Browse Source

Adding group id to the function check_visibility_tree(). see BT#7870

Julio Montoya 11 years ago
parent
commit
cb24d67c42

+ 1 - 3
main/document/document.php

@@ -561,7 +561,6 @@ $js_path = api_get_path(WEB_LIBRARY_PATH).'javascript/';
 $htmlHeadXtra[] = '<link rel="stylesheet" href="'.$js_path.'jquery-jplayer/skins/chamilo/jplayer.blue.monday.css" type="text/css">';
 $htmlHeadXtra[] = '<script type="text/javascript" src="'.$js_path.'jquery-jplayer/jquery.jplayer.min.js"></script>';
 $mediaplayer_path = api_get_path(WEB_LIBRARY_PATH).'mediaplayer/player.swf';
-
 $docs_and_folders = DocumentManager::get_all_document_data(
     $_course,
     $curdirpath,
@@ -632,8 +631,7 @@ if (!empty($_SESSION['_gid'])) {
 
 /* 	MOVE FILE OR DIRECTORY */
 //Only teacher and all users into their group and each user into his/her shared folder
-if (
-    $is_allowed_to_edit ||
+if ($is_allowed_to_edit ||
     $group_member_with_upload_rights ||
     is_my_shared_folder(api_get_user_id(), $curdirpath, $session_id) ||
     is_my_shared_folder(api_get_user_id(), $moveTo, $session_id)

+ 106 - 106
main/document/document_lite.php

@@ -58,7 +58,7 @@ if (api_get_session_id() != 0) {
 $document_id = intval($_REQUEST['id']);
 
 $action = isset($_REQUEST['action']) ? $_REQUEST['action'] : null;
- 
+
 switch ($action) {
 	case 'download':
 		$document_data = DocumentManager::get_document_data_by_id($document_id, api_get_course_id());
@@ -82,23 +82,23 @@ switch ($action) {
 		// Check visibility of document and paths
 		if (!($is_allowed_to_edit || $group_member_with_upload_rights) && !DocumentManager::is_visible_by_id($document_id, $course_info, api_get_session_id(), api_get_user_id())) {
 			api_not_allowed(true);
-		}	
+		}
 		$full_file_name = $base_work_dir.$document_data['path'];
 		if (Security::check_abs_path($full_file_name, $base_work_dir.'/')) {
 			DocumentManager::file_send_for_download($full_file_name, true);
 		}
 		exit;
-		break;	
-	case 'downloadfolder' :		
+		break;
+	case 'downloadfolder' :
 		if (api_get_setting('students_download_folders') == 'true' || api_is_allowed_to_edit() || api_is_platform_admin()) {
 			$document_data = DocumentManager::get_document_data_by_id($document_id, api_get_course_id());
-			
+
 			//filter when I am into shared folder, I can donwload only my shared folder
-			if (is_any_user_shared_folder($document_data['path'], $session_id)) {								
+			if (is_any_user_shared_folder($document_data['path'], $session_id)) {
 				if (is_my_shared_folder(api_get_user_id(), $document_data['path'], $session_id) || api_is_allowed_to_edit() || api_is_platform_admin()){
 					require 'downloadfolder.inc.php';
 				}
-			} else {				
+			} else {
 				require 'downloadfolder.inc.php';
 			}
 			exit;
@@ -107,22 +107,22 @@ switch ($action) {
 }
 
