DataObjects/Core_enum.php

[Pman.Core] / Images.php

diff --git a/Images.php b/Images.php
index 41a5de7..19bc879 100644 (file)
--- a/Images.php
+++ b/Images.php
@@ -42,9 +42,11 @@ class Pman_Core_Images extends Pman
         parent::getAuth(); // load company!
         //return true;
         $au = $this->getAuthUser();
-        //if (!$au) {
-        //    die("Access denied");
-       // }
+        
+        if (!$au) {
+            die("Access denied");
+        }
+        
         $this->authUser = $au;
         
         return true;
@@ -55,6 +57,11 @@ class Pman_Core_Images extends Pman
     
     function get($s) // determin what to serve!!!!
     {
+        // for testing only.
+        //if (!empty($_GET['_post'])) {
+        //   return $this->post();
+        //}
+        
         $this->as_mimetype = empty($_REQUEST['as']) ? '' : $_REQUEST['as'];
         
         $bits= explode('/', $s);
@@ -147,10 +154,20 @@ class Pman_Core_Images extends Pman
                 urlencode("image has been removed or deleted."));
             
         }
+        
+        if(!$this->hasPermission($img)){
+            header('Location: ' . $this->rootURL . '/Pman/templates/images/file-broken.png?reason=' .
+                urlencode("access to this image/file has been denied."));
+        }
+        
         $this->serve($img);
         exit;
     }
     
+    function hasPermission($img) 
+    {
+        return true;
+    }
     
     function post()
     {
@@ -255,12 +272,11 @@ class Pman_Core_Images extends Pman
     }
     function validateSize()
     {
-        
-        if ($this->authUser && $this->authUser->company_id && $this->authUser->company()->comptype=='OWNER') {
+        if (($this->authUser && $this->authUser->company_id && $this->authUser->company()->comptype=='OWNER') || $_SERVER['SERVER_ADDR'] == $_SERVER['REMOTE_ADDR']) {
             return true;
         }
         
-        // DEFAULT allowed - override with $cfg['sizes'];
+        // DEFAULT allowed - override with Pman_Core_Images[sizes] => array();
         
         $sizes = array(
                 '100', 
@@ -277,6 +293,8 @@ class Pman_Core_Images extends Pman
         
         // this should be configurable...
         $ff = HTML_FlexyFramework::get();
+        
+        
         $cfg = isset($ff->Pman_Images) ? $ff->Pman_Images :
                 (isset($ff->Pman_Core_Images) ? $ff->Pman_Core_Images : array());
         
@@ -288,6 +306,7 @@ class Pman_Core_Images extends Pman
         
         
         if (!in_array($this->size, $sizes)) {
+            print_r($sizes);
             die("invalid scale - ".$this->size);
         }
     }