global.inc.php 21 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * It is recommended that ALL Chamilo scripts include this important file.
  5. * This script manages
  6. * - http get, post, post_files, session, server-vars extraction into global namespace;
  7. * (which doesn't occur anymore when servertype config setting is set to test,
  8. * and which will disappear completely in Dokeos 1.6.1)
  9. * - include of /conf/configuration.php;
  10. * - include of several libraries: main_api, database, display, text, security;
  11. * - selecting the main database;
  12. * - include of language files.
  13. *
  14. * @package chamilo.include
  15. * @todo isn't configuration.php renamed to configuration.inc.php yet?
  16. * @todo use the $_configuration array for all the needed variables
  17. * @todo remove the code that displays the button that links to the install page
  18. * but use a redirect immediately. By doing so the $alreadyInstalled variable can be removed.
  19. * @todo make it possible to enable / disable the tracking through the Chamilo config page.
  20. *
  21. */
  22. // Showing/hiding error codes in global error messages.
  23. define('SHOW_ERROR_CODES', false);
  24. require_once __DIR__.'/../../app/AppKernel.php';
  25. $kernel = new AppKernel();
  26. // Determine the directory path where this current file lies.
  27. // This path will be useful to include the other initialisation files.
  28. $includePath = __DIR__;
  29. // Include the main Chamilo platform configuration file.
  30. $alreadyInstalled = false;
  31. if (file_exists($kernel->getConfigurationFile())) {
  32. require_once $kernel->getConfigurationFile();
  33. $alreadyInstalled = true;
  34. } else {
  35. $_configuration = array();
  36. }
  37. //Redirects to the main/install/ page
  38. if (!$alreadyInstalled) {
  39. $global_error_code = 2;
  40. // The system has not been installed yet.
  41. require $includePath.'/global_error_message.inc.php';
  42. die();
  43. }
  44. // Ensure that _configuration is in the global scope before loading
  45. // main_api.lib.php. This is particularly helpful for unit tests
  46. if (!isset($GLOBALS['_configuration'])) {
  47. $GLOBALS['_configuration'] = $_configuration;
  48. }
  49. // Include the main Chamilo platform library file.
  50. require_once $includePath.'/lib/api.lib.php';
  51. $passwordEncryption = api_get_configuration_value('password_encryption');
  52. if ($passwordEncryption == 'bcrypt') {
  53. require_once __DIR__.'/../../vendor/ircmaxell/password-compat/lib/password.php';
  54. }
  55. // Check the PHP version
  56. api_check_php_version($includePath.'/');
  57. // Specification for usernames:
  58. // 1. ASCII-letters, digits, "." (dot), "_" (underscore) are acceptable, 40 characters maximum length.
  59. // 2. Empty username is formally valid, but it is reserved for the anonymous user.
  60. // 3. Checking the login_is_email portal setting in order to accept 100 chars maximum
  61. $defaultUserNameLength = 40;
  62. if (api_get_setting('login_is_email') == 'true') {
  63. $defaultUserNameLength = 100;
  64. }
  65. define('USERNAME_MAX_LENGTH', $defaultUserNameLength);
  66. // Fix bug in IIS that doesn't fill the $_SERVER['REQUEST_URI'].
  67. api_request_uri();
  68. // Include the libraries that are necessary everywhere
  69. require_once __DIR__.'/../../vendor/autoload.php';
  70. // Do not over-use this variable. It is only for this script's local use.
  71. $libraryPath = api_get_path(LIBRARY_PATH);
  72. // @todo convert this libs in classes
  73. require_once $libraryPath.'database.constants.inc.php';
  74. require_once $libraryPath.'text.lib.php';
  75. require_once $libraryPath.'array.lib.php';
  76. require_once $libraryPath.'online.inc.php';
  77. require_once $libraryPath.'banner.lib.php';
  78. require_once $libraryPath.'fileManage.lib.php';
  79. require_once $libraryPath.'fileUpload.lib.php';
  80. require_once $libraryPath.'fileDisplay.lib.php';
  81. require_once $libraryPath.'course_category.lib.php';
  82. define('_MPDF_TEMP_PATH', api_get_path(SYS_ARCHIVE_PATH).'mpdf/');
  83. if (!is_dir(_MPDF_TEMP_PATH)) {
  84. mkdir(_MPDF_TEMP_PATH, api_get_permissions_for_new_directories(), true);
  85. }
  86. // Connect to the server database and select the main chamilo database.
