Wiki Uploads

I added an upload action to my UsemodWiki code. The code I added is in the form of two sub routines that return a upload form if nothing is posted (DoPublish) and uploads the file and returns a confirmation when a file is posted (SavePublish).

I really know nothing about perl code so I am sure this is insecure and or poorly written, but for what it is worth here is what I did. I did add some security with a check for useris...

---

sub DoPublish {

print &GetHeader(, T('File Upload Page'), );
if (&UserIsAdmin || &UserIsEditor){}
else
{
print 'Only Administrators and Editors can upload files';
print &GetCommonFooter();
return;
}
print '

';
print '';
print 'File to Upload:

';
print '';
print '';


print &GetCommonFooter();


}

---

sub SavePublish {

my ($upload_dir,$filename,$upload_filehandle);
print &GetHeader("", "Uploading file", "");


if (&UserIsAdmin || &UserIsEditor){}

else
{
print 'Only Administrators and Editors can upload files';
print &GetCommonFooter();
return;
}
$upload_dir = "/home/username/public_html/uploads"; #absolute path to upload dir
$filename = $q->param("file");
$filename =~ s/.*[\/\\](.*)/$1/;
$upload_filehandle = $q->upload("file");
open UPLOADFILE, ">$upload_dir/$filename";
while ( <$upload_filehandle> ){print UPLOADFILE;}
close UPLOADFILE;
print "The link to your image is...\n

";
print "http://www.yourserver.org/uploads/$filename

\n";
print "

---

http://www.yourserver.org/uploads/$filename>\n";
print &GetCommonFooter();


}