dropbox_download.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * @package chamilo.dropbox
  5. */
  6. /**
  7. * Code
  8. */
  9. /* INIT SECTION */
  10. // We cannot use dropbox_init.inc.php because this one already outputs data.
  11. $language_file = 'dropbox';
  12. // including the basic Chamilo initialisation file
  13. require_once '../inc/global.inc.php';
  14. // the dropbox configuration parameters
  15. require_once 'dropbox_config.inc.php';
  16. // the dropbox file that contains additional functions
  17. require_once 'dropbox_functions.inc.php';
  18. // the dropbox class
  19. require_once 'dropbox_class.inc.php';
  20. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  21. /* DOWNLOAD A FOLDER */
  22. if (isset($_GET['cat_id']) AND is_numeric($_GET['cat_id']) AND $_GET['action'] == 'downloadcategory' AND isset($_GET['sent_received'])) {
  23. // step 1: constructingd' the sql statement. Due to the nature off the classes of the dropbox the categories for sent files are stored in the table
  24. // dropbox_file while the categories for the received files are stored in dropbox_post. It would have been more elegant if these could be stored
  25. // in dropbox_person (which stores the link file-person)
  26. // Therefore we have to create to separate sql statements to find which files are in the categorie (depending if we zip-download a sent category or a
  27. // received category)
  28. if ($_GET['sent_received'] == 'sent') {
  29. // here we also incorporate the person table to make sure that deleted sent documents are not included.
  30. $sql = "SELECT DISTINCT file.id, file.filename, file.title FROM ".$dropbox_cnf['tbl_file']." file, ".$dropbox_cnf['tbl_person']." person
  31. WHERE file.uploader_id='".Database::escape_string($_user['user_id'])."'
  32. AND file.cat_id='".Database::escape_string($_GET['cat_id'])."'
  33. AND person.user_id='".Database::escape_string($_user['user_id'])."'
  34. AND person.file_id=file.id
  35. " ;
  36. }
  37. if ($_GET['sent_received'] == 'received') {
  38. $sql = "SELECT DISTINCT file.id, file.filename, file.title FROM ".$dropbox_cnf['tbl_file']." file, ".$dropbox_cnf['tbl_person']." person, ".$dropbox_cnf['tbl_post']." post
  39. WHERE post.cat_id='".Database::escape_string($_GET['cat_id'])."'
  40. AND person.user_id='".Database::escape_string($_user['user_id'])."'
  41. AND person.file_id=file.id
  42. AND post.file_id=file.id
  43. " ;
  44. }
  45. $result = Database::query($sql);
  46. while ($row = Database::fetch_array($result)) {
  47. $files_to_download[] = $row['id'];
  48. }
  49. if (!is_array($files_to_download) OR empty($files_to_download)) {
  50. header('location: index.php?view='.Security::remove_XSS($_GET['sent_received']).'&error=ErrorNoFilesInFolder');
  51. exit;
  52. }
  53. zip_download($files_to_download);
  54. exit;
  55. }
  56. /* DOWNLOAD A FILE */
  57. /* AUTHORIZATION */
  58. // Check if the id makes sense
  59. if (!isset($_GET['id']) || !is_numeric($_GET['id'])) {
  60. Display::display_header($nameTools, 'Dropbox');
  61. Display :: display_error_message(get_lang('Error'));
  62. Display::display_footer();
  63. exit;
  64. }
  65. // Check if the user is allowed to download the file
  66. $allowed_to_download = false;
  67. // Check if the user has sent or received the file.
