<?php
/************************************************************************/
/* Maximus CMS: Web Portal System                                       */
/* ==============================                                       */
/*                                                                      */
/* Copyright (c) 2002 - 2007                                            */
/* http://www.php-maximus.org                                           */
/* dev@php-maximus.org                                                  */
/*                                                                      */
/* This program is free software. You can redistribute it and/or modify */
/* it under the terms of the GNU General Public License as published by */
/* the Free Software Foundation; either version 2 of the License.       */
/************************************************************************/
/* Based on PHP-NUKE: Web Portal System                                 */
/************************************************************************/
/* Portage Coppermine Photo Gallery                                     */
/************************************************************************/
defined('MAXIMUS') or require_once("mainfile.php");

if ( !defined('USER_ALLOW') ) {
	redirect_url('modules.php?name=Coppermine');
}

define('IN_COPPERMINE', true);
define('ADDPIC_PHP', true);
switch($func) {
default:

require('modules/Coppermine/include/init.inc.php');
require('modules/Coppermine/include/picmgmtbatch.inc.php');

//if (!GALLERY_ADMIN_MODE) die('Access denied');

$aid       = secure( $_GET['aid'], 'num', 1, 'sec' );
$pic_file  = base64_decode($_GET['pic_file']);
$dir_name  = dirname($pic_file)."/";
$file_name = basename($pic_file);
$dir_name  = secure( $dir_name, '', 1, 'sec' );
$file_name = secure( $file_name, '', 1, 'sec' );

$sql = "SELECT `pid` ".
	   "FROM `".TABLE_CPG_PICTURES."` ".
	   "WHERE `filepath`='$dir_name' AND `filename`='$file_name' ".
	   "LIMIT 1";
$result = $GLOBALS['db']->sql_query($sql);

if ($GLOBALS['db']->sql_numrows($result)) {
	$file_name = "modules/Coppermine/images/up_dup.gif";
} elseif (add_picture($aid, $dir_name, $file_name)){
	$file_name = "modules/Coppermine/images/up_ok.gif";
} else {
	$file_name = "modules/Coppermine/images/up_pb.gif";
	echo $ERROR;
}

if(ob_get_length()){
	ob_end_flush();
	exit;
}

header('Content-type: image/gif');
echo fread(fopen($file_name, 'rb'), filesize($file_name));
ob_end_flush();

break;
}