 
-//If no actions we proceed to show the document (Hack in order to use document.php?id=X) 
+//If no actions we proceed to show the document (Hack in order to use document.php?id=X)
 if (isset($document_id)) {
     $document_data = DocumentManager::get_document_data_by_id($document_id, api_get_course_id(), true);
-    
+
     //If the document is not a folder we show the document
     if ($document_data) {
     	$parent_id     = $document_data['parent_id'];
-    	
+
     	//$visibility = DocumentManager::is_visible_by_id($document_id, $course_info, api_get_session_id(), api_get_user_id());
-    	$visibility = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id());
-    	
-	    if (!empty($document_data['filetype']) && $document_data['filetype'] == 'file') {	    	
-	    	if ($visibility && api_is_allowed_to_session_edit()) {    		
-	    		$url = api_get_path(WEB_COURSE_PATH).$course_info['path'].'/document'.$document_data['path'].'?'.api_get_cidreq();    	    	
+    	$visibility = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id(), api_get_group_id());
+
+	    if (!empty($document_data['filetype']) && $document_data['filetype'] == 'file') {
+	    	if ($visibility && api_is_allowed_to_session_edit()) {
+	    		$url = api_get_path(WEB_COURSE_PATH).$course_info['path'].'/document'.$document_data['path'].'?'.api_get_cidreq();
 	    		header("Location: $url");
-	    	}    	
+	    	}
 	    	exit;
 	    } else {
 	    	if (!$visibility && !api_is_allowed_to_edit()) {
@@ -131,7 +131,7 @@ if (isset($document_id)) {
 	    }
     	$_GET['curdirpath'] = $document_data['path'];
     }
-    
+
     // What's the current path?
     // We will verify this a bit further down
     if (isset($_GET['curdirpath']) && $_GET['curdirpath'] != '') {
@@ -140,9 +140,9 @@ if (isset($document_id)) {
     	$curdirpath = Security::remove_XSS($_POST['curdirpath']);
     } else {
     	$curdirpath = '/';
-    }    
+    }
     $curdirpathurl = urlencode($curdirpath);
-    
+
 } else {
 	// What's the current path?
 	// We will verify this a bit further down
@@ -153,19 +153,19 @@ if (isset($document_id)) {
 	} else {
 		$curdirpath = '/';
 	}
-	
+
 	$curdirpathurl = urlencode($curdirpath);
-	
+
 	// Check the path
 	// If the path is not found (no document id), set the path to /
 	$document_id = DocumentManager::get_document_id($course_info, $curdirpath);
-	
+
 	if (!$document_id) {
 		$document_id = DocumentManager::get_document_id($course_info, $curdirpath);
 	}
-	
-	$document_data = DocumentManager::get_document_data_by_id($document_id, api_get_course_id(), true);	
-	$parent_id     = $document_data['parent_id'];	
+
+	$document_data = DocumentManager::get_document_data_by_id($document_id, api_get_course_id(), true);
+	$parent_id     = $document_data['parent_id'];
 }
 
 $current_folder_id = $document_id;
@@ -204,7 +204,7 @@ if ($to_group_id != 0 && $curdirpath == '/') {
 //if (!$is_allowed_to_edit || api_is_coach()) { before
 
 if (!$is_allowed_to_edit && api_is_coach()) {
-    if ($curdirpath != '/' && !(DocumentManager::is_visible($curdirpath, $_course, api_get_session_id(),'folder'))) {   
+    if ($curdirpath != '/' && !(DocumentManager::is_visible($curdirpath, $_course, api_get_session_id(),'folder'))) {
         api_not_allowed(true);
     }
 }
@@ -232,12 +232,12 @@ if ($is_certificate_mode) {
 // Interbreadcrumb for the current directory root path
 
 if (empty($document_data['parents'])) {
-	if (isset($_GET['createdir'])) {		
+	if (isset($_GET['createdir'])) {
 		$interbreadcrumb[] = array('url' => $document_data['document_url'], 'name' => $document_data['title']);
 	} else {
 		$interbreadcrumb[] = array('url' => '#', 'name' => $document_data['title']);
-	}	
-} else {	
+	}
+} else {
 	foreach($document_data['parents'] as $document_sub_data) {
 		if (!isset($_GET['createdir']) && $document_sub_data['id'] ==  $document_data['id']) {
 			$document_sub_data['document_url'] = '#';
@@ -259,37 +259,37 @@ $file_list = $format_list = '';
 $count = 1;
 
