edit_document.php 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use ChamiloSession as Session;
  4. /**
  5. * This file allows editing documents.
  6. *
  7. * Based on create_document, this file allows
  8. * - edit name
  9. * - edit comments
  10. * - edit metadata (requires a document table entry)
  11. * - edit html content (only for htm/html files)
  12. *
  13. * For all files
  14. * - show editable name field
  15. * - show editable comments field
  16. * Additionally, for html and text files
  17. * - show RTE
  18. *
  19. * Remember, all files and folders must always have an entry in the
  20. * database, regardless of wether they are visible/invisible, have
  21. * comments or not.
  22. *
  23. * @package chamilo.document
  24. * @todo improve script structure (FormValidator is used to display form, but
  25. * not for validation at the moment)
  26. */
  27. require_once __DIR__.'/../inc/global.inc.php';
  28. $groupRights = Session::read('group_member_with_upload_rights');
  29. // Template's javascript
  30. $htmlHeadXtra[] = '
  31. <script>
  32. $(document).ready(function() {
  33. $(".scrollbar-light").scrollbar();
  34. expandColumnToogle("#hide_bar_template", {
  35. selector: "#template_col",
  36. width: 3
  37. }, {
  38. selector: "#doc_form",
  39. width: 9
  40. });
  41. CKEDITOR.on("instanceReady", function (e) {
  42. showTemplates();
  43. });
  44. });
  45. </script>';
  46. $this_section = SECTION_COURSES;
  47. $lib_path = api_get_path(LIBRARY_PATH);
  48. $course_info = api_get_course_info();
  49. $group_id = api_get_group_id();
  50. $sessionId = api_get_session_id();
  51. if (api_is_in_group()) {
  52. $group_properties = GroupManager::get_group_properties($group_id);
  53. }
  54. $dir = '/';
  55. $currentDirPath = isset($_GET['curdirpath']) ? Security::remove_XSS($_GET['curdirpath']) : null;
  56. $readonly = false;
  57. if (isset($_GET['id'])) {
  58. $document_data = DocumentManager::get_document_data_by_id(
  59. $_GET['id'],
  60. api_get_course_id(),
  61. true,
  62. 0
  63. );
  64. if (!empty($sessionId) && empty($document_data)) {
  65. $document_data = DocumentManager::get_document_data_by_id(
  66. $_REQUEST['id'],
  67. api_get_course_id(),
  68. true,
  69. $sessionId
  70. );
  71. }
  72. $document_id = $document_data['id'];
  73. $file = $document_data['path'];
  74. $parent_id = DocumentManager::get_document_id($course_info, dirname($file));
  75. $dir = dirname($document_data['path']);
  76. $dir_original = $dir;
  77. $doc = basename($file);
  78. $readonly = $document_data['readonly'];
  79. }
  80. if (empty($document_data)) {
  81. api_not_allowed(true);
  82. }
  83. $is_certificate_mode = DocumentManager::is_certificate_mode($dir);
  84. //Call from
  85. $call_from_tool = isset($_GET['origin']) ? Security::remove_XSS($_GET['origin']) : null;
  86. $slide_id = isset($_GET['origin_opt']) ? Security::remove_XSS($_GET['origin_opt']) : null;
  87. $file_name = $doc;
  88. $group_document = false;
  89. $_course = api_get_course_info();
  90. $sessionId = api_get_session_id();
  91. $user_id = api_get_user_id();
  92. $doc_tree = explode('/', $file);
  93. $count_dir = count($doc_tree) - 2; // "2" because at the begin and end there are 2 "/"
  94. // Level correction for group documents.
