fileopen.php 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. <?php
  2. /*
  3. * fileopen.php
  4. * To be used with ext-server_opensave.js for SVG-edit
  5. *
  6. * Licensed under the Apache License, Version 2
  7. *
  8. * Copyright(c) 2010 Alexis Deveria
  9. *
  10. * Integrate svg-edit with Chamilo
  11. * @author Juan Carlos Ra�a Trabado
  12. * @since 25/september/2010
  13. */
  14. require_once '../../../../inc/global.inc.php'; //hack for chamilo
  15. api_protect_course_script();
  16. api_block_anonymous_users();
  17. if (!isset($_FILES['svg_file']['tmp_name'])) {
  18. api_not_allowed(false); //from Chamilo
  19. die();
  20. }
  21. ?>
  22. <!doctype html>
  23. <?php
  24. // Very minimal PHP file, all we do is Base64 encode the uploaded file and
  25. // return it to the editor
  26. $file = $_FILES['svg_file']['tmp_name'];
  27. $output = file_get_contents($file);
  28. $type = $_REQUEST['type'];
  29. $prefix = '';
  30. // Make Data URL prefix for import image
  31. if ($type == 'import_img') {
  32. $info = getimagesize($file);
  33. $prefix = 'data:'.$info['mime'].';base64,';
  34. }
  35. //check the extension
  36. $extension = explode('.', $file);
  37. $extension = strtolower($extension[sizeof($extension) - 1]);
  38. //a bit title security
  39. $filename = addslashes(trim($file));
  40. $filename = Security::remove_XSS($filename);
  41. $filename = api_replace_dangerous_char($filename, 'strict');
  42. $filename = FileManager::disable_dangerous_file($filename);
  43. //a bit mime security
  44. $current_mime = $_FILES['svg_file']['type'];
  45. $mime_svg = 'image/svg+xml';
  46. $mime_xml = 'application/xml';//hack for svg-edit because original code return application/xml; charset=us-ascii.
  47. if (strpos($current_mime, $mime_svg) === false && strpos($current_mime, $mime_xml) === false && $extension == 'svg') {
  48. // die();//File extension does not match its content disabled to check into chamilo dev campus TODO:enabled
  49. }
  50. ?>
  51. <script>
  52. window.top.window.svgEditor.processFile("<?php echo $prefix.base64_encode($output); ?>", "<?php echo $type ?>");
  53. </script>