X-Git-Url: http://git.shiar.nl/minimedit.git/blobdiff_plain/ebf3182ac0275887fc0609be098329dc30865ee2..95fdba3568a0978b9401376cdca9cdd711abdb1a:/upload.inc.php

diff --git a/upload.inc.php b/upload.inc.php
index 4eff8a0..e70f573 100644
--- a/upload.inc.php
+++ b/upload.inc.php
@@ -27,6 +27,9 @@ function userupload($input, $target = NULL, $filename = NULL)
 		$target .= $input['name'];
 	}
 
+	if (file_exists($target)) {
+		throw new Exception("bestandsnaam al aanwezig op $target");
+	}
 	if (!@move_uploaded_file($input['tmp_name'], $target)) {
 		throw new Exception("bestand kon niet worden opgeslagen in $target");
 	}
@@ -41,10 +44,17 @@ function userupload($input, $target = NULL, $filename = NULL)
 function messagehtml($input)
 {
 	# convert user textarea post to formatted html
+	global $User;
 	if (empty($input)) {
 		return;
 	}
-	$html = htmlspecialchars($input);
-	$html = preg_replace('"(?:<br />){2}"', "</p>\n\n<p>", nl2br($html));
+	if ($User->admin and preg_match('/\A<[a-z][^>]*>/', $input)) {
+		return $input;  # allow html input as is if privileged
+	}
+	$html = preg_replace(
+		["/\r?\n/", "'(?:<br />\n?){2}'"],
+		["<br />\n", "</p>\n\n<p>"],
+		htmlspecialchars($input)
+	);
 	return "<p>$html</p>";
 }