  95. if (!empty($group_properties['directory'])) {
  96. $count_dir = $count_dir > 0 ? $count_dir - 1 : 0;
  97. }
  98. $relative_url = '';
  99. for ($i = 0; $i < ($count_dir); $i++) {
  100. $relative_url .= '../';
  101. }
  102. $editorConfig = array(
  103. 'ToolbarSet' => (api_is_allowed_to_edit(null, true) ? 'Documents' : 'DocumentsStudent'),
  104. 'Width' => '100%',
  105. 'Height' => '400',
  106. 'cols-size' => [2, 10, 0],
  107. 'FullPage' => true,
  108. 'InDocument' => true,
  109. 'CreateDocumentDir' => $relative_url,
  110. 'CreateDocumentWebDir' => (empty($group_properties['directory']))
  111. ? api_get_path(WEB_COURSE_PATH).$_course['path'].'/document/'
  112. : api_get_path(WEB_COURSE_PATH).api_get_course_path().'/document'.$group_properties['directory'].'/',
  113. 'BaseHref' => api_get_path(WEB_COURSE_PATH).$_course['path'].'/document'.$dir
  114. );
  115. if ($is_certificate_mode) {
  116. $editorConfig['CreateDocumentDir'] = api_get_path(WEB_COURSE_PATH).$_course['path'].'/document/';
  117. $editorConfig['CreateDocumentWebDir'] = api_get_path(WEB_COURSE_PATH).$_course['path'].'/document/';
  118. $editorConfig['BaseHref'] = api_get_path(WEB_COURSE_PATH).$_course['path'].'/document'.$dir;
  119. }
  120. $is_allowed_to_edit = api_is_allowed_to_edit(null, true) || $groupRights ||
  121. DocumentManager::is_my_shared_folder(api_get_user_id(), $dir, $sessionId);
  122. $noPHP_SELF = true;
  123. /* Other initialization code */
  124. $dbTable = Database::get_course_table(TABLE_DOCUMENT);
  125. $course_id = api_get_course_int_id();
  126. if (!empty($group_id)) {
  127. $interbreadcrumb[] = array(
  128. 'url' => api_get_path(WEB_CODE_PATH).'group/group_space.php?'.api_get_cidreq(),
  129. 'name' => get_lang('GroupSpace'),
  130. );
  131. $group_document = true;
  132. $noPHP_SELF = true;
  133. }
  134. if (!$is_certificate_mode) {
  135. $interbreadcrumb[] = array(
  136. "url" => api_get_path(WEB_CODE_PATH)."document/document.php?curdirpath=".urlencode($currentDirPath).'&'.api_get_cidreq(),
  137. "name" => get_lang('Documents'),
  138. );
  139. } else {
  140. $interbreadcrumb[] = array(
  141. 'url' => Category::getUrl(),
  142. 'name' => get_lang('Gradebook')
  143. );
  144. }
  145. if (empty($document_data['parents'])) {
  146. $interbreadcrumb[] = array('url' => '#', 'name' => $document_data['title']);
  147. } else {
  148. foreach ($document_data['parents'] as $document_sub_data) {
  149. if ($document_data['title'] == $document_sub_data['title']) {
  150. continue;
  151. }
  152. $interbreadcrumb[] = array('url' => $document_sub_data['document_url'], 'name' => $document_sub_data['title']);
  153. }
  154. }
  155. if (!($is_allowed_to_edit ||
  156. $groupRights ||
  157. DocumentManager::is_my_shared_folder($user_id, $dir, api_get_session_id()))
  158. ) {
  159. api_not_allowed(true);
  160. }
  161. Event::event_access_tool(TOOL_DOCUMENT);
  162. //TODO:check the below code and his funcionality
  163. if (!api_is_allowed_to_edit()) {
  164. if (DocumentManager::check_readonly($course_info, $user_id, $file)) {
  165. api_not_allowed();
  166. }
  167. }
  168. /* MAIN TOOL CODE */
  169. /* Code to change the comment */
  170. if (isset($_POST['comment'])) {
  171. // Fixing the path if it is wrong
  172. $comment = trim($_POST['comment']);
  173. $title = trim($_POST['title']);
  174. // Just in case see BT#3525
  175. if (empty($title)) {
