api.php 6.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207
  1. <?php
  2. /* See license terms in /dokeos_license.txt */
  3. /**
  4. ==============================================================================
  5. * This is an interface between Dokeos and Videoconference application
  6. *
  7. ==============================================================================
  8. */
  9. /*==== DEBUG ====*/
  10. $debug=0;
  11. /*==== CONSTANTS ==== */
  12. define('VIDEOCONF_UPLOAD_PATH', '/videoconf');
  13. $presentation_extension = array('.ppt', '.odp');
  14. $image_extension = array ('.png', '.jpg', '.gif', '.jpeg');
  15. if ($debug>0)
  16. {
  17. // dump the request
  18. $v = array_keys(get_defined_vars());
  19. error_log(var_export($v, true),3, '/tmp/log');
  20. foreach (array_keys(get_defined_vars()) as $k) {
  21. if ($k == 'GLOBALS')
  22. continue;
  23. error_log($k, 3, '/tmp/log');
  24. error_log(var_export($$k, true), 3, '/tmp/log');
  25. }
  26. }
  27. /*==== INCLUDE ====*/
  28. require_once ('../inc/global.inc.php');
  29. api_block_anonymous_users();
  30. require_once (api_get_path(LIBRARY_PATH)."course.lib.php");
  31. require_once (api_get_path(LIBRARY_PATH)."document.lib.php");
  32. require_once (api_get_path(LIBRARY_PATH)."fileUpload.lib.php");
  33. require_once ("../newscorm/learnpath.class.php");
  34. require_once ("../newscorm/openoffice_presentation.class.php");
  35. /*==== Variables initialisation ====*/
  36. $action = $_REQUEST["action"]; //safe as only used in if()'s
  37. $seek = array('/','%2F','..');
  38. $destroy = array('','','');
  39. $cidReq = str_replace($seek,$destroy,$_REQUEST["cidReq"]);
  40. $cidReq = Security::remove_XSS($cidReq);
  41. $user_id = api_get_user_id();
  42. $coursePath = api_get_path(SYS_COURSE_PATH).$cidReq.'/document';
  43. $_course = CourseManager::get_course_information($cidReq);
  44. $_course['path'] = $_course['directory'];
  45. // FIXME: add_document needs this to work
  46. $_course['dbName'] = $_course['db_name'];
  47. // FIXME: check if CourseManager::get_user_in_course_status return !=
  48. // COURSEMANAGER when the code is not valid
  49. if ($debug>0) error_log($coursePath, 0);
  50. if ($action == "uploadgui")
  51. {
  52. echo '<form enctype="multipart/form-data" action="api.php" method="POST">
  53. <input type="hidden" name="MAX_FILE_SIZE" value="100000000" />
  54. <input type="hidden" name="action" value="upload" />
  55. <input type="hidden" name="cidReq" value="'.$cidReq.'" />
  56. <input type="hidden" name="sid" value="'.Security::remove_XSS($_REQUEST["sid"]).'" />
  57. Choose a file to upload: <input name="filedata" type="file" /><br />
  58. <input type="submit" value="Upload File" />
  59. </form>
  60. ';
  61. die();
  62. }
  63. else if ($action == "upload")
  64. {
  65. /*==== PERMISSION ====*/
  66. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  67. if ($permissions != COURSEMANAGER)
  68. {
  69. if ($debug >0) error_log("Upload from videoconf not allowed !!!",0);
  70. die('Not allowed'); // this user is not allowed to add upload documents
  71. }
  72. /*==== UPLOAD ====*/
  73. $destPath = $coursePath.VIDEOCONF_UPLOAD_PATH;
  74. if (!is_dir($destPath))
  75. {
  76. $result = create_unexisting_directory($_course,$user_id,0,NULL,$coursePath,VIDEOCONF_UPLOAD_PATH);
  77. if (!$result)
  78. {
  79. if ($debug>0) error_log("Can't create ".$destPath." folder",0);
  80. }
  81. }
  82. $take_slide_name = false;
  83. $o_ppt = new OpenofficePresentation($take_slide_name);
  84. $o_ppt -> convert_document($_FILES['filedata'],'add_docs_to_visio');
  85. echo '<html><body><script language="javascript">setTimeout(1000,window.close());</script></body></html>';
  86. }
  87. else if ($action == "service")
  88. {
  89. /*==== List files ====*/
  90. if ($debug>0) error_log("sending file list",0);
  91. $subaction = $_REQUEST["subaction"];
  92. $can_delete = (CourseManager::get_user_in_course_status($user_id, $cidReq) == COURSEMANAGER);
  93. if ($subaction == "list")
  94. {
  95. // FIXME: check security around $_REQUEST["cwd"]
  96. $cwd = $_REQUEST["cwd"];
  97. $is_bellow_videoconf_upload_path = Security::check_abs_path($cwd,api_get_path(SYS_PATH));
  98. /*
  99. // treat /..