  87. // When $_configuration['db_persistent_connection'] is set, it is expected to be a boolean type.
  88. /*$dbPersistConnection = api_get_configuration_value('db_persistent_connection');
  89. // $_configuration['db_client_flags'] can be set in configuration.php to pass
  90. // flags to the DB connection
  91. $dbFlags = api_get_configuration_value('db_client_flags');
  92. $params = array(
  93. 'server' => $_configuration['db_host'],
  94. 'username' => $_configuration['db_user'],
  95. 'password' => $_configuration['db_password'],
  96. 'persistent' => $dbPersistConnection,
  97. 'client_flags' => $dbFlags,
  98. );*/
  99. // Doctrine ORM configuration
  100. $dbParams = array(
  101. 'driver' => 'pdo_mysql',
  102. 'host' => $_configuration['db_host'],
  103. 'user' => $_configuration['db_user'],
  104. 'password' => $_configuration['db_password'],
  105. 'dbname' => $_configuration['main_database'],
  106. );
  107. try {
  108. $database = new \Database();
  109. $database->connect($dbParams);
  110. } catch (Exception $e) {
  111. $global_error_code = 3;
  112. // The database server is not available or credentials are invalid.
  113. require $includePath.'/global_error_message.inc.php';
  114. die();
  115. }
  116. /* RETRIEVING ALL THE CHAMILO CONFIG SETTINGS FOR MULTIPLE URLs FEATURE*/
  117. if (!empty($_configuration['multiple_access_urls'])) {
  118. $_configuration['access_url'] = 1;
  119. $access_urls = api_get_access_urls();
  120. $root_rel = api_get_self();
  121. $root_rel = substr($root_rel, 1);
  122. $pos = strpos($root_rel, '/');
  123. $root_rel = substr($root_rel, 0, $pos);
  124. $protocol = ((!empty($_SERVER['HTTPS']) && strtoupper($_SERVER['HTTPS']) != 'OFF') ? 'https' : 'http').'://';
  125. //urls with subdomains (HTTP_HOST is preferred - see #6764)
  126. $request_url_root = '';
  127. if (empty($_SERVER['HTTP_HOST'])) {
  128. if (empty($_SERVER['SERVER_NAME'])) {
  129. $request_url_root = $protocol . 'localhost/';
  130. } else {
  131. $request_url_root = $protocol . $_SERVER['SERVER_NAME'] . '/';
  132. }
  133. } else {
  134. $request_url_root = $protocol.$_SERVER['HTTP_HOST'].'/';
  135. }
  136. //urls with subdirs
  137. $request_url_sub = $request_url_root.$root_rel.'/';
  138. // You can use subdirs as multi-urls, but in this case none of them can be
  139. // the root dir. The admin portal should be something like https://host/adm/
  140. // At this time, subdirs will still hold a share cookie, so not ideal yet
  141. // see #6510
  142. foreach ($access_urls as $details) {
  143. if ($request_url_sub == $details['url']) {
  144. $_configuration['access_url'] = $details['id'];
  145. break; //found one match with subdir, get out of foreach
  146. }
  147. // Didn't find any? Now try without subdirs
  148. if ($request_url_root == $details['url']) {
  149. $_configuration['access_url'] = $details['id'];
  150. break; //found one match, get out of foreach
  151. }
  152. }
  153. } else {
  154. $_configuration['access_url'] = 1;
  155. }
  156. $charset = 'UTF-8';
  157. // Enables the portablity layer and configures PHP for UTF-8
  158. \Patchwork\Utf8\Bootup::initAll();
  159. // Start session after the internationalization library has been initialized.