  68. $sql = "SELECT * FROM ".$dropbox_cnf['tbl_person']." WHERE file_id='".intval($_GET['id'])."' AND user_id='".api_get_user_id()."'";
  69. $result = Database::query($sql);
  70. if (Database::num_rows($result) > 0) {
  71. $allowed_to_download = true;
  72. }
  73. /* ERROR IF NOT ALLOWED TO DOWNLOAD */
  74. if (!$allowed_to_download) {
  75. Display::display_header($nameTools, 'Dropbox');
  76. Display :: display_error_message(get_lang('YouAreNotAllowedToDownloadThisFile'));
  77. Display::display_footer();
  78. exit;
  79. } else {
  80. /* DOWNLOAD THE FILE */
  81. // the user is allowed to download the file
  82. $_SESSION['_seen'][$_course['id']][TOOL_DROPBOX][] = intval($_GET['id']);
  83. $work = new Dropbox_work($_GET['id']);
  84. $path = dropbox_cnf('sysPath') . '/' . $work -> filename; //path to file as stored on server
  85. if (!Security::check_abs_path($path, dropbox_cnf('sysPath').'/')) {
  86. exit;
  87. }
  88. $file = $work->title;
  89. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  90. $mimetype = DocumentManager::file_get_mime_type(true);
  91. $fileparts = explode('.', $file);
  92. $filepartscount = count($fileparts);
  93. if (($filepartscount > 1) && isset($mimetype[$fileparts[$filepartscount - 1]]) && $_GET['action'] != 'download') {
  94. // give hint to browser about filetype
  95. header( 'Content-type: ' . $mimetype[$fileparts[$filepartscount - 1]] . "\n");
  96. } else {
  97. //no information about filetype: force a download dialog window in browser
  98. header( "Content-type: application/octet-stream\n");
  99. }
  100. if (!in_array(strtolower($fileparts [$filepartscount - 1]), array('doc', 'xls', 'ppt', 'pps', 'sxw', 'sxc', 'sxi'))) {
  101. header('Content-Disposition: inline; filename='.$file); // bugs with open office
  102. } else {
  103. header('Content-Disposition: attachment; filename='.$file);
  104. }
  105. /**
  106. * Note that if you use these two headers from a previous example:
  107. * header('Cache-Control: no-cache, must-revalidate');
  108. * header('Pragma: no-cache');
  109. * before sending a file to the browser, the "Open" option on Internet Explorer's file download dialog will not work properly. If the user clicks "Open" instead of "Save," the target application will open an empty file, because the downloaded file was not cached. The user will have to save the file to their hard drive in order to use it.
  110. * Make sure to leave these headers out if you'd like your visitors to be able to use IE's "Open" option.
  111. */
  112. header("Pragma: \n");
  113. header("Cache-Control: \n");
  114. header("Cache-Control: public\n"); // IE cannot download from sessions without a cache
  115. /*if (isset($_SERVER['HTTPS'])) {
  116. /**
  117. * We need to set the following headers to make downloads work using IE in HTTPS mode.
  118. *
  119. //header('Pragma: ');
  120. //header('Cache-Control: ');
  121. header("Expires: Mon, 26 Jul 1997 05:00:00 GMT\n");
  122. header("Last-Modified: " . gmdate( "D, d M Y H:i:s") . " GMT\n");
  123. header("Cache-Control: no-store, no-cache, must-revalidate\n"); // HTTP/1.1
  124. header("Cache-Control: post-check=0, pre-check=0\n", false);
  125. }*/
  126. header('Content-Description: ' . trim(htmlentities($file)) . "\n");
  127. header("Content-Transfer-Encoding: binary\n");
  128. header("Content-Length: " . filesize($path)."\n" );
  129. $fp = fopen( $path, 'rb');
  130. fpassthru($fp);
  131. exit();
  132. }
  133. //@todo clean this file the code below is useless there are 2 exits in previous conditions ... maybe a bad copy/paste/merge?
  134. exit;
  135. /**
  136. * Dropbox module for Chamilo
  137. * handles downloads of files. Direct downloading is prevented because of an .htaccess file in the
  138. * dropbox directory. So everything goes through this script.
