dropbox_submit.php 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703
  1. <?php // $Id: dropbox_submit.php,v 1.27 2005/05/17 08:02:03 renehaentjens Exp $
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2006 Dokeos S.A.
  6. Copyright (c) 2006 Ghent University (UGent)
  7. Copyright (c) various contributors
  8. For a full list of contributors, see "credits.txt".
  9. The full license can be read in "license.txt".
  10. This program is free software; you can redistribute it and/or
  11. modify it under the terms of the GNU General Public License
  12. as published by the Free Software Foundation; either version 2
  13. of the License, or (at your option) any later version.
  14. See the GNU General Public License for more details.
  15. Contact address: Dokeos, 44 rue des palais, B-1030 Brussels, Belgium
  16. Mail: info@dokeos.com
  17. ==============================================================================
  18. */
  19. /*
  20. * ========================================
  21. * PREVENT RESUBMITING
  22. * ========================================
  23. * This part checks if the $dropbox_unid var has the same ID
  24. * as the session var $dropbox_uniqueid that was registered as a session
  25. * var before.
  26. * The resubmit prevention only works with GET requests, because it gives some annoying
  27. * behaviours with POST requests.
  28. */
  29. /*
  30. if (isset($_POST["dropbox_unid"])) {
  31. $dropbox_unid = $_POST["dropbox_unid"];
  32. } elseif (isset($_GET["dropbox_unid"]))
  33. {
  34. $dropbox_unid = $_GET["dropbox_unid"];
  35. } else {
  36. die(dropbox_lang("badFormData")." (code 400)");
  37. }
  38. if (isset($_SESSION["dropbox_uniqueid"]) && isset($_GET["dropbox_unid"]) && $dropbox_unid == $_SESSION["dropbox_uniqueid"]) {
  39. //resubmit : go to index.php
  40. // only prevent resending of data for GETS, not POSTS because this gives annoying results
  41. if (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"]=="on") {
  42. $mypath = "https";
  43. } else {
  44. $mypath = "http";
  45. }
  46. $mypath=$mypath."://".$_SERVER['HTTP_HOST'].dirname($_SERVER['PHP_SELF'])."/index.php";
  47. echo 'hier';
  48. header("Location: $mypath");
  49. }
  50. $dropbox_uniqueid = $dropbox_unid;
  51. api_session_register("dropbox_uniqueid");
  52. */
  53. /**
  54. * ========================================
  55. * FORM SUBMIT
  56. * ========================================
  57. * - VALIDATE POSTED DATA
  58. * - UPLOAD NEW FILE
  59. */
  60. if ( isset( $_POST["submitWork"]))
  61. {
  62. if (file_exists(api_get_path(INCLUDE_PATH) . "/fileUploadLib.inc.php"))
  63. {
  64. require_once(api_get_path(INCLUDE_PATH) . "/fileUploadLib.inc.php");
  65. }
  66. else
  67. {
  68. require_once(api_get_path(LIBRARY_PATH) . "/fileUpload.lib.php");
  69. }
  70. $error = FALSE;
  71. $errormsg = '';
  72. /**
  73. * --------------------------------------
  74. * �����FORM SUBMIT : VALIDATE POSTED DATA
  75. * --------------------------------------
  76. */
  77. // the author or description field is empty
  78. if ( !isset( $_POST['authors']) || !isset( $_POST['description']))
  79. {
  80. $error = TRUE;
  81. $errormsg = dropbox_lang("badFormData");
  82. }
  83. elseif ( !isset( $_POST['recipients']) || count( $_POST['recipients']) <= 0)
  84. {
  85. $error = TRUE;
  86. $errormsg = dropbox_lang("noUserSelected");
  87. }
  88. else
  89. {
  90. $thisIsAMailing = FALSE; // RH: Mailing selected as destination
  91. $thisIsJustUpload = FALSE; // RH
  92. foreach( $_POST['recipients'] as $rec)
  93. {
  94. if ( $rec == 'mailing')
  95. {
  96. $thisIsAMailing = TRUE;
  97. }
  98. elseif ( $rec == 'upload')
  99. {
  100. $thisIsJustUpload = TRUE;
  101. }
  102. elseif (strpos($rec, 'user_') === 0 && !isCourseMember(substr($rec, strlen('user_') ) ))
  103. {
  104. echo '401';
  105. die( dropbox_lang("badFormData")." (code 401)");
  106. }
  107. elseif (strpos($rec, 'group_') !== 0 && strpos($rec, 'user_') !== 0)
  108. {
  109. echo '402';
  110. die( dropbox_lang("badFormData")." (code 402)");
  111. }
  112. }
  113. // we are doing a mailing but an additional recipient is selected
  114. if ( $thisIsAMailing && ( count($_POST['recipients']) != 1))
  115. {
  116. $error = TRUE;
  117. $errormsg = dropbox_lang("mailingSelectNoOther");
  118. }
  119. // we are doing a just upload but an additional recipient is selected.
