save_pixlr.php 5.0 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * This file allows creating new svg and png documents with an online editor.
  5. *
  6. * @package chamilo.document
  7. *
  8. * @author Juan Carlos Ra�a Trabado
  9. * @since 30/january/2011
  10. */
  11. /**
  12. * Code
  13. */
  14. require_once '../inc/global.inc.php';
  15. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  16. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  17. api_protect_course_script();
  18. api_block_anonymous_users();
  19. if(!isset($_GET['title']) && !isset($_GET['type']) && !isset($_GET['image'])) {
  20. api_not_allowed();
  21. die();
  22. }
  23. if(!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami']) ){
  24. api_not_allowed();//
  25. die();
  26. }
  27. //pixlr return
  28. $filename=Security::remove_XSS($_GET['title']);//The user preferred file name of the image.
  29. $extension=Security::remove_XSS($_GET['type']);//The image type, "pdx", "jpg", "bmp" or "png".
  30. $urlcontents=Security::remove_XSS($_GET['image']);//A URL to the image on Pixlr.com server or the raw file post of the saved image.
  31. //make variables
  32. $title = Database::escape_string(str_replace('_',' ',$filename));
  33. $current_session_id = api_get_session_id();
  34. $groupId=$_SESSION['_gid'];
  35. $relativeUrlPath=$_SESSION['paint_dir'];
  36. $currentTool=$_SESSION['whereami'];
  37. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  38. $saveDir=$dirBaseDocuments.$_SESSION['paint_dir'];
  39. $contents = file_get_contents($urlcontents);
  40. //Verify that the URL is pointing to a file @ pixlr.com
  41. if (strpos($urlcontents, "pixlr.com") == 0){
  42. echo "Invalid referrer";
  43. exit;
  44. }
  45. //Verify that the file is an image
  46. $headers = get_headers($urlcontents, 1);
  47. $content_type = explode("/", $headers['Content-Type']);
  48. if ($content_type[0] != "image"){
  49. echo "Invalid file type";
  50. exit;
  51. }
  52. //a bit title security
  53. $filename = addslashes(trim($filename));
  54. $filename = Security::remove_XSS($filename);
  55. $filename = replace_dangerous_char($filename, 'strict');
  56. $filename = disable_dangerous_file($filename);
  57. // a bit extension security
  58. if($extension!= 'jpg' && $extension!= 'png' && $extension!= 'bmp' && $extension!= 'pxd'){
  59. die();
  60. }
  61. //TODO: a bit mime security
  62. //path, file and title
  63. $paintFileName = $filename.'.'.$extension;
  64. $title = $title.'.'.$extension;
  65. if($currentTool=='document/createpaint'){
  66. //check save as and prevent rewrite an older file with same name
  67. if (0 != $groupId){
  68. require_once api_get_path(LIBRARY_PATH).'groupmanager.lib.php';
  69. $group_properties = GroupManager :: get_group_properties($groupId);
  70. $groupPath = $group_properties['directory'];
  71. }
  72. else{
  73. $groupPath ='';
  74. }
  75. if (file_exists($saveDir.'/'.$filename.'.'.$extension)){
  76. $i = 1;
  77. while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
  78. $paintFileName = $filename . '_' . $i . '.'.$extension;
  79. $title = $filename . '_' . $i . '.'.$extension;
  80. }
  81. //
  82. $documentPath = $saveDir.'/'.$paintFileName;
  83. //add new document to disk
  84. file_put_contents( $documentPath, $contents );
  85. //add document to database
  86. $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
  87. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  88. }elseif($currentTool=='document/editpaint'){
  89. $documentPath = $saveDir.'/'.$paintFileName;
  90. //add new document to disk
  91. file_put_contents( $documentPath, $contents );
  92. //check path
  93. if(!isset($_SESSION['paint_file'])){
  94. api_not_allowed();
  95. die();
  96. }
  97. if($_SESSION['paint_file']==$paintFileName){
  98. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
  99. update_existing_document($_course, $document_id, filesize($documentPath), null);
  100. api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  101. }else{
  102. //add a new document
  103. $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
  104. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  105. }
  106. }
  107. //delete temporal file
  108. unlink($_SESSION['temp_realpath_image']);
  109. //Clean sessions and return to Chamilo file list
  110. unset($_SESSION['paint_dir']);
  111. unset($_SESSION['paint_file']);
  112. unset($_SESSION['whereami']);
  113. unset($_SESSION['temp_realpath_image']);
  114. if (!isset($_SESSION['exit_pixlr'])) {
  115. $location=api_get_path(WEB_CODE_PATH).'document/document.php';
  116. echo '<script>window.parent.location.href="'.$location.'"</script>';
  117. api_not_allowed(true);
  118. }
  119. else{
  120. echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
  121. $location=api_get_path(WEB_CODE_PATH).'document/document.php?curdirpath='.Security::remove_XSS($_SESSION['exit_pixlr']);
  122. echo '<script>window.parent.location.href="'.$location.'"</script>';
  123. unset($_SESSION['exit_pixlr']);
  124. }