receiver.php 2.0 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file allows creating new svg and png documents with an online editor.
  5. *
  6. * @package chamilo.document
  7. *
  8. * @author Juan Carlos Ra�a Trabado
  9. * @since 5/mar/2011
  10. */
  11. /**
  12. * Code
  13. */
  14. require_once '../../../inc/global.inc.php';
  15. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  16. //security. Nanogong need less security because under Firefox, Chrome..., not save user_id...
  17. if (api_get_setting('enable_nanogong') == 'false'){
  18. api_protect_course_script();
  19. api_block_anonymous_users();
  20. }
  21. if (!isset($_GET['filename']) || !isset($_GET['filepath']) || !isset($_GET['dir']) || !isset($_GET['course_code'])){
  22. api_not_allowed(true);
  23. }
  24. if (!is_uploaded_file($_FILES['voicefile']['tmp_name'])) exit;
  25. //clean
  26. $filename=Security::remove_XSS($_GET['filename']);
  27. $filename=urldecode($filename);
  28. $filepath=Security::remove_XSS(urldecode($_GET['filepath']));
  29. $dir=Security::remove_XSS(urldecode($_GET['dir']));
  30. $course_code = Security::remove_XSS(urldecode($_GET['course_code']));
  31. $_course=api_get_course_info($course_code);
  32. $filename = trim($_GET['filename']);
  33. $filename = Security::remove_XSS($filename);
  34. $filename = Database::escape_string($filename);
  35. $filename = replace_dangerous_char($filename, $strict = 'loose');// or strict
  36. $filename = disable_dangerous_file($filename);
  37. $title= str_replace('_',' ',$filename);
  38. //
  39. $documentPath = $filepath.$filename;
  40. if (!file_exists($documentPath)){
  41. //add document to disk
  42. move_uploaded_file($_FILES['voicefile']['tmp_name'], $documentPath);
  43. //add document to database
  44. $current_session_id = api_get_session_id();
  45. $groupId=$_SESSION['_gid'];
  46. $file_size = filesize($documentPath);
  47. $relativeUrlPath=$dir;
  48. $doc_id = add_document($_course, $relativeUrlPath.$filename, 'file', filesize($documentPath), $title);
  49. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  50. } else {
  51. return get_lang('FileExistRename');
  52. }