0) {
$file = $_POST['filename'];
} else {
$file = 'image';
}
if ($suffix == 'svg') {
$mime = 'image/svg+xml';
$contents = rawurldecode($_POST['output_svg']);
} else {
$mime = 'image/png';
$contents = $_POST['output_png'];
$pos = (strpos($contents, 'base64,') + 7);
$contents = base64_decode(substr($contents, $pos));
}
//get SVG-Edit values
$filename = $file; //from svg-edit
$extension = $suffix; // from svg-edit
$content = $contents; //from svg-edit
$title = Database::escape_string(str_replace('_', ' ', $filename));
//get Chamilo variables
if (!isset($_SESSION['draw_dir']) && !isset($_SESSION['whereami'])) {
api_not_allowed(); //from Chamilo
die();
}
$current_session_id = api_get_session_id();
$groupId = api_get_group_id();
$relativeUrlPath = $_SESSION['draw_dir'];
$currentTool = $_SESSION['whereami'];
$dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
$saveDir = $dirBaseDocuments.$_SESSION['draw_dir'];
//a bit title security
$filename = addslashes(trim($filename));
$filename = Security::remove_XSS($filename);
$filename = api_replace_dangerous_char($filename, 'strict');
$filename = FileManager::disable_dangerous_file($filename);
// a bit extension
if ($suffix != 'svg' && $suffix != 'png') {
die();
}
//a bit mime security
//comment because finfo seems stopping the save process files in some php vers.
/*
if (phpversion() >= '5.3' && extension_loaded('fileinfo')) {
$finfo = new finfo(FILEINFO_MIME);
$current_mime=$finfo->buffer($contents);
finfo_close($finfo);
$mime_png='image/png';//svg-edit return image/png; charset=binary
$mime_svg='image/svg+xml';
$mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii. See
if(strpos($current_mime, $mime_png)===false && $extension=='png') {
die();//File extension does not match its content
} elseif(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg') {
die();//File extension does not match its content
}
}
*/
//checks if the file exists, then rename the new
if (file_exists($saveDir.'/'.$filename.$i.'.'.$extension) && $currentTool == 'document/createdraw') {
echo '';
die();
} else {
$drawFileName = $filename.'.'.$extension;
$title = $title.'.'.$extension;
}
$documentPath = $saveDir.'/'.$drawFileName;
//make a temporal file for get the file size
$tmpfname = tempnam("/tmp", "CTF");
$handle = fopen($tmpfname, "w");
fwrite($handle, $contents);
fclose($handle);
// Check if there is enough space in the course to save the file
if (!DocumentManager::enough_space(filesize($tmpfname), DocumentManager::get_course_quota())) {
unlink($tmpfname);
die(get_lang('UplNotEnoughSpace'));
}
//erase temporal file
unlink($tmpfname);
//add new document to disk
file_put_contents($documentPath, $contents);
if ($currentTool == 'document/createdraw') {
//add document to database
$doc_id = FileManager::add_document(
$_course,
$relativeUrlPath.'/'.$drawFileName,
'file',
filesize($documentPath),
$title
);
api_item_property_update(
$_course,
TOOL_DOCUMENT,
$doc_id,
'DocumentAdded',
$_user['user_id'],
$groupId,
null,
null,
null,
$current_session_id
);
} elseif ($currentTool == 'document/editdraw') {
//check path
if (!isset($_SESSION['draw_file'])) {
api_not_allowed(); //from Chamilo
die();
}
if ($_SESSION['draw_file'] == $drawFileName) {
$document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$drawFileName);
FileManager::update_existing_document($_course, $document_id, filesize($documentPath), null);
api_item_property_update(
$_course,
TOOL_DOCUMENT,
$document_id,
'DocumentUpdated',
$_user['user_id'],
$groupId,
null,
null,
null,
$current_session_id
);
} else {
//add a new document
$doc_id = FileManager::add_document(
$_course,
$relativeUrlPath.'/'.$drawFileName,
'file',
filesize($documentPath),
$title
);
api_item_property_update(
$_course,
TOOL_DOCUMENT,
$doc_id,
'DocumentAdded',
$_user['user_id'],
$groupId,
null,
null,
null,
$current_session_id
);
}
}
//clean sessions and add messages and return to current document list
unset($_SESSION['draw_dir']);
unset($_SESSION['draw_file']);
unset($_SESSION['whereami']);
echo '';