Initial checkin

Upload.php

@@ -0,0 +1,58 @@
+<?php
+require_once("inc/config.inc.php");
+session_start();
+require_once("inc/HelperFunctions.php");
+SetTraceRoot(__DIR__);
+TraceProgram(__FILE__, __FUNCTION__, __LINE__, "start " . date(DATE_RFC2822), TR_ENTRY);
+
+// This endpoint must return ONLY JSON. CKEditor parses the response as JSON, so any
+// PHP warning/notice echoed to the page makes it report "Couldn't upload file".
+// Errors are still logged (php error log), just not printed.
+error_reporting(E_ALL);
+ini_set('display_errors', 0);
+header('Content-Type: application/json');
+
+TraceProgram(__FILE__, __FUNCTION__, __LINE__, print_r($_FILES, true));
+
+// CKEditor 5's CKFinder upload adapter expects:
+//   success: { "uploaded": 1, "fileName": "...", "url": "..." }
+//   failure: { "uploaded": 0, "error": { "message": "..." } }
+// Without "uploaded" set to a truthy value it treats the upload as failed.
+function UploadFail($msg) {
+	echo json_encode(['uploaded' => 0, 'error' => ['message' => $msg]]);
+	TraceProgram(__FILE__, __FUNCTION__, __LINE__, "fail: $msg", TR_EXIT);
+	exit;
+}
+
+// Check if file is uploaded
+if (!isset($_FILES['upload']) || $_FILES['upload']['error'] !== UPLOAD_ERR_OK) {
+	UploadFail('No file uploaded (error code ' . ($_FILES['upload']['error'] ?? 'none') . ')');
+}
+
+$file = $_FILES['upload'];
+$allowedTypes = ['image/jpeg', 'image/jfif', 'image/png', 'image/gif'];
+
+// Validate file type
+if (!in_array($file['type'], $allowedTypes)) {
+	UploadFail('Invalid file type');
+}
+
+$filename = basename($file['name']);
+$targetPath = __DIR__ . '/inc/Uploads/' . $filename;
+TraceProgram(__FILE__, __FUNCTION__, __LINE__, "target: $targetPath");
+
+if (!is_uploaded_file($file['tmp_name']) || !@copy($file['tmp_name'], $targetPath)) {
+	$err = error_get_last();
+	UploadFail('Failed to save uploaded file: ' . ($err['message'] ?? 'unknown error'));
+}
+@unlink($file['tmp_name']);
+
+TraceProgram(__FILE__, __FUNCTION__, __LINE__, "$filename");
+echo json_encode([
+	'uploaded' => 1,
+	'fileName' => $filename,
+	'url'      => 'inc/Uploads/' . rawurlencode($filename)
+]);
+TraceProgram(__FILE__, __FUNCTION__, __LINE__, "end", TR_EXIT);
+
+?>