dropbox_cnf('maxFilesize')) {
$errormsg = get_lang('TooBig'); // TODO: The "too big" message does not fit in the case of uploading zero-sized file.
$error = true;
} elseif (!is_uploaded_file($dropbox_filetmpname)) { // check user fraud : no clean error msg.
die(get_lang('BadFormData').' (code 403)');
}
if (!$error) {
// Try to add an extension to the file if it hasn't got one
$dropbox_filename = add_ext_on_mime($dropbox_filename, $dropbox_filetype);
// Replace dangerous characters
$dropbox_filename = replace_dangerous_char($dropbox_filename);
// Transform any .php file in .phps fo security
$dropbox_filename = php2phps($dropbox_filename);
if (!filter_extension($dropbox_filename)) {
$error = true;
$errormsg = get_lang('UplUnableToSaveFileFilteredExtension');
} else {
// set title
$dropbox_title = $dropbox_filename;
// set author
if ($_POST['authors'] == '') {
$_POST['authors'] = getUserNameFromId($_user['user_id']);
}
if ($dropbox_overwrite) {
$dropbox_person = new Dropbox_Person($_user['user_id'], $is_courseAdmin, $is_courseTutor);
foreach ($dropbox_person->sentWork as $w) {
if ($w->title == $dropbox_filename) {
if (($w->recipients[0]['id'] > dropbox_cnf('mailingIdBase')) xor $thisIsAMailing) {
$error = true;
$errormsg = get_lang('MailingNonMailingError');
}
if ( ($w->recipients[0]['id'] == $_user['user_id']) xor $thisIsJustUpload) {
$error = true;
$errormsg = get_lang('MailingJustUploadSelectNoOther');
}
$dropbox_filename = $w->filename;
$found = true;
break;
}
}
} else {
// rename file to login_filename_uniqueId format
$dropbox_filename = getLoginFromId( $_user['user_id']) . '_' . $dropbox_filename . '_'.uniqid('');
}
if (!is_dir(dropbox_cnf('sysPath'))) {
//The dropbox subdir doesn't exist yet so make it and create the .htaccess file
mkdir(dropbox_cnf('sysPath'), api_get_permissions_for_new_directories()) or die(get_lang('ErrorCreatingDir').' (code 404)');
$fp = fopen(dropbox_cnf('sysPath').'/.htaccess', 'w') or die(get_lang('ErrorCreatingDir').' (code 405)');
fwrite($fp, "AuthName AllowLocalAccess
AuthType Basic
order deny,allow
deny from all
php_flag zlib.output_compression off") or die(get_lang('ErrorCreatingDir').' (code 406)');
}
if ($error) {}
elseif ($thisIsAMailing) {
if (preg_match(dropbox_cnf('mailingZipRegexp'), $dropbox_title)) {
$newWorkRecipients = dropbox_cnf('mailingIdBase');
} else {
$error = true;
$errormsg = $dropbox_title . ': ' . get_lang('MailingWrongZipfile');
}
} elseif ($thisIsJustUpload) {
$newWorkRecipients = array();
} else {
// Creating the array that contains all the users who will receive the file
$newWorkRecipients = array();
foreach ($_POST['recipients'] as $rec) {
if (strpos($rec, 'user_') === 0) {
$newWorkRecipients[] = substr($rec, strlen('user_'));
} elseif (strpos($rec, 'group_') === 0) {
$userList = GroupManager::get_subscribed_users(substr($rec, strlen('group_')));
foreach ($userList as $usr) {
if (!in_array($usr['user_id'], $newWorkRecipients) && $usr['user_id'] != $_user['user_id']) {
$newWorkRecipients[] = $usr['user_id'];
}
}
}
}
}
// After uploading the file, create the db entries
if (!$error) {
@move_uploaded_file( $dropbox_filetmpname, dropbox_cnf('sysPath') . '/' . $dropbox_filename)
or die(get_lang('UploadError').' (code 407)');
new Dropbox_SentWork($_user['user_id'], $dropbox_title, $_POST['description'], strip_tags($_POST['authors']), $dropbox_filename, $dropbox_filesize, $newWorkRecipients);
}
}
}
} //end if(!$error)
/**
* SUBMIT FORM RESULTMESSAGE
*/
if (!$error) {
$return_message = get_lang('FileUploadSucces');
} else {
$return_message = $errormsg;
}
} // end if ( isset( $_POST['submitWork']))
/**
* EXAMINE OR SEND MAILING (NEW)
* @deprecated The $_GET[mailingIndex] is never called
*/
/*
if (isset($_GET['mailingIndex'])) {
// examine or send
$dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor);
if (isset($_SESSION['sentOrder'])) {
$dropbox_person->orderSentWork($_SESSION['sentOrder']);
}
$i = $_GET['mailingIndex'];
$mailing_item = $dropbox_person->sentWork[$i];
$mailing_title = $mailing_item->title;