 if (!empty($docs_and_folders))
-foreach ($docs_and_folders  as $file) {    
+foreach ($docs_and_folders  as $file) {
     if ($file['filetype'] == 'file') {
-        $path_info = pathinfo($file['path']);  
+        $path_info = pathinfo($file['path']);
         $extension = strtolower($path_info['extension']);
         //@todo use a js loop to autogenerate this code
         if (in_array($extension, array('ogg', 'mp3', 'wav'))) {
             $document_data = DocumentManager::get_document_data_by_id($file['id'], api_get_course_id());
-            
+
             if ($extension == 'ogg') {
                 $extension = 'oga';
-            }            
-            $jquery .= ' $("#jquery_jplayer_'.$count.'").jPlayer({                                
-                                ready: function() {                    
-                                    $(this).jPlayer("setMedia", {                                        
-                                        '.$extension.' : "'.$document_data['direct_url'].'"                                                                                  
+            }
+            $jquery .= ' $("#jquery_jplayer_'.$count.'").jPlayer({
+                                ready: function() {
+                                    $(this).jPlayer("setMedia", {
+                                        '.$extension.' : "'.$document_data['direct_url'].'"
                                     });
-                                },                                
+                                },
                                 swfPath: "'.$js_path.'jquery-jplayer",
-                                supplied: "mp3, m4a, oga, ogv, wav",          
-                                solution: "flash, html",  // Do not change this setting otherwise 
-                                cssSelectorAncestor: "#jp_interface_'.$count.'", 
+                                supplied: "mp3, m4a, oga, ogv, wav",
+                                solution: "flash, html",  // Do not change this setting otherwise
+                                cssSelectorAncestor: "#jp_interface_'.$count.'",
                             });'."\n\n";
-            $count++;      
-        }        
+            $count++;
+        }
     }
 }
- 
+
 $htmlHeadXtra[] = '<script type="text/javascript">
 $(document).ready( function() {
-    //Experimental changes to preview mp3, ogg files        
-     '.$jquery.'              
+    //Experimental changes to preview mp3, ogg files
+     '.$jquery.'
     //Keep this down otherwise the jquery player will not work
     for (i=0;i<$(".actions").length;i++) {
         if ($(".actions:eq("+i+")").html()=="<table border=\"0\"></table>" || $(".actions:eq("+i+")").html()=="" || $(".actions:eq("+i+")").html()==null) {
@@ -357,24 +357,24 @@ if (isset($_GET['action']) && $_GET['action'] == 'copytomyfiles' && api_get_sett
 /*	MOVE FILE OR DIRECTORY */
 //Only teacher and all users into their group and each user into his/her shared folder
 if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_folder(api_get_user_id(), $curdirpath, $session_id) || is_my_shared_folder(api_get_user_id(), Security::remove_XSS($_POST['move_to']), $session_id)) {
-    
+
     if (isset($_GET['move']) && $_GET['move'] != '') {
         $my_get_move = intval($_REQUEST['move']);
 
         if (api_is_coach()) {
-            if (!DocumentManager::is_visible_by_id($my_get_move, $course_info, api_get_session_id(), api_get_user_id())) {                    
+            if (!DocumentManager::is_visible_by_id($my_get_move, $course_info, api_get_session_id(), api_get_user_id())) {
                 api_not_allowed();
             }
         }
 
         if (!$is_allowed_to_edit) {
-            if (DocumentManager::check_readonly($_course, api_get_user_id(), $my_get_move)) {                
+            if (DocumentManager::check_readonly($_course, api_get_user_id(), $my_get_move)) {
                 api_not_allowed();
             }
         }
         $document_to_move = DocumentManager::get_document_data_by_id($my_get_move, api_get_course_id());
-        $move_path = $document_to_move['path']; 
-        
+        $move_path = $document_to_move['path'];
+
         if (!empty($document_to_move)) {
             $folders = DocumentManager::get_all_document_folders($_course, $to_group_id, $is_allowed_to_edit || $group_member_with_upload_rights);
 
@@ -389,10 +389,10 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
                         $user_shared_folders[]=$fold;
                     }
                 }
-                echo '<legend>'.get_lang('Move').'</legend>';                    
+                echo '<legend>'.get_lang('Move').'</legend>';
                 echo build_move_to_selector($user_shared_folders, $move_path, $my_get_move, $group_properties['directory']);
             } else {
-                                    
+
                 echo '<legend>'.get_lang('Move').'</legend>';
                 echo build_move_to_selector($folders, $move_path, $my_get_move, $group_properties['directory']);
             }
@@ -400,35 +400,35 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
     }
 
     if (isset($_POST['move_to']) && isset($_POST['move_file'])) {
-        
+
         if (!$is_allowed_to_edit) {
-            if (DocumentManager::check_readonly($_course, api_get_user_id(), $_POST['move_file'])) {                    
+            if (DocumentManager::check_readonly($_course, api_get_user_id(), $_POST['move_file'])) {
                 api_not_allowed();
             }
         }
 
