1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465666768697071727374757677787980 |
- <?php
- session_cache_limiter('nocache');
- require_once __DIR__.'/../inc/global.inc.php';
- header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
- header('Cache-Control: public');
- header('Pragma: no-cache');
- api_protect_course_script(true);
- $doc_url = $_GET['file'];
- $doc_url = str_replace('///', '&', $doc_url);
- $doc_url = str_replace(' ', '+', $doc_url);
- $doc_url = str_replace('/..', '', $doc_url);
- if (strpos($doc_url, '../') OR strpos($doc_url, '/..')) {
- $doc_url = '';
- }
- if (!isset($_course)) {
- api_not_allowed(true);
- }
- $full_file_name = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/upload/announcements/'.$doc_url;
- if (is_dir($full_file_name)) {
-
-
-
- while ($doc_url{$dul = strlen($doc_url) - 1} == '/') {
- $doc_url = substr($doc_url, 0, $dul);
- }
-
- $document_explorer = api_get_path(WEB_COURSE_PATH).api_get_course_path();
-
- header('Location: '.$document_explorer);
- }
- $tbl_announcement_attachment = Database::get_course_table(TABLE_ANNOUNCEMENT_ATTACHMENT);
- Event::event_download($doc_url);
- $course_id = api_get_course_int_id();
- $doc_url = Database::escape_string($doc_url);
- $sql = "SELECT filename FROM $tbl_announcement_attachment
- WHERE c_id = $course_id AND path LIKE BINARY '$doc_url'";
- $result = Database::query($sql);
- if (Database::num_rows($result) > 0) {
- $row = Database::fetch_array($result);
- $title = str_replace(' ', '_', $row['filename']);
- if (Security::check_abs_path($full_file_name,
- api_get_path(SYS_COURSE_PATH).api_get_course_path().'/upload/announcements/')
- ) {
- $result = DocumentManager::file_send_for_download($full_file_name, true, $title);
- if ($result === false) {
- api_not_allowed(true);
- }
- }
- }
- exit;
|