download.php 1.7 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. use ChamiloSession as Session;
  4. /**
  5. * This file is responsible for passing requested documents to the browser.
  6. * @package chamilo.document
  7. */
  8. session_cache_limiter('none');
  9. require_once __DIR__.'/../inc/global.inc.php';
  10. $this_section = SECTION_COURSES;
  11. // Protection
  12. api_protect_course_script();
  13. if (!isset($_course)) {
  14. api_not_allowed(true);
  15. }
  16. $doc_url = $_GET['doc_url'];
  17. // Change the '&' that got rewritten to '///' by mod_rewrite back to '&'
  18. $doc_url = str_replace('///', '&', $doc_url);
  19. // Still a space present? it must be a '+' (that got replaced by mod_rewrite)
  20. $doc_url = str_replace(' ', '+', $doc_url);
  21. $doc_url = str_replace(array('../', '\\..', '\\0', '..\\'), array('', '', '', ''), $doc_url); //echo $doc_url;
  22. if (strpos($doc_url, '../') || strpos($doc_url, '/..')) {
  23. $doc_url = '';
  24. }
  25. $sys_course_path = api_get_path(SYS_COURSE_PATH).$_course['path'].'/scorm';
  26. $user_id = api_get_user_id();
  27. /** @var learnpath $lp */
  28. $lp = Session::read('oLP');
  29. if ($lp) {
  30. $lp_id = $lp->get_id();
  31. $lp_item_id = $lp->current;
  32. $lp_item_info = new learnpathItem($lp_item_id);
  33. if (!empty($lp_item_info)) {
  34. $visible = learnpath::is_lp_visible_for_student($lp_id, $user_id);
  35. if ($visible) {
  36. Event::event_download($doc_url);
  37. if (Security::check_abs_path($sys_course_path.$doc_url, $sys_course_path.'/')) {
  38. $full_file_name = $sys_course_path.$doc_url;
  39. DocumentManager::file_send_for_download($full_file_name);
  40. exit;
  41. }
  42. }
  43. //}
  44. }
  45. }
  46. echo Display::return_message(get_lang('ProtectedDocument'), 'error');
  47. //api_not_allowed backbutton won't work.
  48. exit;