WikiUploads

I added an upload action to my UsemodWiki code. The code I added is in the form of two sub routines that return a upload form if nothing is posted (DoPublish) and uploads the file and returns a confirmation when a file is posted (SavePublish).

I really know nothing about perl code so I am sure this is insecure and or poorly written, but for what it is worth here is what I did. I did add some security with a check for useris...

---

sub DoPublish {

  print &GetHeader(, T('File Upload Page'), );

  if (&UserIsAdmin || &UserIsEditor){} 

  else 

  {

    print '<center>Only Administrators and Editors can upload files</center>';

    print &GetCommonFooter();

    return;

  }

  print '<FORM METHOD="post" ACTION="wiki.pl" ENCTYPE="multipart/form-data">';

  print '<input type="hidden" name="upload" value="1" />';

  print 'File to Upload: <INPUT TYPE="file" NAME="file"><br><BR>';

  print '<INPUT TYPE="submit" NAME="Submit" VALUE="Upload">';

  print '</FORM>';

  print &GetCommonFooter(); 

}

---

sub SavePublish {

 my ($upload_dir,$filename,$upload_filehandle);

   print &GetHeader("", "Uploading file", "");

if (&UserIsAdmin || &UserIsEditor){}

  else 

  {

    print '<center>Only Administrators and Editors can upload files</center>';

    print &GetCommonFooter();

    return;

  }

   $upload_dir = "/home/username/public_html/uploads"; #absolute path to upload dir

   $filename = $q->param("file");

   $filename =~ s/.*[\/\\](.*)/$1/;

   $upload_filehandle = $q->upload("file");

   open UPLOADFILE, ">$upload_dir/$filename";

   while ( <$upload_filehandle> ){print UPLOADFILE;}

   close UPLOADFILE;

   print "The link to your image is...\n<br><BR>";

   print "http://www.yourserver.org/uploads/$filename<BR><BR>\n";

   print "<HR><img src=http://www.yourserver.org/uploads/$filename></html>\n";

   print &GetCommonFooter();

}