  120. elseif ( $thisIsJustUpload && ( count($_POST['recipients']) != 1))
  121. {
  122. $error = TRUE;
  123. $errormsg = dropbox_lang("mailingJustUploadNoOther");
  124. }
  125. elseif ( empty( $_FILES['file']['name']))
  126. {
  127. $error = TRUE;
  128. $errormsg = dropbox_lang("noFileSpecified");
  129. }
  130. }
  131. //check if $_POST['cb_overwrite'] is true or false
  132. $dropbox_overwrite = false;
  133. if ( isset($_POST['cb_overwrite']) && $_POST['cb_overwrite']==true)
  134. {
  135. $dropbox_overwrite = true;
  136. }
  137. /**
  138. * --------------------------------------
  139. * ����FORM SUBMIT : UPLOAD NEW FILE
  140. * --------------------------------------
  141. */
  142. if ( !$error)
  143. {
  144. $dropbox_filename = $_FILES['file']['name'];
  145. $dropbox_filesize = $_FILES['file']['size'];
  146. $dropbox_filetype = $_FILES['file']['type'];
  147. $dropbox_filetmpname = $_FILES['file']['tmp_name'];
  148. if ( $dropbox_filesize <= 0 || $dropbox_filesize > dropbox_cnf("maxFilesize"))
  149. {
  150. $errormsg = dropbox_lang("tooBig");
  151. $error = TRUE;
  152. }elseif ( !is_uploaded_file( $dropbox_filetmpname)) // check user fraud : no clean error msg.
  153. {
  154. die ( dropbox_lang("badFormData")." (code 403)");
  155. }
  156. if ( !$error)
  157. {
  158. // Try to add an extension to the file if it hasn't got one
  159. $dropbox_filename = add_ext_on_mime( $dropbox_filename,$dropbox_filetype);
  160. // Replace dangerous characters
  161. $dropbox_filename = replace_dangerous_char( $dropbox_filename);
  162. // Transform any .php file in .phps fo security
  163. $dropbox_filename = php2phps ( $dropbox_filename);
  164. if(!filter_extension($dropbox_filename))
  165. {
  166. $error = true;
  167. $errormsg = get_lang('UplUnableToSaveFileFilteredExtension');
  168. }
  169. else
  170. {
  171. // set title
  172. $dropbox_title = $dropbox_filename;
  173. // set author
  174. if ( $_POST['authors'] == '')
  175. {
  176. $_POST['authors'] = getUserNameFromId( $_user['user_id']);
  177. }
  178. if ( $dropbox_overwrite) // RH: Mailing: adapted
  179. {
  180. $dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor);
  181. foreach($dropbox_person->sentWork as $w)
  182. {
  183. if ($w->title == $dropbox_filename)
  184. {
  185. if ( ($w->recipients[0]['id'] > dropbox_cnf("mailingIdBase")) xor $thisIsAMailing)
  186. {
  187. $error = TRUE;
  188. $errormsg = dropbox_lang("mailingNonMailingError");
  189. }
  190. if ( ($w->recipients[0]['id'] == $_user['user_id']) xor $thisIsJustUpload)
  191. {
  192. $error = TRUE;
  193. $errormsg = dropbox_lang("mailingJustUploadNoOther");
  194. }
  195. $dropbox_filename = $w->filename; $found = true;
  196. break;
  197. }
  198. }
  199. }
  200. else // rename file to login_filename_uniqueId format
