api.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302
  1. <?php
  2. /* See license terms in /license.txt */
  3. /* FIX for IE cache when using https */
  4. session_cache_limiter("none");
  5. /**
  6. * This is an interface between Chamilo and Videoconference application
  7. *
  8. */
  9. /*==== DEBUG ====*/
  10. $debug = 0;
  11. /*==== CONSTANTS ==== */
  12. define('VIDEOCONF_UPLOAD_PATH', '/videoconf');
  13. $presentation_extension = array('.ppt', '.odp');
  14. $image_extension = array('.png', '.jpg', '.gif', '.jpeg');
  15. if ($debug > 0) {
  16. // dump the request
  17. $v = array_keys(get_defined_vars());
  18. error_log(var_export($v, true), 3, '/tmp/log');
  19. foreach (array_keys(get_defined_vars()) as $k) {
  20. if ($k == 'GLOBALS') {
  21. continue;
  22. }
  23. error_log($k, 3, '/tmp/log');
  24. error_log(var_export($$k, true), 3, '/tmp/log');
  25. }
  26. }
  27. /*==== Flash loose the cookie ===*/
  28. /* needed when using the nice upload window :
  29. if ($_SERVER['HTTP_USER_AGENT'] == 'Shockwave Flash') {
  30. $sid = $_REQUEST['sid'];
  31. if ($debug>0) error_log("reusing: ".$sid);
  32. session_id($sid);
  33. } */
  34. /*==== INCLUDE ====*/
  35. require_once '../inc/global.inc.php';
  36. api_block_anonymous_users();
  37. require_once (api_get_path(LIBRARY_PATH)."document.lib.php");
  38. require_once ("../newscorm/learnpath.class.php");
  39. require_once ("../newscorm/openoffice_presentation.class.php");
  40. /*==== Variables initialisation ====*/
  41. $action = $_REQUEST["action"]; //safe as only used in if()'s
  42. $seek = array('/', '%2F', '..');
  43. $destroy = array('', '', '');
  44. $cidReq = str_replace($seek, $destroy, $_REQUEST["cidReq"]);
  45. $cidReq = Security::remove_XSS($cidReq);
  46. $user_id = api_get_user_id();
  47. $coursePath = api_get_path(SYS_COURSE_PATH).$cidReq.'/document';
  48. $_course = CourseManager::get_course_information($cidReq);
  49. $_course['path'] = $_course['directory'];
  50. // FIXME: FileManager::add_document needs this to work
  51. $_course['dbName'] = $_course['db_name'];
  52. // FIXME: check if CourseManager::get_user_in_course_status return !=
  53. // COURSEMANAGER when the code is not valid
  54. if ($debug > 0) {
  55. error_log($coursePath, 0);
  56. }
  57. if ($action == "uploadgui") {
  58. echo '<form enctype="multipart/form-data" action="api.php" method="POST">
  59. <input type="hidden" name="MAX_FILE_SIZE" value="100000000" />
  60. <input type="hidden" name="action" value="upload" />
  61. <input type="hidden" name="cidReq" value="'.$cidReq.'" />
  62. <input type="hidden" name="sid" value="'.Security::remove_XSS($_REQUEST["sid"]).'" />
  63. '.get_lang('SelectFile').': <input name="Filedata" type="file" /><br />
  64. <input type="submit" value="'.get_lang('UploadFile').'" />
  65. </form>
  66. ';
  67. die();
  68. } else {
  69. if ($action == "upload") {
  70. if ($debug > 0) {
  71. error_log("upload".$_FILES['Filedata']);
  72. }
  73. /*==== PERMISSION ====*/
  74. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  75. if ($permissions != COURSEMANAGER) {
  76. if ($debug > 0) {
  77. error_log("Upload from videoconf not allowed !!!", 0);
  78. }
  79. die('Not allowed'); // this user is not allowed to add upload documents
  80. }
  81. /*==== UPLOAD ====*/
  82. $destPath = $coursePath.VIDEOCONF_UPLOAD_PATH;
