save_pixlr.php 6.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use ChamiloSession as Session;
  4. /**
  5. * This file allows creating new svg and png documents with an online editor.
  6. *
  7. * @package chamilo.document
  8. *
  9. * @author Juan Carlos Raña Trabado
  10. * @since 30/january/2011
  11. */
  12. require_once __DIR__.'/../inc/global.inc.php';
  13. api_protect_course_script();
  14. api_block_anonymous_users();
  15. if ($_user['user_id'] != api_get_user_id() || api_get_user_id() == 0 || $_user['user_id'] == 0) {
  16. api_not_allowed();
  17. die();
  18. }
  19. if (!isset($_GET['title']) || !isset($_GET['type']) || !isset($_GET['image'])) {
  20. api_not_allowed();
  21. die();
  22. }
  23. $paintDir = Session::read('paint_dir');
  24. if (empty($paintDir)) {
  25. api_not_allowed();
  26. die();
  27. }
  28. //pixlr return
  29. $filename = Security::remove_XSS($_GET['title']); //The user preferred file name of the image.
  30. $extension = Security::remove_XSS($_GET['type']); //The image type, "pdx", "jpg", "bmp" or "png".
  31. $urlcontents = Security::remove_XSS($_GET['image']); //A URL to the image on Pixlr.com server or the raw file post of the saved image.
  32. //make variables
  33. $title = Database::escape_string(str_replace('_', ' ', $filename));
  34. $current_session_id = api_get_session_id();
  35. $groupId = api_get_group_id();
  36. $groupInfo = GroupManager::get_group_properties($groupId);
  37. $relativeUrlPath = Session::read('paint_dir');
  38. $dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document';
  39. $saveDir = $dirBaseDocuments.$paintDir;
  40. $contents = file_get_contents($urlcontents);
  41. //Security. Verify that the URL is pointing to a file @ pixlr.com domain or an ip @ pixlr.com. Comment because sometimes return a ip number
  42. /*
  43. if (strpos($urlcontents, "pixlr.com") === 0){
  44. echo "Invalid referrer";
  45. exit;
  46. }
  47. */
  48. //Security. Allway get from pixlr.com. Comment because for now this does not run
  49. /*
  50. $urlcontents1='http://pixlr.com/';
  51. $urlcontents2 = strstr($urlcontents, '_temp');
  52. $urlcontents_to_save=$urlcontents1.$urlcontents2;
  53. $contents = file_get_contents($urlcontents_to_save);//replace line 45.
  54. */
  55. //a bit title security
  56. $filename = addslashes(trim($filename));
  57. $filename = Security::remove_XSS($filename);
  58. $filename = api_replace_dangerous_char($filename);
  59. $filename = disable_dangerous_file($filename);
  60. if (strlen(trim($filename)) == 0) {
  61. echo "The title is empty"; //if title is empty, headers Content-Type = application/octet-stream, then not create a new title here please
  62. exit;
  63. }
  64. //check file_get_contents
  65. if ($contents === false) {
  66. echo "I cannot read: ".$urlcontents;
  67. exit;
  68. }
  69. // Extension security
  70. if ($extension != 'jpg' && $extension != 'png' && $extension != 'pxd') {
  71. die();
  72. }
  73. if ($extension == 'pxd') {
  74. echo "pxd file type does not supported"; // not secure because check security headers and finfo() return Content-Type = application/octet-stream
  75. exit;
  76. }
  77. //Verify that the file is an image. Headers method
  78. $headers = get_headers($urlcontents, 1);
  79. $content_type = explode("/", $headers['Content-Type']);
  80. if ($content_type[0] != "image") {
  81. echo "Invalid file type";
  82. exit;
  83. }
  84. //Verify that the file is an image. Fileinfo method
  85. $finfo = new finfo(FILEINFO_MIME);
  86. $current_mime = $finfo->buffer($contents);
  87. if (strpos($current_mime, 'image') === false) {
  88. echo "Invalid mime type file";
  89. exit;
  90. }
  91. //path, file and title
  92. $paintFileName = $filename.'.'.$extension;
  93. $title = $title.'.'.$extension;
  94. if ($currentTool == 'document/createpaint') {
  95. //check save as and prevent rewrite an older file with same name
  96. if (0 != $groupId) {
  97. $group_properties = GroupManager :: get_group_properties($groupId);
  98. $groupPath = $group_properties['directory'];
  99. } else {
  100. $groupPath = '';
  101. }
  102. if (file_exists($saveDir.'/'.$filename.'.'.$extension)) {
  103. $i = 1;
  104. while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++;
  105. $paintFileName = $filename.'_'.$i.'.'.$extension;
  106. $title = $filename.'_'.$i.'.'.$extension;
  107. }
  108. //
  109. $documentPath = $saveDir.'/'.$paintFileName;
  110. //add new document to disk
  111. file_put_contents($documentPath, $contents);
  112. //add document to database
  113. $doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title);
  114. api_item_property_update(
  115. $_course,
  116. TOOL_DOCUMENT,
  117. $doc_id,
  118. 'DocumentAdded',
  119. $_user['user_id'],
  120. $groupInfo,
  121. null,
  122. null,
  123. null,
  124. $current_session_id
  125. );
  126. } elseif ($currentTool == 'document/editpaint') {
  127. $documentPath = $saveDir.'/'.$paintFileName;
  128. //add new document to disk
  129. file_put_contents($documentPath, $contents);
  130. $paintFile = Session::read('paint_file');
  131. //check path
  132. if (empty($paintFile)) {
  133. api_not_allowed();
  134. die();
  135. }
  136. if ($paintFile == $paintFileName) {
  137. $document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName);
  138. update_existing_document($_course, $document_id, filesize($documentPath), null);
  139. api_item_property_update(
  140. $_course,
  141. TOOL_DOCUMENT,
  142. $document_id,
  143. 'DocumentUpdated',
  144. $_user['user_id'],
  145. $groupInfo,
  146. null,
  147. null,
  148. null,
  149. $current_session_id
  150. );
  151. } else {
  152. //add a new document
  153. $doc_id = add_document(
  154. $_course,
  155. $relativeUrlPath.'/'.$paintFileName,
  156. 'file',
  157. filesize($documentPath),
  158. $title
  159. );
  160. api_item_property_update(
  161. $_course,
  162. TOOL_DOCUMENT,
  163. $doc_id,
  164. 'DocumentAdded',
  165. $_user['user_id'],
  166. $groupInfo,
  167. null,
  168. null,
  169. null,
  170. $current_session_id
  171. );
  172. }
  173. }
  174. //delete temporal file
  175. $temp_file_2delete = Session::read('temp_realpath_image');
  176. unlink($temp_file_2delete);
  177. //Clean sessions and return to Chamilo file list
  178. Session::erase('paint_dir');
  179. Session::erase('paint_file');
  180. Session::erase('temp_realpath_image');
  181. $exit = Session::read('exit_pixlr');
  182. if (empty($exit)) {
  183. $location = api_get_path(WEB_CODE_PATH).'document/document.php?'.api_get_cidreq();
  184. echo '<script>window.parent.location.href="'.$location.'"</script>';
  185. api_not_allowed(true);
  186. } else {
  187. echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>';
  188. $location = api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($exit).'&'.api_get_cidreq();
  189. echo '<script>window.parent.location.href="'.$location.'"</script>';
  190. Session::erase('exit_pixlr');
  191. }