savefile_config.php 5.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161
  1. <?php
  2. /*
  3. * filesave.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Raña Trabado
  12. * @since 25/september/2010
  13. */
  14. require_once '../../../../../inc/global.inc.php';
  15. // Add security from Chamilo
  16. api_protect_course_script();
  17. api_block_anonymous_users();
  18. if(!isset($_POST['output_svg']) && !isset($_POST['output_png'])) {
  19. api_not_allowed();//from Chamilo
  20. die();
  21. }
  22. $file = '';
  23. $suffix = isset($_POST['output_svg']) ? 'svg' : 'png';
  24. if (isset($_POST['filename']) && strlen($_POST['filename']) > 0) {
  25. $file = $_POST['filename'];
  26. } else {
  27. $file = 'image';
  28. }
  29. if ($suffix == 'svg') {
  30. $mime = 'image/svg+xml';
  31. $contents = rawurldecode($_POST['output_svg']);
  32. } else {
  33. $mime = 'image/png';
  34. $contents = $_POST['output_png'];
  35. $pos = (strpos($contents, 'base64,') + 7);
  36. $contents = base64_decode(substr($contents, $pos));
  37. }
  38. //get SVG-Edit values
  39. $filename = $file;//from svg-edit
  40. $extension = $suffix;// from svg-edit
  41. $content = $contents;//from svg-edit
  42. $title = Database::escape_string(str_replace('_',' ',$filename));
  43. //get Chamilo variables
  44. if (!isset($_SESSION['draw_dir']) && !isset($_SESSION['whereami'])) {
  45. api_not_allowed();//from Chamilo
  46. die();
  47. }
  48. $current_session_id = api_get_session_id();
  49. $groupId = api_get_group_id();
  50. $relativeUrlPath = $_SESSION['draw_dir'];
  51. $currentTool = $_SESSION['whereami'];
  52. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  53. $saveDir=$dirBaseDocuments.$_SESSION['draw_dir'];
  54. // a bit title security
  55. $filename = addslashes(trim($filename));
  56. $filename = Security::remove_XSS($filename);
  57. $filename = api_replace_dangerous_char($filename);
  58. $filename = disable_dangerous_file($filename);
  59. // a bit extension
  60. if ($suffix != 'svg' && $suffix != 'png') {
  61. die();
  62. }
  63. //a bit mime security
  64. //comment because finfo seems stopping the save process files in some php vers.
  65. /*
  66. if (phpversion() >= '5.3' && extension_loaded('fileinfo')) {
  67. $finfo = new finfo(FILEINFO_MIME);
  68. $current_mime=$finfo->buffer($contents);
  69. finfo_close($finfo);
  70. $mime_png='image/png';//svg-edit return image/png; charset=binary
  71. $mime_svg='image/svg+xml';
  72. $mime_xml='application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii. See
  73. if(strpos($current_mime, $mime_png)===false && $extension=='png') {
  74. die();//File extension does not match its content
  75. } elseif(strpos($current_mime, $mime_svg)===false && strpos($current_mime, $mime_xml)===false && $extension=='svg') {
  76. die();//File extension does not match its content
  77. }
  78. }
  79. */
  80. //checks if the file exists, then rename the new
  81. if (file_exists($saveDir.'/'.$filename.'.'.$extension) && $currentTool=='document/createdraw') {
  82. $message = get_lang('FileExistsChangeToSave');
  83. $params = array(
  84. 'message' => $message,
  85. 'url' => ''
  86. );
  87. echo json_encode($params);
  88. exit;
  89. } else {
  90. $drawFileName = $filename.'.'.$extension;
  91. $title = $title.'.'.$extension;
  92. }
  93. $documentPath = $saveDir.'/'.$drawFileName;
  94. //add new document to disk
  95. file_put_contents( $documentPath, $contents );
  96. if ($currentTool=='document/createdraw') {
  97. //add document to database
  98. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  99. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  100. } elseif($currentTool=='document/editdraw') {
  101. //check path
  102. if (!isset($_SESSION['draw_file'])){
  103. api_not_allowed();//from Chamilo
  104. die();
  105. }
  106. if ($_SESSION['draw_file'] == $drawFileName ){
  107. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$drawFileName);
  108. update_existing_document($_course, $document_id, filesize($documentPath), null);
  109. api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  110. } else {
  111. //add a new document
  112. $doc_id = add_document($_course, $relativeUrlPath.'/'.$drawFileName, 'file', filesize($documentPath), $title);
  113. api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id);
  114. }
  115. }
  116. //clean sessions and add messages and return to current document list
  117. unset($_SESSION['draw_dir']);
  118. unset($_SESSION['draw_file']);
  119. unset($_SESSION['whereami']);
  120. if ($suffix != 'png') {
  121. if ($relativeUrlPath == '') {
  122. $relativeUrlPath = '/';
  123. };
  124. $url = api_get_path(WEB_CODE_PATH).'document/document.php?'.api_get_cidreq().'&curdirpath='.urlencode($relativeUrlPath);
  125. $message = get_lang('FileSavedAs').': '.$title;
  126. //echo 'alert("'.get_lang('FileSavedAs').': '.$title.'");';
  127. //echo 'window.top.location.href="'.$interbreadcrumb.'";';//return to current document list
  128. } else {
  129. $url = '';
  130. $message = get_lang('FileExportAs').': '.$title;
  131. }
  132. $params = array(
  133. 'message' => $message,
  134. 'url' => $url
  135. );
  136. echo json_encode($params);
  137. exit;