receiver.php 2.4 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file allows creating new svg and png documents with an online editor.
  5. *
  6. * @package chamilo.document
  7. *
  8. * @author Juan Carlos Raña Trabado
  9. * @since 5/mar/2011
  10. */
  11. /**
  12. * Code
  13. */
  14. require_once '../../../inc/global.inc.php';
  15. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  16. api_protect_course_script();
  17. api_block_anonymous_users();
  18. if (!isset($_GET['filename']) || !isset($_GET['filepath']) || !isset($_GET['dir']) || !isset($_GET['course_code'])|| !isset($_GET['nano_group_id']) || !isset($_GET['nano_session_id']) || !isset($_GET['nano_user_id'])){
  19. echo 'Error. Not allowed';
  20. exit;
  21. }
  22. if (!is_uploaded_file($_FILES['voicefile']['tmp_name'])) exit;
  23. //clean
  24. $nano_user_id=Security::remove_XSS($_GET['nano_user_id']);
  25. $nano_group_id=Security::remove_XSS($_GET['nano_group_id']);
  26. $nano_session_id=Security::remove_XSS($_GET['nano_session_id']);
  27. $filename=Security::remove_XSS($_GET['filename']);
  28. $filename=urldecode($filename);
  29. $filepath=Security::remove_XSS(urldecode($_GET['filepath']));
  30. $dir=Security::remove_XSS(urldecode($_GET['dir']));
  31. $course_code = Security::remove_XSS(urldecode($_GET['course_code']));
  32. $_course=api_get_course_info($course_code);
  33. $filename = trim($_GET['filename']);
  34. $filename = Security::remove_XSS($filename);
  35. $filename = Database::escape_string($filename);
  36. $filename = replace_dangerous_char($filename, $strict = 'loose');// or strict
  37. $filename = disable_dangerous_file($filename);
  38. $title= trim(str_replace('_chnano_.','.',$filename));//hide nanogong wav tag at title
  39. $title= str_replace('_',' ',$title);
  40. //
  41. $documentPath = $filepath.$filename;
  42. if ($nano_user_id!= api_get_user_id() || api_get_user_id()==0 || $nano_user_id==0) {
  43. echo 'Not allowed';
  44. exit;
  45. }
  46. //Do not use here check Fileinfo method because return: text/plain
  47. if (!file_exists($documentPath)){
  48. //add document to disk
  49. move_uploaded_file($_FILES['voicefile']['tmp_name'], $documentPath);
  50. //add document to database
  51. $current_session_id = $nano_session_id;
  52. $groupId=$nano_group_id;
  53. $file_size = filesize($documentPath);
  54. $relativeUrlPath=$dir;
  55. $doc_id = add_document($_course, $relativeUrlPath.$filename, 'file', filesize($documentPath), $title);
  56. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $nano_user_id, $groupId, null, null, null, $current_session_id);
  57. } else {
  58. return get_lang('FileExistRename');
  59. }