-        if (api_is_coach()) {               
-            if (!DocumentManager::is_visible_by_id($_POST['move_file'], $_course, api_get_session_id(), api_get_user_id())) {                    
+        if (api_is_coach()) {
+            if (!DocumentManager::is_visible_by_id($_POST['move_file'], $_course, api_get_session_id(), api_get_user_id())) {
                 api_not_allowed();
             }
         }
-        $document_to_move = DocumentManager::get_document_data_by_id($_POST['move_file'], api_get_course_id());            
-        require_once $lib_path.'fileManage.lib.php';        
+        $document_to_move = DocumentManager::get_document_data_by_id($_POST['move_file'], api_get_course_id());
+        require_once $lib_path.'fileManage.lib.php';
         // Security fix: make sure they can't move files that are not in the document table
         if (!empty($document_to_move)) {
-			
+
 			$real_path_target = $base_work_dir.$_POST['move_to'].'/'.basename($document_to_move['path']);
 			$fileExist=false;
 			if(file_exists($real_path_target)){
 				$fileExist=true;
-			}			
-			
+			}
+
             if (move($base_work_dir.$document_to_move['path'], $base_work_dir.$_POST['move_to'])) {
             //if (1) {
             //$contents = DocumentManager::replace_urls_inside_content_html_when_moving_file(basename($document_to_move['path']), $base_work_dir.dirname($document_to_move['path']), $base_work_dir.$_POST['move_to']);
             //exit;
                 update_db_info('update', $document_to_move['path'], $_POST['move_to'].'/'.basename($document_to_move['path']));
-               
+
 			   //update database item property
 			   $doc_id=$_POST['move_file'];
 
@@ -439,12 +439,12 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
 			   elseif(is_file($real_path_target)){
 				   api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentMoved', api_get_user_id(),$to_group_id,null,null,null,$session_id);
 				   Display::display_confirmation_message(get_lang('DocMv'));
-			   }		   
+			   }
 
 				// Set the current path
                 $curdirpath = $_POST['move_to'];
                 $curdirpathurl = urlencode($_POST['move_to']);
-                
+
             } else {
 				if($fileExist){
 					if(is_dir($real_path_target)){
@@ -469,19 +469,19 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
 if($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_folder(api_get_user_id(), $curdirpath, $session_id)){
     if (isset($_GET['delete'])) {
         if (!$is_allowed_to_edit) {
-            if (api_is_coach()) {                
-                if (!DocumentManager::is_visible($_GET['delete'], $_course, api_get_session_id())) {                    
+            if (api_is_coach()) {
+                if (!DocumentManager::is_visible($_GET['delete'], $_course, api_get_session_id())) {
                     api_not_allowed();
                 }
             }
-            
+
             if (DocumentManager::check_readonly($_course, api_get_user_id(), $_GET['delete'], '', true)) {
                 api_not_allowed();
             }
         }
         require_once api_get_path(LIBRARY_PATH).'fileManage.lib.php';
         if (DocumentManager::delete_document($_course, $_GET['delete'], $base_work_dir)) {
-            if ( isset($_GET['delete_certificate_id']) && $_GET['delete_certificate_id'] == strval(intval($_GET['delete_certificate_id']))) {                    
+            if ( isset($_GET['delete_certificate_id']) && $_GET['delete_certificate_id'] == strval(intval($_GET['delete_certificate_id']))) {
                 $default_certificate_id = $_GET['delete_certificate_id'];
                 DocumentManager::remove_attach_certificate(api_get_course_id(), $default_certificate_id);
             }
@@ -529,16 +529,16 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
 