  201. {
  202. $dropbox_filename = getLoginFromId( $_user['user_id']) . "_" . $dropbox_filename . "_".uniqid('');
  203. }
  204. if ( ( ! is_dir( dropbox_cnf("sysPath"))))
  205. {
  206. //The dropbox subdir doesn't exist yet so make it and create the .htaccess file
  207. mkdir( dropbox_cnf("sysPath"), 0700) or die ( dropbox_lang("errorCreatingDir")." (code 404)");
  208. $fp = fopen( dropbox_cnf("sysPath")."/.htaccess", "w") or die (dropbox_lang("errorCreatingDir")." (code 405)");
  209. fwrite($fp, "AuthName AllowLocalAccess
  210. AuthType Basic
  211. order deny,allow
  212. deny from all
  213. php_flag zlib.output_compression off") or die (dropbox_lang("errorCreatingDir")." (code 406)");
  214. }
  215. if ( $error) {}
  216. elseif ( $thisIsAMailing) // RH: $newWorkRecipients is integer - see class
  217. {
  218. if ( preg_match( dropbox_cnf("mailingZipRegexp"), $dropbox_title))
  219. {
  220. $newWorkRecipients = dropbox_cnf("mailingIdBase");
  221. }
  222. else
  223. {
  224. $error = TRUE;
  225. $errormsg = $dropbox_title . ": " . dropbox_lang("mailingWrongZipfile");
  226. }
  227. }
  228. elseif ( $thisIsJustUpload) // RH: $newWorkRecipients is empty array
  229. {
  230. $newWorkRecipients = array();
  231. }
  232. else
  233. { // creating the array that contains all the users who will receive the file
  234. $newWorkRecipients = array();
  235. foreach ($_POST["recipients"] as $rec)
  236. {
  237. if (strpos($rec, 'user_') === 0) {
  238. $newWorkRecipients[] = substr($rec, strlen('user_') );
  239. }
  240. elseif (strpos($rec, 'group_') === 0 )
  241. {
  242. $userList = GroupManager::get_subscribed_users(substr($rec, strlen('group_') ));
  243. foreach ($userList as $usr)
  244. {
  245. if (! in_array($usr['user_id'], $newWorkRecipients) && $usr['user_id'] != $_user['user_id'])
  246. {
  247. $newWorkRecipients[] = $usr['user_id'];
  248. }
  249. }
  250. }
  251. }
  252. }
  253. //After uploading the file, create the db entries
  254. if ( !$error)
  255. {
  256. @move_uploaded_file( $dropbox_filetmpname, dropbox_cnf("sysPath") . '/' . $dropbox_filename)
  257. or die( dropbox_lang("uploadError")." (code 407)");
  258. new Dropbox_SentWork( $_user['user_id'], $dropbox_title, $_POST['description'], strip_tags($_POST['authors']), $dropbox_filename, $dropbox_filesize, $newWorkRecipients);
  259. }
  260. }
  261. }
  262. } //end if(!$error)
  263. /**
  264. * ========================================
  265. * SUBMIT FORM RESULTMESSAGE
  266. * ========================================
  267. */
  268. if ( !$error)
  269. {
  270. $return_message=get_lang('FileUploadSucces');
  271. }
  272. else
  273. {
  274. $return_message=$errormsg;
  275. }
  276. } // end if ( isset( $_POST["submitWork"]))
  277. /**