$mailing_file = dropbox_cnf('sysPath') . '/' . $mailing_item->filename;
$errormsg = '' . $mailing_item->recipients[0]['name'] . ' ('
. ""
. htmlspecialchars($mailing_title, ENT_QUOTES, api_get_system_encoding()) . '):
';
if (preg_match( dropbox_cnf('mailingZipRegexp'), $mailing_title, $nameParts)) {
$var = api_strtoupper($nameParts[2]); // the variable part of the name
$course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
$sel = "SELECT u.user_id, u.lastname, u.firstname, cu.status
FROM ".$_configuration['main_database'].".user u
LEFT JOIN $course_user cu
ON cu.user_id = u.user_id AND cu.relation_type<>".COURSE_RELATION_TYPE_RRHH." AND cu.course_code = '".$_course['sysCode']."'";
$sel .= " WHERE u.".dropbox_cnf("mailingWhere".$var)." = '";
$preFix = $nameParts[1]; $postFix = $nameParts[3];
$preLen = api_strlen($preFix); $postLen = api_strlen($postFix);
require api_get_path(LIBRARY_PATH) . 'pclzip/pclzip.lib.php';
$zipFile = new PclZip($mailing_file);
$goodFiles = array();
$zipContent = $zipFile->listContent();
$ucaseFiles = array();
if ($zipContent) {
foreach( $zipFile->listContent() as $thisContent) {
$thisFile = substr(strrchr('/' . $thisContent['filename'], '/'), 1);
$thisFileUcase = strtoupper($thisFile);
if (preg_match("~.(php.*|phtml)$~i", $thisFile)) {
$error = true;
$errormsg .= $thisFile . ': ' . get_lang('MailingZipPhp');
break;
} elseif (!$thisContent['folder']) {
if ($ucaseFiles[$thisFileUcase]) {
$error = true;
$errormsg .= $thisFile . ': ' . get_lang('MailingZipDups');
break;
} else {
$goodFiles[$thisFile] = findRecipient($thisFile);
$ucaseFiles[$thisFileUcase] = 'yep';
}
}
}
} else {
$error = true;
$errormsg .= get_lang('MailingZipEmptyOrCorrupt');
}
if (!$error) {
$students = array(); // collect all recipients in this course
foreach ($goodFiles as $thisFile => $thisRecip) {
$errormsg .= htmlspecialchars($thisFile, ENT_QUOTES, api_get_system_encoding()) . ': ';
if (is_string($thisRecip)) { // see findRecipient
$errormsg .= ''
. htmlspecialchars($thisRecip, ENT_QUOTES, api_get_system_encoding()) . '
';
} else {
if ( isset( $_GET['mailingSend'])) {
$errormsg .= get_lang('MailingFileSentTo');
} else {
$errormsg .= get_lang('MailingFileIsFor');
}
$errormsg .= htmlspecialchars(api_get_person_name($thisRecip[2], $thisRecip[1]), ENT_QUOTES, api_get_system_encoding());
if (is_null($thisRecip[3])) {
$errormsg .= get_lang('MailingFileNotRegistered');
} else {
$students[] = $thisRecip[0];
}
$errormsg .= '
';
}
}
// find student course members not among the recipients
$course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
$sql = "SELECT u.lastname, u.firstname
FROM $course_user cu
LEFT JOIN ".$_configuration['main_database'].".user u
ON cu.user_id = u.user_id AND cu.course_code = '".$_course['sysCode']."'
WHERE cu.status = 5
AND u.user_id NOT IN ('" . implode("', '" , $students) . "')";
$result = Database::query($sql);
if (Database::num_rows($result) > 0) {
$remainingUsers = '';
while ($res = Database::fetch_array($result)) {
$remainingUsers .= ', ' . htmlspecialchars(api_get_person_name($res[1], $res[0]), ENT_QUOTES, api_get_system_encoding());
}
$errormsg .= '
' . get_lang('MailingNothingFor') . api_substr($remainingUsers, 1) . '.
';
}
if (isset($_GET['mailingSend'])) {
chdir(dropbox_cnf('sysPath'));
$zipFile->extract(PCLZIP_OPT_REMOVE_ALL_PATH);
$mailingPseudoId = dropbox_cnf('mailingIdBase') + $mailing_item->id;
foreach ($goodFiles as $thisFile => $thisRecip) {
if (is_string($thisRecip)) { // remove problem file
@unlink(dropbox_cnf('sysPath') . '/' . $thisFile);
} else {
$newName = getLoginFromId( $_user['user_id']) . '_' . $thisFile . '_' . uniqid('');
if (rename(dropbox_cnf('sysPath') . '/' . $thisFile, dropbox_cnf('sysPath') . '/' . $newName))
new Dropbox_SentWork($mailingPseudoId, $thisFile, $mailing_item->description, $mailing_item->author, $newName, $thisContent['size'], array($thisRecip[0]));
}
}
$sendDT = api_get_utc_datetime();
// set filesize to zero on send, to avoid 2nd send (see index.php)
$sql = "UPDATE ".dropbox_cnf("tbl_file")."
