filesave.php 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163
  1. <?php
  2. /*
  3. * filesave.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. $language_file = array('document');//Chamilo load lang var
  15. //Chamilo load libraries
  16. require_once '../../../../inc/global.inc.php';
  17. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  18. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  19. //Add security from Chamilo
  20. api_protect_course_script();
  21. api_block_anonymous_users();
  22. if(!isset($_POST['output_svg']) && !isset($_POST['output_png'])) {
  23. api_not_allowed();//from Chamilo
  24. die();
  25. }
  26. $file = '';
  27. $suffix = isset($_POST['output_svg'])?'svg':'png';
  28. if(isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
  29. $file = $_POST['filename'];
  30. } else {
  31. $file = 'image';
  32. }
  33. if($suffix == 'svg') {
  34. $mime = 'image/svg+xml';
  35. $contents = rawurldecode($_POST['output_svg']);
  36. } else {
  37. $mime = 'image/png';
  38. $contents = $_POST['output_png'];
  39. $pos = (strpos($contents, 'base64,') + 7);
  40. $contents = base64_decode(substr($contents, $pos));
  41. }
  42. //get SVG-Edit values
  43. $filename=$file;//from svg-edit
  44. $extension=$suffix;// from svg-edit
  45. $content=$contents;//from svg-edit
  46. $title = Database::escape_string(str_replace('_',' ',$filename));
  47. //get Chamilo variables
  48. if(!isset($_SESSION['draw_dir']) && !isset($_SESSION['whereami'])){
  49. api_not_allowed();//from Chamilo
  50. die();
  51. }
  52. $current_session_id = api_get_session_id();
  53. $groupId=$_SESSION['_gid'];
  54. $relativeUrlPath=$_SESSION['draw_dir'];
  55. $currentTool=$_SESSION['whereami'];
  56. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  57. $saveDir=$dirBaseDocuments.$_SESSION['draw_dir'];
  58. //a bit title security
  59. $filename = addslashes(trim($filename));
  60. $filename = Security::remove_XSS($filename);
  61. $filename = replace_dangerous_char($filename, 'strict');
  62. $filename = disable_dangerous_file($filename);
  63. // a bit extension
  64. if($suffix!= 'svg' && $suffix!= 'png'){
  65. die();
  66. }
  67. //a bit mime security
  68. if (phpversion() >= '5.3') {
  69. $finfo = new finfo(FILEINFO_MIME);
  70. $current_mime=$finfo->buffer($contents);
  71. finfo_close($finfo);
  72. $mime_png='image/png';//svg-edit return image/png; charset=binary
  73. $mime_svg='image/svg+xml';
  74. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii. See
  75. if(strpos($current_mime, $mime_png)===false && $extension=='png')
  76. {
  77. //die();//File extension does not match its content //disabled to check into chamilo dev campus TODO:check
  78. }elseif(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg')
  79. {
  80. //die();//File extension does not match its content //disabled to check into chamilo dev campus TODO:check
  81. }
  82. }
  83. //checks if the file exists, then rename the new
  84. if(file_exists($saveDir.'/'.$filename.$i.'.'.$extension) && $currentTool=='document/createdraw'){
  85. echo '<script language="javascript" type="text/javascript">';
  86. echo 'alert("'.get_lang('FileExistsChangeToSave').'");';
  87. echo '</script>';
  88. die();
  89. }else{
  90. $drawFileName = $filename.'.'.$extension;
  91. $title = $title.'.'.$extension;
  92. }
  93. $documentPath = $saveDir.'/'.$drawFileName;
  94. //add new document to disk
  95. file_put_contents( $documentPath, $contents );
  96. if($currentTool=='document/createdraw'){
  97. //add document to database
  98. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  99. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  100. }elseif($currentTool=='document/editdraw'){
  101. //check path
  102. if(!isset($_SESSION['draw_file'])){
  103. api_not_allowed();//from Chamilo
  104. die();
  105. }
  106. if($_SESSION['draw_file']==$drawFileName){
  107. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$drawFileName);
  108. update_existing_document($_course, $document_id, filesize($documentPath), null);
  109. api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  110. }else{
  111. //add a new document
  112. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  113. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  114. }
  115. }
  116. //clean sessions and add messages and return to current document list
  117. unset($_SESSION['draw_dir']);
  118. unset($_SESSION['draw_file']);
  119. unset($_SESSION['whereami']);
  120. echo '<script language="javascript" type="text/javascript">';
  121. if($suffix!= 'png'){
  122. if($relativeUrlPath==''){$relativeUrlPath='/';};
  123. $interbreadcrumb=api_get_path(WEB_CODE_PATH).'document/document.php?cidReq='.$_course['path'].'&curdirpath='. urlencode($relativeUrlPath);
  124. echo 'alert("'.get_lang('FileSavedAs').': '.$title.'");';
  125. echo 'window.top.location.href="'.$interbreadcrumb.'";';//return to current document list
  126. }else{
  127. echo 'alert("'.get_lang('FileExportAs').': '.$title.'");';
  128. }
  129. echo '</script>';
  130. ?>