survey.download.inc.php 4.3 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131
  1. <?php
  2. /*
  3. DOKEOS - elearning and course management software
  4. For a full list of contributors, see documentation/credits.html
  5. This program is free software; you can redistribute it and/or
  6. modify it under the terms of the GNU General Public License
  7. as published by the Free Software Foundation; either version 2
  8. of the License, or (at your option) any later version.
  9. See "documentation/licence.html" more details.
  10. Contact:
  11. Dokeos
  12. Rue des Palais 44 Paleizenstraat
  13. B-1030 Brussels - Belgium
  14. Tel. +32 (2) 211 34 56
  15. */
  16. /**
  17. * @package dokeos.survey
  18. * @author Arnaud Ligot <arnaud@cblue.be>
  19. * @version $Id: $
  20. *
  21. * small peace code to enable user to access images included into survey
  22. * which are accessible by non authenticated users. This file is included
  23. * by document/download.php
  24. */
  25. function check_download_survey($course, $invitation, $doc_url) {
  26. require_once('survey.lib.php');
  27. require_once (api_get_path(LIBRARY_PATH)."/course.lib.php");
  28. // getting all the course information
  29. $_course = CourseManager::get_course_information($course);
  30. // Database table definitions
  31. $table_survey = Database :: get_course_table(TABLE_SURVEY, $_course['db_name']);
  32. $table_survey_question = Database :: get_course_table(TABLE_SURVEY_QUESTION, $_course['db_name']);
  33. $table_survey_question_option = Database :: get_course_table(TABLE_SURVEY_QUESTION_OPTION, $_course['db_name']);
  34. $table_course = Database :: get_main_table(TABLE_MAIN_COURSE);
  35. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  36. $table_survey_invitation = Database :: get_course_table(TABLE_SURVEY_INVITATION, $_course['db_name']);
  37. // now we check if the invitationcode is valid
  38. $sql = "SELECT * FROM $table_survey_invitation WHERE invitation_code = '".Database::escape_string($invitation)."'";
  39. $result = Database::query($sql, __FILE__, __LINE__);
  40. if (Database::num_rows($result) < 1)
  41. {
  42. Display :: display_error_message(get_lang('WrongInvitationCode'), false);
  43. Display :: display_footer();
  44. exit;
  45. }
  46. $survey_invitation = mysql_fetch_assoc($result);
  47. // now we check if the user already filled the survey
  48. if ($survey_invitation['answered'] == 1)
  49. {
  50. Display :: display_error_message(get_lang('YouAlreadyFilledThisSurvey'), false);
  51. Display :: display_footer();
  52. exit;
  53. }
  54. // very basic security check: check if a text field from a survey/answer/option contains the name of the document requested
  55. //////////////
  56. // fetch survey ID
  57. //////////////
  58. // If this is the case there will be a language choice
  59. $sql = "SELECT * FROM $table_survey WHERE code='".Database::escape_string($survey_invitation['survey_code'])."'";
  60. $result = Database::query($sql, __FILE__, __LINE__);
  61. if (Database::num_rows($result) > 1)
  62. {
  63. if ($_POST['language'])
  64. {
  65. $survey_invitation['survey_id'] = $_POST['language'];
  66. }
  67. else
  68. {
  69. echo '<form id="language" name="language" method="POST" action="'.api_get_self().'?course='.$_GET['course'].'&invitationcode='.$_GET['invitationcode'].'">';
  70. echo ' <select name="language">';
  71. while ($row=mysql_fetch_assoc($result))
  72. {
  73. echo '<option value="'.$row['survey_id'].'">'.$row['lang'].'</option>';
  74. }
  75. echo '</select>';
  76. echo ' <input type="submit" name="Submit" value="'.get_lang('Ok').'" />';
  77. echo '</form>';
  78. display::display_footer();
  79. exit;
  80. }
  81. }
  82. else
  83. {
  84. $row=mysql_fetch_assoc($result);
  85. $survey_invitation['survey_id'] = $row['survey_id'];
  86. }
  87. $sql = "select count(*) from $table_survey where survey_id = ".$survey_invitation['survey_id']."
  88. and (
  89. title LIKE '%$doc_url%'
  90. or subtitle LIKE '%$doc_url%'
  91. or intro LIKE '%$doc_url%'
  92. or surveythanks LIKE '%$doc_url%'
  93. )
  94. union select count(*) from $table_survey_question where survey_id = ".$survey_invitation['survey_id']."
  95. and (
  96. survey_question LIKE '%$doc_url%'
  97. or survey_question_comment LIKE '%$doc_url%'
  98. )
  99. union select count(*) from $table_survey_question_option where survey_id = ".$survey_invitation['survey_id']."
  100. and (
  101. option_text LIKE '%$doc_url%'
  102. )";
  103. $result = Database::query($sql, __FILE__, __LINE__);
  104. if (Database::num_rows($result) == 0)
  105. {
  106. Display :: display_error_message(get_lang('WrongInvitationCode'), false);
  107. Display :: display_footer();
  108. exit;
  109. }
  110. return $_course;
  111. }
  112. ?>