filesave.php 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133
  1. <?php
  2. /*
  3. * filesave.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. //Chamilo load libraries
  15. require_once '../../../../inc/global.inc.php';
  16. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  17. //Add security from Chamilo
  18. api_protect_course_script();
  19. api_block_anonymous_users();
  20. //Adding Chamilo style because Display :: display_error_message() dont run well.
  21. ?>
  22. <style type="text/css">
  23. <!--
  24. .error-message {
  25. position: relative;
  26. margin-top: 10px;
  27. margin-bottom: 10px;
  28. border-width: 1px;
  29. border-style: solid;
  30. -moz-border-radius: 10px;
  31. padding: 6px;
  32. border: 1px solid #FF0000;
  33. color: #440000;
  34. background-color: #FFD1D1;
  35. min-height: 30px;
  36. }
  37. -->
  38. </style>
  39. <?php
  40. if(!isset($_POST['output_svg']) && !isset($_POST['output_png'])) {
  41. echo '<div class="error-message">'. get_lang('lang_no_access_here').'</div>';// from Chamilo
  42. die();
  43. }
  44. $file = '';
  45. //$suffix = isset($_POST['output_svg'])?'.svg':'.png';
  46. $suffix = isset($_POST['output_svg'])?'svg':'png';
  47. if(isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
  48. //$file = $_POST['filename'] . $suffix;
  49. $file = $_POST['filename'];
  50. } else {
  51. //$file = 'image' . $suffix;
  52. $file = 'image';
  53. }
  54. //if($suffix == '.svg') {
  55. if($suffix == 'svg') {
  56. $mime = 'image/svg+xml';
  57. $contents = rawurldecode($_POST['output_svg']);
  58. } else {
  59. $mime = 'image/png';
  60. $contents = $_POST['output_png'];
  61. $pos = (strpos($contents, 'base64,') + 7);
  62. $contents = base64_decode(substr($contents, $pos));
  63. }
  64. /////hack for Chamilo
  65. //get SVG-Edit values
  66. $filename=$file;//from svg-edit
  67. $extension=$suffix;// from svg-edit
  68. $content=$contents;//from svg-edit
  69. $title = Database::escape_string(str_replace('_',' ',$filename));
  70. //get Chamilo variables
  71. $current_session_id = api_get_session_id();
  72. $groupId=$_SESSION['_gid'];
  73. $relativeUrlPath=$_SESSION['draw_dir'];// for main documents and for groups (groupmanager only returns the root directory of the group) // alias $groupPath
  74. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document/';
  75. $saveDir=$dirBaseDocuments.$_SESSION['draw_dir']; // saveDir alias exporDir
  76. //a bit title security
  77. $filename = addslashes(trim($filename));
  78. $filename = Security::remove_XSS($filename);
  79. $filename = replace_dangerous_char($filename, 'strict');
  80. $filename = disable_dangerous_file($filename);
  81. //a bit mime security
  82. $finfo = new finfo(FILEINFO_MIME);
  83. $current_mime=$finfo->buffer($contents);
  84. $mime_png='image/png';//image/png; charset=binary
  85. $mime_svg='application/xml';//application/xml; charset=us-ascii
  86. if(strpos($current_mime, $mime_png)===false && $extension=='png')
  87. {
  88. die('File extension does not match its content');
  89. }elseif(strpos($current_mime, $mime_svg)===false && $extension=='svg')
  90. {
  91. die('File extension does not match its content');
  92. }
  93. //check path
  94. if(!isset($_SESSION['draw_dir']))
  95. {
  96. die('Error');
  97. }
  98. //checks if the file exists, then rename the new
  99. if(file_exists($saveDir.'/'.$filename.$i.'.'.$extension)){
  100. $i = 1;
  101. while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++; //prevent duplicates
  102. $drawFileName = $filename.'_'.$i.'.'.$extension;
  103. $title=$title.' '.$i.'.'.$extension;
  104. }else{
  105. $drawFileName = $filename.'.'.$extension;
  106. $title = $title.'.'.$extension;
  107. }
  108. $documentPath = $saveDir.'/'.$drawFileName;
  109. //add new document to disk
  110. file_put_contents( $documentPath, $contents );
  111. //add new document to database
  112. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  113. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId,null, null,$current_session_id);
  114. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'invisible', $_user['user_id'], $groupId,null, null,$current_session_id);
  115. ?>