api.php 7.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215
  1. <?php
  2. /* See license terms in /dokeos_license.txt */
  3. /**
  4. ==============================================================================
  5. * This is an interface between Dokeos and Videoconference application
  6. *
  7. ==============================================================================
  8. */
  9. /*==== DEBUG ====*/
  10. $debug=0;
  11. /*==== CONSTANTS ==== */
  12. define('VIDEOCONF_UPLOAD_PATH', '/videoconf');
  13. $presentation_extension = array('.ppt', '.odp');
  14. $image_extension = array ('.png', '.jpg', '.gif', '.jpeg');
  15. if ($debug>0)
  16. {
  17. // dump the request
  18. $v = array_keys(get_defined_vars());
  19. error_log(var_export($v, true),3, '/tmp/log');
  20. foreach (array_keys(get_defined_vars()) as $k) {
  21. if ($k == 'GLOBALS')
  22. continue;
  23. error_log($k, 3, '/tmp/log');
  24. error_log(var_export($$k, true), 3, '/tmp/log');
  25. }
  26. }
  27. /*==== INCLUDE ====*/
  28. require_once ('../inc/global.inc.php');
  29. api_block_anonymous_users();
  30. require_once (api_get_path(LIBRARY_PATH)."course.lib.php");
  31. require_once (api_get_path(LIBRARY_PATH)."document.lib.php");
  32. require_once (api_get_path(LIBRARY_PATH)."fileUpload.lib.php");
  33. require_once ("../newscorm/learnpath.class.php");
  34. require_once ("../newscorm/openoffice_presentation.class.php");
  35. /*==== Variables initialisation ====*/
  36. $action = $_REQUEST["action"]; //safe as only used in if()'s
  37. $seek = array('/','%2F','..');
  38. $destroy = array('','','');
  39. $cidReq = str_replace($seek,$destroy,$_REQUEST["cidReq"]);
  40. $cidReq = Security::remove_XSS($cidReq);
  41. $user_id = api_get_user_id();
  42. $coursePath = api_get_path(SYS_COURSE_PATH).$cidReq.'/document';
  43. $_course = CourseManager::get_course_information($cidReq);
  44. $_course['path'] = $_course['directory'];
  45. // FIXME: add_document needs this to work
  46. $_course['dbName'] = $_course['db_name'];
  47. // FIXME: check if CourseManager::get_user_in_course_status return !=
  48. // COURSEMANAGER when the code is not valid
  49. if ($debug>0) error_log($coursePath, 0);
  50. if ($action == "uploadgui")
  51. {
  52. echo '<form enctype="multipart/form-data" action="api.php" method="POST">
  53. <input type="hidden" name="MAX_FILE_SIZE" value="100000000" />
  54. <input type="hidden" name="action" value="upload" />
  55. <input type="hidden" name="cidReq" value="'.$cidReq.'" />
  56. <input type="hidden" name="sid" value="'.Security::remove_XSS($_REQUEST["sid"]).'" />
  57. Choose a file to upload: <input name="filedata" type="file" /><br />
  58. <input type="submit" value="Upload File" />
  59. </form>
  60. ';
  61. die();
  62. }
  63. else if ($action == "upload")
  64. {
  65. /*==== PERMISSION ====*/
  66. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  67. if ($permissions != COURSEMANAGER)
  68. {
  69. if ($debug >0) error_log("Upload from videoconf not allowed !!!",0);
  70. die('Not allowed'); // this user is not allowed to add upload documents
  71. }
  72. /*==== UPLOAD ====*/
  73. $destPath = $coursePath.VIDEOCONF_UPLOAD_PATH;
  74. $newPath = handle_uploaded_document($_course,$_FILES['filedata'],$coursePath,VIDEOCONF_UPLOAD_PATH,$user_id,0,NULL,'',0,'rename',false);
  75. error_log($newPath);
  76. $file_name = (strrpos($newPath,'.')>0 ? substr($newPath, 0, strrpos($newPath,'.')) : $newPath);
  77. $file_extension = (strrpos($newPath,'.')>0 ? substr($newPath, strrpos($newPath,'.'),10) : '');
  78. error_log(strrpos($newPath,'.'));
  79. error_log($file_extension);
  80. if (!in_array(strtolower($file_extension), $image_extension))
  81. {
  82. error_log('toc');
  83. if (!is_dir($destPath))
  84. {
  85. $result = create_unexisting_directory($_course,$user_id,0,NULL,$coursePath,VIDEOCONF_UPLOAD_PATH);
  86. if (!$result)
  87. {
  88. if ($debug>0) error_log("Can't create ".$destPath." folder",0);
  89. }
  90. }
  91. $take_slide_name = false;
  92. $o_ppt = new OpenofficePresentation($take_slide_name);
  93. $o_ppt -> convert_document($_FILES['filedata'],'add_docs_to_visio');
  94. }
  95. echo '<html><body><script language="javascript">setTimeout(1000,window.close());</script></body></html>';
  96. }
  97. else if ($action == "service")
  98. {
  99. /*==== List files ====*/
  100. if ($debug>0) error_log("sending file list",0);
  101. $subaction = $_REQUEST["subaction"];
  102. $is_manager = (CourseManager::get_user_in_course_status($user_id, $cidReq) == COURSEMANAGER);
  103. if ($subaction == "list")
  104. {
  105. // FIXME: check security around $_REQUEST["cwd"]
  106. $cwd = $_REQUEST["cwd"];
  107. // treat /..