  176. $title = $document_data['title'];
  177. }
  178. if (empty($title)) {
  179. $title = get_document_title($_POST['filename']);
  180. }
  181. if (!empty($document_id)) {
  182. $params = [
  183. 'comment' => $comment,
  184. 'title' => $title,
  185. ];
  186. Database::update(
  187. $dbTable,
  188. $params,
  189. ['c_id = ? AND id = ?' => [$course_id, $document_id]]
  190. );
  191. Display::addFlash(Display::return_message(get_lang('fileModified')));
  192. }
  193. }
  194. /* WYSIWYG HTML EDITOR - Program Logic */
  195. if ($is_allowed_to_edit) {
  196. if (isset($_POST['formSent']) && $_POST['formSent'] == 1) {
  197. $filename = stripslashes($_POST['filename']);
  198. $extension = $_POST['extension'];
  199. $content = isset($_POST['content']) ? trim(str_replace(array("\r", "\n"), '', stripslashes($_POST['content']))) : null;
  200. $content = Security::remove_XSS($content, COURSEMANAGERLOWSECURITY);
  201. if ($dir == '/') {
  202. $dir = '';
  203. }
  204. $file = $dir.'/'.$filename.'.'.$extension;
  205. $read_only_flag = isset($_POST['readonly']) ? $_POST['readonly'] : null;
  206. $read_only_flag = empty($read_only_flag) ? 0 : 1;
  207. if (empty($filename)) {
  208. Display::addFlash(Display::return_message(get_lang('NoFileName'), 'warning'));
  209. } else {
  210. $file_size = filesize($document_data['absolute_path']);
  211. if ($read_only_flag == 0) {
  212. if (!empty($content)) {
  213. if ($fp = @fopen($document_data['absolute_path'], 'w')) {
  214. // For flv player, change absolute path temporarily to prevent from erasing it in the following lines
  215. $content = str_replace(array('flv=h', 'flv=/'), array('flv=h|', 'flv=/|'), $content);
  216. fputs($fp, $content);
  217. fclose($fp);
  218. $filepath = $document_data['absolute_parent_path'];
  219. // "WHAT'S NEW" notification: update table item_property
  220. $document_id = DocumentManager::get_document_id($_course, $file);
  221. if ($document_id) {
  222. update_existing_document(
  223. $_course,
  224. $document_id,
  225. $file_size,
  226. $read_only_flag
  227. );
  228. api_item_property_update(
  229. $_course,
  230. TOOL_DOCUMENT,
  231. $document_id,
  232. 'DocumentUpdated',
  233. api_get_user_id(),
  234. null,
  235. null,
  236. null,
  237. null,
  238. $sessionId
  239. );
  240. // Update parent folders
  241. item_property_update_on_folder(
  242. $_course,
  243. $dir,
  244. api_get_user_id()
  245. );
  246. } else {
  247. Display::addFlash(Display::return_message(get_lang('Impossible'), 'warning'));
  248. }
  249. } else {
  250. Display::addFlash(Display::return_message(get_lang('Impossible'), 'warning'));
  251. }
  252. } else {
  253. if ($document_id) {
  254. update_existing_document($_course, $document_id, $file_size, $read_only_flag);
  255. }
  256. }
  257. } else {
  258. if ($document_id) {
  259. update_existing_document($_course, $document_id, $file_size, $read_only_flag);
  260. }
  261. }
  262. header('Location: document.php?id='.$document_data['parent_id'].'&'.api_get_cidreq().($is_certificate_mode ? '&curdirpath=/certificates&selectcat=1' : ''));
  263. exit;
  264. }
  265. }
  266. }
  267. // Replace relative paths by absolute web paths (e.g. './' => 'http://www.chamilo.org/courses/ABC/document/')
  268. $content = null;
  269. $extension = null;
  270. $filename = null;
  271. if (file_exists($document_data['absolute_path'])) {
  272. $path_info = pathinfo($document_data['absolute_path']);
