filesave.php 6.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215
  1. <?php
  2. /*
  3. * filesave.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. $language_file = array('document'); //Chamilo load lang var
  15. //Chamilo load libraries
  16. require_once '../../../../inc/global.inc.php';
  17. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  18. //Add security from Chamilo
  19. api_protect_course_script();
  20. api_block_anonymous_users();
  21. if (!isset($_POST['output_svg']) && !isset($_POST['output_png'])) {
  22. api_not_allowed(); //from Chamilo
  23. die();
  24. }
  25. $file = '';
  26. $suffix = isset($_POST['output_svg']) ? 'svg' : 'png';
  27. if (isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
  28. $file = $_POST['filename'];
  29. } else {
  30. $file = 'image';
  31. }
  32. if ($suffix == 'svg') {
  33. $mime = 'image/svg+xml';
  34. $contents = rawurldecode($_POST['output_svg']);
  35. } else {
  36. $mime = 'image/png';
  37. $contents = $_POST['output_png'];
  38. $pos = (strpos($contents, 'base64,') + 7);
  39. $contents = base64_decode(substr($contents, $pos));
  40. }
  41. //get SVG-Edit values
  42. $filename = $file; //from svg-edit
  43. $extension = $suffix; // from svg-edit
  44. $content = $contents; //from svg-edit
  45. $title = Database::escape_string(str_replace('_', ' ', $filename));
  46. //get Chamilo variables
  47. if (!isset($_SESSION['draw_dir']) && !isset($_SESSION['whereami'])) {
  48. api_not_allowed(); //from Chamilo
  49. die();
  50. }
  51. $current_session_id = api_get_session_id();
  52. $groupId = api_get_group_id();
  53. $relativeUrlPath = $_SESSION['draw_dir'];
  54. $currentTool = $_SESSION['whereami'];
  55. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  56. $saveDir = $dirBaseDocuments.$_SESSION['draw_dir'];
  57. //a bit title security
  58. $filename = addslashes(trim($filename));
  59. $filename = Security::remove_XSS($filename);
  60. $filename = replace_dangerous_char($filename, 'strict');
  61. $filename = FileManager::disable_dangerous_file($filename);
  62. // a bit extension
  63. if ($suffix != 'svg' && $suffix != 'png') {
  64. die();
  65. }
  66. //a bit mime security
  67. //comment because finfo seems stopping the save process files in some php vers.
  68. /*
  69. if (phpversion() >= '5.3' && extension_loaded('fileinfo')) {
  70. $finfo = new finfo(FILEINFO_MIME);
  71. $current_mime=$finfo->buffer($contents);
  72. finfo_close($finfo);
  73. $mime_png='image/png';//svg-edit return image/png; charset=binary
  74. $mime_svg='image/svg+xml';
  75. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii. See
  76. if(strpos($current_mime, $mime_png)===false && $extension=='png') {
  77. die();//File extension does not match its content
  78. } elseif(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg') {
  79. die();//File extension does not match its content
  80. }
  81. }
  82. */
  83. //checks if the file exists, then rename the new
  84. if (file_exists($saveDir.'/'.$filename.$i.'.'.$extension) && $currentTool == 'document/createdraw') {
  85. echo '<script language="javascript" type="text/javascript">';
  86. echo 'alert("'.get_lang('FileExistsChangeToSave').'");';
  87. echo '</script>';
  88. die();
  89. } else {
  90. $drawFileName = $filename.'.'.$extension;
  91. $title = $title.'.'.$extension;
  92. }
  93. $documentPath = $saveDir.'/'.$drawFileName;
  94. //make a temporal file for get the file size
  95. $tmpfname = tempnam("/tmp", "CTF");
  96. $handle = fopen($tmpfname, "w");
  97. fwrite($handle, $contents);
  98. fclose($handle);
  99. // Check if there is enough space in the course to save the file
  100. if (!DocumentManager::enough_space(filesize($tmpfname), DocumentManager::get_course_quota())) {
  101. unlink($tmpfname);
  102. die(get_lang('UplNotEnoughSpace'));
  103. }
  104. //erase temporal file
  105. unlink($tmpfname);
  106. //add new document to disk
  107. file_put_contents($documentPath, $contents);
  108. if ($currentTool == 'document/createdraw') {
  109. //add document to database
  110. $doc_id = FileManager::add_document(
  111. $_course,
  112. $relativeUrlPath.'/'.$drawFileName,
  113. 'file',
  114. filesize($documentPath),
  115. $title
  116. );
  117. api_item_property_update(
  118. $_course,
  119. TOOL_DOCUMENT,
  120. $doc_id,
  121. 'DocumentAdded',
  122. $_user['user_id'],
  123. $groupId,
  124. null,
  125. null,
  126. null,
  127. $current_session_id
  128. );
  129. } elseif ($currentTool == 'document/editdraw') {
  130. //check path
  131. if (!isset($_SESSION['draw_file'])) {
  132. api_not_allowed(); //from Chamilo
  133. die();
  134. }
  135. if ($_SESSION['draw_file'] == $drawFileName) {
  136. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$drawFileName);
  137. FileManager::update_existing_document($_course, $document_id, filesize($documentPath), null);
  138. api_item_property_update(
  139. $_course,
  140. TOOL_DOCUMENT,
  141. $document_id,
  142. 'DocumentUpdated',
  143. $_user['user_id'],
  144. $groupId,
  145. null,
  146. null,
  147. null,
  148. $current_session_id
  149. );
  150. } else {
  151. //add a new document
  152. $doc_id = FileManager::add_document(
  153. $_course,
  154. $relativeUrlPath.'/'.$drawFileName,
  155. 'file',
  156. filesize($documentPath),
  157. $title
  158. );
  159. api_item_property_update(
  160. $_course,
  161. TOOL_DOCUMENT,
  162. $doc_id,
  163. 'DocumentAdded',
  164. $_user['user_id'],
  165. $groupId,
  166. null,
  167. null,
  168. null,
  169. $current_session_id
  170. );
  171. }
  172. }
  173. //clean sessions and add messages and return to current document list
  174. unset($_SESSION['draw_dir']);
  175. unset($_SESSION['draw_file']);
  176. unset($_SESSION['whereami']);
  177. echo '<script language="javascript" type="text/javascript">';
  178. if ($suffix != 'png') {
  179. if ($relativeUrlPath == '') {
  180. $relativeUrlPath = '/';
  181. }
  182. ;
  183. $interbreadcrumb = api_get_path(WEB_CODE_PATH).'document/document.php?'.api_get_cidreq().'&curdirpath='.urlencode(
  184. $relativeUrlPath
  185. );
  186. echo 'alert("'.get_lang('FileSavedAs').': '.$title.'");';
  187. echo 'window.top.location.href="'.$interbreadcrumb.'";'; //return to current document list
  188. } else {
  189. echo 'alert("'.get_lang('FileExportAs').': '.$title.'");';
  190. }
  191. echo '</script>';