  278. * ========================================
  279. * // RH: EXAMINE OR SEND MAILING (NEW)
  280. * ========================================
  281. */
  282. if ( isset( $_GET['mailingIndex'])) // examine or send
  283. {
  284. $dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor);
  285. if ( isset($_SESSION["sentOrder"]))
  286. {
  287. $dropbox_person->orderSentWork ($_SESSION["sentOrder"]);
  288. }
  289. $i = $_GET['mailingIndex']; $mailing_item = $dropbox_person->sentWork[$i];
  290. $mailing_title = $mailing_item->title;
  291. $mailing_file = dropbox_cnf("sysPath") . '/' . $mailing_item->filename;
  292. $errormsg = '<b>' . $mailing_item->recipients[0]['name'] . ' ('
  293. . "<a href='dropbox_download.php?origin=$origin&id=".urlencode($mailing_item->id)."'>"
  294. . htmlspecialchars($mailing_title,ENT_QUOTES,$charset) . '</a>):</b><br><br>';
  295. if ( preg_match( dropbox_cnf("mailingZipRegexp"), $mailing_title, $nameParts))
  296. {
  297. $var = strtoupper($nameParts[2]); // the variable part of the name
  298. $course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  299. $sel = "SELECT u.user_id, u.lastname, u.firstname, cu.status
  300. FROM `".$_configuration['main_database']."`.`user` u
  301. LEFT JOIN $course_user cu
  302. ON cu.user_id = u.user_id AND cu.course_code = '".$_course['sysCode']."'";
  303. $sel .= " WHERE u.".dropbox_cnf("mailingWhere".$var)." = '";
  304. function getUser($thisRecip)
  305. {
  306. // string result = error message, array result = [user_id, lastname, firstname]
  307. global $var, $sel; unset($students);
  308. $result = api_sql_query($sel . $thisRecip . "'",__FILE__,__LINE__);
  309. while ( ($res = mysql_fetch_array($result))) {$students[] = $res;}
  310. mysql_free_result($result);
  311. if (count($students) == 1)
  312. {
  313. return($students[0]);
  314. }
  315. elseif (count($students) > 1)
  316. {
  317. return ' <'.dropbox_lang("mailingFileRecipDup", "noDLTT").$var."= $thisRecip>";
  318. }
  319. else
  320. {
  321. return ' <'.dropbox_lang("mailingFileRecipNotFound", "noDLTT").$var."= $thisRecip>";
  322. }
  323. }
  324. $preFix = $nameParts[1]; $postFix = $nameParts[3];
  325. $preLen = strlen($preFix); $postLen = strlen($postFix);
  326. function findRecipient($thisFile)
  327. {
  328. // string result = error message, array result = [user_id, lastname, firstname, status]
  329. global $nameParts, $preFix, $preLen, $postFix, $postLen;
  330. if ( preg_match(dropbox_cnf("mailingFileRegexp"), $thisFile, $matches))
  331. {
  332. $thisName = $matches[1];
  333. if ( substr($thisName, 0, $preLen) == $preFix)
  334. {
  335. if ( $postLen == 0 || substr($thisName, -$postLen) == $postFix)
  336. {
  337. $thisRecip = substr($thisName, $preLen, strlen($thisName) - $preLen - $postLen);
  338. if ( $thisRecip) return getUser($thisRecip);
