download.php 3.1 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file is responsible for passing requested file attachments from messages
  5. * Html files are parsed to fix a few problems with URLs,
  6. * but this code will hopefully be replaced soon by an Apache URL
  7. * rewrite mechanism.
  8. *
  9. * @package chamilo.messages
  10. */
  11. /**
  12. * MAIN CODE
  13. */
  14. session_cache_limiter('public');
  15. require_once '../inc/global.inc.php';
  16. require_once api_get_path(LIBRARY_PATH).'usermanager.lib.php';
  17. require_once api_get_path(LIBRARY_PATH).'group_portal_manager.lib.php';
  18. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  19. // IMPORTANT to avoid caching of documents
  20. header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
  21. header('Cache-Control: public');
  22. header('Pragma: no-cache');
  23. $file_url = $_GET['file'];
  24. //change the '&' that got rewritten to '///' by mod_rewrite back to '&'
  25. $file_url = str_replace('///', '&', $file_url);
  26. //still a space present? it must be a '+' (that got replaced by mod_rewrite)
  27. $file_url = str_replace(' ', '+', $file_url);
  28. $file_url = str_replace('/..', '', $file_url); //echo $doc_url;
  29. $tbl_messsage = Database::get_main_table(TABLE_MESSAGE);
  30. $tbl_messsage_attachment = Database::get_main_table(TABLE_MESSAGE_ATTACHMENT);
  31. $file_url = Database::escape_string($file_url);
  32. $sql= "SELECT filename, message_id FROM $tbl_messsage_attachment WHERE path LIKE BINARY '$file_url'";
  33. $result = Database::query($sql);
  34. $row = Database::fetch_array($result, 'ASSOC');
  35. $title = str_replace(' ','_', $row['filename']);
  36. $message_id = $row['message_id'];
  37. // allow download only for user sender and user receiver
  38. $sql = "SELECT user_sender_id, user_receiver_id, group_id FROM $tbl_messsage WHERE id = '$message_id'";
  39. $rs = Database::query($sql);
  40. $row_users = Database::fetch_array($rs, 'ASSOC');
  41. $current_uid = api_get_user_id();
  42. // get message user id for inbox/outbox
  43. $message_uid = '';
  44. $message_type = array('inbox','outbox');
  45. if (in_array($_GET['type'],$message_type)) {
  46. if ($_GET['type'] == 'inbox') {
  47. $message_uid = $row_users['user_receiver_id'];
  48. } else {
  49. $message_uid = $row_users['user_sender_id'];
  50. }
  51. }
  52. // allow to the correct user for download this file
  53. $not_allowed_to_edit = false;
  54. if (!empty($row_users['group_id'])) {
  55. $users_group = GroupPortalManager::get_all_users_by_group($row_users['group_id']);
  56. if (!in_array($current_uid,array_keys($users_group))) {
  57. $not_allowed_to_edit = true;
  58. }
  59. } else {
  60. if ($current_uid != $message_uid) {
  61. $not_allowed_to_edit = true;
  62. }
  63. }
  64. if ($not_allowed_to_edit) {
  65. api_not_allowed();
  66. exit;
  67. }
  68. // set the path directory file
  69. if (!empty($row_users['group_id'])) {
  70. $path_user_info = GroupPortalManager::get_group_picture_path_by_id($row_users['group_id'], 'system', true);
  71. } else {
  72. $path_user_info = UserManager::get_user_picture_path_by_id($message_uid, 'system', true);
  73. }
  74. $full_file_name = $path_user_info['dir'].'message_attachments/'.$file_url;
  75. if (Security::check_abs_path($full_file_name, $path_user_info['dir'].'message_attachments/')) {
  76. // launch event
  77. event_download($file_url);
  78. DocumentManager::file_send_for_download($full_file_name,TRUE, $title);
  79. }
  80. exit;