Browse Source

Fixed, secured and ordered scripts to attach files to announcements

Yannick Warnier 15 years ago
parent
commit
29788a59ed
2 changed files with 95 additions and 99 deletions
  1. 76 54
      main/announcements/announcements.inc.php
  2. 19 45
      main/announcements/announcements.php

+ 76 - 54
main/announcements/announcements.inc.php

@@ -654,6 +654,8 @@ function sent_to_form($sent_to_array)
 * This function separates the users from the groups
 * users have a value USER:XXX (with XXX the dokeos id
 * groups have a value GROUP:YYY (with YYY the group id)
+* @param    array   Array of strings that define the type and id of each destination
+* @return   array   Array of groups and users (each an array of IDs)
 */
 function separate_users_groups($to)
 {
@@ -661,10 +663,10 @@ function separate_users_groups($to)
 		list($type, $id) = explode(':', $to_item);
 		switch($type) {
 			case 'GROUP':
-				$grouplist[] =$id;
+				$grouplist[] = intval($id);
 				break;
 			case 'USER':
-				$userlist[] =$id;
+				$userlist[] = intval($id);
 				break;
 		}
 	}
@@ -680,8 +682,11 @@ function separate_users_groups($to)
 	 			SENT_TO()
   ======================================*/
 /**
-* returns all the users and all the groups a specific announcement item
+* Returns all the users and all the groups a specific announcement item
 * has been sent to
+* @param    string  The tool (announcement, agenda, ...)
+* @param    int     ID of the element of the corresponding type
+* @return   array   Array of users and groups to whom the element has been sent 
 */
 function sent_to($tool, $id)
 {
@@ -730,6 +735,9 @@ function sent_to($tool, $id)
 * This functions swithes the visibility a course resource
 * using the visibility field in 'item_property'
 * values: 0 = invisibility for
+* @param    string  The tool (announcement, agenda, ...)
+* @param    int     ID of the element of the corresponding type
+* @return   bool    The result of the update operation, or nothing on failure
 */
 function change_visibility_announcement($tool,$id)
 {
@@ -752,34 +760,42 @@ function change_visibility_announcement($tool,$id)
 	{
 		$sql_visibility="UPDATE $tbl_item_property SET visibility='1' WHERE tool='$tool' AND ref='$id'";
 	}
-
-	$result=Database::query($sql_visibility,__FILE__,__LINE__) or die (mysql_error());
+    $result=Database::query($sql_visibility,__FILE__,__LINE__);
+    if ($(mysql_error());
 }
 
-
-/*====================================================
-	            STORE_ADVALVAS_ITEM
-====================================================*/
-
-function store_advalvas_item($emailTitle,$newContent, $order, $to, $file_comment='') {
+/**
+ * Store an announcement in the database (including its attached file if any)
+ * @param string    Announcement title (pure text)
+ * @param string    Content of the announcement (can be HTML)
+ * @param int       Display order in the list of announcements
+ * @param array     Array of users and groups to send the announcement to 
+ * @param string    Comment describing the attachment
+ * @return int      false on failure, ID of the announcement on success 
+ */
+function store_advalvas_item($emailTitle, $newContent, $order, $to, $file_comment='') {
 
 	global $_course;
 	global $nameTools;
 	global $_user;
 
-	global $tbl_announcement;
-	global $tbl_item_property;
-	$newContent=stripslashes($newContent);
+	$tbl_announcement = Database::get_course_table(TABLE_ANNOUNCEMENT);
+	$tbl_item_property = Database::get_course_table(TABLE_ITEM_PROPERTY);
+
+	// filter data
 	$emailTitle = Database::escape_string(Security::remove_XSS($emailTitle));
 	$newContent = Database::escape_string(Security::remove_XSS($newContent,COURSEMANAGERLOWSECURITY));
 	$order = intval($order);
 	
 	// store in the table announcement
 	$sql = "INSERT INTO $tbl_announcement SET content = '$newContent', title = '$emailTitle', end_date = NOW(), display_order ='$order', session_id=".intval($_SESSION['id_session']);
-	$result = Database::query($sql,__FILE__,__LINE__) or die (mysql_error());
+	$result = Database::query($sql,__FILE__,__LINE__);
+	if ($result === false) {
+		return false;
+	}
 	
 	//store the attach file
-	$last_id= Database::insert_id();
+	$last_id = Database::insert_id();
 	$save_attachment = add_announcement_attachment_file($last_id, $file_comment, $_FILES['user_upload']);
 	
