remote.php 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102
  1. <?php
  2. // By Arnaud Ligot <arnaud@cblue.be>
  3. // Based on work done for old videoconference application
  4. // params:
  5. // action=list cidReq=course_Code cwd=folder result: json output
  6. // I have about 30 minutes to write this peace of code so if somebody has more time, feel free to rewrite it...
  7. /* See license terms in /license.txt */
  8. /* FIX for IE cache when using https */
  9. session_cache_limiter("none");
  10. /*==== DEBUG ====*/
  11. $debug=0;
  12. if ($debug>0)
  13. {
  14. // dump the request
  15. $v = array_keys(get_defined_vars());
  16. error_log(var_export($v, true),3, '/tmp/log');
  17. foreach (array_keys(get_defined_vars()) as $k) {
  18. if ($k == 'GLOBALS')
  19. continue;
  20. error_log($k, 3, '/tmp/log');
  21. error_log(var_export($$k, true), 3, '/tmp/log');
  22. }
  23. }
  24. /*==== INCLUDE ====*/
  25. require_once '../inc/global.inc.php';
  26. api_block_anonymous_users();
  27. require_once (api_get_path(LIBRARY_PATH)."course.lib.php");
  28. require_once (api_get_path(LIBRARY_PATH)."document.lib.php");
  29. require_once ("../newscorm/learnpath.class.php");
  30. /*==== Variables initialisation ====*/
  31. $action = $_REQUEST["action"]; //safe as only used in if()'s
  32. $seek = array('/','%2F','..');
  33. $destroy = array('','','');
  34. $cidReq = str_replace($seek,$destroy,$_REQUEST["cidReq"]);
  35. $cidReq = Security::remove_XSS($cidReq);
  36. $user_id = api_get_user_id();
  37. $coursePath = api_get_path(SYS_COURSE_PATH).$cidReq.'/document';
  38. $_course = CourseManager::get_course_information($cidReq);
  39. if ($_course == null) die ("problem when fetching course information");
  40. // stupid variable initialisation for old version of DocumentManager functions.
  41. $_course['path'] = $_course['directory'];
  42. $_course['dbName'] = $_course['db_name'];
  43. $is_manager = (CourseManager::get_user_in_course_status($user_id, $cidReq) == COURSEMANAGER);
  44. if ($debug>0) error_log($coursePath, 0);
  45. // FIXME: check security around $_REQUEST["cwd"]
  46. $cwd = $_REQUEST["cwd"];
  47. // treat /..
  48. $nParent = 0; // the number of /.. into the url
  49. while (substr($cwd, -3, 3) == "/..")
  50. {
  51. // go to parent directory
  52. $cwd= substr($cwd, 0, -3);
  53. if (strlen($cwd) == 0) $cwd="/";
  54. $nParent++;
  55. }
  56. for (;$nParent >0; $nParent--){
  57. $cwd = (strrpos($cwd,'/')>-1 ? substr($cwd, 0, strrpos($cwd,'/')) : $cwd);
  58. }
  59. if (strlen($cwd) == 0) $cwd="/";
  60. if (Security::check_abs_path($cwd,api_get_path(SYS_PATH)))
  61. die();
  62. if ($action == "list")
  63. {
  64. /*==== List files ====*/
  65. if ($debug>0) error_log("sending file list",0);
  66. // get files list
  67. $files = DocumentManager::get_all_document_data($_course, $cwd, 0, NULL, false);
  68. // adding download link to files
  69. foreach($files as $k=>$f)
  70. if ($f['filetype'] == 'file')
  71. // $files[$k]['download'] = api_get_path(WEB_CODE_PATH)."/document/document.php?cidReq=$cidReq&action=download&id=".urlencode($f['path']);
  72. $files[$k]['download'] = api_get_path(WEB_COURSE_PATH).$cidReq."/document".$f['path'];
  73. print json_encode($files);
  74. exit;
  75. }
  76. ?>