download.php 4.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126
  1. <?php // $Id: download.php 22201 2009-07-17 19:57:03Z cfasanando $
  2. /*
  3. ==============================================================================
  4. Dokeos - elearning and course management software
  5. Copyright (c) 2004 Dokeos S.A.
  6. Copyright (c) 2003 Ghent University (UGent)
  7. Copyright (c) 2001 Universite catholique de Louvain (UCL)
  8. Copyright (c) Olivier Brouckaert
  9. Copyright (c) Roan Embrechts
  10. Copyright (c) Sergio A. Kessler aka "sak"
  11. For a full list of contributors, see "credits.txt".
  12. The full license can be read in "license.txt".
  13. This program is free software; you can redistribute it and/or
  14. modify it under the terms of the GNU General Public License
  15. as published by the Free Software Foundation; either version 2
  16. of the License, or (at your option) any later version.
  17. See the GNU General Public License for more details.
  18. Contact: Dokeos, 181 rue Royale, B-1000 Brussels, Belgium, info@dokeos.com
  19. ==============================================================================
  20. */
  21. /**
  22. ==============================================================================
  23. * This file is responsible for passing requested documents to the browser.
  24. * Html files are parsed to fix a few problems with URLs,
  25. * but this code will hopefully be replaced soon by an Apache URL
  26. * rewrite mechanism.
  27. *
  28. * @package dokeos.document
  29. ==============================================================================
  30. */
  31. /*
  32. ==============================================================================
  33. FUNCTIONS
  34. ==============================================================================
  35. */
  36. /* file_html_dynamic_parsing removed */
  37. /* other functions updated and moved to lib/document.lib.php */
  38. /*
  39. ==============================================================================
  40. MAIN CODE
  41. ==============================================================================
  42. */
  43. session_cache_limiter('none');
  44. require_once '../inc/global.inc.php';
  45. $this_section=SECTION_COURSES;
  46. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  47. $doc_url = $_GET['doc_url'];
  48. //change the '&' that got rewritten to '///' by mod_rewrite back to '&'
  49. $doc_url = str_replace('///', '&', $doc_url);
  50. //still a space present? it must be a '+' (that got replaced by mod_rewrite)
  51. $doc_url = str_replace(' ', '+', $doc_url);
  52. $doc_url = str_replace(array('../','\\..','\\0','..\\'),array('','','',''), $doc_url); //echo $doc_url;
  53. // dealing with image included into survey: when users receive a link towards a
  54. // survey while not being authenticated on the plateform.
  55. // the administrator should probably be able to disable this code through admin
  56. // inteface
  57. $refer_script = strrchr($_SERVER["HTTP_REFERER"],'/');
  58. if (substr($refer_script,0,15) == "/fillsurvey.php") {
  59. $invitation = substr(strstr($refer_script, 'invitationcode='),15);
  60. $course = strstr($refer_script, 'course=');
  61. $course = substr($course, 7, strpos($course, '&')-7);
  62. include ("../survey/survey.download.inc.php");
  63. $_course = check_download_survey($course, $invitation, $doc_url);
  64. $_course['path']=$_course['directory'];
  65. } else {
  66. //protection
  67. api_protect_course_script();
  68. if (! isset($_course))
  69. {
  70. api_not_allowed(true);
  71. }
  72. //if the rewrite rule asks for a directory, we redirect to the document explorer
  73. if(is_dir(api_get_path(SYS_COURSE_PATH).$_course['path']."/document".$doc_url))
  74. {
  75. //remove last slash if present
  76. //$doc_url = ($doc_url{strlen($doc_url)-1}=='/')?substr($doc_url,0,strlen($doc_url)-1):$doc_url;
  77. //mod_rewrite can change /some/path/ to /some/path// in some cases, so clean them all off (René)
  78. while ($doc_url{$dul = strlen($doc_url)-1}=='/') $doc_url = substr($doc_url,0,$dul);
  79. //group folder?
  80. $gid_req = ($_GET['gidReq'])?'&gidReq='.Security::remove_XSS($_GET['gidReq']):'';
  81. //create the path
  82. $document_explorer = api_get_path(WEB_CODE_PATH).'document/document.php?curdirpath='.urlencode($doc_url).'&cidReq='.Security::remove_XSS($_GET['cidReq']).$gid_req;
  83. //redirect
  84. header('Location: '.$document_explorer);
  85. }
  86. // launch event
  87. event_download($doc_url);
  88. }
  89. $sys_course_path = api_get_path(SYS_COURSE_PATH);
  90. //$full_file_name = $sys_course_path.$_course['path'].'/document'.$doc_url;
  91. $full_file_name = $sys_course_path.$_course['path'].'/document'.str_replace('+',' ',$doc_url);
  92. // check visibility of document and paths
  93. $is_allowed_to_edit = api_is_allowed_to_edit();
  94. if (!$is_allowed_to_edit &&
  95. !DocumentManager::is_visible($doc_url, $_course)){
  96. echo "document not visible"; //api_not_allowed backbutton won't work
  97. exit; // you shouldn't be here anyway
  98. }
  99. DocumentManager::file_send_for_download($full_file_name);
  100. exit;
  101. ?>