fileopen.php 1.7 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465
  1. <?php
  2. /*
  3. * fileopen.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. require_once '../../../../inc/global.inc.php';//hack for chamilo
  15. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  16. api_protect_course_script();
  17. api_block_anonymous_users();
  18. if(!isset($_FILES['svg_file']['tmp_name'])) {
  19. api_not_allowed(false);//from Chamilo
  20. die();
  21. }
  22. ?>
  23. <!doctype html>
  24. <?php
  25. // Very minimal PHP file, all we do is Base64 encode the uploaded file and
  26. // return it to the editor
  27. $file = $_FILES['svg_file']['tmp_name'];
  28. $output = file_get_contents($file);
  29. $type = $_REQUEST['type'];
  30. $prefix = '';
  31. // Make Data URL prefix for import image
  32. if($type == 'import_img') {
  33. $info = getimagesize($file);
  34. $prefix = 'data:' . $info['mime'] . ';base64,';
  35. }
  36. //a bit title security
  37. $filename = addslashes(trim($file));
  38. $filename = Security::remove_XSS($filename);
  39. $filename = replace_dangerous_char($filename, 'strict');
  40. $filename = disable_dangerous_file($filename);
  41. //a bit mime security
  42. $current_mime = $_FILES['svg_file']['type'];
  43. $mime_svg='image/svg+xml';
  44. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii.
  45. if(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg'){
  46. die();//File extension does not match its content
  47. }
  48. ?>
  49. <script>
  50. window.top.window.svgEditor.processFile("<?php echo $prefix . base64_encode($output); ?>", "<?php echo $type ?>");
  51. </script>