  108. $nParent = 0; // the number of /.. into the url
  109. while (substr($cwd, -3, 3) == "/..")
  110. {
  111. // go to parent directory
  112. $cwd= substr($cwd, 0, -3);
  113. if (strlen($cwd) == 0) $cwd="/";
  114. $nParent++;
  115. }
  116. for (;$nParent >0; $nParent--){
  117. $cwd = (strrpos($cwd,'/')>-1 ? substr($cwd, 0, strrpos($cwd,'/')) : $cwd);
  118. }
  119. if (strlen($cwd) == 0) $cwd="/";
  120. if (Security::check_abs_path($cwd,api_get_path(SYS_PATH)))
  121. die();
  122. // check if user can delete files. He must be manager and be inside /videoconf
  123. $is_below_videoconf_dir = (substr($cwd,0,strlen(VIDEOCONF_UPLOAD_PATH)) == VIDEOCONF_UPLOAD_PATH);
  124. error_log($cwd);
  125. error_log(VIDEOCONF_UPLOAD_PATH);
  126. /* $canDelete = ($canDelete && $isBellowVideoConfUploadPath);
  127. */
  128. $can_delete = ($is_manager && $is_below_videoconf_dir);
  129. // get files list
  130. $files = DocumentManager::get_all_document_data($_course, $cwd, 0, NULL, false);
  131. printf("<dokeosobject><fileListMeta></fileListMeta><fileList>");
  132. printf("<folders>");
  133. // title filter
  134. foreach (array_keys($files) as $k)
  135. $files[$k]['title'] = strlen($files[$k]['title']) > 32 ? substr($files[$k]['title'],0, 32)."..." : $files[$k]['title'];
  136. foreach($files as $i)
  137. {
  138. if ($i["filetype"] == "folder")
  139. printf('<folder><path>%s</path><title>%s</title><canDelete>%s</canDelete></folder>', $i['path'],$i['title'],($can_delete?'true':'false'));
  140. }
  141. printf("</folders><files>");
  142. foreach($files as $i) {
  143. $extension = (strrpos($i['path'],'.')>0 ? substr($i['path'], strrpos($i['path'],'.'),10) : '');
  144. if ($i["filetype"] == "file" && in_array(strtolower($extension), $image_extension))
  145. printf('<file><path>%s</path><title>%s</title><canDelete>%s</canDelete></file>', $i['path'],$i['title'],($can_delete?'true':'false'));
  146. }
  147. printf("</files><ppts>");
  148. printf("</ppts>");
  149. printf("</fileList></dokeosobject>");
  150. }
  151. else if ($subaction == "delete")
  152. {
  153. /*==== PERMISSION ====*/
  154. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  155. if ($permissions != COURSEMANAGER)
  156. {
  157. if ($debug > 0) error_log("Upload from videoconf not allowed !!!",0);
  158. die(); // this user is not allowed to add upload documents
  159. }
  160. /*==== DELETE ====*/
  161. $path = str_replace('../','',$_REQUEST["path"]);
  162. if ((substr($path,0,strlen(VIDEOCONF_UPLOAD_PATH)) != VIDEOCONF_UPLOAD_PATH))
  163. {
  164. if ($debug >0 ) error_log("Delete from videoconf for "+$path+" NOT ALLOWED",0);
  165. die();
  166. }
  167. DocumentManager::delete_document($_course, $path, $coursePath);
  168. echo "<result>OK</result>"; // We have to returns something to OpenLaszlo
  169. }
  170. }
  171. else if ($action == "download")
  172. {
  173. /*==== DOWNLOAD ====*/
  174. //check if the document is in the database
  175. if(!DocumentManager::get_document_id($_course,$_REQUEST['file']))
  176. {
  177. //file not found!
  178. if ($debug>0) error_log("404 ".$_REQUEST["file"]);
  179. header("HTTP/1.0 404 Not Found");
  180. $error404 = '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">';
  181. $error404 .= '<html><head>';
  182. $error404 .= '<title>404 Not Found</title>';
  183. $error404 .= '</head><body>';
  184. $error404 .= '<h1>Not Found</h1>';
  185. $error404 .= '<p>The requested URL was not found on this server.</p>';
  186. $error404 .= '<hr>';
  187. $error404 .= '</body></html>';
  188. echo($error404);
  189. exit;
  190. }
  191. $doc_url = str_replace('../','',$_REQUEST['file']);
  192. if ($debug >0) error_log($doc_url);
  193. $full_file_name = $coursePath.$doc_url;
  194. DocumentManager::file_send_for_download($full_file_name,false);
  195. exit;
  196. }
  197. ?>