  139. *
  140. * 1. Initialising vars
  141. * 2. Authorisation
  142. * 3. Sanity check of get data & file
  143. * 4. Send headers
  144. * 5. Send file
  145. *
  146. *
  147. * NOTE :
  148. * When testing this with PHP4.0.4 on WinXP and Apache2 there were problems with downloading in IE6
  149. * After searching the only explanation I could find is a problem with the headers:
  150. *
  151. * HEADERS SENT WITH PHP4.3:
  152. * HTTP/1.1 200 OK(CR)
  153. * (LF)
  154. * Date: Fri, 12 Sep 2003 19:07:33 GMT(CR)
  155. * (LF)
  156. * Server: Apache/2.0.47 (Win32) PHP/4.3.3(CR)
  157. * (LF)
  158. * X-Powered-By: PHP/4.3.3(CR)
  159. * (LF)
  160. * Set-Cookie: PHPSESSID=06880edcc8363be3f60929576fc1bc6e; path=/(CR)
  161. * (LF)
  162. * Expires: Thu, 19 Nov 1981 08:52:00 GMT(CR)
  163. * (LF)
  164. * Cache-Control: public(CR)
  165. * (LF)
  166. * Pragma: (CR)
  167. * (LF)
  168. * Content-Transfer-Encoding: binary(CR)
  169. * (LF)
  170. * Content-Disposition: attachment; filename=SV-262E4.png(CR)
  171. * (LF)
  172. * Content-Length: 92178(CR)
  173. * (LF)
  174. * Connection: close(CR)
  175. * (LF)
  176. * Content-Type: application/octet-stream(CR)
  177. * (LF)
  178. * (CR)
  179. * (LF)
  180. *
  181. * HEADERS SENT WITH PHP4.0.4:
  182. * HTTP/1.1 200 OK(CR)
  183. * (LF)
  184. * Date: Fri, 12 Sep 2003 18:28:21 GMT(CR)
  185. * (LF)
  186. * Server: Apache/2.0.47 (Win32)(CR)
  187. * (LF)
  188. * X-Powered-By: PHP/4.0.4(CR)
  189. * (LF)
  190. * Expires: Thu, 19 Nov 1981 08:52:00 GMT(CR)
  191. * (LF)
  192. * Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0, , public(CR)
  193. * (LF)
  194. * Pragma: no-cache, (CR)
  195. * (LF)
  196. * Content-Disposition: attachment; filename=SV-262E4.png(CR)
  197. * (LF)
  198. * Content-Transfer-Encoding: binary(CR)
  199. * (LF)
  200. * Set-Cookie: PHPSESSID=0a5b1c1b9d5e3b474fef359ee55e82d0; path=/(CR)
  201. * (LF)
  202. * Content-Length: 92178(CR)
  203. * (LF)
  204. * Connection: close(CR)
  205. * (LF)
  206. * Content-Type: application/octet-stream(CR)
  207. * (LF)
  208. * (CR)
  209. * (LF)
  210. *
  211. * As you can see the there is a difference in the Cache-Control directive. I suspect that this
  212. * explains the problem. Also have a look at http://bugs.php.net/bug.php?id=16458.
