[pmwiki-devel] Upload variables available in PmWiki

[Petko Yotov]

On 2015-08-21 12:19, Simon wrote:
> On page http://www.pmwiki.org/wiki/PmWiki/UploadVariables
> 
> the following variables are defined
> 
> $UploadUrlFmt
> $UploadDir
> $UploadPrefixFmt
> 
> But they are not exposed to PmWiki markup, i.e. don't work on the 
> website.

Correct.

> Are there any variables that are?

Yes, all those defined in the $FmtPV array.

We don't want all global PHP variables to be readable by simply typing 
them on a wiki page, this might open a number of vulnerabilities. In a 
wiki page, one can only check if a global PHP variable is enabled or 
not, with the conditional (:if enabled $UploadDir:).

Now, these upload variables are not confidential (except maybe 
$UploadDir in some cases of protected downloads) so if you require them 
to be accessible as PageVariables, just define them in the $FmtPV array:

   $FmtPV['$UploadDir'] = '$GLOBALS["UploadDir"]';

or for $UploadPrefixFmt which contains PageVariables:

   $FmtPV['$UploadPrefixFmt'] =
     'FmtPageName($GLOBALS["UploadPrefixFmt"], "$group.$name")';

> On a second note (for NZTopo), can someone suggest some exemplar code
> that would left me validate, in a recipe, that a supplied filename (as
> a parameter) exists in a upload directory.
> 
> It would have to cope with per page/per group attachments, and the
> standard pmwiki variants
> 
> filename.ext
> group.page/filename.ext
> etc.
> 
> Ideally if the file does not exist it would exhibit an upload link.
> Or is there an internal PmWiki function for the use of recipe writers?

The core function LinkUpload($pagename, $imap, $path, $alt, $txt, $fmt) 
does exactly this. You can call it like this:

   $imap = "Attach:";
   $path = $alt = "filename.ext"; # or "group.page/filename.ext"

   $txt = $path; # you may want to change this, or not

   $fmt = null; # use the default html snippet for attachment links

   $MyAttachLink = LinkUpload($pagename, $imap, $path, $alt, $txt, $fmt);

Now, this doesn't tell your recipe if the file exists or not, but 
returns the correct link. To know if the file exists, the easiest thing 
is to check this link for ?action=upload:

   $FileIsAlreadyAttached = strpos($MyAttachLink, "action=upload") ? 
false: true;

A less easy way but which would help you better understand the uploads 
feature in PmWiki would be to copy the function LinkUpload() in your 
recipe, rename it, study it and adapt it for your needs.

Petko

-- 
Change log     :  http://www.pmwiki.org/wiki/PmWiki/ChangeLog
Release notes  :  http://www.pmwiki.org/wiki/PmWiki/ReleaseNotes
If you upgrade :  http://www.pmwiki.org/wiki/PmWiki/Upgrades

If this message helped you and saved you time, feel free to make
a small contribution: ♥ http://5ko.fr/donate-ml (mailing list).