 	// store in item_property (first the groups, then the users
@@ -1054,12 +1070,14 @@ function get_attachment($announcement_id) {
  * This function add a attachment file into announcement
  * @param string  a comment about file
  * @param int last id from announcement table
- *
+ * @return int  -1 if failed, 0 if unknown (should not happen), 1 if success
  */
 
 function add_announcement_attachment_file($last_id, $file_comment, $file = array()) {
 	global $_course;
 	$tbl_announcement_attachment = Database::get_course_table(TABLE_ANNOUNCEMENT_ATTACHMENT);
+	$return = 0;
+	$last_id = intval($last_id);
 	
 	if (is_array($file) && $file['error'] == 0 ) {
 		$courseDir   = $_course['path'].'/upload/announcements';
@@ -1069,42 +1087,44 @@ function add_announcement_attachment_file($last_id, $file_comment, $file = array
 		// Try to add an extension to the file if it hasn't one
 		$new_file_name = add_ext_on_mime(stripslashes($_FILES['user_upload']['name']), $_FILES['user_upload']['type']);
 		// user's file name
-		$file_name =$_FILES['user_upload']['name'];
+		$file_name = $_FILES['user_upload']['name'];
 
 		if (!filter_extension($new_file_name))  {
+			$return = -1;
 			Display :: display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));
 		} else {
 			$new_file_name = uniqid('');
-			$new_path=$updir.'/'.$new_file_name;
-			$result= @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);
-			$safe_file_comment= Database::escape_string($file_comment);
-			$safe_file_name = Database::escape_string($file_name);
+			$new_path           = $updir.'/'.$new_file_name;
+			$result             = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);
+			$safe_file_comment  = Database::escape_string($file_comment);
+			$safe_file_name     = Database::escape_string($file_name);
 			$safe_new_file_name = Database::escape_string($new_file_name);
 			// Storing the attachments if any
 			//if ($result) {
-				$sql='INSERT INTO '.$tbl_announcement_attachment.'(filename,comment, path,announcement_id,size) '.
-					 "VALUES ( '".$safe_file_name."', '".$file_comment."', '".$safe_new_file_name."' , '".$last_id."', '".$_FILES['user_upload']['size']."' )";
-				$result=Database::query($sql, __LINE__, __FILE__);
-				$message.=' / '.get_lang('FileUploadSucces').'<br />';
-
+				$sql = 'INSERT INTO '.$tbl_announcement_attachment.'(filename, comment, path, announcement_id, size) '.
+					   "VALUES ( '$safe_file_name', '$file_comment', '$safe_new_file_name' , '$last_id', '".intval($_FILES['user_upload']['size'])."' )";
+				$result = Database::query($sql, __LINE__, __FILE__);
+				//$message .= ' / '.get_lang('FileUploadSucces').'<br />';
+                $return = 1;
 				//$last_id_file=Database::insert_id();
 				//api_item_property_update($_course, 'announcement_attachment', $last_id_file ,'AnnouncementAttachmentAdded', api_get_user_id());
 
 			//}
 		}
 	}
+	return $return;
 }
 
 /**
  * This function edit a attachment file into announcement
  * @param string  a comment about file
  * @param int Agenda Id
- *  @param int attachment file Id
+ * @param int attachment file Id
  */
 function edit_announcement_attachment_file($last_id, $file = array(), $file_comment) {
-
 	global $_course;
 	$tbl_announcement_attachment = Database::get_course_table(TABLE_ANNOUNCEMENT_ATTACHMENT);
+    $return = 0;
 	// Storing the attachments
 
     if(!empty($_FILES['user_upload'])) {
@@ -1112,35 +1132,37 @@ function edit_announcement_attachment_file($last_id, $file = array(), $file_comm
 	}
 
 	if (!empty($upload_ok)) {
-			$courseDir   = $_course['path'].'/upload/announcements';
-			$sys_course_path = api_get_path(SYS_COURSE_PATH);
-			$updir = $sys_course_path.$courseDir;
-
-			// Try to add an extension to the file if it hasn't one
-			$new_file_name = add_ext_on_mime(stripslashes($_FILES['user_upload']['name']), $_FILES['user_upload']['type']);
-			// user's file name
-			$file_name =$_FILES['user_upload'] ['name'];
+		$courseDir   = $_course['path'].'/upload/announcements';
+		$sys_course_path = api_get_path(SYS_COURSE_PATH);
+		$updir = $sys_course_path.$courseDir;
 
