<? 
require "header.php"; 

if(stristr($_REQUEST['file'],"..")) {
	exit('Invalid File');
}
	
if($_POST) {
	if($_FILES[fileField][tmp_name]) {
		if(move_uploaded_file($_FILES['fileField']['tmp_name'],$thumb_path.'/'.rawurldecode($_POST['file']))) {
			$success = true;
		}
	}
}
?>
<h1>Replace Thumb</h1>
<? if($success) { ?>
<p align='center'>Saved.<br /></p> <? } ?>
<form method='post' enctype="multipart/form-data" action=''>
<input type='hidden' name='id' value='<? echo $_REQUEST[id]; ?>' />
<input type='hidden' name='file' value='<? echo $_REQUEST[file]; ?>' />
  <table width="750" border="0" align="center" cellpadding="3" cellspacing="0">
    <tr class='menutop'>
      <td colspan="4"><span class="style5">Upload Thumb</span></td>
    </tr>
    <tr>
      <td width="105" class="style4">Filename</td>
	  <td width="609" colspan="3" align="left" class="style4"><? echo strip_tags($_GET[file]); ?></td>
    </tr>
    <tr>
      <td class="style4">Upload</td>
      <td colspan="3" align="left" class="style4"><input type="file" name="fileField" id="fileField" /></td>
    
      <tr>
      <td colspan="4" class="style4"><div align="center">
        <br />
        <input type="submit" name="button" id="button" value="Save" />
        <br />
      </div></td>
      </tr>
  </table>
</form>
<p style="clear: both;"></p>
<? require "footer.php"; ?>