  339. return ' <'.dropbox_lang("mailingFileNoRecip", "noDLTT").'>';
  340. }
  341. else
  342. {
  343. return ' <'.dropbox_lang("mailingFileNoPostfix", "noDLTT").$postFix.'>';
  344. }
  345. }
  346. else
  347. {
  348. return ' <'.dropbox_lang("mailingFileNoPrefix", "noDLTT").$preFix.'>';
  349. }
  350. }
  351. else
  352. {
  353. return ' <'.dropbox_lang("mailingFileFunny", "noDLTT").'>';
  354. }
  355. }
  356. if (file_exists(api_get_path(INCLUDE_PATH) . "/pclzip/pclzip.lib.php"))
  357. {
  358. require(api_get_path(INCLUDE_PATH) . "/pclzip/pclzip.lib.php");
  359. }
  360. else
  361. {
  362. require(api_get_path(LIBRARY_PATH) . "/pclzip/pclzip.lib.php");
  363. }
  364. $zipFile = new pclZip($mailing_file); $goodFiles = array();
  365. $zipContent = $zipFile->listContent(); $ucaseFiles = array();
  366. if ( $zipContent)
  367. {
  368. foreach( $zipFile->listContent() as $thisContent)
  369. {
  370. $thisFile = substr(strrchr('/' . $thisContent['filename'], '/'), 1);
  371. $thisFileUcase = strtoupper($thisFile);
  372. if ( preg_match("~.(php.*|phtml)$~i", $thisFile) )
  373. {
  374. $error = TRUE; $errormsg .= $thisFile . ': ' . dropbox_lang("mailingZipPhp");
  375. break;
  376. }
  377. elseif ( !$thisContent['folder'])
  378. {
  379. if ( $ucaseFiles[$thisFileUcase])
  380. {
  381. $error = TRUE; $errormsg .= $thisFile . ': ' . dropbox_lang("mailingZipDups");
  382. break;
  383. }
  384. else
  385. {
  386. $goodFiles[$thisFile] = findRecipient($thisFile);
  387. $ucaseFiles[$thisFileUcase] = "yep";
  388. }
  389. }
  390. }
  391. }
  392. else
  393. {
  394. $error = TRUE; $errormsg .= dropbox_lang("mailingZipEmptyOrCorrupt");
  395. }
  396. if ( !$error)
  397. {
  398. $students = array(); // collect all recipients in this course
  399. foreach( $goodFiles as $thisFile => $thisRecip)
  400. {
  401. $errormsg .= htmlspecialchars($thisFile,ENT_QUOTES,$charset) . ': ';
  402. if ( is_string($thisRecip)) // see findRecipient
  403. {
  404. $errormsg .= '<font color="#FF0000">'
  405. . htmlspecialchars($thisRecip,ENT_QUOTES,$charset) . '</font><br>';
  406. }
  407. else
  408. {
  409. if ( isset( $_GET['mailingSend']))
  410. {
  411. $errormsg .= dropbox_lang("mailingFileSentTo");
  412. }
  413. else
  414. {
  415. $errormsg .= dropbox_lang("mailingFileIsFor");
  416. }
  417. $errormsg .= htmlspecialchars($thisRecip[1].' '.$thisRecip[2],ENT_QUOTES,$charset);
  418. if ( is_null($thisRecip[3]))
  419. {
  420. $errormsg .= dropbox_lang("mailingFileNotRegistered");
  421. }
  422. else
  423. {
  424. $students[] = $thisRecip[0];
  425. }
  426. $errormsg .= '<br>';
  427. }
  428. }
  429. // find student course members not among the recipients
  430. $course_user = Database::get_main_table(TABLE_MAIN_COURSE_USER);
