Wiki Uploads

I added an upload action to my UsemodWiki code. The code I added is in the form of two sub routines that return a upload form if nothing is posted (DoPublish) and uploads the file and returns a confirmation when a file is posted (SavePublish).

I really know nothing about perl code so I am sure this is insecure and or poorly written, but for what it is worth here is what I did. I did add some security with a check for useris...

sub DoPublish {

print &GetHeader(, T('File Upload Page'), );

if (&UserIsAdmin || &UserIsEditor){}, 

else 

{

  print '<center>Only Administrators and Editors can upload files</center>';

  print &GetCommonFooter();

  return;

},

print '<FORM METHOD="post" ACTION="wiki.pl" ENCTYPE="multipart/form-data">';

print '<input type="hidden" name="upload" value="1" />';

print 'File to Upload: <INPUT TYPE="file" NAME="file"><br><BR>';

print '<INPUT TYPE="submit" NAME="Submit" VALUE="Upload">';

print '</FORM>';

print &GetCommonFooter(); 

},

sub SavePublish {

my ($upload_dir,$filename,$upload_filehandle);

  print &GetHeader("", "Uploading file", "");

if (&UserIsAdmin || &UserIsEditor){},

else 

{

  print '<center>Only Administrators and Editors can upload files</center>';

  print &GetCommonFooter();

  return;

},

 $upload_dir = "/home/username/public_html/uploads"; #absolute path to upload dir

 $filename = $q->param("file");

 $filename =~ s/.*[\/\\](.*)/$1/;

 $upload_filehandle = $q->upload("file");

 open UPLOADFILE, ">$upload_dir/$filename";

 while ( <$upload_filehandle> ){print UPLOADFILE;},

 close UPLOADFILE;

 print "The link to your image is...\n<br><BR>";

 print "http://www.yourserver.org/uploads/$filename<BR><BR>\n";

 print "<HR><img src=http://www.yourserver.org/uploads/$filename></html>\n";

 print &GetCommonFooter();

},