<?php 
declare(strict_types=1);
session_start();

if (empty($_SESSION['miter'])) {
header('Location: ../../index.php');
exit;
}

$icon_dir = '../../images/icons/';
$icon_types = ['jpg', 'png', 'jpeg', 'gif'];
$allowed_mimes = ['image/jpeg', 'image/png', 'image/gif'];

// limit 2.0 mb
$icon_size = 2 * 1024 * 1024;

include 'otc.php';
$log_file = 'log.txt';

if (!empty($_FILES['iconfiles']['name']) && is_array($_FILES['iconfiles']['name'])) {
foreach ($_FILES['iconfiles']['tmp_name'] as $icon_key => $icon_egg) {
if ($_FILES['iconfiles']['error'][$icon_key] !== UPLOAD_ERR_OK) {
continue;
}

$icon_tmp = $_FILES['iconfiles']['tmp_name'][$icon_key];
$orig_name = $_FILES['iconfiles']['name'][$icon_key];
$icon_file_size = $_FILES['iconfiles']['size'][$icon_key];

$icon_ext = strtolower(pathinfo($orig_name, PATHINFO_EXTENSION));

if (in_array($icon_ext, $icon_types, true)) {

$finfo = new finfo(FILEINFO_MIME_TYPE);
$mime_type = $finfo->file($icon_tmp);

if (in_array($mime_type, $allowed_mimes, true)) {

if ($icon_file_size < $icon_size) {

$icon_name = preg_replace('/[^a-zA-Z0-9_\.-]/', '', $orig_name);

if ($icon_name === '' || $icon_name === '.' || $icon_name === '..') {
echo "Invalid filename pattern.<br>";
continue;
}

$icon_path = $icon_dir . $icon_name;

if (move_uploaded_file($icon_tmp, $icon_path)) {
echo htmlspecialchars($icon_name, ENT_QUOTES, 'UTF-8') . " uploaded<br>";
$log_data = "{$o_date} -- Uploaded: {$icon_name}\n";
file_put_contents($log_file, $log_data, FILE_APPEND | LOCK_EX);
} else {                     
echo "Error uploading " . htmlspecialchars($icon_name, ENT_QUOTES, 'UTF-8') . "<br>";
$log_data = "{$o_date} -- Failed to upload: {$icon_name}\n";
file_put_contents($log_file, $log_data, FILE_APPEND | LOCK_EX);
}
} else { 
echo htmlspecialchars($orig_name, ENT_QUOTES, 'UTF-8') . " too large (limit 2.0mb)<br>"; 
}
} else {
echo htmlspecialchars($orig_name, ENT_QUOTES, 'UTF-8') . " content type verification failed<br>";
}
} else {
echo htmlspecialchars($orig_name, ENT_QUOTES, 'UTF-8') . " extension not allowed (jpg, jpeg, png, gif)<br>"; 
}
}
}

echo "<script>setTimeout('window.close();', 1500);</script>";
?>