SET filesize = '0' , upload_date = '".$sendDT."', last_upload_date = '".$sendDT."'
WHERE id='".addslashes($mailing_item->id)."'";
$result = Database::query($sql);
} elseif ($mailing_item->filesize != 0) {
$errormsg .= '
' . get_lang('MailingNotYetSent') . '
';
}
}
} else {
$error = true;
$errormsg .= get_lang('MailingWrongZipfile');
}
//EXAMINE OR SEND MAILING RESULTMESSAGE
if ($error) {
?>
">
">
';
} else {
return ' <'.get_lang('MailingFileNoPostfix', '').$postFix.'>';
}
} else {
return ' <'.get_lang('MailingFileNoPrefix', '').$preFix.'>';
}
} else {
return ' <'.get_lang('MailingFileFunny', '').'>';
}
}
function getUser($thisRecip) {
// string result = error message, array result = [user_id, lastname, firstname]
global $var, $sel;
if (isset($students)) {
unset($students);
}
$result = Database::query($sel . $thisRecip . "'");
while ( ($res = Database::fetch_array($result))) {$students[] = $res;}
Database::free_result($result);
if (count($students) == 1) {
return($students[0]);
} elseif (count($students) > 1) {
return ' <'.get_lang('MailingFileRecipDup', '').$var."= $thisRecip>";
} else {
return ' <'.get_lang('MailingFileRecipNotFound', '').$var."= $thisRecip>";
}
}
/**
* DELETE RECEIVED OR SENT FILES - EDIT FEEDBACK
* - DELETE ALL RECEIVED FILES
* - DELETE 1 RECEIVED FILE
* - DELETE ALL SENT FILES
* - DELETE 1 SENT FILE
* - EDIT FEEDBACK
*/
if (isset($_GET['deleteReceived']) || isset($_GET['deleteSent'])
|| isset( $_GET['showFeedback']) || isset( $_GET['editFeedback'])) {
if ($_GET['mailing']) {
getUserOwningThisMailing($_GET['mailing'], $_user['user_id'], '408');
$dropbox_person = new Dropbox_Person($_GET['mailing'], $is_courseAdmin, $is_courseTutor);
} else {
$dropbox_person = new Dropbox_Person($_user['user_id'], $is_courseAdmin, $is_courseTutor);
}
if (isset($_SESSION['sentOrder'])) {
$dropbox_person->orderSentWork($_SESSION['sentOrder']);
}
if (isset($_SESSION['receivedOrder'])) {
$dropbox_person->orderReceivedWork($_SESSION['receivedOrder']);
}
/*if (!$dropbox_person->isCourseAdmin || ! $dropbox_person->isCourseTutor) {
die(get_lang('GeneralError').' (code 408)');
}*/
$tellUser = get_lang('FileDeleted');
if (isset($_GET['deleteReceived'])) {
if ($_GET['deleteReceived'] == 'all') {
$dropbox_person->deleteAllReceivedWork();
} elseif (is_numeric($_GET['deleteReceived'])) {
$dropbox_person->deleteReceivedWork( $_GET['deleteReceived']);
} else {
die(get_lang('GeneralError').' (code 409)');
}
} elseif (isset( $_GET['deleteSent'])) {
if ($_GET['deleteSent'] == 'all') {
$dropbox_person->deleteAllSentWork( );
} elseif (is_numeric($_GET['deleteSent'])) {
$dropbox_person->deleteSentWork($_GET['deleteSent']);
} else {
die(get_lang('GeneralError').' (code 410)');
}
} elseif (isset($_GET['showFeedback'])) {
$w = new Dropbox_SentWork($id = $_GET['showFeedback']);
if ($w->uploader_id != $_user['user_id']) {
getUserOwningThisMailing($w->uploader_id, $_user['user_id'], '411');
}
foreach ($w -> recipients as $r) {
if (($fb = $r['feedback'])) {
$fbarray[$r['feedback_date'].$r['name']] = $r['name'].' '.get_lang('SentOn', '').' '.$r['feedback_date'].":\n".$fb;
}
}
if ($fbarray) {
krsort($fbarray);
echo '', "\n";
} else {
echo '', "\n";
}
$tellUser = get_lang('ShowFeedback');
} else { // if ( isset( $_GET['editFeedback'])) {
$id = $_GET['editFeedback'];
$found = false;
foreach ($dropbox_person->receivedWork as $w) {
if ($w->id == $id) {
$found = true;
break;
}
}
if (!$found) die(get_lang('GeneralError').' (code 415)');
echo '