download.php 3.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596
  1. <?php
  2. /* For licensing terms, see /chamilo_license.txt */
  3. /**
  4. ==============================================================================
  5. * This file is responsible for passing requested file attachments from messages
  6. * Html files are parsed to fix a few problems with URLs,
  7. * but this code will hopefully be replaced soon by an Apache URL
  8. * rewrite mechanism.
  9. *
  10. * @package dokeos.messages
  11. ==============================================================================
  12. */
  13. /*
  14. ==============================================================================
  15. MAIN CODE
  16. ==============================================================================
  17. */
  18. session_cache_limiter('public');
  19. require_once '../inc/global.inc.php';
  20. require_once api_get_path(LIBRARY_PATH).'usermanager.lib.php';
  21. require_once api_get_path(LIBRARY_PATH).'group_portal_manager.lib.php';
  22. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  23. // IMPORTANT to avoid caching of documents
  24. header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
  25. header('Cache-Control: public');
  26. header('Pragma: no-cache');
  27. $file_url = $_GET['file'];
  28. //change the '&' that got rewritten to '///' by mod_rewrite back to '&'
  29. $file_url = str_replace('///', '&', $file_url);
  30. //still a space present? it must be a '+' (that got replaced by mod_rewrite)
  31. $file_url = str_replace(' ', '+', $file_url);
  32. $file_url = str_replace('/..', '', $file_url); //echo $doc_url;
  33. $tbl_messsage = Database::get_main_table(TABLE_MESSAGE);
  34. $tbl_messsage_attachment = Database::get_main_table(TABLE_MESSAGE_ATTACHMENT);
  35. $sql= "SELECT filename,message_id FROM $tbl_messsage_attachment WHERE path LIKE BINARY '$file_url'";
  36. $result= Database::query($sql, __FILE__, __LINE__);
  37. $row= Database::fetch_array($result,MYSQL_ASSOC);
  38. $title = str_replace(' ','_', $row['filename']);
  39. $message_id = $row['message_id'];
  40. // allow download only for user sender and user receiver
  41. $sql = "SELECT user_sender_id, user_receiver_id, group_id FROM $tbl_messsage WHERE id = '$message_id'";
  42. $rs= Database::query($sql, __FILE__, __LINE__);
  43. $row_users= Database::fetch_array($rs,MYSQL_ASSOC);
  44. $current_uid = api_get_user_id();
  45. // get message user id for inbox/outbox
  46. $message_uid = '';
  47. $message_type = array('inbox','outbox');
  48. if (in_array($_GET['type'],$message_type)) {
  49. if ($_GET['type'] == 'inbox') {
  50. $message_uid = $row_users['user_receiver_id'];
  51. } else {
  52. $message_uid = $row_users['user_sender_id'];
  53. }
  54. }
  55. // allow to the correct user for download this file
  56. $not_allowed_to_edit = false;
  57. if (!empty($row_users['group_id'])) {
  58. $users_group = GroupPortalManager::get_all_users_by_group($row_users['group_id']);
  59. if (!in_array($current_uid,array_keys($users_group))) {
  60. $not_allowed_to_edit = true;
  61. }
  62. } else {
  63. if ($current_uid != $message_uid) {
  64. $not_allowed_to_edit = true;
  65. }
  66. }
  67. if ($not_allowed_to_edit) {
  68. api_not_allowed();
  69. exit;
  70. }
  71. // set the path directory file
  72. if (!empty($row_users['group_id'])) {
  73. $path_user_info = GroupPortalManager::get_group_picture_path_by_id($row_users['group_id'], 'system', true);
  74. } else {
  75. $path_user_info = UserManager::get_user_picture_path_by_id($message_uid, 'system', true);
  76. }
  77. $full_file_name = $path_user_info['dir'].'message_attachments/'.$file_url;
  78. // launch event
  79. event_download($file_url);
  80. DocumentManager::file_send_for_download($full_file_name,TRUE, $title);
  81. exit;