File: /var/www/html/tmpr/../tmpr/../tmpr/../tmpr/../tmpr/../v/ajaxuploadassets.php
<?php
include("../includes/limittext.php");
include('../Connections/videoondemand.php');
require("../DbSql.inc.php");
require("../NewsSql.inc.php");
require("../const.inc.php");
$db = new NewsSQL($DBName);
function filter($arr) {
global $link;
return array_map(array($link, 'real_escape_string'), $arr);
}
$_GET = filter($_GET);
$_POST = filter($_POST);
$valid_extensions = array('json'); // valid extensions
$path = 'uploads/gthumbs/'; // upload directory
$path2 = 'uploads/gallery/'; // upload directory
if(isset($_POST) && $_SERVER['REQUEST_METHOD'] == "POST")
{
$catalogid = $_GET['filex'];
$title = $_GET['title'];
$theme = $_GET['theme'];
$file_name = strip_tags($_FILES['upload_file']['name']);
$file_id = strip_tags($_POST['upload_file_ids']);
$file_size = $_FILES['upload_file']['size'];
$files_path = $path;
$file_location = $files_path . $file_name;
$files_path2 = $path2;
$file_location2 = $files_path2 . $file_name;
$type = 4;
$word = "template";
// Test if string contains the word
$base = basename($file_name);
$extfile = explode('.',$base);
$extfile = $extfile[1];
if($extfile != "jpg"){
$campaign = $db->addPhotoshopLayers($catalogid,$file_name,$type,$title,$theme);
if(move_uploaded_file(strip_tags($_FILES['upload_file']['tmp_name']), $file_location)){
echo $file_id;
}else{
echo 'system_error';
}
} else{
$campaign = $db->addPosterX($theme,$file_name);
if(move_uploaded_file(strip_tags($_FILES['upload_file']['tmp_name']), $file_location2)){
copy($file_location2,$file_location);
echo $file_id;
}else{
echo 'system_error';
}
}
}