  431. $sql = "SELECT u.lastname, u.firstname
  432. FROM $course_user cu
  433. LEFT JOIN `".$_configuration['main_database']."`.`user` u
  434. ON cu.user_id = u.user_id AND cu.course_code = '".$_course['sysCode']."'
  435. WHERE cu.status = 5
  436. AND u.user_id NOT IN ('" . implode("', '" , $students) . "')";
  437. $result = api_sql_query($sql,__FILE__,__LINE__);
  438. if ( mysql_num_rows($result) > 0)
  439. {
  440. $remainingUsers = '';
  441. while ( ($res = mysql_fetch_array($result)))
  442. {
  443. $remainingUsers .= ', ' . htmlspecialchars($res[0].' '.$res[1],ENT_QUOTES,$charset);
  444. }
  445. $errormsg .= '<br>' . dropbox_lang("mailingNothingFor") . substr($remainingUsers, 1) . '.<br>';
  446. }
  447. if ( isset( $_GET['mailingSend']))
  448. {
  449. chdir(dropbox_cnf("sysPath"));
  450. $zipFile->extract(PCLZIP_OPT_REMOVE_ALL_PATH);
  451. $mailingPseudoId = dropbox_cnf("mailingIdBase") + $mailing_item->id;
  452. foreach( $goodFiles as $thisFile => $thisRecip)
  453. {
  454. if ( is_string($thisRecip)) // remove problem file
  455. {
  456. @unlink(dropbox_cnf("sysPath") . '/' . $thisFile);
  457. }
  458. else
  459. {
  460. $newName = getLoginFromId( $_user['user_id']) . "_" . $thisFile . "_" . uniqid('');
  461. if ( rename(dropbox_cnf("sysPath") . '/' . $thisFile, dropbox_cnf("sysPath") . '/' . $newName))
  462. new Dropbox_SentWork( $mailingPseudoId, $thisFile, $mailing_item->description, $mailing_item->author, $newName, $thisContent['size'], array($thisRecip[0]));
  463. }
  464. }
  465. $sendDT = addslashes(date("Y-m-d H:i:s",time()));
  466. // set filesize to zero on send, to avoid 2nd send (see index.php)
  467. $sql = "UPDATE ".dropbox_cnf("tbl_file")."
  468. SET filesize = '0'
  469. , upload_date = '".$sendDT."', last_upload_date = '".$sendDT."'
  470. WHERE id='".addslashes($mailing_item->id)."'";
  471. $result =api_sql_query($sql,__FILE__,__LINE__);
  472. }
  473. elseif ( $mailing_item->filesize != 0)
  474. {
  475. $errormsg .= '<br>' . dropbox_lang("mailingNotYetSent") . '<br>';
  476. }
  477. }
  478. }
  479. else
  480. {
  481. $error = TRUE; $errormsg .= dropbox_lang("mailingWrongZipfile");
  482. }
  483. /**
  484. * ========================================
  485. * EXAMINE OR SEND MAILING RESULTMESSAGE
  486. * ========================================
  487. */
  488. if ( $error)
  489. {
  490. ?>
  491. <b><font color="#FF0000"><?php echo $errormsg?></font></b><br><br>
  492. <a href="index.php<?php echo "?origin=$origin"; ?>"><?php echo dropbox_lang("backList")?></a><br>
  493. <?php
  494. }
  495. else
  496. {
  497. ?>
  498. <?php echo $errormsg?><br><br>
  499. <a href="index.php<?php echo "?origin=$origin"; ?>"><?php echo dropbox_lang("backList")?></a><br>
  500. <?php
  501. }
  502. }
  503. /**
  504. * =============================================
  505. * DELETE RECEIVED OR SENT FILES - EDIT FEEDBACK // RH: Feedback
  506. * =============================================
  507. * - DELETE ALL RECEIVED FILES
  508. * - DELETE 1 RECEIVED FILE
  509. * - DELETE ALL SENT FILES
  510. * - DELETE 1 SENT FILE
  511. * - EDIT FEEDBACK // RH: Feedback
  512. */
  513. if ( isset( $_GET['deleteReceived']) || isset( $_GET['deleteSent'])
  514. || isset( $_GET['showFeedback']) || isset( $_GET['editFeedback'])) // RH: Feedback
  515. {
  516. if ( $_GET['mailing']) // RH: Mailing
  517. {
  518. getUserOwningThisMailing($_GET['mailing'], $_user['user_id'], '408'); // RH or die
