document.ajax.php 3.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * Responses to AJAX calls for the document upload
  5. */
  6. require_once '../global.inc.php';
  7. $action = $_REQUEST['a'];
  8. switch ($action) {
  9. case 'upload_file':
  10. api_protect_course_script(true);
  11. // User access same as upload.php
  12. $is_allowed_to_edit = api_is_allowed_to_edit(null, true);
  13. // This needs cleaning!
  14. if (api_get_group_id()) {
  15. // Only course admin or group members allowed
  16. if ($is_allowed_to_edit || GroupManager::is_user_in_group(api_get_user_id(), api_get_group_id())) {
  17. } else {
  18. exit;
  19. }
  20. } elseif ($is_allowed_to_edit || DocumentManager::is_my_shared_folder(api_get_user_id(), $_POST['curdirpath'], api_get_session_id())) {
  21. // ??
  22. } else {
  23. // No course admin and no group member...
  24. exit;
  25. }
  26. $fileExistsOption = api_get_setting('document_if_file_exists_option');
  27. $defaultFileExistsOption = 'rename';
  28. if (!empty($fileExistsOption)) {
  29. $defaultFileExistsOption = $fileExistsOption;
  30. }
  31. //$ifExists = isset($_POST['if_exists']) ? $_POST['if_exists'] : $defaultFileExistsOption;
  32. if (!empty($_FILES)) {
  33. $files = $_FILES['files'];
  34. $fileList = [];
  35. foreach ($files as $name => $array) {
  36. $counter = 0;
  37. foreach ($array as $data) {
  38. $fileList[$counter][$name] = $data;
  39. $counter++;
  40. }
  41. }
  42. $resultList = [];
  43. foreach ($fileList as $file) {
  44. $globalFile = [];
  45. $globalFile['files'] = $file;
  46. $result = DocumentManager::upload_document(
  47. $globalFile,
  48. $_REQUEST['curdirpath'],
  49. $file['name'],
  50. '', // comment
  51. 0,
  52. $defaultFileExistsOption,
  53. false,
  54. false,
  55. 'files'
  56. );
  57. $json = array();
  58. if (!empty($result) && is_array($result)) {
  59. $json['name'] = Display::url(
  60. api_htmlentities($result['title']),
  61. api_htmlentities($result['url']),
  62. array('target'=>'_blank')
  63. );
  64. $json['url'] = $result['url'];
  65. $json['size'] = format_file_size($file['size']);
  66. $json['type'] = api_htmlentities($file['type']);
  67. $json['result'] = Display::return_icon(
  68. 'accept.png',
  69. get_lang('Uploaded')
  70. );
  71. } else {
  72. $json['url'] = '';
  73. $json['error'] = get_lang('Error');
  74. }
  75. $resultList[] = $json;
  76. }
  77. echo json_encode(['files' => $resultList]);
  78. }
  79. exit;
  80. break;
  81. case 'document_preview':
  82. $course_info = api_get_course_info_by_id($_REQUEST['course_id']);
  83. if (!empty($course_info) && is_array($course_info)) {
  84. echo DocumentManager::get_document_preview(
  85. $course_info,
  86. false,
  87. '_blank',
  88. $_REQUEST['session_id']
  89. );
  90. }
  91. break;
  92. case 'document_destination':
  93. //obtained the bootstrap-select selected value via ajax
  94. $dirValue = isset($_POST['dirValue']) ? $_POST['dirValue'] : null;
  95. echo Security::remove_XSS($dirValue);
  96. break;
  97. }
  98. exit;