remote.php 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172
  1. <?php
  2. /* See license terms in /license.txt */
  3. /**
  4. * Script that allows download of a specific file from external applications
  5. * @author Arnaud Ligot <arnaud@cblue.be>, Based on work done for old videoconference application (I have about 30 minutes to write this peace of code so if somebody has more time, feel free to rewrite it...)
  6. * @package chamilo.document
  7. */
  8. /**
  9. * Script that allows remote download of a file
  10. * @param string Action parameter (action=...)
  11. * @param string Course code (cidReq=...)
  12. * @param string Current working directory (cwd=...)
  13. * @return string JSON output
  14. */
  15. /* FIX for IE cache when using https */
  16. session_cache_limiter('none');
  17. require_once __DIR__.'/../inc/global.inc.php';
  18. api_block_anonymous_users();
  19. /*==== Variables initialisation ====*/
  20. $action = $_REQUEST['action']; //safe as only used in if()'s
  21. $seek = array('/', '%2F', '..');
  22. $destroy = array('', '', '');
  23. $cidReq = str_replace($seek, $destroy, $_REQUEST["cidReq"]);
  24. $cidReq = Security::remove_XSS($cidReq);
  25. $user_id = api_get_user_id();
  26. $coursePath = api_get_path(SYS_COURSE_PATH).$cidReq.'/document';
  27. $_course = api_get_course_info($cidReq);
  28. if (empty($_course)) {
  29. die ("problem when fetching course information");
  30. }
  31. // stupid variable initialisation for old version of DocumentManager functions.
  32. $_course['path'] = $_course['directory'];
  33. $is_manager = (CourseManager::getUserInCourseStatus($user_id, $_course['real_id']) == COURSEMANAGER);
  34. if ($debug > 0) {
  35. error_log($coursePath, 0);
  36. }
  37. // FIXME: check security around $_REQUEST["cwd"]
  38. $cwd = $_REQUEST['cwd'];
  39. // treat /..
  40. $nParent = 0; // the number of /.. into the url
  41. while (substr($cwd, -3, 3) == '/..') {
  42. // go to parent directory
  43. $cwd = substr($cwd, 0, -3);
  44. if (strlen($cwd) == 0) { $cwd = '/'; }
  45. $nParent++;
  46. }
  47. for (; $nParent > 0; $nParent--) {
  48. $cwd = (strrpos($cwd, '/') > -1 ? substr($cwd, 0, strrpos($cwd, '/')) : $cwd);
  49. }
  50. if (strlen($cwd) == 0) {
  51. $cwd = '/';
  52. }
  53. if (Security::check_abs_path($cwd, api_get_path(SYS_PATH))) {
  54. die();
  55. }
  56. if ($action == 'list') {
  57. /*==== List files ====*/
  58. if ($debug > 0) { error_log("sending file list", 0); }
  59. // get files list
  60. $files = DocumentManager::get_all_document_data($_course, $cwd, 0, null, false);
  61. // adding download link to files
  62. foreach ($files as $k => $f) {
  63. if ($f['filetype'] == 'file') {
  64. $files[$k]['download'] = api_get_path(WEB_COURSE_PATH).$cidReq."/document".$f['path'];
  65. }
  66. print json_encode($files);
  67. exit;
  68. }
  69. }