123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146 |
- <?php
- require_once '../inc/global.inc.php';
- require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
- require_once api_get_path(LIBRARY_PATH).'document.lib.php';
- api_protect_course_script();
- api_block_anonymous_users();
- if(!isset($_GET['title']) && !isset($_GET['type']) && !isset($_GET['image'])) {
- api_not_allowed();
- die();
- }
- if(!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami']) ){
- api_not_allowed();
- die();
- }
- $filename=Security::remove_XSS($_GET['title']);
- $extension=Security::remove_XSS($_GET['type']);
- $urlcontents=Security::remove_XSS($_GET['image']);
- $title = Database::escape_string(str_replace('_',' ',$filename));
- $current_session_id = api_get_session_id();
- $groupId=$_SESSION['_gid'];
- $relativeUrlPath=$_SESSION['paint_dir'];
- $currentTool=$_SESSION['whereami'];
- $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
- $saveDir=$dirBaseDocuments.$_SESSION['paint_dir'];
- $contents = file_get_contents($urlcontents);
- if (strpos($urlcontents, "pixlr.com") == 0){
- echo "Invalid referrer";
- exit;
- }
- $headers = get_headers($urlcontents, 1);
- $content_type = explode("/", $headers['Content-Type']);
- if ($content_type[0] != "image"){
- echo "Invalid file type";
- exit;
- }
- $filename = addslashes(trim($filename));
- $filename = Security::remove_XSS($filename);
- $filename = replace_dangerous_char($filename, 'strict');
- $filename = disable_dangerous_file($filename);
- if($extension!= 'jpg' && $extension!= 'png' && $extension!= 'bmp' && $extension!= 'pxd'){
- die();
- }
- $paintFileName = $filename.'.'.$extension;
- $title = $title.'.'.$extension;
- if($currentTool=='document/createpaint'){
-
- if (0 != $groupId){
- require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
- $group_properties = GroupManager :: get_group_properties($groupId);
- $groupPath = $group_properties['directory'];
- }
- else{
- $groupPath ='';
- }
-
- if (file_exists($saveDir.'/'.$filename.'.'.$extension)){
- $i = 1;
- while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
- $paintFileName = $filename . '_' . $i . '.'.$extension;
- $title = $filename . '_' . $i . '.'.$extension;
- }
-
-
- $documentPath = $saveDir.'/'.$paintFileName;
-
- file_put_contents( $documentPath, $contents );
-
- $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
- api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
- }elseif($currentTool=='document/editpaint'){
-
- $documentPath = $saveDir.'/'.$paintFileName;
-
- file_put_contents( $documentPath, $contents );
-
-
- if(!isset($_SESSION['paint_file'])){
- api_not_allowed();
- die();
- }
- if($_SESSION['paint_file']==$paintFileName){
- $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
- update_existing_document($_course, $document_id, filesize($documentPath), null);
- api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
- }else{
-
- $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
- api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
- }
- }
- unlink($_SESSION['temp_realpath_image']);
- unset($_SESSION['paint_dir']);
- unset($_SESSION['paint_file']);
- unset($_SESSION['whereami']);
- unset($_SESSION['temp_realpath_image']);
- if (!isset($_SESSION['exit_pixlr'])) {
- $location=api_get_path(WEB_CODE_PATH).'document/document.php';
- echo '<script>window.parent.location.href="'.$location.'"</script>';
- api_not_allowed(true);
- }
- else{
- echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
- $location=api_get_path(WEB_CODE_PATH).'document/document.php?curdirpath='.Security::remove_XSS($_SESSION['exit_pixlr']);
- echo '<script>window.parent.location.href="'.$location.'"</script>';
- unset($_SESSION['exit_pixlr']);
- }
|