roles as $rid => $name) { $extensions .= ' '. variable_get("upload_extensions_$rid", variable_get('upload_extensions_default', 'jpg jpeg gif png txt html doc xls pdf ppt pps odt ods odp')); } // Begin building file object. $file = new stdClass(); $file->filename = file_munge_filename(trim(basename($source), '.'), $extensions); $file->filepath = $source; $file->filemime = $mimetype; // Rename potentially executable files, to help prevent exploits. if (preg_match('/\.(php|pl|py|cgi|asp|js)$/i', $file->filename) && (substr($file->filename, -4) != '.txt')) { $file->filemime = 'text/plain'; $file->filepath .= '.txt'; $file->filename .= '.txt'; } // If the destination is not provided, or is not writable, then use the // temporary directory. if (empty($dest) || file_check_directory($dest, FILE_CREATE_DIRECTORY) === FALSE) { $dest = file_directory_temp(); } $file->source = $source; $file->destination = file_destination(file_create_path($dest .'/'. $file->filename), $replace); $file->filesize = filesize($source); // Call the validation functions. $errors = array(); foreach ($validators as $function => $args) { array_unshift($args, $file); $errors = array_merge($errors, call_user_func_array($function, $args)); } // Check for validation errors. if (!empty($errors)) { $message = t('The selected file %name could not be uploaded.', array('%name' => $file->filename)); if (count($errors) > 1) { $message .= ''; } else { $message .= ' '. array_pop($errors); } form_set_error($source, $message); return 0; } file_copy($file->filepath, $file->destination, $replace); // If we made it this far it's safe to record this file in the database. $file->uid = $user->uid; $file->status = FILE_STATUS_TEMPORARY; $file->timestamp = time(); drupal_write_record('files', $file); // Add file to the cache. $upload_cache[$source] = $file; return $file; } return 0; }