  83. /*==== creation of /videoconf ====*/
  84. if (!is_dir($destPath)) {
  85. $result = FileManager::create_unexisting_directory(
  86. $_course,
  87. $user_id,
  88. api_get_session_id(),
  89. 0,
  90. null,
  91. $coursePath,
  92. VIDEOCONF_UPLOAD_PATH
  93. );
  94. if (!$result) {
  95. if ($debug > 0) {
  96. error_log("Can't create ".$destPath." folder", 0);
  97. }
  98. }
  99. }
  100. /*==== file upload ====*/
  101. $newPath = $_FILES['Filedata']['name'];
  102. if ($debug > 0) {
  103. error_log($newPath);
  104. }
  105. /*==== extension extraction ====*/
  106. $file_name = (strrpos($newPath, '.') > 0 ? substr($newPath, 0, strrpos($newPath, '.')) : $newPath);
  107. $file_extension = (strrpos($newPath, '.') > 0 ? substr($newPath, strrpos($newPath, '.'), 10) : '');
  108. if ($debug > 0) {
  109. error_log(strrpos($newPath, '.'));
  110. }
  111. if ($debug > 0) {
  112. error_log($file_extension);
  113. }
  114. /*==== conversion if needed ====*/
  115. if (!in_array(strtolower($file_extension), $image_extension)) {
  116. if ($debug > 0) {
  117. error_log("converting: ".$file_extension);
  118. }
  119. $take_slide_name = false;
  120. $o_ppt = new OpenofficePresentation($take_slide_name);
  121. $o_ppt->set_slide_size(640, 480);
  122. $o_ppt->convert_document($_FILES['Filedata'], 'add_docs_to_visio');
  123. }
  124. echo '<html><body><script language="javascript">setTimeout(1000,window.close());</script></body></html>';
  125. } else {
  126. if ($action == "service") {
  127. /*==== List files ====*/
  128. if ($debug > 0) {
  129. error_log("sending file list", 0);
  130. }
  131. $subaction = $_REQUEST["subaction"];
  132. $is_manager = (CourseManager::get_user_in_course_status($user_id, $cidReq) == COURSEMANAGER);
  133. if ($subaction == "list") {
  134. // FIXME: check security around $_REQUEST["cwd"]
  135. $cwd = $_REQUEST["cwd"];
  136. // treat /..
  137. $nParent = 0; // the number of /.. into the url
  138. while (substr($cwd, -3, 3) == "/..") {
  139. // go to parent directory
  140. $cwd = substr($cwd, 0, -3);
  141. if (strlen($cwd) == 0) {
  142. $cwd = "/";
  143. }
  144. $nParent++;
  145. }
  146. for (; $nParent > 0; $nParent--) {
  147. $cwd = (strrpos($cwd, '/') > -1 ? substr($cwd, 0, strrpos($cwd, '/')) : $cwd);
  148. }
  149. if (strlen($cwd) == 0) {
  150. $cwd = "/";
  151. }
  152. if (Security::check_abs_path($cwd, api_get_path(SYS_PATH))) {
  153. die();
  154. }
  155. // check if user can delete files. He must be manager and be inside /videoconf
  156. $is_below_videoconf_dir = (substr($cwd, 0, strlen(VIDEOCONF_UPLOAD_PATH)) == VIDEOCONF_UPLOAD_PATH);
  157. if ($debug > 0) {
  158. error_log('Current working directory: '.$cwd);
  159. }
  160. if ($debug > 0) {
  161. error_log('Videoconf upload path: '.VIDEOCONF_UPLOAD_PATH);
  162. }
  163. /* $canDelete = ($canDelete && $isBellowVideoConfUploadPath);
  164. */
  165. $can_delete = ($is_manager && $is_below_videoconf_dir);
  166. // get files list
  167. $files = DocumentManager::get_all_document_data($_course, $cwd, 0, null, false);
  168. printf("<dokeosobject><fileListMeta></fileListMeta><fileList>");
  169. printf("<folders>");
  170. // title filter
  171. if (is_array($files)) {
  172. foreach (array_keys($files) as $k) {
  173. // converting to UTF-8
  174. $files[$k]['title'] = api_convert_encoding(
  175. api_strlen($files[$k]['title']) > 32 ?
