survey.download.inc.php 3.9 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111
  1. <?php
  2. /* For licensing terms, see /license.txt */
  3. /**
  4. * @package chamilo.survey
  5. * @author Arnaud Ligot <arnaud@cblue.be>
  6. * @version $Id: $
  7. *
  8. * A small peace of code to enable user to access images included into survey
  9. * which are accessible by non authenticated users. This file is included
  10. * by document/download.php
  11. */
  12. function check_download_survey($course, $invitation, $doc_url)
  13. {
  14. // Getting all the course information
  15. $_course = CourseManager::get_course_information($course);
  16. $course_id = $_course['real_id'];
  17. // Database table definitions
  18. $table_survey = Database :: get_course_table(TABLE_SURVEY);
  19. $table_survey_question = Database :: get_course_table(TABLE_SURVEY_QUESTION);
  20. $table_survey_question_option = Database :: get_course_table(TABLE_SURVEY_QUESTION_OPTION);
  21. $table_survey_invitation = Database :: get_course_table(TABLE_SURVEY_INVITATION);
  22. // Now we check if the invitationcode is valid
  23. $sql = "SELECT * FROM $table_survey_invitation
  24. WHERE
  25. c_id = $course_id AND
  26. invitation_code = '".Database::escape_string($invitation)."'";
  27. $result = Database::query($sql);
  28. if (Database::num_rows($result) < 1) {
  29. Display :: display_error_message(get_lang('WrongInvitationCode'), false);
  30. Display :: display_footer();
  31. exit;
  32. }
  33. $survey_invitation = Database::fetch_assoc($result);
  34. // Now we check if the user already filled the survey
  35. if ($survey_invitation['answered'] == 1) {
  36. Display :: display_error_message(get_lang('YouAlreadyFilledThisSurvey'), false);
  37. Display :: display_footer();
  38. exit;
  39. }
  40. // Very basic security check: check if a text field from a survey/answer/option contains the name of the document requested
  41. // Fetch survey ID
  42. // If this is the case there will be a language choice
  43. $sql = "SELECT * FROM $table_survey
  44. WHERE
  45. c_id = $course_id AND
  46. code='".Database::escape_string($survey_invitation['survey_code'])."'";
  47. $result = Database::query($sql);
  48. if (Database::num_rows($result) > 1) {
  49. if ($_POST['language']) {
  50. $survey_invitation['survey_id'] = $_POST['language'];
  51. } else {
  52. echo '<form id="language" name="language" method="POST" action="'.api_get_self().'?course='.$_GET['course'].'&invitationcode='.$_GET['invitationcode'].'">';
  53. echo ' <select name="language">';
  54. while ($row = Database::fetch_assoc($result)) {
  55. echo '<option value="'.$row['survey_id'].'">'.$row['lang'].'</option>';
  56. }
  57. echo '</select>';
  58. echo ' <input type="submit" name="Submit" value="'.get_lang('Ok').'" />';
  59. echo '</form>';
  60. display::display_footer();
  61. exit;
  62. }
  63. } else {
  64. $row = Database::fetch_assoc($result);
  65. $survey_invitation['survey_id'] = $row['survey_id'];
  66. }
  67. $sql = "SELECT count(*)
  68. FROM $table_survey
  69. WHERE
  70. c_id = $course_id AND
  71. survey_id = ".$survey_invitation['survey_id']." AND (
  72. title LIKE '%$doc_url%'
  73. or subtitle LIKE '%$doc_url%'
  74. or intro LIKE '%$doc_url%'
  75. or surveythanks LIKE '%$doc_url%'
  76. )
  77. UNION
  78. SELECT count(*)
  79. FROM $table_survey_question
  80. WHERE
  81. c_id = $course_id AND
  82. survey_id = ".$survey_invitation['survey_id']." AND (
  83. survey_question LIKE '%$doc_url%'
  84. or survey_question_comment LIKE '%$doc_url%'
  85. )
  86. UNION
  87. SELECT count(*)
  88. FROM $table_survey_question_option
  89. WHERE
  90. c_id = $course_id AND
  91. survey_id = ".$survey_invitation['survey_id']." AND (
  92. option_text LIKE '%$doc_url%'
  93. )";
  94. $result = Database::query($sql);
  95. if (Database::num_rows($result) == 0) {
  96. Display :: display_error_message(get_lang('WrongInvitationCode'), false);
  97. Display :: display_footer();
  98. exit;
  99. }
  100. return $_course;
  101. }