fileopen.php 1.8 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970
  1. <?php
  2. /*
  3. * fileopen.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. require_once '../../../../inc/global.inc.php';//hack for chamilo
  15. require_once api_get_path(LIBRARY_PATH).'fileUpload.lib.php';
  16. api_protect_course_script();
  17. api_block_anonymous_users();
  18. if(!isset($_FILES['svg_file']['tmp_name'])) {
  19. api_not_allowed(false);//from Chamilo
  20. die();
  21. }
  22. ?>
  23. <!doctype html>
  24. <?php
  25. // Very minimal PHP file, all we do is Base64 encode the uploaded file and
  26. // return it to the editor
  27. $file = $_FILES['svg_file']['tmp_name'];
  28. $output = file_get_contents($file);
  29. $type = $_REQUEST['type'];
  30. $prefix = '';
  31. // Make Data URL prefix for import image
  32. if($type == 'import_img') {
  33. $info = getimagesize($file);
  34. $prefix = 'data:' . $info['mime'] . ';base64,';
  35. }
  36. //check the extension
  37. $extension = explode('.', $file);
  38. $extension = strtolower($extension[sizeof($extension) - 1]);
  39. //a bit title security
  40. $filename = addslashes(trim($file));
  41. $filename = Security::remove_XSS($filename);
  42. $filename = replace_dangerous_char($filename, 'strict');
  43. $filename = disable_dangerous_file($filename);
  44. //a bit mime security
  45. $current_mime = $_FILES['svg_file']['type'];
  46. $mime_svg='image/svg+xml';
  47. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii.
  48. if(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg'){
  49. // die();//File extension does not match its content disabled to check into chamilo dev campus TODO:enabled
  50. }
  51. ?>
  52. <script>
  53. window.top.window.svgEditor.processFile("<?php echo $prefix . base64_encode($output); ?>", "<?php echo $type ?>");
  54. </script>