrawSizeType		= strSetting(4)			'"0"=固定缩小，"1"=等比例缩小，"2"=关闭
	If strSetting(13)<>"" Then
		Upload.TransitionColor	= "#"&strSetting(13)		'透明度颜色设置
	End If
End Sub

' ============================================
' 去除Html格式，用于从数据库中取出值填入输入框时
' 注意：value="?"这边一定要用双引号
' ============================================
Function inHTML(str)
	Dim sTemp
	sTemp = str
	inHTML = ""
	If IsNull(sTemp) = True Then Exit Function
	sTemp = Replace(sTemp, "&", "&amp;")
	sTemp = Replace(sTemp, "<", "&lt;")
	sTemp = Replace(sTemp, ">", "&gt;")
	sTemp = Replace(sTemp, Chr(34), "&quot;")
	inHTML = sTemp
End Function

'检测用户每日上传文件数量。
Function Up_Today_Num()
  If Login_Mode = "admin" Then 
     Up_Today_Num = True
	 Exit Function
  Else
     If Login_Username = "" Then
        Up_Today_Num=false
	    Exit Function
     End If
  End If
  Dim ta
  ta="#"
  if SqlType=1 then ta="'"
  Up_Today_Num=true
  sql="select count(*) from AsaiMHUpload where UserName='"&login_username&"' and UpFileTime>="&ta&formatdatetime(formatdatetime(Cls.now_time,2))&ta
  set rs=Cls.exec(sql,1)
  Today_num=rs(0)
  rs.close
  if not(isnumeric(Today_num)) then Today_num=0
  if int(Today_num)>=int(UserGroup_Config(18)) then
   Up_Today_Num=false
  end if
end Function

'按月份自动明名上传文件夹,需要ＦＳＯ组件支持。
Private Function CreatePath(PathValue)
	Dim objFSO,uploadpath
	uploadpath=year(now)&"-"&month(now)	'以年月创建上传文件夹，格式：2003－8
	If Right(PathValue,1)<>"/" Then PathValue = PathValue&"/"
	On Error Resume Next
	Set objFSO = Server.CreateObject("Scripting.FileSystemObject")
		If objFSO.FolderExists(Server.MapPath(PathValue))=False Then
			objFSO.CreateFolder Server.MapPath(PathValue)
		End If
		If objFSO.FolderExists(Server.MapPath(PathValue & uploadpath))=False Then
			objFSO.CreateFolder Server.MapPath(PathValue & uploadpath)
		End If
		If Err.Number = 0 Then
			CreatePath = PathValue & uploadpath & "/"
		Else
			CreatePath = PathValue
		End If
	Set objFSO = Nothing
End Function
%>
