|
@@ -17,18 +17,18 @@ api_protect_course_script();
|
|
|
api_block_anonymous_users();
|
|
|
|
|
|
if ($_user['user_id'] != api_get_user_id() || api_get_user_id() == 0 || $_user['user_id'] == 0) {
|
|
|
- api_not_allowed();
|
|
|
- die();
|
|
|
+ api_not_allowed();
|
|
|
+ die();
|
|
|
}
|
|
|
|
|
|
if (!isset($_GET['title']) || !isset($_GET['type']) || !isset($_GET['image'])) {
|
|
|
- api_not_allowed();
|
|
|
- die();
|
|
|
+ api_not_allowed();
|
|
|
+ die();
|
|
|
}
|
|
|
|
|
|
if (!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami'])) {
|
|
|
- api_not_allowed();
|
|
|
- die();
|
|
|
+ api_not_allowed();
|
|
|
+ die();
|
|
|
}
|
|
|
|
|
|
//pixlr return
|
|
@@ -42,18 +42,18 @@ $urlcontents = Security::remove_XSS($_GET['image']); //A URL to the image on Pix
|
|
|
$title = Database::escape_string(str_replace('_', ' ', $filename));
|
|
|
$current_session_id = api_get_session_id();
|
|
|
$groupId = api_get_group_id();
|
|
|
+$groupInfo = GroupManager::get_group_properties($groupId);
|
|
|
$relativeUrlPath = $_SESSION['paint_dir'];
|
|
|
$currentTool = $_SESSION['whereami'];
|
|
|
$dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
|
|
|
$saveDir = $dirBaseDocuments.$_SESSION['paint_dir'];
|
|
|
-
|
|
|
$contents = file_get_contents($urlcontents);
|
|
|
|
|
|
//Security. Verify that the URL is pointing to a file @ pixlr.com domain or an ip @ pixlr.com. Comment because sometimes return a ip number
|
|
|
/*
|
|
|
if (strpos($urlcontents, "pixlr.com") === 0){
|
|
|
- echo "Invalid referrer";
|
|
|
- exit;
|
|
|
+ echo "Invalid referrer";
|
|
|
+ exit;
|
|
|
}
|
|
|
*/
|
|
|
|
|
@@ -72,22 +72,22 @@ $filename = api_replace_dangerous_char($filename);
|
|
|
$filename = disable_dangerous_file($filename);
|
|
|
|
|
|
if (strlen(trim($filename)) == 0) {
|
|
|
- echo "The title is empty"; //if title is empty, headers Content-Type = application/octet-stream, then not create a new title here please
|
|
|
- exit;
|
|
|
+ echo "The title is empty"; //if title is empty, headers Content-Type = application/octet-stream, then not create a new title here please
|
|
|
+ exit;
|
|
|
}
|
|
|
|
|
|
//check file_get_contents
|
|
|
if ($contents === false) {
|
|
|
- echo "I cannot read: ".$urlcontents;
|
|
|
+ echo "I cannot read: ".$urlcontents;
|
|
|
exit;
|
|
|
}
|
|
|
|
|
|
// Extension security
|
|
|
if ($extension != 'jpg' && $extension != 'png' && $extension != 'pxd') {
|
|
|
- die();
|
|
|
+ die();
|
|
|
}
|
|
|
if ($extension == 'pxd') {
|
|
|
- echo "pxd file type does not supported"; // not secure because check security headers and finfo() return Content-Type = application/octet-stream
|
|
|
+ echo "pxd file type does not supported"; // not secure because check security headers and finfo() return Content-Type = application/octet-stream
|
|
|
exit;
|
|
|
}
|
|
|
|
|
@@ -95,8 +95,8 @@ if ($extension == 'pxd') {
|
|
|
$headers = get_headers($urlcontents, 1);
|
|
|
$content_type = explode("/", $headers['Content-Type']);
|
|
|
if ($content_type[0] != "image") {
|
|
|
- echo "Invalid file type";
|
|
|
- exit;
|
|
|
+ echo "Invalid file type";
|
|
|
+ exit;
|
|
|
}
|
|
|
|
|
|
//Verify that the file is an image. Fileinfo method
|
|
@@ -114,49 +114,86 @@ $paintFileName = $filename.'.'.$extension;
|
|
|
$title = $title.'.'.$extension;
|
|
|
|
|
|
if ($currentTool == 'document/createpaint') {
|
|
|
- //check save as and prevent rewrite an older file with same name
|
|
|
- if (0 != $groupId) {
|
|
|
+ //check save as and prevent rewrite an older file with same name
|
|
|
+ if (0 != $groupId) {
|
|
|
$group_properties = GroupManager :: get_group_properties($groupId);
|
|
|
$groupPath = $group_properties['directory'];
|
|
|
- } else {
|
|
|
- $groupPath = '';
|
|
|
- }
|
|
|
-
|
|
|
- if (file_exists($saveDir.'/'.$filename.'.'.$extension)) {
|
|
|
- $i = 1;
|
|
|
- while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
|
|
|
- $paintFileName = $filename.'_'.$i.'.'.$extension;
|
|
|
- $title = $filename.'_'.$i.'.'.$extension;
|
|
|
- }
|
|
|
-
|
|
|
- //
|
|
|
- $documentPath = $saveDir.'/'.$paintFileName;
|
|
|
- //add new document to disk
|
|
|
- file_put_contents($documentPath, $contents);