  160. ChamiloSession::instance()->start($alreadyInstalled);
  161. // Remove quotes added by PHP - get_magic_quotes_gpc() is deprecated in PHP 5 see #2970
  162. if (function_exists('get_magic_quotes_gpc') && get_magic_quotes_gpc()) {
  163. array_walk_recursive_limited($_GET, 'stripslashes', true);
  164. array_walk_recursive_limited($_POST, 'stripslashes', true);
  165. array_walk_recursive_limited($_COOKIE, 'stripslashes', true);
  166. array_walk_recursive_limited($_REQUEST, 'stripslashes', true);
  167. }
  168. // access_url == 1 is the default chamilo location
  169. if ($_configuration['access_url'] != 1) {
  170. $url_info = api_get_access_url($_configuration['access_url']);
  171. if ($url_info['active'] == 1) {
  172. $settings_by_access = & api_get_settings(null, 'list', $_configuration['access_url'], 1);
  173. foreach ($settings_by_access as & $row) {
  174. if (empty($row['variable'])) {
  175. $row['variable'] = 0;
  176. }
  177. if (empty($row['subkey'])) {
  178. $row['subkey'] = 0;
  179. }
  180. if (empty($row['category'])) {
  181. $row['category'] = 0;
  182. }
  183. $settings_by_access_list[$row['variable']][$row['subkey']][$row['category']] = $row;
  184. }
  185. }
  186. }
  187. $result = & api_get_settings(null, 'list', 1);
  188. foreach ($result as & $row) {
  189. if ($_configuration['access_url'] != 1) {
  190. if ($url_info['active'] == 1) {
  191. $var = empty($row['variable']) ? 0 : $row['variable'];
  192. $subkey = empty($row['subkey']) ? 0 : $row['subkey'];
  193. $category = empty($row['category']) ? 0 : $row['category'];
  194. }
  195. if ($row['access_url_changeable'] == 1 && $url_info['active'] == 1) {
  196. if (isset($settings_by_access_list[$var]) &&
  197. $settings_by_access_list[$var][$subkey][$category]['selected_value'] != '') {
  198. if ($row['subkey'] == null) {
  199. $_setting[$row['variable']] = $settings_by_access_list[$var][$subkey][$category]['selected_value'];
  200. } else {
  201. $_setting[$row['variable']][$row['subkey']] = $settings_by_access_list[$var][$subkey][$category]['selected_value'];
  202. }
  203. } else {
  204. if ($row['subkey'] == null) {
  205. $_setting[$row['variable']] = $row['selected_value'];
  206. } else {
  207. $_setting[$row['variable']][$row['subkey']] = $row['selected_value'];
  208. }
  209. }
  210. } else {
  211. if ($row['subkey'] == null) {
  212. $_setting[$row['variable']] = $row['selected_value'];
  213. } else {
  214. $_setting[$row['variable']][$row['subkey']] = $row['selected_value'];
  215. }
  216. }
  217. } else {
  218. if ($row['subkey'] == null) {
  219. $_setting[$row['variable']] = $row['selected_value'];
  220. } else {
  221. $_setting[$row['variable']][$row['subkey']] = $row['selected_value'];
  222. }
  223. }
  224. }
  225. $result = & api_get_settings('Plugins', 'list', $_configuration['access_url']);
  226. $_plugins = array();
  227. foreach ($result as & $row) {
  228. $key = & $row['variable'];
  229. if (is_string($_setting[$key])) {
  230. $_setting[$key] = array();
  231. }
  232. $_setting[$key][] = $row['selected_value'];
  233. $_plugins[$key][] = $row['selected_value'];
  234. }
  235. // Error reporting settings.
  236. if (api_get_setting('server_type') == 'test') {
  237. ini_set('display_errors', '1');
  238. ini_set('log_errors', '1');
  239. error_reporting(-1);
  240. } else {
  241. error_reporting(E_COMPILE_ERROR | E_ERROR | E_CORE_ERROR);
  242. }
  243. // Load allowed tag definitions for kses and/or HTMLPurifier.