  213. *
  214. * @version 1.21
  215. * @copyright 2004-2005
  216. * @author Jan Bols <jan@ivpv.UGent.be>, main programmer
  217. * @author René Haentjens <rene.haentjens@UGent.be>, several contributions
  218. * @author Roan Embrechts, virtual course support
  219. *
  220. */
  221. // INITIALISING VARIABLES
  222. require_once 'dropbox_init.inc.php'; //only call init1 because init2 outputs data
  223. require_once 'dropbox_class.inc.php';
  224. // AUTHORISATION SECTION
  225. if (!isset($_user['user_id']) || !$is_course_member) {
  226. exit();
  227. }
  228. if ($_GET['mailing']) {
  229. getUserOwningThisMailing($_GET['mailing'], $_user['user_id'], '500');
  230. }
  231. // SANITY CHECKS OF GET DATA & FILE
  232. if (!isset($_GET['id']) || !is_numeric($_GET['id'])) die(get_lang('GeneralError').' (code 501)');
  233. $work = new Dropbox_work($_GET['id']);
  234. $path = dropbox_cnf('sysPath') . '/' . $work -> filename; //path to file as stored on server
  235. $file = $work->title;
  236. // check that this file exists and that it doesn't include any special characters
  237. //if (!is_file($path) || ! eregi('^[A-Z0-9_\-][A-Z0-9._\-]*$', $file))
  238. if (!is_file($path)) {
  239. die(get_lang('GeneralError').' (code 504)');
  240. }
  241. // SEND HEADERS
  242. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  243. $mimetype = DocumentManager::file_get_mime_type(true);
  244. $fileparts = explode('.', $file);
  245. $filepartscount = count($fileparts);
  246. if (($filepartscount > 1) && isset($mimetype[$fileparts[$filepartscount - 1]])) {
  247. // give hint to browser about filetype
  248. header('Content-type: ' . $mimetype[$fileparts[$filepartscount - 1]] . "\n");
  249. } else {
  250. //no information about filetype: force a download dialog window in browser
  251. header("Content-type: application/octet-stream\n");
  252. }
  253. if (!in_array(strtolower($fileparts [$filepartscount - 1]), array('doc', 'xls', 'ppt', 'pps', 'sxw', 'sxc', 'sxi'))) {
  254. header('Content-Disposition: inline; filename='.$file); // bugs with open office
  255. } else {
  256. header('Content-Disposition: attachment; filename='.$file);
  257. }
  258. /**
  259. * Note that if you use these two headers from a previous example:
  260. * header('Cache-Control: no-cache, must-revalidate');
  261. * header('Pragma: no-cache');
  262. * before sending a file to the browser, the "Open" option on Internet Explorer's file download dialog will not work properly. If the user clicks "Open" instead of "Save," the target application will open an empty file, because the downloaded file was not cached. The user will have to save the file to their hard drive in order to use it.
  263. * Make sure to leave these headers out if you'd like your visitors to be able to use IE's "Open" option.
  264. */
  265. header("Pragma: \n");
  266. header("Cache-Control: \n");
  267. header("Cache-Control: public\n"); // IE cannot download from sessions without a cache
  268. /*if (isset($_SERVER['HTTPS'])) {
  269. /**
  270. * We need to set the following headers to make downloads work using IE in HTTPS mode.
  271. *
  272. //header('Pragma: ');
  273. //header('Cache-Control: ');
  274. header("Expires: Mon, 26 Jul 1997 05:00:00 GMT\n");
  275. header('Last-Modified: ' . gmdate('D, d M Y H:i:s') . " GMT\n");
  276. header("Cache-Control: no-store, no-cache, must-revalidate\n"); // HTTP/1.1
  277. header("Cache-Control: post-check=0, pre-check=0\n", false);
  278. }*/
  279. header('Content-Description: ' . trim(htmlentities($file)) . "\n");
  280. header("Content-Transfer-Encoding: binary\n");
  281. header('Content-Length: ' . filesize($path)."\n" );
  282. // SEND FILE
  283. $fp = fopen( $path, 'rb');
  284. fpassthru($fp);
  285. exit();
  286. /**
  287. * Found a workaround to another headache that just cropped up tonight. Apparently Opera 6.1 on Linux (unsure of other versions/platforms) has problems downloading files using the above methods if you have enabled compression via zlib.output_compression in php.ini.
  288. * It seems that Opera sees that the actual transfer size is less than the size in the "Content-length" header for the download and decides that the transfer was incomplete or corrupted. It then either continuously retries the download or else leaves you with a corrupted file.
  289. * Solution: Make sure your download script/section is off in its own directory. and add the following to your .htaccess file for that directory:
  290. * php_flag zlib.output_compression off
  291. */