filesave.php 6.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214
  1. <?php
  2. /*
  3. * filesave.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. $language_file = array('document'); //Chamilo load lang var
  15. //Chamilo load libraries
  16. require_once '../../../../inc/global.inc.php';
  17. //Add security from Chamilo
  18. api_protect_course_script();
  19. api_block_anonymous_users();
  20. if (!isset($_POST['output_svg']) && !isset($_POST['output_png'])) {
  21. api_not_allowed(); //from Chamilo
  22. die();
  23. }
  24. $file = '';
  25. $suffix = isset($_POST['output_svg']) ? 'svg' : 'png';
  26. if (isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
  27. $file = $_POST['filename'];
  28. } else {
  29. $file = 'image';
  30. }
  31. if ($suffix == 'svg') {
  32. $mime = 'image/svg+xml';
  33. $contents = rawurldecode($_POST['output_svg']);
  34. } else {
  35. $mime = 'image/png';
  36. $contents = $_POST['output_png'];
  37. $pos = (strpos($contents, 'base64,') + 7);
  38. $contents = base64_decode(substr($contents, $pos));
  39. }
  40. //get SVG-Edit values
  41. $filename = $file; //from svg-edit
  42. $extension = $suffix; // from svg-edit
  43. $content = $contents; //from svg-edit
  44. $title = Database::escape_string(str_replace('_', ' ', $filename));
  45. //get Chamilo variables
  46. if (!isset($_SESSION['draw_dir']) && !isset($_SESSION['whereami'])) {
  47. api_not_allowed(); //from Chamilo
  48. die();
  49. }
  50. $current_session_id = api_get_session_id();
  51. $groupId = api_get_group_id();
  52. $relativeUrlPath = $_SESSION['draw_dir'];
  53. $currentTool = $_SESSION['whereami'];
  54. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  55. $saveDir = $dirBaseDocuments.$_SESSION['draw_dir'];
  56. //a bit title security
  57. $filename = addslashes(trim($filename));
  58. $filename = Security::remove_XSS($filename);
  59. $filename = api_replace_dangerous_char($filename, 'strict');
  60. $filename = FileManager::disable_dangerous_file($filename);
  61. // a bit extension
  62. if ($suffix != 'svg' && $suffix != 'png') {
  63. die();
  64. }
  65. //a bit mime security
  66. //comment because finfo seems stopping the save process files in some php vers.
  67. /*
  68. if (phpversion() >= '5.3' && extension_loaded('fileinfo')) {
  69. $finfo = new finfo(FILEINFO_MIME);
  70. $current_mime=$finfo->buffer($contents);
  71. finfo_close($finfo);
  72. $mime_png='image/png';//svg-edit return image/png; charset=binary
  73. $mime_svg='image/svg+xml';
  74. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii. See
  75. if(strpos($current_mime, $mime_png)===false && $extension=='png') {
  76. die();//File extension does not match its content
  77. } elseif(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg') {
  78. die();//File extension does not match its content
  79. }
  80. }
  81. */
  82. //checks if the file exists, then rename the new
  83. if (file_exists($saveDir.'/'.$filename.$i.'.'.$extension) && $currentTool == 'document/createdraw') {
  84. echo '<script language="javascript" type="text/javascript">';
  85. echo 'alert("'.get_lang('FileExistsChangeToSave').'");';
  86. echo '</script>';
  87. die();
  88. } else {
  89. $drawFileName = $filename.'.'.$extension;
  90. $title = $title.'.'.$extension;
  91. }
  92. $documentPath = $saveDir.'/'.$drawFileName;
  93. //make a temporal file for get the file size
  94. $tmpfname = tempnam("/tmp", "CTF");
  95. $handle = fopen($tmpfname, "w");
  96. fwrite($handle, $contents);
  97. fclose($handle);
  98. // Check if there is enough space in the course to save the file
  99. if (!DocumentManager::enough_space(filesize($tmpfname), DocumentManager::get_course_quota())) {
  100. unlink($tmpfname);
  101. die(get_lang('UplNotEnoughSpace'));
  102. }
  103. //erase temporal file
  104. unlink($tmpfname);
  105. //add new document to disk
  106. file_put_contents($documentPath, $contents);
  107. if ($currentTool == 'document/createdraw') {
  108. //add document to database
  109. $doc_id = FileManager::add_document(
  110. $_course,
  111. $relativeUrlPath.'/'.$drawFileName,
  112. 'file',
  113. filesize($documentPath),
  114. $title
  115. );
  116. api_item_property_update(
  117. $_course,
  118. TOOL_DOCUMENT,
  119. $doc_id,
  120. 'DocumentAdded',
  121. $_user['user_id'],
  122. $groupId,
  123. null,
  124. null,
  125. null,
  126. $current_session_id
  127. );
  128. } elseif ($currentTool == 'document/editdraw') {
  129. //check path
  130. if (!isset($_SESSION['draw_file'])) {
  131. api_not_allowed(); //from Chamilo
  132. die();
  133. }
  134. if ($_SESSION['draw_file'] == $drawFileName) {
  135. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$drawFileName);
  136. FileManager::update_existing_document($_course, $document_id, filesize($documentPath), null);
  137. api_item_property_update(
  138. $_course,
  139. TOOL_DOCUMENT,
  140. $document_id,
  141. 'DocumentUpdated',
  142. $_user['user_id'],
  143. $groupId,
  144. null,
  145. null,
  146. null,
  147. $current_session_id
  148. );
  149. } else {
  150. //add a new document
  151. $doc_id = FileManager::add_document(
  152. $_course,
  153. $relativeUrlPath.'/'.$drawFileName,
  154. 'file',
  155. filesize($documentPath),
  156. $title
  157. );
  158. api_item_property_update(
  159. $_course,
  160. TOOL_DOCUMENT,
  161. $doc_id,
  162. 'DocumentAdded',
  163. $_user['user_id'],
  164. $groupId,
  165. null,
  166. null,
  167. null,
  168. $current_session_id
  169. );
  170. }
  171. }
  172. //clean sessions and add messages and return to current document list
  173. unset($_SESSION['draw_dir']);
  174. unset($_SESSION['draw_file']);
  175. unset($_SESSION['whereami']);
  176. echo '<script language="javascript" type="text/javascript">';
  177. if ($suffix != 'png') {
  178. if ($relativeUrlPath == '') {
  179. $relativeUrlPath = '/';
  180. }
  181. ;
  182. $interbreadcrumb = api_get_path(WEB_CODE_PATH).'document/document.php?'.api_get_cidreq().'&curdirpath='.urlencode(
  183. $relativeUrlPath
  184. );
  185. echo 'alert("'.get_lang('FileSavedAs').': '.$title.'");';
  186. echo 'window.top.location.href="'.$interbreadcrumb.'";'; //return to current document list
  187. } else {
  188. echo 'alert("'.get_lang('FileExportAs').': '.$title.'");';
  189. }
  190. echo '</script>';