survey.download.inc.php 3.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * @package chamilo.survey
  5. * @author Arnaud Ligot <arnaud@cblue.be>
  6. * @version $Id: $
  7. *
  8. * A small peace of code to enable user to access images included into survey
  9. * which are accessible by non authenticated users. This file is included
  10. * by document/download.php
  11. */
  12. function check_download_survey($course, $invitation, $doc_url) {
  13. require_once 'survey.lib.php';
  14. require_once api_get_path(LIBRARY_PATH).'course.lib.php';
  15. // Getting all the course information
  16. $_course = CourseManager::get_course_information($course);
  17. // Database table definitions
  18. $table_survey = Database :: get_course_table(TABLE_SURVEY, $_course['db_name']);
  19. $table_survey_question = Database :: get_course_table(TABLE_SURVEY_QUESTION, $_course['db_name']);
  20. $table_survey_question_option = Database :: get_course_table(TABLE_SURVEY_QUESTION_OPTION, $_course['db_name']);
  21. $table_course = Database :: get_main_table(TABLE_MAIN_COURSE);
  22. $table_user = Database :: get_main_table(TABLE_MAIN_USER);
  23. $table_survey_invitation = Database :: get_course_table(TABLE_SURVEY_INVITATION, $_course['db_name']);
  24. // Now we check if the invitationcode is valid
  25. $sql = "SELECT * FROM $table_survey_invitation WHERE invitation_code = '".Database::escape_string($invitation)."'";
  26. $result = Database::query($sql);
  27. if (Database::num_rows($result) < 1) {
  28. Display :: display_error_message(get_lang('WrongInvitationCode'), false);
  29. Display :: display_footer();
  30. exit;
  31. }
  32. $survey_invitation = Database::fetch_assoc($result);
  33. // Now we check if the user already filled the survey
  34. if ($survey_invitation['answered'] == 1) {
  35. Display :: display_error_message(get_lang('YouAlreadyFilledThisSurvey'), false);
  36. Display :: display_footer();
  37. exit;
  38. }
  39. // Very basic security check: check if a text field from a survey/answer/option contains the name of the document requested
  40. // Fetch survey ID
  41. // If this is the case there will be a language choice
  42. $sql = "SELECT * FROM $table_survey WHERE code='".Database::escape_string($survey_invitation['survey_code'])."'";
  43. $result = Database::query($sql);
  44. if (Database::num_rows($result) > 1) {
  45. if ($_POST['language']) {
  46. $survey_invitation['survey_id'] = $_POST['language'];
  47. } else {
  48. echo '<form id="language" name="language" method="POST" action="'.api_get_self().'?course='.$_GET['course'].'&invitationcode='.$_GET['invitationcode'].'">';
  49. echo ' <select name="language">';
  50. while ($row = Database::fetch_assoc($result)) {
  51. echo '<option value="'.$row['survey_id'].'">'.$row['lang'].'</option>';
  52. }
  53. echo '</select>';
  54. echo ' <input type="submit" name="Submit" value="'.get_lang('Ok').'" />';
  55. echo '</form>';
  56. display::display_footer();
  57. exit;
  58. }
  59. } else {
  60. $row = Database::fetch_assoc($result);
  61. $survey_invitation['survey_id'] = $row['survey_id'];
  62. }
  63. $sql = "select count(*) from $table_survey where survey_id = ".$survey_invitation['survey_id']."
  64. and (
  65. title LIKE '%$doc_url%'
  66. or subtitle LIKE '%$doc_url%'
  67. or intro LIKE '%$doc_url%'
  68. or surveythanks LIKE '%$doc_url%'
  69. )
  70. union select count(*) from $table_survey_question where survey_id = ".$survey_invitation['survey_id']."
  71. and (
  72. survey_question LIKE '%$doc_url%'
  73. or survey_question_comment LIKE '%$doc_url%'
  74. )
  75. union select count(*) from $table_survey_question_option where survey_id = ".$survey_invitation['survey_id']."
  76. and (
  77. option_text LIKE '%$doc_url%'
  78. )";
  79. $result = Database::query($sql);
  80. if (Database::num_rows($result) == 0) {
  81. Display :: display_error_message(get_lang('WrongInvitationCode'), false);
  82. Display :: display_footer();
  83. exit;
  84. }
  85. return $_course;
  86. }