  273. $filename = $path_info['filename'];
  274. if (is_file($document_data['absolute_path'])) {
  275. $extension = $path_info['extension'];
  276. if (in_array($extension, array('html', 'htm'))) {
  277. $content = file($document_data['absolute_path']);
  278. $content = implode('', $content);
  279. }
  280. }
  281. }
  282. // Display the header
  283. $nameTools = get_lang('EditDocument').': '.Security::remove_XSS($document_data['title']);
  284. Display::display_header($nameTools, 'Doc');
  285. $document_info = api_get_item_property_info(
  286. api_get_course_int_id(),
  287. 'document',
  288. $document_id,
  289. 0
  290. );
  291. // Try to find this document in the session
  292. if (!empty($sessionId)) {
  293. $document_info = api_get_item_property_info(
  294. api_get_course_int_id(),
  295. 'document',
  296. $document_id,
  297. $sessionId
  298. );
  299. }
  300. $owner_id = $document_info['insert_user_id'];
  301. $last_edit_date = $document_info['lastedit_date'];
  302. $groupInfo = GroupManager::get_group_properties(api_get_group_id());
  303. if ($owner_id == api_get_user_id() ||
  304. api_is_platform_admin() ||
  305. $is_allowed_to_edit || GroupManager:: is_user_in_group(
  306. api_get_user_id(),
  307. $groupInfo
  308. )
  309. ) {
  310. $action = api_get_self().'?id='.$document_data['id'].'&'.api_get_cidreq();
  311. if ($is_certificate_mode) {
  312. $action .= '&curdirpath=/certificates&selectcat=1';
  313. }
  314. $form = new FormValidator(
  315. 'formEdit',
  316. 'post',
  317. $action,
  318. null,
  319. array('class' => 'form-vertical')
  320. );
  321. // Form title
  322. $form->addElement('header', $nameTools);
  323. $form->addElement('hidden', 'filename');
  324. $form->addElement('hidden', 'extension');
  325. $form->addElement('hidden', 'file_path');
  326. $form->addElement('hidden', 'commentPath');
  327. $form->addElement('hidden', 'showedit');
  328. $form->addElement('hidden', 'origin');
  329. $form->addElement('hidden', 'origin_opt');
  330. $form->addText(
  331. 'title',
  332. get_lang('Title'),
  333. true,
  334. array('cols-size' => [2, 10, 0], 'autofocus')
  335. );
  336. $defaults['title'] = $document_data['title'];
  337. $form->addElement('hidden', 'formSent');
  338. $defaults['formSent'] = 1;
  339. $read_only_flag = isset($_POST['readonly']) ? $_POST['readonly'] : null;
  340. // Desactivation of IE proprietary commenting tags inside the text before loading it on the online editor.
  341. // This fix has been proposed by Hubert Borderiou, see Bug #573, http://support.chamilo.org/issues/573
  342. $defaults['content'] = str_replace('<!--[', '<!-- [', $content);
  343. // HotPotatoes tests are html files, but they should not be edited in order their functionality to be preserved.
  344. $showSystemFolders = api_get_course_setting('show_system_folders');
  345. $condition = stripos($dir, '/HotPotatoes_files') === false;
  346. if ($showSystemFolders == 1) {
  347. $condition = true;
  348. }
  349. if (($extension == 'htm' || $extension == 'html') && $condition) {
  350. if (empty($readonly) && $readonly == 0) {
  351. $form->addHtmlEditor('content', '', true, true, $editorConfig);
  352. }
  353. }
  354. if (!$group_document && !DocumentManager::is_my_shared_folder(api_get_user_id(), $currentDirPath, $sessionId)) {
  355. // Updated on field
  356. $display_date = date_to_str_ago($last_edit_date).