         if ($post_dir_name == '../' || $post_dir_name == '.' || $post_dir_name == '..') {
             Display::display_error_message(get_lang('CannotCreateDir'));
-        } else {            
+        } else {
             if (!empty($_POST['dir_id'])) {
                 $document_data = DocumentManager::get_document_data_by_id($_POST['dir_id'], api_get_course_id());
                 $curdirpath = $document_data['path'];
-            }            
-            $added_slash = ($curdirpath == '/') ? '' : '/';                
+            }
+            $added_slash = ($curdirpath == '/') ? '' : '/';
             $dir_name = $curdirpath.$added_slash.replace_dangerous_char($post_dir_name);
             $dir_name = disable_dangerous_file($dir_name);
             $dir_check = $base_work_dir.$dir_name;
-            
+
             if (!is_dir($dir_check)) {
                 $created_dir = create_unexisting_directory($_course, api_get_user_id(), api_get_session_id(), $to_group_id, $to_user_id, $base_work_dir, $dir_name, $post_dir_name);
                 if ($created_dir) {
@@ -573,13 +573,13 @@ if ($is_allowed_to_edit) {
             $update_id = intval($_GET['set_invisible']);
             $visibility_command = 'invisible';
         }
-        
-        if (!$is_allowed_to_edit) {                
-            if (api_is_coach()) {                
-                if (!DocumentManager::is_visible_by_id($update_id, $_course, api_get_session_id(), api_get_user_id())) {                    
+
+        if (!$is_allowed_to_edit) {
+            if (api_is_coach()) {
+                if (!DocumentManager::is_visible_by_id($update_id, $_course, api_get_session_id(), api_get_user_id())) {
                     api_not_allowed();
                 }
-            }                
+            }
             if (DocumentManager::check_readonly($_course, api_get_user_id(), '', $update_id)) {
                 api_not_allowed();
             }
@@ -622,7 +622,7 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
         $document_id_for_template = intval(Database::escape_string($_GET['add_as_template']));
 
         $title = Security::remove_XSS($_POST['template_title']);
-        //$description = Security::remove_XSS($_POST['template_description']);        
+        //$description = Security::remove_XSS($_POST['template_description']);
         $user_id = api_get_user_id();
 
         // Create the template_thumbnails folder in the upload folder (if needed)
@@ -665,7 +665,7 @@ if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_fold
     }
 
     if (isset($_GET['remove_as_template'])) {
-        $document_id_for_template = intval($_GET['remove_as_template']);        
+        $document_id_for_template = intval($_GET['remove_as_template']);
         $user_id = api_get_user_id();
         DocumentManager::unset_document_as_template($document_id_for_template, $course_code, $user_id);
         Display::display_confirmation_message(get_lang('DocumentUnsetAsTemplate'));
@@ -685,8 +685,8 @@ if (isset($_GET['curdirpath']) && $_GET['curdirpath'] == '/certificates' && isse
 }
 
 /*	GET ALL DOCUMENT DATA FOR CURDIRPATH */
-if (isset($_GET['keyword']) && !empty($_GET['keyword'])) {	
-    $docs_and_folders = DocumentManager::get_all_document_data($_course, $curdirpath, $to_group_id, null, $is_allowed_to_edit || $group_member_with_upload_rights, true);    
+if (isset($_GET['keyword']) && !empty($_GET['keyword'])) {
+    $docs_and_folders = DocumentManager::get_all_document_data($_course, $curdirpath, $to_group_id, null, $is_allowed_to_edit || $group_member_with_upload_rights, true);
 } else {
     $docs_and_folders = DocumentManager::get_all_document_data($_course, $curdirpath, $to_group_id, null, $is_allowed_to_edit || $group_member_with_upload_rights, false);
 }
@@ -702,34 +702,34 @@ if (isset($docs_and_folders) && is_array($docs_and_folders)) {
     // Create a sortable table with our data
     $sortable_data = array();
 
