filesave.php 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161
  1. <?php
  2. /*
  3. * filesave.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. $language_file = array('document');//Chamilo load lang var
  15. //Chamilo load libraries
  16. require_once '../../../../inc/global.inc.php';
  17. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  18. //Add security from Chamilo
  19. api_protect_course_script();
  20. api_block_anonymous_users();
  21. if(!isset($_POST['output_svg']) && !isset($_POST['output_png'])) {
  22. api_not_allowed(false);//from Chamilo
  23. die();
  24. }
  25. $file = '';
  26. $suffix = isset($_POST['output_svg'])?'svg':'png';
  27. if(isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
  28. $file = $_POST['filename'];
  29. } else {
  30. $file = 'image';
  31. }
  32. if($suffix == 'svg') {
  33. $mime = 'image/svg+xml';
  34. $contents = rawurldecode($_POST['output_svg']);
  35. } else {
  36. $mime = 'image/png';
  37. $contents = $_POST['output_png'];
  38. $pos = (strpos($contents, 'base64,') + 7);
  39. $contents = base64_decode(substr($contents, $pos));
  40. }
  41. //get SVG-Edit values
  42. $filename=$file;//from svg-edit
  43. $extension=$suffix;// from svg-edit
  44. $content=$contents;//from svg-edit
  45. $title = Database::escape_string(str_replace('_',' ',$filename));
  46. //get Chamilo variables
  47. if(!isset($_SESSION['draw_dir']) || !isset($_SESSION['whereami']) )
  48. {
  49. api_not_allowed(false);//from Chamilo
  50. die();
  51. }
  52. $current_session_id = api_get_session_id();
  53. $groupId=$_SESSION['_gid'];
  54. $relativeUrlPath=$_SESSION['draw_dir'];
  55. $currentTool=$_SESSION['whereami'];
  56. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  57. $saveDir=$dirBaseDocuments.$_SESSION['draw_dir'];
  58. //a bit title security
  59. $filename = addslashes(trim($filename));
  60. $filename = Security::remove_XSS($filename);
  61. $filename = replace_dangerous_char($filename, 'strict');
  62. $filename = disable_dangerous_file($filename);
  63. //a bit mime security
  64. if (phpversion() >= '5.3') {
  65. $finfo = new finfo(FILEINFO_MIME);
  66. $current_mime=$finfo->buffer($contents);
  67. finfo_close($finfo);
  68. $mime_png='image/png';//svg-edit return image/png; charset=binary
  69. $mime_svg='image/svg+xml';
  70. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii. See
  71. if(strpos($current_mime, $mime_png)===false && $extension=='png')
  72. {
  73. //die();//File extension does not match its content //disabled to check into chamilo dev campus
  74. }elseif(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg')
  75. {
  76. //die();//File extension does not match its content //disabled to check into chamilo dev campus TODO:enabled
  77. }
  78. }else{
  79. if($suffix!= 'svg' || $suffix!= 'png')
  80. {
  81. //die();//disabled to check into chamilo dev campus
  82. }
  83. }
  84. //checks if the file exists, then rename the new
  85. if(file_exists($saveDir.'/'.$filename.$i.'.'.$extension) && $currentTool=='document/createdraw'){
  86. $i = 1;
  87. while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++; //prevent duplicates
  88. $drawFileName = $filename.'_'.$i.'.'.$extension;
  89. $title=$title.' '.$i.'.'.$extension;
  90. }else{
  91. $drawFileName = $filename.'.'.$extension;
  92. $title = $title.'.'.$extension;
  93. }
  94. $documentPath = $saveDir.'/'.$drawFileName;
  95. //add new document to disk
  96. file_put_contents( $documentPath, $contents );
  97. if($currentTool=='document/createdraw'){
  98. //add document to database
  99. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  100. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  101. }elseif($currentTool=='document/editdraw'){
  102. //check path
  103. if(!isset($_SESSION['draw_file'])){
  104. api_not_allowed(false);//from Chamilo
  105. die();
  106. }
  107. if($_SESSION['draw_file']==$drawFileName){
  108. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$drawFileName);
  109. update_existing_document($_course, $document_id, filesize($documentPath), null);
  110. api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  111. }else{
  112. //add a new document
  113. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  114. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  115. }
  116. }
  117. //add messages and return to current document list
  118. echo '<script language="javascript" type="text/javascript">';
  119. if($suffix!= 'png'){
  120. if($relativeUrlPath==''){$relativeUrlPath='/';};
  121. $interbreadcrumb=api_get_path(WEB_CODE_PATH).'document/document.php?cidReq='.$_course['path'].'&curdirpath='. urlencode($relativeUrlPath);
  122. echo 'alert("'.get_lang('FileSavedAs').': '.$title.'");';
  123. echo 'window.top.location.href="'.$interbreadcrumb.'";';//return to current document list
  124. }else{
  125. echo 'alert("'.get_lang('FileExportAs').': '.$title.'");';
  126. }
  127. echo '</script>';
  128. ?>