  244. require_once $libraryPath.'formvalidator/Rule/allowed_tags.inc.php';
  245. // Before we call local.inc.php, let's define a global $this_section variable
  246. // which will then be usable from the banner and header scripts
  247. $this_section = SECTION_GLOBAL;
  248. // Include Chamilo Mail conf this is added here because the api_get_setting works
  249. // Fixes bug in Chamilo 1.8.7.1 array was not set
  250. $administrator['email'] = isset($administrator['email']) ? $administrator['email'] : 'admin@example.com';
  251. $administrator['name'] = isset($administrator['name']) ? $administrator['name'] : 'Admin';
  252. // Including configuration files
  253. $configurationFiles = array(
  254. 'mail.conf.php',
  255. 'profile.conf.php',
  256. 'course_info.conf.php',
  257. 'add_course.conf.php',
  258. 'events.conf.php',
  259. 'auth.conf.php',
  260. 'portfolio.conf.php'
  261. );
  262. foreach ($configurationFiles as $file) {
  263. $file = api_get_path(CONFIGURATION_PATH).$file;
  264. if (file_exists($file)) {
  265. require_once $file;
  266. }
  267. }
  268. /* LOAD LANGUAGE FILES SECTION */
  269. // if we use the javascript version (without go button) we receive a get
  270. // if we use the non-javascript version (with the go button) we receive a post
  271. $user_language = '';
  272. $browser_language = '';
  273. if (!empty($_GET['language'])) {
  274. $user_language = $_GET['language'];
  275. }
  276. if (!empty($_POST['language_list'])) {
  277. $user_language = str_replace('index.php?language=', '', $_POST['language_list']);
  278. }
  279. if (empty($user_language) && !empty($_SERVER['HTTP_ACCEPT_LANGUAGE']) && !isset($_SESSION['_user'])) {
  280. $l = SubLanguageManager::getLanguageFromBrowserPreference($_SERVER['HTTP_ACCEPT_LANGUAGE']);
  281. if (!empty($l)) {
  282. $user_language = $browser_language = $l;
  283. }
  284. }
  285. // Include all files (first english and then current interface language)
  286. $langpath = api_get_path(SYS_LANG_PATH);
  287. /* This will only work if we are in the page to edit a sub_language */
  288. if (isset($this_script) && $this_script == 'sub_language') {
  289. // getting the arrays of files i.e notification, trad4all, etc
  290. $language_files_to_load = SubLanguageManager:: get_lang_folder_files_list(
  291. api_get_path(SYS_LANG_PATH).'english',
  292. true
  293. );
  294. //getting parent info
  295. $parent_language = SubLanguageManager::get_all_information_of_language($_REQUEST['id']);
  296. //getting sub language info
  297. $sub_language = SubLanguageManager::get_all_information_of_language($_REQUEST['sub_language_id']);
  298. $english_language_array = $parent_language_array = $sub_language_array = array();
  299. foreach ($language_files_to_load as $language_file_item) {
  300. $lang_list_pre = array_keys($GLOBALS);
  301. //loading english
  302. $path = $langpath.'english/'.$language_file_item.'.inc.php';
  303. if (file_exists($path)) {
  304. include $path;
  305. }
  306. $lang_list_post = array_keys($GLOBALS);
  307. $lang_list_result = array_diff($lang_list_post, $lang_list_pre);
  308. unset($lang_list_pre);
  309. // english language array
  310. $english_language_array[$language_file_item] = compact($lang_list_result);
  311. //cleaning the variables
  312. foreach ($lang_list_result as $item) {
  313. unset(${$item});
  314. }
  315. $parent_file = $langpath.$parent_language['dokeos_folder'].'/'.$language_file_item.'.inc.php';
  316. if (file_exists($parent_file) && is_file($parent_file)) {
  317. include_once $parent_file;
  318. }
  319. // parent language array
  320. $parent_language_array[$language_file_item] = compact($lang_list_result);
  321. //cleaning the variables
  322. foreach ($lang_list_result as $item) {
  323. unset(${$item});
  324. }
  325. $sub_file = $langpath.$sub_language['dokeos_folder'].'/'.$language_file_item.'.inc.php';
  326. if (file_exists($sub_file) && is_file($sub_file)) {
  327. include $sub_file;
  328. }
  329. // sub language array
  330. $sub_language_array[$language_file_item] = compact($lang_list_result);
  331. //cleaning the variables
  332. foreach ($lang_list_result as $item) {
  333. unset(${$item});
  334. }
  335. }
  336. }
  337. // Checking if we have a valid language. If not we set it to the platform language.