-    $count = 1;    
+    $count = 1;
     foreach ($docs_and_folders as $key => $document_data) {
-        $row = array();        
+        $row = array();
         $row['id']   = $document_data['id'];
         //$row['type'] = $document_data['filetype'];
-        $row['type'] = create_document_link($document_data,  true, $count, $is_visible);        
-       
+        $row['type'] = create_document_link($document_data,  true, $count, $is_visible);
+
         // If the item is invisible, wrap it in a span with class invisible
-        
+
         $is_visible = DocumentManager::is_visible_by_id($document_data['id'], $course_info, api_get_session_id(), api_get_user_id(), false);
-        
+
         $invisibility_span_open  = ($is_visible == 0) ? '<span class="muted">' : '';
         $invisibility_span_close = ($is_visible == 0) ? '</span>' : '';
-                
-        
+
+
         // Size (or total size of a directory)
         $size = $document_data['filetype'] == 'folder' ? get_total_folder_size($document_data['path'], $is_allowed_to_edit) : $document_data['size'];
         $row['size'] = format_file_size($size);
-        
+
         // Get the title or the basename depending on what we're using
         if ($document_data['title'] != '') {
             $document_name = $document_data['title'];
         } else {
             $document_name = basename($document_data['path']);
         }
-        $row['name'] = $document_name;        
+        $row['name'] = $document_name;
         $row['name'] = create_document_link($document_data, false, null, $is_visible).$session_img.'<br />'.$invisibility_span_open.'<i>'.nl2br(htmlspecialchars($document_data['comment'],ENT_QUOTES,$charset)).'</i>'.$invisibility_span_close.$user_link;
-        
+
         // Data for checkbox
         if (($is_allowed_to_edit || $group_member_with_upload_rights) && count($docs_and_folders) > 1) {
             $row[] = $document_data['path'];
@@ -768,19 +768,19 @@ if (isset($docs_and_folders) && is_array($docs_and_folders)) {
 
         // Icons (clickable)
         $row[] = create_document_link($document_data,  true, $count, $is_visible);
-        
+
         $path_info = pathinfo($document_data['path']);
-                
+
         if (isset($path_info['extension']) && in_array($path_info['extension'], array('ogg', 'mp3','wav'))) {
             $count ++;
         }
 
         // Validacion when belongs to a session
         $session_img = api_get_session_image($document_data['session_id'], $_user['status']);
-                
-        // Document title with link        
+
+        // Document title with link
         $row[] = create_document_link($document_data, false, null, $is_visible).$session_img.'<br />'.$invisibility_span_open.'<i>'.nl2br(htmlspecialchars($document_data['comment'],ENT_QUOTES,$charset)).'</i>'.$invisibility_span_close.$user_link;
-    
+
         // Comments => display comment under the document name
         $display_size = format_file_size($size);
         $row[] = '<span style="display:none;">'.$size.'</span>'.$invisibility_span_open.$display_size.$invisibility_span_close;
@@ -792,13 +792,13 @@ if (isset($docs_and_folders) && is_array($docs_and_folders)) {
         $display_date = date_to_str_ago($last_edit_date);
         $row[] = $invisibility_span_open.$display_date.$invisibility_span_close;
         // Admins get an edit column
-        
+
         if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_folder(api_get_user_id(), $curdirpath, $session_id)) {
-            $is_template = isset($document_data['is_template']) ? $document_data['is_template'] : false;            
-            // If readonly, check if it the owner of the file or if the user is an admin            
-            if ($document_data['insert_user_id'] == api_get_user_id() || api_is_platform_admin()) {                
+            $is_template = isset($document_data['is_template']) ? $document_data['is_template'] : false;
+            // If readonly, check if it the owner of the file or if the user is an admin
+            if ($document_data['insert_user_id'] == api_get_user_id() || api_is_platform_admin()) {
                 $edit_icons = build_edit_icons($document_data, $key, $is_template, 0, $is_visible);
-            } else {          
+            } else {
                 $edit_icons = build_edit_icons($document_data, $key, $is_template, $document_data['readonly'], $is_visible);
             }
             $row[] = $edit_icons;
@@ -808,7 +808,7 @@ if (isset($docs_and_folders) && is_array($docs_and_folders)) {
         $row[] = $document_name;
         $total_size = $total_size + $size;
 
