api.php 8.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254
  1. <?php
  2. /* See license terms in /dokeos_license.txt */
  3. /* FIX for IE cache when using https */
  4. session_cache_limiter("none");
  5. /**
  6. ==============================================================================
  7. * This is an interface between Dokeos and Videoconference application
  8. *
  9. ==============================================================================
  10. */
  11. /*==== DEBUG ====*/
  12. $debug=0;
  13. /*==== CONSTANTS ==== */
  14. define('VIDEOCONF_UPLOAD_PATH', '/videoconf');
  15. $presentation_extension = array('.ppt', '.odp');
  16. $image_extension = array ('.png', '.jpg', '.gif', '.jpeg');
  17. if ($debug>0)
  18. {
  19. // dump the request
  20. $v = array_keys(get_defined_vars());
  21. error_log(var_export($v, true),3, '/tmp/log');
  22. foreach (array_keys(get_defined_vars()) as $k) {
  23. if ($k == 'GLOBALS')
  24. continue;
  25. error_log($k, 3, '/tmp/log');
  26. error_log(var_export($$k, true), 3, '/tmp/log');
  27. }
  28. }
  29. /*==== Flash loose the cookie ===*/
  30. /* needed when using the nice upload window :
  31. if ($_SERVER['HTTP_USER_AGENT'] == 'Shockwave Flash') {
  32. $sid = $_REQUEST['sid'];
  33. if ($debug>0) error_log("reusing: ".$sid);
  34. session_id($sid);
  35. } */
  36. /*==== INCLUDE ====*/
  37. require_once ('../inc/global.inc.php');
  38. api_block_anonymous_users();
  39. require_once (api_get_path(LIBRARY_PATH)."course.lib.php");
  40. require_once (api_get_path(LIBRARY_PATH)."document.lib.php");
  41. require_once (api_get_path(LIBRARY_PATH)."fileUpload.lib.php");
  42. require_once ("../newscorm/learnpath.class.php");
  43. require_once ("../newscorm/openoffice_presentation.class.php");
  44. /*==== Variables initialisation ====*/
  45. $action = $_REQUEST["action"]; //safe as only used in if()'s
  46. $seek = array('/','%2F','..');
  47. $destroy = array('','','');
  48. $cidReq = str_replace($seek,$destroy,$_REQUEST["cidReq"]);
  49. $cidReq = Security::remove_XSS($cidReq);
  50. $user_id = api_get_user_id();
  51. $coursePath = api_get_path(SYS_COURSE_PATH).$cidReq.'/document';
  52. $_course = CourseManager::get_course_information($cidReq);
  53. $_course['path'] = $_course['directory'];
  54. // FIXME: add_document needs this to work
  55. $_course['dbName'] = $_course['db_name'];
  56. // FIXME: check if CourseManager::get_user_in_course_status return !=
  57. // COURSEMANAGER when the code is not valid
  58. if ($debug>0) error_log($coursePath, 0);
  59. if ($action == "uploadgui")
  60. {
  61. echo '<form enctype="multipart/form-data" action="api.php" method="POST">
  62. <input type="hidden" name="MAX_FILE_SIZE" value="100000000" />
  63. <input type="hidden" name="action" value="upload" />
  64. <input type="hidden" name="cidReq" value="'.$cidReq.'" />
  65. <input type="hidden" name="sid" value="'.Security::remove_XSS($_REQUEST["sid"]).'" />
  66. '.get_lang('SelectFile').': <input name="Filedata" type="file" /><br />
  67. <input type="submit" value="'.get_lang('UploadFile').'" />
  68. </form>
  69. ';
  70. die();
  71. }
  72. else if ($action == "upload")
  73. {
  74. if ($debug >0) error_log("upload".$_FILES['Filedata']);
  75. /*==== PERMISSION ====*/
  76. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  77. if ($permissions != COURSEMANAGER)
  78. {
  79. if ($debug >0) error_log("Upload from videoconf not allowed !!!",0);
  80. die('Not allowed'); // this user is not allowed to add upload documents
  81. }
  82. /*==== UPLOAD ====*/
  83. $destPath = $coursePath.VIDEOCONF_UPLOAD_PATH;
  84. /*==== creation of /videoconf ====*/
  85. if (!is_dir($destPath))
  86. {
  87. $result = create_unexisting_directory($_course,$user_id,0,NULL,$coursePath,VIDEOCONF_UPLOAD_PATH);
  88. if (!$result)
  89. {
  90. if ($debug>0) error_log("Can't create ".$destPath." folder",0);
  91. }
  92. }
  93. /*==== file upload ====*/
  94. $newPath = $_FILES['Filedata']['name'];
  95. if($debug>0) error_log($newPath);
  96. /*==== extension extraction ====*/
  97. $file_name = (strrpos($newPath,'.')>0 ? substr($newPath, 0, strrpos($newPath,'.')) : $newPath);
  98. $file_extension = (strrpos($newPath,'.')>0 ? substr($newPath, strrpos($newPath,'.'),10) : '');
  99. if($debug>0) error_log(strrpos($newPath,'.'));
  100. if($debug>0) error_log($file_extension);
  101. /*==== conversion if needed ====*/
  102. if (!in_array(strtolower($file_extension), $image_extension))
  103. {
  104. if($debug>0) error_log("converting: ".$file_extension);
  105. $take_slide_name = false;
  106. $o_ppt = new OpenofficePresentation($take_slide_name);
  107. $o_ppt -> set_slide_size(640,480);
  108. $o_ppt -> convert_document($_FILES['Filedata'],'add_docs_to_visio');
  109. }
  110. echo '<html><body><script language="javascript">setTimeout(1000,window.close());</script></body></html>';
  111. }
  112. else if ($action == "service")
  113. {
  114. /*==== List files ====*/
  115. if ($debug>0) error_log("sending file list",0);
  116. $subaction = $_REQUEST["subaction"];
  117. $is_manager = (CourseManager::get_user_in_course_status($user_id, $cidReq) == COURSEMANAGER);
  118. if ($subaction == "list")
  119. {
  120. // FIXME: check security around $_REQUEST["cwd"]
  121. $cwd = $_REQUEST["cwd"];
  122. // treat /..
