Update to upload, so tinymce also uses random generated names

classes/upload.class.php

@@ -10,7 +10,7 @@ class Upload {
         
     }
 
-    private static function generateRandomString($length = 5) {
+    public static function generateRandomString($length = 5) {
         // Function to generate a random string of 5 chars.
         $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ'; // Chars to use
         $charactersLength = strlen($characters); // Check string length

handleUpload.php

@@ -18,10 +18,20 @@ $temp = current($_FILES);
 if (is_uploaded_file($temp['tmp_name'])) {
 
     if (!User::checkLevel("75")) {
-        header("HTTP/1.1 403 Origin Denied");
+        header("HTTP/1.1 403 Permission Denied");
         return;
     }
 
+    // Set required variables.
+    $ext = explode('.', $temp['name']); // end() doesnt like us using explode directly.
+    $extension = strtolower(end($ext)); // Get the extension of the file.
+    $randomname = Upload::generateRandomString(); // We give our file a random name - It will be this.
+    
+    // Check if filename exists, and regenrate until it doesnt.
+    while (IS_FILE($cwd . '/' . Config::$file_path . $randomname . '.' . $extension)) {
+        $randomname = Upload::generateRandomString();
+    }
+
     // Sanitize input
     if (preg_match("/([^\w\s\d\-_~,;:\[\]\(\).])|([\.]{2,})/", $temp['name'])) {
         header("HTTP/1.1 400 Invalid file name.");
@@ -35,14 +45,11 @@ if (is_uploaded_file($temp['tmp_name'])) {
     }
 
     // Accept upload
-    $filetowrite = $imageFolder . $temp['name'];
+    $filetowrite = $imageFolder . $randomname .'.'. $extension;
     move_uploaded_file($temp['tmp_name'], $filetowrite);
 
     // Respond to the successful upload with JSON.
-    // Use a location key to specify the path to the saved image resource.
-    // { location : '/your/uploaded/image/file'}
-
-    echo json_encode(array('location' => Config::$sys_url . Config::$file_path . $temp['name']));
+    echo json_encode(array('location' => Config::$sys_url . Config::$file_path . $randomname .'.'. $extension));
 } else {
     // Notify editor that the upload failed
     header("HTTP/1.1 500 Server Error");