-        if ((isset($_GET['keyword']) && search_keyword($document_name, $_GET['keyword'])) || !isset($_GET['keyword']) || empty($_GET['keyword'])) {            
+        if ((isset($_GET['keyword']) && search_keyword($document_name, $_GET['keyword'])) || !isset($_GET['keyword']) || empty($_GET['keyword'])) {
             $sortable_data[] = $row;
         }
     }
@@ -840,13 +840,13 @@ $action_links = 'function action_formatter(cellvalue, options, rowObject) {
                          return \'<a href="?action=edit&id=\'+options.rowId+\'">'.Display::return_icon('edit.png',get_lang('Edit'),'',ICON_SIZE_SMALL).'</a>'.
                          '&nbsp;<a onclick="javascript:if(!confirm('."\'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES))."\'".')) return false;"  href="?action=copy&id=\'+options.rowId+\'">'.Display::return_icon('copy.png',get_lang('Copy'),'',ICON_SIZE_SMALL).'</a>'.
                          '&nbsp;<a onclick="javascript:if(!confirm('."\'".addslashes(api_htmlentities(get_lang("ConfirmYourChoice"),ENT_QUOTES))."\'".')) return false;"  href="?action=delete&id=\'+options.rowId+\'">'.Display::return_icon('delete.png',get_lang('Delete'),'',ICON_SIZE_SMALL).'</a>'.
-                         '\'; 
+                         '\';
                  }';
 $js_content = Display::grid_js('documents',  '' ,$columns,$column_model, $extra_params, $sortable_data, $action_links,true);
 $htmlHeadXtra[] = '<script>
 $(function() {
     // grid definition see the $career->display() function
-    '.$js_content.'         
+    '.$js_content.'
 });
 </script>';
 

+ 7 - 7
main/document/edit_odf.php

@@ -14,7 +14,7 @@ $document_id = $_GET['id'];
 if ($document_id) {
     $document_data = DocumentManager::get_document_data_by_id($document_id);
     if (empty($document_data)) {
-        api_not_allowed();    
+        api_not_allowed();
     }
 } else {
     api_not_allowed();
@@ -22,7 +22,7 @@ if ($document_id) {
 
 //Check user visibility
 //$is_visible = DocumentManager::is_visible_by_id($document_id, $course_info, api_get_session_id(), api_get_user_id());
-$is_visible = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id());
+$is_visible = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id(), api_get_group_id());
 
 if (!api_is_allowed_to_edit() && !$is_visible) {
     api_not_allowed(true);
@@ -44,16 +44,16 @@ if ($show_web_odf) {
     $htmlHeadXtra[] = api_get_js('webodf/webodf.js');
     $htmlHeadXtra[] = api_get_css(api_get_path(WEB_LIBRARY_PATH).'javascript/webodf/webodf.css');
     $htmlHeadXtra[] = '
-    <script type="text/javascript" charset="utf-8">        
+    <script type="text/javascript" charset="utf-8">
         function init() {
                 var odfelement = document.getElementById("odf"),
                 odfcanvas = new odf.OdfCanvas(odfelement);
                 odfcanvas.load("'.$file_url_web.'");
         }
-        $(document).ready(function() {        
+        $(document).ready(function() {
             window.setTimeout(init, 0);
-        });        
-  </script>';  
+        });
+  </script>';
 }
 
 $interbreadcrumb[]=array("url"=>"./document.php?curdirpath=".urlencode($my_cur_dir_path).$req_gid, "name"=> get_lang('Documents'));
@@ -61,7 +61,7 @@ $interbreadcrumb[]=array("url"=>"./document.php?curdirpath=".urlencode($my_cur_d
 // Interbreadcrumb for the current directory root path
 if (empty($document_data['parents'])) {
     $interbreadcrumb[] = array('url' => '#', 'name' => $document_data['title']);
-} else {    
+} else {
     foreach($document_data['parents'] as $document_sub_data) {
         if ($document_data['title'] == $document_sub_data['title']) {
             continue;

+ 11 - 7
main/document/show_content.php

@@ -2,7 +2,7 @@
 /* For licensing terms, see /license.txt */
 /**
  *	@author jmontoya
- *  
+ *
  *	@package chamilo.document
  */
 /**
@@ -28,7 +28,7 @@ if (empty($course_info)) {
     api_not_allowed(true);
 }
 
-//Generate path 
+//Generate path
 if (!$document_id) {
     $document_id = DocumentManager::get_document_id($course_info, $header_file);
 }
@@ -63,22 +63,26 @@ if (is_dir($file_url_sys)) {
 }
 
 //fix the screen when you try to access a protected course through the url
-$is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
+$is_allowed_in_course = $_SESSION['is_allowed_in_course'];
 
 if ($is_allowed_in_course == false) {
     api_not_allowed(true);
 }
 
-
-
 //Check user visibility
 //$is_visible = DocumentManager::is_visible_by_id($document_id, $course_info, api_get_session_id(), api_get_user_id());
-$is_visible = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id());
+$is_visible = DocumentManager::check_visibility_tree(
+    $document_id,
+    api_get_course_id(),
+    api_get_session_id(),
+    api_get_user_id(),
+    api_get_group_id()
+);
+
 if (!api_is_allowed_to_edit() && !$is_visible) {
     api_not_allowed(true);
 }
 