  123. $nParent = 0; // the number of /.. into the url
  124. while (substr($cwd, -3, 3) == "/..")
  125. {
  126. // go to parent directory
  127. $cwd= substr($cwd, 0, -3);
  128. if (strlen($cwd) == 0) $cwd="/";
  129. $nParent++;
  130. }
  131. for (;$nParent >0; $nParent--){
  132. $cwd = (strrpos($cwd,'/')>-1 ? substr($cwd, 0, strrpos($cwd,'/')) : $cwd);
  133. }
  134. if (strlen($cwd) == 0) $cwd="/";
  135. if (Security::check_abs_path($cwd,api_get_path(SYS_PATH)))
  136. die();
  137. // check if user can delete files. He must be manager and be inside /videoconf
  138. $is_below_videoconf_dir = (substr($cwd,0,strlen(VIDEOCONF_UPLOAD_PATH)) == VIDEOCONF_UPLOAD_PATH);
  139. if($debug>0) error_log('Current working directory: '.$cwd);
  140. if($debug>0) error_log('Videoconf upload path: '.VIDEOCONF_UPLOAD_PATH);
  141. /* $canDelete = ($canDelete && $isBellowVideoConfUploadPath);
  142. */
  143. $can_delete = ($is_manager && $is_below_videoconf_dir);
  144. // get files list
  145. $files = DocumentManager::get_all_document_data($_course, $cwd, 0, NULL, false);
  146. printf("<dokeosobject><fileListMeta></fileListMeta><fileList>");
  147. printf("<folders>");
  148. // title filter
  149. if (is_array($files)) foreach (array_keys($files) as $k)
  150. {
  151. // converting to UTF-8
  152. $files[$k]['title'] = api_convert_encoding(
  153. api_strlen($files[$k]['title']) > 32 ?
  154. api_substr($files[$k]['title'],0, 32)."..." :
  155. $files[$k]['title'],
  156. 'utf-8',api_get_setting('platform_charset'));
  157. // removing '<', '>' and '_'
  158. $files[$k]['title'] = str_replace(array('<','>','_'),' ', $files[$k]['title']);
  159. }
  160. if(is_array($files))
  161. {
  162. foreach($files as $i)
  163. {
  164. if ($i["filetype"] == "folder")
  165. printf('<folder><path>%s</path><title>%s</title><canDelete>%s</canDelete></folder>', $i['path'],$i['title'],($can_delete?'true':'false'));
  166. }
  167. }
  168. printf("</folders><files>");
  169. if(is_array($files))
  170. {
  171. foreach($files as $i) {
  172. $extension = (strrpos($i['path'],'.')>0 ? substr($i['path'], strrpos($i['path'],'.'),10) : '');
  173. if ($i["filetype"] == "file" && in_array(strtolower($extension), $image_extension))
  174. printf('<file><path>%s</path><title>%s</title><canDelete>%s</canDelete></file>', $i['path'],$i['title'],($can_delete?'true':'false'));
  175. }
  176. }
  177. printf("</files><ppts>");
  178. printf("</ppts>");
  179. printf("</fileList></dokeosobject>");
  180. }
  181. else if ($subaction == "delete")
  182. {
  183. /*==== PERMISSION ====*/
  184. $permissions = CourseManager::get_user_in_course_status($user_id, $cidReq);
  185. if ($permissions != COURSEMANAGER)
  186. {
  187. if ($debug > 0) error_log("Upload from videoconf not allowed !!!",0);
  188. die(); // this user is not allowed to add upload documents
  189. }
  190. /*==== DELETE ====*/
  191. $path = str_replace('../','',$_REQUEST["path"]);
  192. if ((substr($path,0,strlen(VIDEOCONF_UPLOAD_PATH)) != VIDEOCONF_UPLOAD_PATH))
  193. {
  194. if ($debug >0 ) error_log("Delete from videoconf for "+$path+" NOT ALLOWED",0);
  195. die();
  196. }
  197. DocumentManager::delete_document($_course, $path, $coursePath);
  198. echo "<result>OK</result>"; // We have to return something to OpenLaszlo
  199. }
  200. }
  201. else if ($action == "download")
  202. {
  203. /*==== DOWNLOAD ====*/
  204. //check if the document is in the database
  205. if(!DocumentManager::get_document_id($_course,$_REQUEST['file']))
  206. {
  207. //file not found!
  208. if ($debug>0) error_log("404 ".$_REQUEST["file"]);
  209. header("HTTP/1.0 404 Not Found");
  210. $error404 = '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">';
  211. $error404 .= '<html><head>';
  212. $error404 .= '<title>404 Not Found</title>';
  213. $error404 .= '</head><body>';
  214. $error404 .= '<h1>Not Found</h1>';
  215. $error404 .= '<p>The requested URL was not found on this server.</p>';
  216. $error404 .= '<hr>';
  217. $error404 .= '</body></html>';
  218. echo($error404);
  219. exit;
  220. }
  221. $doc_url = str_replace('../','',$_REQUEST['file']);
  222. if ($debug >0) error_log($doc_url);
  223. $full_file_name = $coursePath.$doc_url;
  224. DocumentManager::file_send_for_download($full_file_name,false);
  225. exit;
  226. }
  227. ?>