Browse Source

[svn r20283] Security improvements see FS#4152

Julio Montoya 16 years ago
parent
commit
032a858f58
1 changed files with 9 additions and 24 deletions
  1. 9 24
      main/exercice/Hpdownload.php

+ 9 - 24
main/exercice/Hpdownload.php

@@ -22,7 +22,7 @@
 *	This script shows the list of exercises for administrators and students.
 *	@package dokeos.exercise
 * 	@author Istvan Mandak
-* 	@version $Id: Hpdownload.php 12269 2007-05-03 14:17:37Z elixir_julian $
+* 	@version $Id: Hpdownload.php 20283 2009-05-04 16:42:52Z juliomontoya $
 */
 
 
@@ -37,32 +37,24 @@ $tbl_document = Database::get_course_table(TABLE_DOCUMENT);
 
 $doc_url=urldecode($_GET['doc_url']);
 
-$filename=basename($doc_url);
+$filename=basename(Security::remove_XSS($doc_url));
 
 // launch event
 //event_download($doc_url);
-if (isset($_course['path']))
-{
-//	$full_file_name=$_configuration['root_sys']."courses/".$_course['path'].'/document'.$doc_url;
+if (isset($_course['path'])) {
 	$full_file_name = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document'.$doc_url;
-}
-else
-{
-//$full_file_name=$_configuration['root_sys']."courses/".$cid.'/document'.$doc_url;
-$full_file_name = api_get_path(SYS_COURSE_PATH).$cid.'/document'.$doc_url;
+} else {
+	$full_file_name = api_get_path(SYS_COURSE_PATH).$cid.'/document'.$doc_url;
 }
 
-if(!is_file($full_file_name))
-{
+if(!is_file($full_file_name)) {
 	exit();
 }
 
 $extension=explode('.',$filename);
-
 $extension=strtolower($extension[sizeof($extension)-1]);
 
-switch($extension)
-{
+switch($extension) {
 	case 'gz':		$content_type='application/x-gzip';			break;
 	case 'zip':		$content_type='application/zip';			break;
 	case 'pdf':		$content_type='application/pdf';			break;
@@ -91,10 +83,7 @@ header('Last-Modified: '.gmdate('D, d M Y H:i:s',time()+10).' GMT');
 ------------------------------------------------------------------------------
 */
 
-
-
-if($content_type == 'text/html')
-{
+if($content_type == 'text/html') {
 	include (api_get_path(LIBRARY_PATH).'fileUpload.lib.php');
 	$directory_name = dirname($full_file_name);
 
@@ -175,11 +164,7 @@ if($content_type == 'text/html')
 
 //normal case, all non-html files
 //header('Content-length: '.filesize($full_file_name));
-
 $fp=fopen($full_file_name,'rb');
-
-	fpassthru($fp);
-
+fpassthru($fp);
 fclose($fp);
-
 ?>