|
|
|
|
@ -17,18 +17,18 @@ api_protect_course_script(); |
|
|
|
|
api_block_anonymous_users(); |
|
|
|
|
|
|
|
|
|
if ($_user['user_id'] != api_get_user_id() || api_get_user_id() == 0 || $_user['user_id'] == 0) { |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (!isset($_GET['title']) || !isset($_GET['type']) || !isset($_GET['image'])) { |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (!isset($_SESSION['paint_dir']) || !isset($_SESSION['whereami'])) { |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
//pixlr return |
|
|
|
|
@ -42,18 +42,18 @@ $urlcontents = Security::remove_XSS($_GET['image']); //A URL to the image on Pix |
|
|
|
|
$title = Database::escape_string(str_replace('_', ' ', $filename)); |
|
|
|
|
$current_session_id = api_get_session_id(); |
|
|
|
|
$groupId = api_get_group_id(); |
|
|
|
|
$groupInfo = GroupManager::get_group_properties($groupId); |
|
|
|
|
$relativeUrlPath = $_SESSION['paint_dir']; |
|
|
|
|
$currentTool = $_SESSION['whereami']; |
|
|
|
|
$dirBaseDocuments = api_get_path(SYS_COURSE_PATH).$_course['path'].'/document'; |
|
|
|
|
$saveDir = $dirBaseDocuments.$_SESSION['paint_dir']; |
|
|
|
|
|
|
|
|
|
$contents = file_get_contents($urlcontents); |
|
|
|
|
|
|
|
|
|
//Security. Verify that the URL is pointing to a file @ pixlr.com domain or an ip @ pixlr.com. Comment because sometimes return a ip number |
|
|
|
|
/* |
|
|
|
|
if (strpos($urlcontents, "pixlr.com") === 0){ |
|
|
|
|
echo "Invalid referrer"; |
|
|
|
|
exit; |
|
|
|
|
echo "Invalid referrer"; |
|
|
|
|
exit; |
|
|
|
|
} |
|
|
|
|
*/ |
|
|
|
|
|
|
|
|
|
@ -72,22 +72,22 @@ $filename = api_replace_dangerous_char($filename); |
|
|
|
|
$filename = disable_dangerous_file($filename); |
|
|
|
|
|
|
|
|
|
if (strlen(trim($filename)) == 0) { |
|
|
|
|
echo "The title is empty"; //if title is empty, headers Content-Type = application/octet-stream, then not create a new title here please |
|
|
|
|
exit; |
|
|
|
|
echo "The title is empty"; //if title is empty, headers Content-Type = application/octet-stream, then not create a new title here please |
|
|
|
|
exit; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
//check file_get_contents |
|
|
|
|
if ($contents === false) { |
|
|
|
|
echo "I cannot read: ".$urlcontents; |
|
|
|
|
echo "I cannot read: ".$urlcontents; |
|
|
|
|
exit; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// Extension security |
|
|
|
|
if ($extension != 'jpg' && $extension != 'png' && $extension != 'pxd') { |
|
|
|
|
die(); |
|
|
|
|
die(); |
|
|
|
|
} |
|
|
|
|
if ($extension == 'pxd') { |
|
|
|
|
echo "pxd file type does not supported"; // not secure because check security headers and finfo() return Content-Type = application/octet-stream |
|
|
|
|
echo "pxd file type does not supported"; // not secure because check security headers and finfo() return Content-Type = application/octet-stream |
|
|
|
|
exit; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
@ -95,8 +95,8 @@ if ($extension == 'pxd') { |
|
|
|
|
$headers = get_headers($urlcontents, 1); |
|
|
|
|
$content_type = explode("/", $headers['Content-Type']); |
|
|
|
|
if ($content_type[0] != "image") { |
|
|
|
|
echo "Invalid file type"; |
|
|
|
|
exit; |
|
|
|
|
echo "Invalid file type"; |
|
|
|
|
exit; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
//Verify that the file is an image. Fileinfo method |
|
|
|
|
@ -114,49 +114,86 @@ $paintFileName = $filename.'.'.$extension; |
|
|
|
|
$title = $title.'.'.$extension; |
|
|
|
|
|
|
|
|
|
if ($currentTool == 'document/createpaint') { |
|
|
|
|
//check save as and prevent rewrite an older file with same name |
|
|
|
|
if (0 != $groupId) { |
|
|
|
|
//check save as and prevent rewrite an older file with same name |
|
|
|
|
if (0 != $groupId) { |
|
|
|
|
$group_properties = GroupManager :: get_group_properties($groupId); |
|
|
|
|
$groupPath = $group_properties['directory']; |
|
|
|
|
} else { |
|
|
|
|
$groupPath = ''; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (file_exists($saveDir.'/'.$filename.'.'.$extension)) { |
|
|
|
|
$i = 1; |
|
|
|
|
while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++; |
|
|
|
|
$paintFileName = $filename.'_'.$i.'.'.$extension; |
|
|
|
|
$title = $filename.'_'.$i.'.'.$extension; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// |
|
|
|
|
$documentPath = $saveDir.'/'.$paintFileName; |
|
|
|
|
//add new document to disk |
|
|
|
|
file_put_contents($documentPath, $contents); |
|
|
|
|
//add document to database |