|
|
|
- //add document to database
|
|
|
- $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
|
|
|
- api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
|
|
|
-
|
|
|
-}elseif ($currentTool == 'document/editpaint') {
|
|
|
-
|
|
|
- $documentPath = $saveDir.'/'.$paintFileName;
|
|
|
- //add new document to disk
|
|
|
- file_put_contents($documentPath, $contents);
|
|
|
-
|
|
|
- //check path
|
|
|
- if (!isset($_SESSION['paint_file'])) {
|
|
|
- api_not_allowed();
|
|
|
- die();
|
|
|
- }
|
|
|
- if ($_SESSION['paint_file'] == $paintFileName) {
|
|
|
- $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
|
|
|
- update_existing_document($_course, $document_id, filesize($documentPath), null);
|
|
|
- api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
|
|
|
- } else {
|
|
|
- //add a new document
|
|
|
- $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
|
|
|
- api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
|
|
|
- }
|
|
|
+ } else {
|
|
|
+ $groupPath = '';
|
|
|
+ }
|
|
|
+
|
|
|
+ if (file_exists($saveDir.'/'.$filename.'.'.$extension)) {
|
|
|
+ $i = 1;
|
|
|
+ while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
|
|
|
+ $paintFileName = $filename.'_'.$i.'.'.$extension;
|
|
|
+ $title = $filename.'_'.$i.'.'.$extension;
|
|
|
+ }
|
|
|
+
|
|
|
+ //
|
|
|
+ $documentPath = $saveDir.'/'.$paintFileName;
|
|
|
+ //add new document to disk
|
|
|
+ file_put_contents($documentPath, $contents);
|
|
|
+ //add document to database
|
|
|
+ $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
|
|
|
+ api_item_property_update(
|
|
|
+ $_course,
|
|
|
+ TOOL_DOCUMENT,
|
|
|
+ $doc_id,
|
|
|
+ 'DocumentAdded',
|
|
|
+ $_user['user_id'],
|
|
|
+ $groupInfo,
|
|
|
+ null,
|
|
|
+ null,
|
|
|
+ null,
|
|
|
+ $current_session_id
|
|
|
+ );
|
|
|
+} elseif ($currentTool == 'document/editpaint') {
|
|
|
+ $documentPath = $saveDir.'/'.$paintFileName;
|
|
|
+ //add new document to disk
|
|
|
+ file_put_contents($documentPath, $contents);
|
|
|
+
|
|
|
+ //check path
|
|
|
+ if (!isset($_SESSION['paint_file'])) {
|
|
|
+ api_not_allowed();
|
|
|
+ die();
|
|
|
+ }
|
|
|
+ if ($_SESSION['paint_file'] == $paintFileName) {
|
|
|
+ $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
|
|
|
+ update_existing_document($_course, $document_id, filesize($documentPath), null);
|
|
|
+ api_item_property_update(
|
|
|
+ $_course,
|
|
|
+ TOOL_DOCUMENT,
|
|
|
+ $document_id,
|
|
|
+ 'DocumentUpdated',
|
|
|
+ $_user['user_id'],
|
|
|
+ $groupInfo,
|
|
|
+ null,
|
|
|
+ null,
|
|
|
+ null,
|
|
|
+ $current_session_id
|
|
|
+ );
|
|
|
+ } else {
|
|
|
+ //add a new document
|
|
|
+ $doc_id = add_document(
|
|
|
+ $_course,
|
|
|
+ $relativeUrlPath.'/'.$paintFileName,
|
|
|
+ 'file',
|
|
|
+ filesize($documentPath),
|
|
|
+ $title
|
|
|
+ );
|
|
|
+ api_item_property_update(
|
|
|
+ $_course,
|
|
|
+ TOOL_DOCUMENT,
|
|
|
+ $doc_id,
|
|
|
+ 'DocumentAdded',
|
|
|
+ $_user['user_id'],
|
|
|
+ $groupInfo,
|
|
|
+ null,
|
|
|
+ null,
|
|
|
+ null,
|
|
|
+ $current_session_id
|
|
|
+ );
|
|
|
+ }
|
|
|
}
|
|
|
|
|
|
|
|
@@ -171,12 +208,12 @@ unset($_SESSION['whereami']);
|
|
|
unset($_SESSION['temp_realpath_image']);
|
|
|
|
|
|
if (!isset($_SESSION['exit_pixlr'])) {
|
|
|
- $location = api_get_path(WEB_CODE_PATH).'document/document.php';
|
|
|
- echo '<script>window.parent.location.href="'.$location.'"</script>';
|
|
|
- api_not_allowed(true);
|
|
|
+ $location = api_get_path(WEB_CODE_PATH).'document/document.php';
|
|
|
+ echo '<script>window.parent.location.href="'.$location.'"</script>';
|
|
|
+ api_not_allowed(true);
|
|
|
} else {
|
|
|
- echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
|
|
|
- $location = api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']);
|
|
|
- echo '<script>window.parent.location.href="'.$location.'"</script>';
|
|
|
- unset($_SESSION['exit_pixlr']);
|
|
|
+ echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
|
|
|
+ $location = api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']);
|
|
|
+ echo '<script>window.parent.location.href="'.$location.'"</script>';
|
|
|
+ unset($_SESSION['exit_pixlr']);
|
|
|
}
|