  357. ' <span class="dropbox_date">'.api_format_date(api_get_local_time($last_edit_date)).'</span>';
  358. $form->addElement('static', null, get_lang('UpdatedOn'), $display_date);
  359. }
  360. $form->addElement('textarea', 'comment', get_lang('Comment'), ['cols-size' => [2, 10, 0]]);
  361. if ($owner_id == api_get_user_id() || api_is_platform_admin()) {
  362. $checked = & $form->addElement('checkbox', 'readonly', null, get_lang('ReadOnly'));
  363. if ($readonly == 1) {
  364. $checked->setChecked(true);
  365. }
  366. }
  367. if ($is_certificate_mode) {
  368. $form->addButtonUpdate(get_lang('SaveCertificate'));
  369. } else {
  370. $form->addButtonUpdate(get_lang('SaveDocument'));
  371. }
  372. $defaults['filename'] = $filename;
  373. $defaults['extension'] = $extension;
  374. $defaults['file_path'] = isset($_GET['file']) ? Security::remove_XSS($_GET['file']) : null;
  375. $defaults['commentPath'] = $file;
  376. $defaults['renameTo'] = $file_name;
  377. $defaults['comment'] = $document_data['comment'];
  378. $defaults['origin'] = isset($_GET['origin']) ? Security::remove_XSS($_GET['origin']) : null;
  379. $defaults['origin_opt'] = isset($_GET['origin_opt']) ? Security::remove_XSS($_GET['origin_opt']) : null;
  380. $form->setDefaults($defaults);
  381. show_return(
  382. $parent_id,
  383. $dir_original,
  384. $call_from_tool,
  385. $slide_id,
  386. $is_certificate_mode
  387. );
  388. if ($is_certificate_mode) {
  389. $all_information_by_create_certificate = DocumentManager::get_all_info_to_certificate(
  390. api_get_user_id(),
  391. api_get_course_id()
  392. );
  393. $str_info = '';
  394. foreach ($all_information_by_create_certificate[0] as $info_value) {
  395. $str_info .= $info_value.'<br/>';
  396. }
  397. $create_certificate = get_lang('CreateCertificateWithTags');
  398. echo Display::return_message(
  399. $create_certificate.': <br /><br />'.$str_info,
  400. 'normal',
  401. false
  402. );
  403. }
  404. if ($extension == 'svg' && !api_browser_support('svg') && api_get_setting('enabled_support_svg') == 'true') {
  405. echo Display::return_message(get_lang('BrowserDontSupportsSVG'), 'warning');
  406. }
  407. // HTML-editor
  408. echo '<div class="page-create">
  409. <div class="row" style="overflow:hidden">
  410. <div id="template_col" class="col-md-3">
  411. <div class="panel panel-default">
  412. <div class="panel-body">
  413. <div id="frmModel" class="items-templates scrollbar-light"></div>
  414. </div>
  415. </div>
  416. </div>
  417. <div id="doc_form" class="col-md-9">
  418. '.$form->returnForm().'
  419. </div>
  420. </div></div>';
  421. }
  422. Display::display_footer();
  423. /**
  424. This function changes the name of a certain file.
  425. It needs no global variables, it takes all info from parameters.
  426. It returns nothing.
  427. @todo check if this function is used
  428. */
  429. function change_name($base_work_dir, $source_file, $rename_to, $dir, $doc)
  430. {
  431. $file_name_for_change = $base_work_dir.$dir.$source_file;
  432. $rename_to = disable_dangerous_file($rename_to); // Avoid renaming to .htaccess file
  433. $rename_to = my_rename($file_name_for_change, stripslashes($rename_to)); // fileManage API
  434. if ($rename_to) {
  435. if (isset($dir) && $dir != '') {
  436. $source_file = $dir.$source_file;
  437. $new_full_file_name = dirname($source_file).'/'.$rename_to;
  438. } else {
  439. $source_file = '/'.$source_file;
  440. $new_full_file_name = '/'.$rename_to;
  441. }
  442. update_db_info('update', $source_file, $new_full_file_name); // fileManage API
  443. Display::addFlash(Display::return_message(get_lang('fileModified')));
  444. return true;
  445. } else {
  446. Display::addFlash(Display::return_message(get_lang('FileExists')));
  447. }
  448. }
  449. //return button back to
  450. function show_return($document_id, $path, $call_from_tool = '', $slide_id = 0, $is_certificate_mode = false)
  451. {
  452. $actionsLeft = null;
  453. global $parent_id;
  454. $url = api_get_path(WEB_CODE_PATH).'document/document.php?'.api_get_cidreq().'&id='.$parent_id;
  455. if ($is_certificate_mode) {
  456. $selectedCategory = (isset($_GET['curdirpath']) ? Security::remove_XSS($_GET['curdirpath']) : '');
  457. $actionsLeft .= '<a href="document.php?curdirpath='.$selectedCategory.'&selectcat='.$selectedCategory.'">'.
