download.php 4.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file is responsible for passing requested documents to the browser.
  5. * Html files are parsed to fix a few problems with URLs,
  6. * but this code will hopefully be replaced soon by an Apache URL
  7. * rewrite mechanism.
  8. *
  9. * @package chamilo.work
  10. */
  11. session_cache_limiter('public');
  12. require_once '../inc/global.inc.php';
  13. $current_course_tool = TOOL_STUDENTPUBLICATION;
  14. $this_section = SECTION_COURSES;
  15. // IMPORTANT to avoid caching of documents
  16. header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
  17. header('Cache-Control: public');
  18. header('Pragma: no-cache');
  19. //protection
  20. api_protect_course_script(true);
  21. $id = intval($_GET['id']);
  22. $course_info = api_get_course_info();
  23. if (empty($course_info)) {
  24. api_not_allowed(true);
  25. }
  26. $tbl_student_publication = Database::get_course_table(TABLE_STUDENT_PUBLICATION);
  27. if (!empty($course_info['real_id'])) {
  28. $sql = 'SELECT * FROM '.$tbl_student_publication.' WHERE c_id = '.$course_info['real_id'].' AND id = "'.$id.'"';
  29. $result = Database::query($sql);
  30. if ($result && Database::num_rows($result)) {
  31. $row = Database::fetch_array($result, 'ASSOC');
  32. $full_file_name = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/'.$row['url'];
  33. $item_info = api_get_item_property_info(api_get_course_int_id(), 'work', $row['id']);
  34. if (empty($item_info)) {
  35. exit;
  36. }
  37. /*
  38. field show_score in table course : 0 => New documents are visible for all users
  39. 1 => New documents are only visible for the teacher(s)
  40. field visibility in table item_property : 0 => eye closed, invisible for all students
  41. 1 => eye open
  42. field accepted in table c_student_publication : 0 => eye closed, invisible for all students
  43. 1 => eye open
  44. (we should have visibility == accepted , otherwise there is an inconsistency in the Database)
  45. field value in table c_course_setting : 0 => Allow learners to delete their own publications = NO
  46. 1 => Allow learners to delete their own publications = YES
  47. +------------------+------------------------------+----------------------------+
  48. |Can download work?| doc visible for all = 0 | doc visible for all = 1|
  49. +------------------+------------------------------+----------------------------+
  50. | visibility = 0 | editor only | editor only |
  51. | | | |
  52. +------------------+------------------------------+----------------------------+
  53. | visibility = 1 | editor | editor |
  54. | | + owner of the work | + any student |
  55. +------------------+------------------------------+----------------------------+
  56. (editor = teacher + admin + anybody with right api_is_allowed_to_edit)
  57. */
  58. $work_is_visible = ($item_info['visibility'] == 1 && $row['accepted'] == 1);
  59. $doc_visible_for_all = ($course_info['show_score'] == 1);
  60. $is_editor = api_is_allowed_to_edit(true,true,true);
  61. $student_is_owner_of_work = ($row['user_id'] == api_get_user_id());
  62. if ($is_editor
  63. || (!$doc_visible_for_all && $work_is_visible && $student_is_owner_of_work)
  64. || ($doc_visible_for_all && $work_is_visible)) {
  65. $title = str_replace(' ', '_', $row['title']);
  66. event_download($title);
  67. if (Security::check_abs_path($full_file_name, api_get_path(SYS_COURSE_PATH).api_get_course_path().'/')) {
  68. DocumentManager::file_send_for_download($full_file_name, true, $title);
  69. }
  70. } else {
  71. api_not_allowed();
  72. }
  73. }
  74. }
  75. exit;