  338. $valid_languages = api_get_languages();
  339. if (!empty($valid_languages)) {
  340. if (!in_array($user_language, $valid_languages['folder'])) {
  341. $user_language = api_get_setting('platformLanguage');
  342. }
  343. $language_priority1 = api_get_setting('languagePriority1');
  344. $language_priority2 = api_get_setting('languagePriority2');
  345. $language_priority3 = api_get_setting('languagePriority3');
  346. $language_priority4 = api_get_setting('languagePriority4');
  347. if (isset($_GET['language']) ||
  348. (isset($_POST['language_list']) && !empty($_POST['language_list'])) ||
  349. !empty($browser_language)
  350. ) {
  351. $user_selected_language = $user_language; // $_GET['language']; or HTTP_ACCEPT_LANGUAGE
  352. $_SESSION['user_language_choice'] = $user_selected_language;
  353. $platformLanguage = $user_selected_language;
  354. }
  355. if (!empty($language_priority4) && api_get_language_from_type($language_priority4) !== false) {
  356. $language_interface = api_get_language_from_type($language_priority4);
  357. } else {
  358. $language_interface = api_get_setting('platformLanguage');
  359. }
  360. if (!empty($language_priority3) && api_get_language_from_type($language_priority3) !== false) {
  361. $language_interface = api_get_language_from_type($language_priority3);
  362. } else {
  363. if (isset($_SESSION['user_language_choice'])) {
  364. $language_interface = $_SESSION['user_language_choice'];
  365. }
  366. }
  367. if (!empty($language_priority2) && api_get_language_from_type($language_priority2) !== false) {
  368. $language_interface = api_get_language_from_type($language_priority2);
  369. } else {
  370. if (isset($_user['language'])) {
  371. $language_interface = $_user['language'];
  372. }
  373. }
  374. if (!empty($language_priority1) && api_get_language_from_type($language_priority1) !== false) {
  375. $language_interface = api_get_language_from_type($language_priority1);
  376. } else {
  377. if (isset($_course['language'])) {
  378. $language_interface = $_course['language'];
  379. }
  380. }
  381. }
  382. // Sometimes the variable $language_interface is changed
  383. // temporarily for achieving translation in different language.
  384. // We need to save the genuine value of this variable and
  385. // to use it within the function get_lang(...).
  386. $language_interface_initial_value = $language_interface;
  387. /**
  388. * Include the trad4all language file
  389. */
  390. // if the sub-language feature is on
  391. $parent_path = SubLanguageManager::get_parent_language_path($language_interface);
  392. if (!empty($parent_path)) {
  393. // include English
  394. include $langpath.'english/trad4all.inc.php';
  395. // prepare string for current language and its parent
  396. $lang_file = $langpath.$language_interface.'/trad4all.inc.php';
  397. $parent_lang_file = $langpath.$parent_path.'/trad4all.inc.php';
  398. // load the parent language file first
  399. if (file_exists($parent_lang_file)) {
  400. include $parent_lang_file;
  401. }
  402. // overwrite the parent language translations if there is a child
  403. if (file_exists($lang_file)) {
  404. include $lang_file;
  405. }
  406. } else {
  407. // if the sub-languages feature is not on, then just load the
  408. // set language interface
  409. // include English
  410. include $langpath.'english/trad4all.inc.php';
  411. // prepare string for current language
  412. $langfile = $langpath.$language_interface.'/trad4all.inc.php';
  413. if (file_exists($langfile)) {
  414. include $langfile;
  415. }
  416. }
  417. // include the local (contextual) parameters of this course or section
  418. require $includePath.'/local.inc.php';
  419. // The global variable $text_dir has been defined in the language file trad4all.inc.php.