-
 //TODO:clean all code
 
 /*	Main section */

+ 9 - 4
main/document/showinframes.php

@@ -78,15 +78,20 @@ if (is_dir($file_url_sys)) {
 }
 
 //fix the screen when you try to access a protected course through the url
-$is_allowed_in_course = $_SESSION ['is_allowed_in_course'];
-
+$is_allowed_in_course = $_SESSION['is_allowed_in_course'];
 if ($is_allowed_in_course == false) {
     api_not_allowed(true);
 }
 
-//Check user visibility
+// Check user visibility.
 //$is_visible = DocumentManager::is_visible_by_id($document_id, $course_info, api_get_session_id(), api_get_user_id());
-$is_visible = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id());
+$is_visible = DocumentManager::check_visibility_tree(
+    $document_id,
+    api_get_course_id(),
+    api_get_session_id(),
+    api_get_user_id(),
+    api_get_group_id()
+);
 
 if (!api_is_allowed_to_edit() && !$is_visible) {
     api_not_allowed(true);

+ 14 - 7
main/document/showinframesmin.php

@@ -2,7 +2,7 @@
 /* For licensing terms, see /license.txt */
 /**
  *	@author Juan Carlos Raña Trabado (herodoto@telefonica.net)
- *  
+ *
  *	@package chamilo.document
  */
 /**
@@ -24,13 +24,13 @@ $header_file = Security::remove_XSS($_GET['file']);
 $document_id = intval($_GET['id']);
 
 $course_info = api_get_course_info();
-$course_code = api_get_course_id(); 
+$course_code = api_get_course_id();
 
 if (empty($course_info)) {
     api_not_allowed(true);
 }
 
-//Generate path 
+//Generate path
 if (!$document_id) {
     $document_id = DocumentManager::get_document_id($course_info, $header_file);
 }
@@ -70,7 +70,14 @@ if ($is_allowed_in_course == false) {
 
 //Check user visibility
 //$is_visible = DocumentManager::is_visible_by_id($document_id, $course_info, api_get_session_id(), api_get_user_id());
-$is_visible = DocumentManager::check_visibility_tree($document_id, api_get_course_id(), api_get_session_id(), api_get_user_id());
+$is_visible = DocumentManager::check_visibility_tree(
+    $document_id,
+    api_get_course_id(),
+    api_get_session_id(),
+    api_get_user_id(),
+    api_get_group_id()
+);
+
 if (!api_is_allowed_to_edit() && !$is_visible) {
     api_not_allowed(true);
 }
@@ -130,12 +137,12 @@ $htmlHeadXtra[] = '
         //document.getElementById("mainFrame").style.height = ((docHeight-(parseInt(HeaderHeight)+parseInt(FooterHeight)))+60)+"px";
         my_iframe           = document.getElementById("mainFrame");
         new_height          = my_iframe.contentWindow.document.body.scrollHeight;
-        my_iframe.height    = my_iframe.contentWindow.document.body.scrollHeight + "px";        
+        my_iframe.height    = my_iframe.contentWindow.document.body.scrollHeight + "px";
     };
 
     // Fixes the content height of the frame
     window.onload = function() {
-         updateContentHeight();    
+         updateContentHeight();
         '.$js_glossary_in_documents.'
     }
 -->
@@ -158,6 +165,6 @@ if ($pathinfo['extension']=='wav' && preg_match('/_chnano_.wav/i', $file_url_web
 	echo '</div>';
 } else {
 	if ($pathinfo['extension']=='swf'){ $width='83%'; $height='83%';} else {$width='100%'; $height='';}
-	
+
 	echo '<iframe border="0" frameborder="0" scrolling="no" style="width:'.$width.'; height:'.$height.';background-color:#ffffff;" id="mainFrame" name="mainFrame" src="'.$file_url_web.'&amp;rand='.mt_rand(1, 10000).'"></iframe>';
 }