Przeglądaj źródła

import a svg file to current canvas and open svg file

Juan Carlos Raña 14 lat temu
rodzic
commit
72833f5576

+ 47 - 11
main/inc/lib/svg-edit/extensions/fileopen.php

@@ -1,4 +1,3 @@
-<!doctype html>
 <?php
 /*
  * fileopen.php
@@ -14,13 +13,38 @@
 */
 
 require_once '../../../../inc/global.inc.php';//hack for chamilo
-require_once api_get_path(LIBRARY_PATH).'course.lib.php';
-require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
-require_once api_get_path(LIBRARY_PATH).'security.lib.php';
-require_once api_get_path(LIBRARY_PATH).'document.lib.php';
+require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
 
 api_protect_course_script();
 api_block_anonymous_users();
+//Adding Chamilo style because Display :: display_error_message() dont run well.
+?>
+<style type="text/css">
+<!--
+.error-message {
+	position: relative;
+	margin-top: 10px;
+	margin-bottom: 10px;
+	border-width: 1px;
+	border-style: solid;
+	-moz-border-radius: 10px;
+	padding: 6px;
+	border: 1px solid #FF0000;
+	color: #440000;
+	background-color: #FFD1D1;
+	min-height: 30px;
+}
+-->
+</style>
+
+<?php
+if(!isset($_FILES['svg_file']['tmp_name'])) {
+	//echo '<div class="error-message">'. get_lang('lang_no_access_here').'</div>';// from Chamilo
+	//die();
+}
+?>
+<!doctype html>
+<?php
 	// Very minimal PHP file, all we do is Base64 encode the uploaded file and
 	// return it to the editor
 	
@@ -38,12 +62,24 @@ api_block_anonymous_users();
 		$prefix = 'data:' . $info['mime'] . ';base64,';
 	}
 	
-//disable upload files (IMPORT SVG FILES) for now. Chamilo
-	$file='';
-	$output='';
-	type='';
-	prefix='';
-//
+//a bit title security
+
+$filename = addslashes(trim($file));
+$filename = Security::remove_XSS($filename);
+$filename = replace_dangerous_char($filename, 'strict');
+$filename = disable_dangerous_file($filename);
+
+
+//a bit mime security
+$finfo = new finfo(FILEINFO_MIME);
+$current_mime=$finfo->buffer($contents);
+
+$mime_svg='image/svg+xml';
+$mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii.
+
+if(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg'){
+	die();//File extension does not match its content
+}
 ?>
 
 <script>

+ 1 - 1
main/inc/lib/svg-edit/svg-editor.php

@@ -111,7 +111,7 @@ api_block_anonymous_users();
 				<div></div>
 				New Image [N]
 			</li>
-			
+            
 			<li id="tool_open" style="display:none;">
 				<div id="fileinputs">
 					<div></div>