  458. Display::return_icon('back.png', get_lang('Back').' '.get_lang('To').' '.get_lang('CertificateOverview'), '', ICON_SIZE_MEDIUM).'</a>';
  459. $actionsLeft .= '<a id="hide_bar_template" href="#" role="button">'.Display::return_icon('expand.png', get_lang('Expand'), array('id'=>'expand'), ICON_SIZE_MEDIUM).Display::return_icon('contract.png', get_lang('Collapse'), array('id'=>'contract', 'class'=>'hide'), ICON_SIZE_MEDIUM).'</a>';
  460. } elseif ($call_from_tool == 'slideshow') {
  461. $actionsLeft .= '<a href="'.api_get_path(WEB_PATH).'main/document/slideshow.php?slide_id='.$slide_id.'&curdirpath='.Security::remove_XSS(urlencode($_GET['curdirpath'])).'">'.
  462. Display::return_icon('slideshow.png', get_lang('BackTo').' '.get_lang('ViewSlideshow'), '', ICON_SIZE_MEDIUM).'</a>';
  463. } elseif ($call_from_tool == 'editdraw') {
  464. $actionsLeft .= '<a href="'.$url.'">'.
  465. Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('DocumentsOverview'), '', ICON_SIZE_MEDIUM).'</a>';
  466. $actionsLeft .= '<a href="javascript:history.back(1)">'.Display::return_icon('draw.png', get_lang('BackTo').' '.get_lang('Draw'), array(), 32).'</a>';
  467. } elseif ($call_from_tool == 'editodf') {
  468. $actionsLeft .= '<a href="'.$url.'">'.
  469. Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('DocumentsOverview'), '', ICON_SIZE_MEDIUM).'</a>';
  470. $actionsLeft .= '<a href="javascript:history.back(1)">'.Display::return_icon('draw.png', get_lang('BackTo').' '.get_lang('Write'), array(), 32).'</a>';
  471. $actionsLeft .= '<a id="hide_bar_template" href="#" role="button">'.Display::return_icon('expand.png', get_lang('Expand'), array('id'=>'expand'), ICON_SIZE_MEDIUM).Display::return_icon('contract.png', get_lang('Collapse'), array('id'=>'contract', 'class'=>'hide'), ICON_SIZE_MEDIUM).'</a>';
  472. } elseif ($call_from_tool == 'editpaint') {
  473. $actionsLeft .= '<a href="'.$url.'">'.
  474. Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('DocumentsOverview'), array(), ICON_SIZE_MEDIUM).'</a>';
  475. $actionsLeft .= '<a href="javascript:history.back(1)">'.Display::return_icon('paint.png', get_lang('BackTo').' '.get_lang('Paint'), array(), 32).'</a>';
  476. } else {
  477. $actionsLeft .= '<a href="'.$url.'">'.
  478. Display::return_icon('back.png', get_lang('BackTo').' '.get_lang('DocumentsOverview'), '', ICON_SIZE_MEDIUM).'</a>';
  479. $actionsLeft .= '<a id="hide_bar_template" href="#" role="button">'.Display::return_icon('expand.png', get_lang('Expand'), array('id'=>'expand'), ICON_SIZE_MEDIUM).Display::return_icon('contract.png', get_lang('Collapse'), array('id'=>'contract', 'class'=>'hide'), ICON_SIZE_MEDIUM).'</a>';
  480. }
  481. echo $toolbar = Display::toolbarAction('actions-documents', array($actionsLeft));
  482. }