download.php 2.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file is responsible for passing requested documents to the browser.
  5. * Html files are parsed to fix a few problems with URLs,
  6. * but this code will hopefully be replaced soon by an Apache URL
  7. * rewrite mechanism.
  8. *
  9. * @package chamilo.announcements
  10. */
  11. /*
  12. MAIN CODE
  13. */
  14. session_cache_limiter('nocache');
  15. require_once '../inc/global.inc.php';
  16. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  17. // IMPORTANT to avoid caching of documents
  18. header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
  19. header('Cache-Control: public');
  20. header('Pragma: no-cache');
  21. //protection
  22. api_protect_course_script(true);
  23. $doc_url = $_GET['file'];
  24. //change the '&' that got rewritten to '///' by mod_rewrite back to '&'
  25. $doc_url = str_replace('///', '&', $doc_url);
  26. //still a space present? it must be a '+' (that got replaced by mod_rewrite)
  27. $doc_url = str_replace(' ', '+', $doc_url);
  28. $doc_url = str_replace('/..', '', $doc_url); //echo $doc_url;
  29. if (strpos($doc_url,'../') OR strpos($doc_url,'/..')) {
  30. $doc_url = '';
  31. }
  32. if (!isset($_course)) {
  33. api_not_allowed(true);
  34. }
  35. $full_file_name = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/upload/announcements/'.$doc_url;
  36. //if the rewrite rule asks for a directory, we redirect to the document explorer
  37. if (is_dir($full_file_name)) {
  38. //remove last slash if present
  39. //$doc_url = ($doc_url{strlen($doc_url)-1}=='/')?substr($doc_url,0,strlen($doc_url)-1):$doc_url;
  40. //mod_rewrite can change /some/path/ to /some/path// in some cases, so clean them all off (René)
  41. while ($doc_url{$dul = strlen($doc_url)-1}=='/') $doc_url = substr($doc_url,0,$dul);
  42. //create the path
  43. $document_explorer = api_get_path(WEB_COURSE_PATH).api_get_course_path(); // home course path
  44. //redirect
  45. header('Location: '.$document_explorer);
  46. }
  47. $tbl_announcement_attachment = Database::get_course_table(TABLE_ANNOUNCEMENT_ATTACHMENT);
  48. // launch event
  49. event_download($doc_url);
  50. $course_id = api_get_course_int_id();
  51. $doc_url = Database::escape_string($doc_url);
  52. $sql = "SELECT filename FROM $tbl_announcement_attachment
  53. WHERE c_id = $course_id AND path LIKE BINARY '$doc_url'";
  54. $result= Database::query($sql);
  55. if (Database::num_rows($result) > 0) {
  56. $row= Database::fetch_array($result);
  57. $title = str_replace(' ','_', $row['filename']);
  58. if (Security::check_abs_path($full_file_name, api_get_path(SYS_COURSE_PATH).api_get_course_path().'/upload/announcements/')) {
  59. DocumentManager::file_send_for_download($full_file_name,TRUE, $title);
  60. }
  61. }
  62. exit;