  176. api_substr($files[$k]['title'], 0, 32)."..." :
  177. $files[$k]['title'],
  178. 'utf-8',
  179. api_get_system_encoding()
  180. );
  181. // removing '<', '>' and '_'
  182. $files[$k]['title'] = str_replace(array('<', '>', '_'), ' ', $files[$k]['title']);
  183. }
  184. }
  185. if (is_array($files)) {
  186. foreach ($files as $i) {
  187. if ($i["filetype"] == "folder") {
  188. printf(
  189. '<folder><path>%s</path><title>%s</title><canDelete>%s</canDelete></folder>',
  190. $i['path'],
  191. $i['title'],
  192. ($can_delete ? 'true' : 'false')
  193. );
  194. }
  195. }
  196. }
  197. printf("</folders><files>");
  198. if (is_array($files)) {
  199. foreach ($files as $i) {
  200. $extension = (strrpos($i['path'], '.') > 0 ? substr(
  201. $i['path'],
  202. strrpos($i['path'], '.'),
  203. 10
  204. ) : '');
  205. if ($i["filetype"] == "file" && in_array(strtolower($extension), $image_extension)) {
  206. printf(
  207. '<file><path>%s</path><title>%s</title><canDelete>%s</canDelete></file>',
  208. $i['path'],
  209. $i['title'],
  210. ($can_delete ? 'true' : 'false')
  211. );
  212. }
  213. }
  214. }
  215. printf("</files><ppts>");
  216. printf("</ppts>");
  217. printf("</fileList></dokeosobject>");
  218. } else {
  219. if ($subaction == "delete") {
  220. /*==== PERMISSION ====*/
  221. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  222. if ($permissions != COURSEMANAGER) {
  223. if ($debug > 0) {
  224. error_log("Upload from videoconf not allowed !!!", 0);
  225. }
  226. die(); // this user is not allowed to add upload documents
  227. }
  228. /*==== DELETE ====*/
  229. $path = str_replace('../', '', $_REQUEST["path"]);
  230. if ((substr($path, 0, strlen(VIDEOCONF_UPLOAD_PATH)) != VIDEOCONF_UPLOAD_PATH)) {
  231. if ($debug > 0) {
  232. error_log("Delete from videoconf for " + $path + " NOT ALLOWED", 0);
  233. }
  234. die();
  235. }
  236. DocumentManager::delete_document($_course, $path, $coursePath);
  237. echo "<result>OK</result>"; // We have to return something to OpenLaszlo
  238. }
  239. }
  240. } else {
  241. if ($action == "download") {
  242. /*==== DOWNLOAD ====*/
  243. //check if the document is in the database
  244. if (!DocumentManager::get_document_id($_course, $_REQUEST['file'])) {
  245. //file not found!
  246. if ($debug > 0) {
  247. error_log("404 ".$_REQUEST["file"]);
  248. }
  249. header("HTTP/1.0 404 Not Found");
  250. $error404 = '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">';
  251. $error404 .= '<html><head>';
  252. $error404 .= '<title>404 Not Found</title>';
  253. $error404 .= '</head><body>';
  254. $error404 .= '<h1>Not Found</h1>';
  255. $error404 .= '<p>The requested URL was not found on this server.</p>';
  256. $error404 .= '<hr>';
  257. $error404 .= '</body></html>';
  258. echo($error404);
  259. exit;
  260. }
  261. $doc_url = str_replace('../', '', $_REQUEST['file']);
  262. if ($debug > 0) {
  263. error_log($doc_url);
  264. }
  265. $full_file_name = $coursePath.$doc_url;
  266. if (Security::check_abs_path($full_file_name, $coursePath.'/')) {
  267. DocumentManager::file_send_for_download($full_file_name, false);
  268. }
  269. exit;
  270. }
  271. }
  272. }
  273. }