download.php 1.5 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. //session_cache_limiter('public');
  4. require_once '../inc/global.inc.php';
  5. $this_section = SECTION_COURSES;
  6. require_once api_get_path(LIBRARY_PATH).'fileManage.lib.php';
  7. if ($_GET['session']) {
  8. $archive_path = api_get_path(SYS_ARCHIVE_PATH).'temp/';
  9. $_cid = true;
  10. $is_courseAdmin = true;
  11. } else {
  12. $archive_path = api_get_path(SYS_ARCHIVE_PATH);
  13. }
  14. $archive_file = $_GET['archive'];
  15. $archive_file = str_replace(array('..', '/', '\\'), '', $archive_file);
  16. list($extension) = getextension($archive_file);
  17. if (empty($extension) || !file_exists($archive_path.$archive_file)) {
  18. exit;
  19. }
  20. $extension = strtolower($extension);
  21. $content_type = '';
  22. if (in_array($extension, array('xml', 'csv')) && (api_is_platform_admin(true) || api_is_drh())) {
  23. $content_type = 'application/force-download';
  24. } elseif ($extension == 'zip' && $_cid && (api_is_platform_admin(true) || $is_courseAdmin)) {
  25. $content_type = 'application/force-download';
  26. }
  27. if (empty($content_type)) {
  28. api_not_allowed(true);
  29. }
  30. if (Security::check_abs_path($archive_path.$archive_file, $archive_path)) {
  31. header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
  32. header('Last-Modified: '.gmdate('D, d M Y H:i:s').' GMT');
  33. header('Cache-Control: public');
  34. header('Pragma: no-cache');
  35. header('Content-Type: '.$content_type);
  36. header('Content-Length: '.filesize($archive_path.$archive_file));
  37. header('Content-Disposition: attachment; filename='.$archive_file);
  38. readfile($archive_path.$archive_file);
  39. } else {
  40. api_not_allowed(true);
  41. }