X-Git-Url: http://git.shiar.nl/minimedit.git/blobdiff_plain/ebf3182ac0275887fc0609be098329dc30865ee2..04a1a7a24edbf8423a48f51609d545a5a7a3eb42:/upload.inc.php
diff --git a/upload.inc.php b/upload.inc.php
index 4eff8a0..d7d572d 100644
--- a/upload.inc.php
+++ b/upload.inc.php
@@ -27,6 +27,9 @@ function userupload($input, $target = NULL, $filename = NULL)
$target .= $input['name'];
}
+ if (file_exists($target)) {
+ throw new Exception("bestandsnaam al aanwezig op $target");
+ }
if (!@move_uploaded_file($input['tmp_name'], $target)) {
throw new Exception("bestand kon niet worden opgeslagen in $target");
}
@@ -41,10 +44,20 @@ function userupload($input, $target = NULL, $filename = NULL)
function messagehtml($input)
{
# convert user textarea post to formatted html
+ global $User;
if (empty($input)) {
return;
}
- $html = htmlspecialchars($input);
- $html = preg_replace('"(?:
){2}"', "
", nl2br($html));
+ if ($User->admin and preg_match('/\A<[a-z][^>]*>/', $input)) {
+ return $input; # allow html input as is if privileged
+ }
+ $markup = [
+ "/\r\n?/" => "\n", # unix newlines
+ "/ +\n/" => "
", # trailing spaces for hard line break
+ "/\n/" => "
", # newlines start paragraphs + '/\b_(\w+)_\b/' => '$1', # italic + '/\b\*(\w+)\*\b/' => '$1', # bold + ]; + $html = preg_replace(array_keys($markup), array_values($markup), htmlspecialchars($input)); return "
$html
"; }