Keep uploads outside the web root.

save_uploaded_file() read, and prune_images() deleted, any path in the
"uploaded" POST field. Uploads now go to UPLOAD_DIR under a random name
that only the session knows.

publish/index.php

@@ -1,4 +1,10 @@
-<?php require_once("../session.lib.php"); ?>
+<?php
+if ( ! isset($_SERVER['HTTPS'])) {
+   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
+   exit;
+}
+require_once("../session.lib.php");
+?>
 <!DOCTYPE html>
 <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>