  519. $dropbox_person = new Dropbox_Person( $_GET['mailing'], $is_courseAdmin, $is_courseTutor);
  520. }
  521. else
  522. {
  523. $dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor);
  524. }
  525. // RH: these two are needed, I think
  526. if ( isset($_SESSION["sentOrder"]))
  527. {
  528. $dropbox_person->orderSentWork ($_SESSION["sentOrder"]);
  529. }
  530. if ( isset($_SESSION["receivedOrder"]))
  531. {
  532. $dropbox_person->orderReceivedWork ($_SESSION["receivedOrder"]);
  533. }
  534. /*if (! $dropbox_person->isCourseAdmin || ! $dropbox_person->isCourseTutor) {
  535. die(dropbox_lang("generalError")." (code 408)");
  536. }*/
  537. $tellUser = dropbox_lang("fileDeleted"); // RH: Feedback
  538. if ( isset( $_GET['deleteReceived']))
  539. {
  540. if ( $_GET["deleteReceived"] == "all")
  541. {
  542. $dropbox_person->deleteAllReceivedWork( );
  543. }elseif ( is_numeric( $_GET["deleteReceived"]))
  544. {
  545. $dropbox_person->deleteReceivedWork( $_GET['deleteReceived']);
  546. }
  547. else
  548. {
  549. die(dropbox_lang("generalError")." (code 409)");
  550. }
  551. }
  552. elseif ( isset( $_GET['deleteSent'])) // RH: Feedback
  553. {
  554. if ( $_GET["deleteSent"] == "all")
  555. {
  556. $dropbox_person->deleteAllSentWork( );
  557. }elseif ( is_numeric( $_GET["deleteSent"]))
  558. {
  559. $dropbox_person->deleteSentWork( $_GET['deleteSent']);
  560. }
  561. else
  562. {
  563. die(dropbox_lang("generalError")." (code 410)");
  564. }
  565. }
  566. elseif ( isset( $_GET['showFeedback'])) // RH: Feedback
  567. {
  568. $w = new Dropbox_SentWork($id = $_GET['showFeedback']);
  569. if ($w->uploader_id != $_user['user_id'])
  570. getUserOwningThisMailing($w->uploader_id, $_user['user_id'], '411'); // RH or die
  571. foreach( $w -> recipients as $r) if (($fb = $r["feedback"]))
  572. {
  573. $fbarray [$r["feedback_date"].$r["name"]]=
  574. $r["name"] . ' ' . dropbox_lang("sentOn", "noDLTT") .
  575. ' ' . $r["feedback_date"] . ":\n" . $fb;
  576. }
  577. if ($fbarray)
  578. {
  579. krsort($fbarray);
  580. echo '<textarea class="dropbox_feedbacks">',
  581. htmlspecialchars(implode("\n\n", $fbarray),ENT_QUOTES,$charset), '</textarea>', "\n";
  582. }
  583. else
  584. {
  585. echo '<textarea class="dropbox_feedbacks">&nbsp;</textarea>', "\n";
  586. }
  587. $tellUser = dropbox_lang("showFeedback");
  588. }
  589. else // if ( isset( $_GET['editFeedback'])) // RH: Feedback
  590. {
  591. $id = $_GET['editFeedback']; $found = false;
  592. foreach($dropbox_person->receivedWork as $w) {
  593. if ($w->id == $id) {
  594. $found = true; break;
  595. }
  596. }
  597. if (! $found) die(dropbox_lang("generalError")." (code 415)");
  598. echo '<form method="post" action="index.php">', "\n",
  599. '<input type="hidden" name="feedbackid" value="',
  600. $id, '"/>', "\n",
  601. '<textarea name="feedbacktext" class="dropbox_feedbacks">',
  602. htmlspecialchars($w->feedback,ENT_QUOTES,$charset), '</textarea>', "<br>\n",
  603. '<input type="submit" name="feedbacksubmit" value="', dropbox_lang("ok", "noDLTT"), '"/>', "\n",
  604. '</form>', "\n";
  605. $tellUser = dropbox_lang("giveFeedback");
  606. }
  607. /**
  608. * ==============================================
  609. * RESULTMESSAGE FOR DELETE FILE OR EDIT FEEDBACK // RH: Feedback
  610. * ==============================================
  611. */
  612. $return_message=dropbox_lang("backList");
  613. }
  614. ?>