-			if (!filter_extension($new_file_name))  {
-				Display :: display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));
+		// Try to add an extension to the file if it hasn't one
+		$new_file_name = add_ext_on_mime(stripslashes($_FILES['user_upload']['name']), $_FILES['user_upload']['type']);
+		// user's file name
+		$file_name =$_FILES['user_upload'] ['name'];
+		if (!filter_extension($new_file_name)) {
+			$return -1;
+			Display :: display_error_message(get_lang('UplUnableToSaveFileFilteredExtension'));
+		} else {
+			$new_file_name = uniqid('');
+			$new_path = $updir.'/'.$new_file_name;
+			$result = @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);
+			$safe_file_comment = Database::escape_string($file_comment);
+			$safe_file_name = Database::escape_string($file_name);
+			$safe_new_file_name = Database::escape_string($new_file_name);	
+			$sql = "UPDATE $tbl_announcement_attachment SET filename = '$safe_file_name', comment = '$safe_file_comment', path = '$safe_new_file_name', announcement_id = '$last_id', size ='".intval($_FILES['user_upload']['size'])."'
+				 WHERE announcement_id = '$last_id'";
+			$result = Database::query($sql, __FILE__,__LINE__);
+			if ($result === false) {
+				$return = -1;
+                Display :: display_error_message(get_lang('UplUnableToSaveFile'));
 			} else {
-				$new_file_name = uniqid('');
-				$new_path=$updir.'/'.$new_file_name;
-				$result= @move_uploaded_file($_FILES['user_upload']['tmp_name'], $new_path);
-				$safe_file_comment= Database::escape_string($file_comment);
-				$safe_file_name = Database::escape_string($file_name);
-				$safe_new_file_name = Database::escape_string($new_file_name);	
-				// Storing the attachments if any
-				//if ($result) {
-					$sql="UPDATE $tbl_announcement_attachment SET filename = '$safe_file_name', comment = '$safe_file_comment', path = '$safe_new_file_name', announcement_id = '$last_id', size ='".$_FILES['user_upload']['size']."'
-						 WHERE announcement_id = '$last_id'";
-					$result=Database::query($sql, __FILE__,__LINE__);
-					$message.=' / '.get_lang('FileUploadSucces').'<br />';
-					//api_item_property_update($_course, 'announcement_attachment', $last_id ,'AnnouncementAttachmentUpdated', api_get_user_id());
-
-				//}
+                $return = 1;
 			}
+			//$message .= ' / '.get_lang('FileUploadSucces').'<br />';
 		}
+	}
+	return $return;
 }
 
 /**

+ 19 - 45
main/announcements/announcements.php

@@ -1,29 +1,6 @@
 <?php //$Id: announcements.php 2009-11-13 18:56:45Z aportugal $
-/*
-==============================================================================
-	Dokeos - elearning and course management software
-
-	Copyright (c) 2004-2008 Dokeos SPRL
-	Copyright (c) 2003 Ghent University (UGent)
-	Copyright (c) 2001 Universite catholique de Louvain (UCL)
-	Copyright (c) various contributors
-
-	For a full list of contributors, see "credits.txt".
-	The full license can be read in "license.txt".
-
-	This program is free software; you can redistribute it and/or
-	modify it under the terms of the GNU General Public License
-	as published by the Free Software Foundation; either version 2
-	of the License, or (at your option) any later version.
-
-	See the GNU General Public License for more details.
-
-	Contact address: Dokeos, rue du Corbeau, 108, B-1030 Brussels, Belgium
-	Mail: info@dokeos.com
-==============================================================================
-*/
+/* For licensing terms, see /dokeos_license.txt */
 /**
-==============================================================================
  * @author Frederik Vermeire <frederik.vermeire@pandora.be>, UGent Internship
  * @author Patrick Cool <patrick.cool@UGent.be>, Ghent University: code cleaning
  * @abstract The task of the internship was to integrate the 'send messages to specific users' with the
@@ -33,7 +10,6 @@
  * @todo make AWACS out of the configuration settings
  * @todo this file is 1200+ lines without any functions -> needs to be split into
  * multiple functions
-==============================================================================
 */
 /*
 ==============================================================================
@@ -144,22 +120,23 @@ event_access_tool(TOOL_ANNOUNCEMENT);
 	Libraries
 -----------------------------------------------------------
 */
-require_once(api_get_path(LIBRARY_PATH).'groupmanager.lib.php');
+$lib = api_get_path(LIBRARY_PATH); //avoid useless function calls
+require_once($lib.'groupmanager.lib.php');
 require_once('announcements.inc.php');
-require_once(api_get_path(INCLUDE_PATH).'lib/mail.lib.inc.php');
+require_once($lib.'mail.lib.inc.php');
 require_once(api_get_path(INCLUDE_PATH).'conf/mail.conf.php');
-require_once(api_get_path(LIBRARY_PATH).'debug.lib.inc.php');
-require_once(api_get_path(LIBRARY_PATH).'tracking.lib.php');
-require_once(api_get_path(LIBRARY_PATH).'/fckeditor/fckeditor.php');
-require_once(api_get_path(LIBRARY_PATH).'fileUpload.lib.php');
+require_once($lib.'debug.lib.inc.php');
+require_once($lib.'tracking.lib.php');
+require_once($lib.'fckeditor/fckeditor.php');
+require_once($lib.'fileUpload.lib.php');
 /*
 -----------------------------------------------------------
 	POST TO
 -----------------------------------------------------------
 */
 
