save_pixlr.php 6.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file allows creating new svg and png documents with an online editor.
  5. *
  6. * @package chamilo.document
  7. *
  8. * @author Juan Carlos Raña Trabado
  9. * @since 30/january/2011
  10. */
  11. /**
  12. * Code
  13. */
  14. require_once '../inc/global.inc.php';
  15. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  16. api_protect_course_script();
  17. api_block_anonymous_users();
  18. if ($_user['user_id']!= api_get_user_id() || api_get_user_id()==0 || $_user['user_id']==0) {
  19. api_not_allowed();
  20. die();
  21. }
  22. if(!isset($_GET['title']) || !isset($_GET['type']) || !isset($_GET['image'])) {
  23. api_not_allowed();
  24. die();
  25. }
  26. if(!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami']) ){
  27. api_not_allowed();
  28. die();
  29. }
  30. //pixlr return
  31. $filename=Security::remove_XSS($_GET['title']);//The user preferred file name of the image.
  32. $extension=Security::remove_XSS($_GET['type']);//The image type, "pdx", "jpg", "bmp" or "png".
  33. $urlcontents=Security::remove_XSS($_GET['image']);//A URL to the image on Pixlr.com server or the raw file post of the saved image.
  34. //make variables
  35. $title = Database::escape_string(str_replace('_',' ',$filename));
  36. $current_session_id = api_get_session_id();
  37. $groupId= api_get_group_id();
  38. $relativeUrlPath=$_SESSION['paint_dir'];
  39. $currentTool=$_SESSION['whereami'];
  40. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  41. $saveDir=$dirBaseDocuments.$_SESSION['paint_dir'];
  42. $contents = file_get_contents($urlcontents);
  43. //Security. Verify that the URL is pointing to a file @ pixlr.com domain or an ip @ pixlr.com. Comment because sometimes return a ip number
  44. /*
  45. if (strpos($urlcontents, "pixlr.com") === 0){
  46. echo "Invalid referrer";
  47. exit;
  48. }
  49. */
  50. //Security. Allway get from pixlr.com. Comment because for now this does not run
  51. /*
  52. $urlcontents1='http://pixlr.com/';
  53. $urlcontents2 = strstr($urlcontents, '_temp');
  54. $urlcontents_to_save=$urlcontents1.$urlcontents2;
  55. $contents = file_get_contents($urlcontents_to_save);//replace line 45.
  56. */
  57. //a bit title security
  58. $filename = addslashes(trim($filename));
  59. $filename = Security::remove_XSS($filename);
  60. $filename = replace_dangerous_char($filename, 'strict');
  61. $filename = disable_dangerous_file($filename);
  62. if (strlen(trim($filename))==0) {
  63. echo "The title is empty";//if title is empty, headers Content-Type = application/octet-stream, then not create a new title here please
  64. exit;
  65. }
  66. //check file_get_contents
  67. if ($contents === false) {
  68. echo "I cannot read: ".$urlcontents;
  69. exit;
  70. }
  71. // Extension security
  72. if($extension!= 'jpg' && $extension!= 'png' && $extension!= 'pxd'){
  73. die();
  74. }
  75. if($extension=='pxd') {
  76. echo "pxd file type does not supported";// not secure because check security headers and finfo() return Content-Type = application/octet-stream
  77. exit;
  78. }
  79. //Verify that the file is an image. Headers method
  80. $headers = get_headers($urlcontents, 1);
  81. $content_type = explode("/", $headers['Content-Type']);
  82. if ($content_type[0] != "image") {
  83. echo "Invalid file type";
  84. exit;
  85. }
  86. //Verify that the file is an image. Fileinfo method
  87. $finfo = new finfo(FILEINFO_MIME);
  88. $current_mime=$finfo->buffer($contents);
  89. finfo_close($finfo);
  90. if(strpos($current_mime, 'image')===false) {
  91. echo "Invalid mime type file";
  92. exit;
  93. }
  94. //path, file and title
  95. $paintFileName = $filename.'.'.$extension;
  96. $title = $title.'.'.$extension;
  97. if($currentTool=='document/createpaint'){
  98. //check save as and prevent rewrite an older file with same name
  99. if (0 != $groupId){
  100. $group_properties = GroupManager :: get_group_properties($groupId);
  101. $groupPath = $group_properties['directory'];
  102. } else {
  103. $groupPath ='';
  104. }
  105. if (file_exists($saveDir.'/'.$filename.'.'.$extension)){
  106. $i = 1;
  107. while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
  108. $paintFileName = $filename . '_' . $i . '.'.$extension;
  109. $title = $filename . '_' . $i . '.'.$extension;
  110. }
  111. //
  112. $documentPath = $saveDir.'/'.$paintFileName;
  113. //add new document to disk
  114. file_put_contents( $documentPath, $contents );
  115. //add document to database
  116. $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
  117. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  118. }elseif($currentTool=='document/editpaint'){
  119. $documentPath = $saveDir.'/'.$paintFileName;
  120. //add new document to disk
  121. file_put_contents( $documentPath, $contents );
  122. //check path
  123. if(!isset($_SESSION['paint_file'])){
  124. api_not_allowed();
  125. die();
  126. }
  127. if($_SESSION['paint_file']==$paintFileName){
  128. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
  129. update_existing_document($_course, $document_id, filesize($documentPath), null);
  130. api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  131. }else{
  132. //add a new document
  133. $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
  134. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  135. }
  136. }
  137. //delete temporal file
  138. $temp_file_2delete=$_SESSION['temp_realpath_image'];
  139. unlink($temp_file_2delete);
  140. //Clean sessions and return to Chamilo file list
  141. unset($_SESSION['paint_dir']);
  142. unset($_SESSION['paint_file']);
  143. unset($_SESSION['whereami']);
  144. unset($_SESSION['temp_realpath_image']);
  145. if (!isset($_SESSION['exit_pixlr'])) {
  146. $location=api_get_path(WEB_CODE_PATH).'document/document.php';
  147. echo '<script>window.parent.location.href="'.$location.'"</script>';
  148. api_not_allowed(true);
  149. } else {
  150. echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
  151. $location=api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']);
  152. echo '<script>window.parent.location.href="'.$location.'"</script>';
  153. unset($_SESSION['exit_pixlr']);
  154. }