  420. // For determining text direction correspondent to the current language
  421. // we use now information from the internationalization library.
  422. $text_dir = api_get_text_direction();
  423. // ===== "who is logged in?" module section =====
  424. // check and modify the date of user in the track.e.online table
  425. if (!$x = strpos($_SERVER['PHP_SELF'], 'whoisonline.php')) {
  426. preventMultipleLogin($_user["user_id"]);
  427. LoginCheck(isset($_user['user_id']) ? $_user['user_id'] : '');
  428. }
  429. // ===== end "who is logged in?" module section =====
  430. //Update of the logout_date field in the table track_e_login
  431. // (needed for the calculation of the total connection time)
  432. if (!isset($_SESSION['login_as']) && isset($_user)) {
  433. // if $_SESSION['login_as'] is set, then the user is an admin logged as the user
  434. $tbl_track_login = Database :: get_main_table(TABLE_STATISTIC_TRACK_E_LOGIN);
  435. $sql = "SELECT login_id, login_date
  436. FROM $tbl_track_login
  437. WHERE
  438. login_user_id='".$_user["user_id"]."'
  439. ORDER BY login_date DESC
  440. LIMIT 0,1";
  441. $q_last_connection = Database::query($sql);
  442. if (Database::num_rows($q_last_connection) > 0) {
  443. $i_id_last_connection = Database::result($q_last_connection, 0, 'login_id');
  444. // is the latest logout_date still relevant?
  445. $sql = "SELECT logout_date FROM $tbl_track_login
  446. WHERE login_id = $i_id_last_connection";
  447. $q_logout_date = Database::query($sql);
  448. $res_logout_date = convert_sql_date(Database::result($q_logout_date, 0, 'logout_date'));
  449. if ($res_logout_date < time() - $_configuration['session_lifetime']) {
  450. // it isn't, we should create a fresh entry
  451. Event::event_login($_user['user_id']);
  452. // now that it's created, we can get its ID and carry on
  453. $i_id_last_connection = Database::result($q_last_connection, 0, 'login_id');
  454. }
  455. $now = api_get_utc_datetime(time());
  456. $sql = "UPDATE $tbl_track_login SET logout_date = '$now'
  457. WHERE login_id='$i_id_last_connection'";
  458. Database::query($sql);
  459. // Saves the last login in the user table see BT#7297
  460. if (isset($_configuration['save_user_last_login']) &&
  461. $_configuration['save_user_last_login']
  462. ) {
  463. $tableUser = Database::get_main_table(TABLE_MAIN_USER);
  464. $sql = "UPDATE $tableUser SET last_login = '$now'
  465. WHERE user_id = ".$_user["user_id"];
  466. Database::query($sql);
  467. }
  468. }
  469. }
  470. // Add language_measure_frequency to your main/inc/conf/configuration.php in
  471. // order to generate language variables frequency measurements (you can then
  472. // see them through main/cron/lang/langstats.php)
  473. // The langstat object will then be used in the get_lang() function.
  474. // This block can be removed to speed things up a bit as it should only ever
  475. // be used in development versions.
  476. if (isset($_configuration['language_measure_frequency']) &&
  477. $_configuration['language_measure_frequency'] == 1
  478. ) {
  479. require_once api_get_path(SYS_CODE_PATH).'/cron/lang/langstats.class.php';
  480. $langstats = new langstats();
  481. }
  482. //Default quota for the course documents folder
  483. $default_quota = api_get_setting('default_document_quotum');
  484. //Just in case the setting is not correctly set
  485. if (empty($default_quota)) {
  486. $default_quota = 100000000;
  487. }
  488. define('DEFAULT_DOCUMENT_QUOTA', $default_quota);
  489. // Sets the ascii_math plugin see #7134
  490. $_SESSION['ascii_math_loaded'] = false;