-$safe_emailTitle = $_POST['emailTitle'];
-$safe_newContent = $_POST['newContent'];
+$safe_emailTitle = Security::remove_XSS($_POST['emailTitle']);
+$safe_newContent = Security::remove_XSS($_POST['newContent']);
 
 if (!empty($_POST['To']))
 {
@@ -168,7 +145,7 @@ if (!empty($_POST['To']))
 	}
 	$display_form = true;
 
-	$form_elements= array ('emailTitle'=>$safe_emailTitle, 'newContent'=>$safe_newContent, 'id'=>$_POST['id'], 'emailoption'=>$_POST['email_ann']);
+	$form_elements= array ('emailTitle'=>$safe_emailTitle, 'newContent'=>$safe_newContent, 'id'=>Security::remove_XSS($_POST['id']), 'emailoption'=>Security::remove_XSS($_POST['email_ann']));
     $_SESSION['formelements']=$form_elements;
 
     $form_elements            	= $_SESSION['formelements'];
@@ -186,7 +163,7 @@ if (!empty($_POST['To']))
 -----------------------------------------------------------
 */
 
-$setting_select_groupusers=true;
+$setting_select_groupusers = true;
 if (empty($_POST['To']) and !$_SESSION['select_groupusers'])
 {
 	$_SESSION['select_groupusers']="hide";
@@ -331,9 +308,9 @@ else
 	$display_announcement_list = false;
 	$display_specific_announcement = true;
 	$announcement_id = $_REQUEST['ann_id'];
-	?> <link rel="stylesheet" type="text/css" href="<?php echo $clarolineRepositoryWeb ?>css/default.css">
+	?> <link rel="stylesheet" type="text/css" href="<?php echo api_get_path(WEB_CODE_PATH).'css/'.$my_style; ?>/default.css">
 	<!-- css file for announcements -->
-	<link href="../css/announcements.css" rel="stylesheet" type="text/css">
+	<link href="../css/<?php echo $my_style; ?>/announcements.css" rel="stylesheet" type="text/css">
 	<?php
 }
 
@@ -353,17 +330,14 @@ if (api_is_allowed_to_edit(false,true) OR (api_get_course_setting('allow_user_ed
 	// $_GET['isStudentView']<>"false" is added to prevent that the visibility
 	// is changed after you do the following:
 	// change visibility -> studentview -> course manager view
-	if (!isset($_GET['isStudentView']) || $_GET['isStudentView']!='false')
-	{
-		if (isset($_GET['id']) AND $_GET['id'] AND isset($_GET['action']) AND $_GET['action']=="showhide")
-		{
+	if (!isset($_GET['isStudentView']) || $_GET['isStudentView']!='false') {
+		if (isset($_GET['id']) AND $_GET['id'] AND isset($_GET['action']) AND $_GET['action']=="showhide") {
 			if (api_get_session_id()!=0 && api_is_allowed_to_session_edit(false,true)==false) {		 
 				api_not_allowed();
 			}
 			
-			$id=intval(addslashes($_GET['id']));
-			if(!api_is_course_coach() || api_is_element_in_the_session(TOOL_ANNOUNCEMENT, $id))
-			{
+			$id=intval($_GET['id']);
+			if (!api_is_course_coach() || api_is_element_in_the_session(TOOL_ANNOUNCEMENT, $id)) {
 				if ($ctok == $_GET['sec_token']) {
 					change_visibility_announcement(TOOL_ANNOUNCEMENT,$id);
 					$message = get_lang("VisibilityChanged");
@@ -409,7 +383,7 @@ if (api_is_allowed_to_edit(false,true) OR (api_get_course_setting('allow_user_ed
 	if (!empty($_GET['action']) and $_GET['action']=='delete_all') {
 
 		//Database::query("DELETE FROM $tbl_announcement",__FILE__,__LINE__);
-		if(api_is_allowed_to_edit()) {
+		if (api_is_allowed_to_edit()) {
 			Database::query("UPDATE $tbl_item_property SET visibility='2' WHERE tool='".TOOL_ANNOUNCEMENT."'",__FILE__,__LINE__);
 
 			delete_all_resources_type("Ad_Valvas");