download.php 1.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142
  1. <?php
  2. require_once '../config.php';
  3. $plugin = TicketPlugin::create();
  4. require_once api_get_path(LIBRARY_PATH).'group_portal_manager.lib.php';
  5. require_once api_get_path(LIBRARY_PATH).'document.lib.php';
  6. api_block_anonymous_users();
  7. $language_file = array('courses', 'index','admin');
  8. $user_id = api_get_user_id();
  9. if(!isset($_GET['file']) || ! isset($_GET['title']) || !isset($_GET['ticket_id'])){
  10. api_not_allowed();
  11. }
  12. if(!api_is_platform_admin()){
  13. $ticket_id = $_GET['ticket_id'];
  14. $table_support_messages = Database::get_main_table(TABLE_SUPPORT_MESSAGE);
  15. $table_support_tickets = Database::get_main_table(TABLE_SUPPORT_TICKET);
  16. $table_support_message_attachments = Database::get_main_table(TABLE_SUPPORT_MESSAGE_ATTACHMENTS);
  17. $sql ="SELECT DISTINCT ticket.request_user FROM $table_support_tickets ticket, $table_support_messages message, $table_support_message_attachments attch
  18. WHERE ticket.ticket_id = message.ticket_id AND attch.message_id = message.message_id AND ticket.ticket_id = $ticket_id";
  19. $rs = Database::query($sql);
  20. $row_users = Database::fetch_array($rs, 'ASSOC');
  21. $user_request_id = $row_users['request_user'];
  22. if(intval($user_request_id) != $user_id ){
  23. api_not_allowed();
  24. }
  25. }
  26. $file_url = $_GET['file'];
  27. $file_url = str_replace('///', '&', $file_url);
  28. $file_url = str_replace(' ', '+', $file_url);
  29. $file_url = str_replace('/..', '', $file_url);
  30. $file_url = Database::escape_string($file_url);
  31. $title = $_GET['title'];
  32. $path_attachment = api_get_path(SYS_PATH);
  33. $path_message_attach =$path_attachment.'tck_messageattch/';
  34. $full_file_name = $path_message_attach.$file_url;
  35. if (Security::check_abs_path($full_file_name, $path_message_attach)) {
  36. DocumentManager::file_send_for_download($full_file_name,TRUE, $title);
  37. }
  38. exit;