  100. $nParent = 0; // the number of /.. into the url
  101. while (substr($cwd, -3, 3) == "/..")
  102. {
  103. // go to parent directory
  104. $cwd= substr($cwd, 0, -3);
  105. if (strlen($cwd) == 0) $cwd="/";
  106. $nParent++;
  107. }
  108. for (;$nParent >0; $nParent--){
  109. $cwd = (strrpos($cwd,'/')>-1 ? substr($cwd, 0, strrpos($cwd,'/')) : $cwd);
  110. }
  111. if (strlen($cwd) == 0) $cwd="/";
  112. // check if user can delete files. He must be manager and be inside /videoconf
  113. $isBellowVideoConfUploadPath = (substr($cwd,0,strlen(VIDEOCONF_UPLOAD_PATH)) == VIDEOCONF_UPLOAD_PATH);
  114. $canDelete = ($canDelete && $isBellowVideoConfUploadPath);
  115. */
  116. $can_delete = ($can_delete && $is_bellow_videoconf_upload_path);
  117. // get files list
  118. $files = DocumentManager::get_all_document_data($_course, $cwd, 0, NULL, false);
  119. printf("<dokeosobject><fileListMeta></fileListMeta><fileList>");
  120. printf("<folders>");
  121. foreach($files as $i)
  122. {
  123. if ($i["filetype"] != "folder")
  124. {
  125. continue;
  126. }
  127. else
  128. {
  129. printf('<folder><path>%s</path><title>%s</title><canDelete>%s</canDelete></folder>', $i['path'],$i['title'],($can_delete?'true':'false'));
  130. }
  131. }
  132. printf("</folders><files>");
  133. foreach($files as $i) {
  134. $extension = (strrpos($i['path'],'.')>0 ? substr($i['path'], strrpos($i['path'],'.'),10) : '');
  135. if ($i["filetype"] != "file" || !in_array($extension, $image_extension))
  136. {
  137. continue;
  138. }
  139. else
  140. {
  141. printf('<file><path>%s</path><title>%s</title><canDelete>%s</canDelete></file>', $i['path'],$i['title'],($can_delete?'true':'false'));
  142. }
  143. }
  144. printf("</files><ppts>");
  145. printf("</ppts>");
  146. printf("</fileList></dokeosobject>");
  147. }
  148. else if ($subaction == "delete")
  149. {
  150. /*==== PERMISSION ====*/
  151. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  152. if ($permissions != COURSEMANAGER)
  153. {
  154. if ($debug > 0) error_log("Upload from videoconf not allowed !!!",0);
  155. die(); // this user is not allowed to add upload documents
  156. }
  157. /*==== DELETE ====*/
  158. $path = str_replace('../','',$_REQUEST["path"]);
  159. if ((substr($path,0,strlen(VIDEOCONF_UPLOAD_PATH)) != VIDEOCONF_UPLOAD_PATH))
  160. {
  161. if ($debug >0 ) error_log("Delete from videoconf for "+$path+" NOT ALLOWED",0);
  162. die();
  163. }
  164. DocumentManager::delete_document($_course, $path, $coursePath);
  165. echo "<result>OK</result>"; // We have to returns something to OpenLaszlo
  166. }
  167. }
  168. else if ($action == "download")
  169. {
  170. /*==== DOWNLOAD ====*/
  171. //check if the document is in the database
  172. if(!DocumentManager::get_document_id($_course,$_REQUEST['file']))
  173. {
  174. //file not found!
  175. if ($debug>0) error_log("404 ".$_REQUEST["file"]);
  176. header("HTTP/1.0 404 Not Found");
  177. $error404 = '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">';
  178. $error404 .= '<html><head>';
  179. $error404 .= '<title>404 Not Found</title>';
  180. $error404 .= '</head><body>';
  181. $error404 .= '<h1>Not Found</h1>';
  182. $error404 .= '<p>The requested URL was not found on this server.</p>';
  183. $error404 .= '<hr>';
  184. $error404 .= '</body></html>';
  185. echo($error404);
  186. exit;
  187. }
  188. $doc_url = str_replace('../','',$_REQUEST['file']);
  189. if ($debug >0) error_log($doc_url);
  190. $full_file_name = $coursePath.$doc_url;
  191. DocumentManager::file_send_for_download($full_file_name,false);
  192. exit;
  193. }
  194. ?>