|
|
|
|
$doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title); |
|
|
|
|
api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id); |
|
|
|
|
|
|
|
|
|
}elseif ($currentTool == 'document/editpaint') { |
|
|
|
|
|
|
|
|
|
$documentPath = $saveDir.'/'.$paintFileName; |
|
|
|
|
//add new document to disk |
|
|
|
|
file_put_contents($documentPath, $contents); |
|
|
|
|
|
|
|
|
|
//check path |
|
|
|
|
if (!isset($_SESSION['paint_file'])) { |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
} |
|
|
|
|
if ($_SESSION['paint_file'] == $paintFileName) { |
|
|
|
|
$document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName); |
|
|
|
|
update_existing_document($_course, $document_id, filesize($documentPath), null); |
|
|
|
|
api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentUpdated', $_user['user_id'], $groupId, null, null, null, $current_session_id); |
|
|
|
|
} else { |
|
|
|
|
//add a new document |
|
|
|
|
$doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title); |
|
|
|
|
api_item_property_update($_course, TOOL_DOCUMENT, $doc_id, 'DocumentAdded', $_user['user_id'], $groupId, null, null, null, $current_session_id); |
|
|
|
|
} |
|
|
|
|
} else { |
|
|
|
|
$groupPath = ''; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
if (file_exists($saveDir.'/'.$filename.'.'.$extension)) { |
|
|
|
|
$i = 1; |
|
|
|
|
while (file_exists($saveDir.'/'.$filename.'_'.$i.'.'.$extension)) $i++; |
|
|
|
|
$paintFileName = $filename.'_'.$i.'.'.$extension; |
|
|
|
|
$title = $filename.'_'.$i.'.'.$extension; |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
// |
|
|
|
|
$documentPath = $saveDir.'/'.$paintFileName; |
|
|
|
|
//add new document to disk |
|
|
|
|
file_put_contents($documentPath, $contents); |
|
|
|
|
//add document to database |
|
|
|
|
$doc_id = add_document($_course, $relativeUrlPath.'/'.$paintFileName, 'file', filesize($documentPath), $title); |
|
|
|
|
api_item_property_update( |
|
|
|
|
$_course, |
|
|
|
|
TOOL_DOCUMENT, |
|
|
|
|
$doc_id, |
|
|
|
|
'DocumentAdded', |
|
|
|
|
$_user['user_id'], |
|
|
|
|
$groupInfo, |
|
|
|
|
null, |
|
|
|
|
null, |
|
|
|
|
null, |
|
|
|
|
$current_session_id |
|
|
|
|
); |
|
|
|
|
} elseif ($currentTool == 'document/editpaint') { |
|
|
|
|
$documentPath = $saveDir.'/'.$paintFileName; |
|
|
|
|
//add new document to disk |
|
|
|
|
file_put_contents($documentPath, $contents); |
|
|
|
|
|
|
|
|
|
//check path |
|
|
|
|
if (!isset($_SESSION['paint_file'])) { |
|
|
|
|
api_not_allowed(); |
|
|
|
|
die(); |
|
|
|
|
} |
|
|
|
|
if ($_SESSION['paint_file'] == $paintFileName) { |
|
|
|
|
$document_id = DocumentManager::get_document_id($_course, $relativeUrlPath.'/'.$paintFileName); |
|
|
|
|
update_existing_document($_course, $document_id, filesize($documentPath), null); |
|
|
|
|
api_item_property_update( |
|
|
|
|
$_course, |
|
|
|
|
TOOL_DOCUMENT, |
|
|
|
|
$document_id, |
|
|
|
|
'DocumentUpdated', |
|
|
|
|
$_user['user_id'], |
|
|
|
|
$groupInfo, |
|
|
|
|
null, |
|
|
|
|
null, |
|
|
|
|
null, |
|
|
|
|
$current_session_id |
|
|
|
|
); |
|
|
|
|
} else { |
|
|
|
|
//add a new document |
|
|
|
|
$doc_id = add_document( |
|
|
|
|
$_course, |
|
|
|
|
$relativeUrlPath.'/'.$paintFileName, |
|
|
|
|
'file', |
|
|
|
|
filesize($documentPath), |
|
|
|
|
$title |
|
|
|
|
); |
|
|
|
|
api_item_property_update( |
|
|
|
|
$_course, |
|
|
|
|
TOOL_DOCUMENT, |
|
|
|
|
$doc_id, |
|
|
|
|
'DocumentAdded', |
|
|
|
|
$_user['user_id'], |
|
|
|
|
$groupInfo, |
|
|
|
|
null, |
|
|
|
|
null, |
|
|
|
|
null, |
|
|
|
|
$current_session_id |
|
|
|
|
); |
|
|
|
|
} |
|
|
|
|
} |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
@ -171,12 +208,12 @@ unset($_SESSION['whereami']); |
|
|
|
|
unset($_SESSION['temp_realpath_image']); |
|
|
|
|
|
|
|
|
|
if (!isset($_SESSION['exit_pixlr'])) { |
|
|
|
|
$location = api_get_path(WEB_CODE_PATH).'document/document.php'; |
|
|
|
|
echo '<script>window.parent.location.href="'.$location.'"</script>'; |
|
|
|
|
api_not_allowed(true); |
|
|
|
|
$location = api_get_path(WEB_CODE_PATH).'document/document.php'; |
|
|
|
|
echo '<script>window.parent.location.href="'.$location.'"</script>'; |
|
|
|
|
api_not_allowed(true); |
|
|
|
|
} else { |
|
|
|
|
echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>'; |
|
|
|
|
$location = api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']); |
|
|
|
|
echo '<script>window.parent.location.href="'.$location.'"</script>'; |
|
|
|
|
unset($_SESSION['exit_pixlr']); |
|
|
|
|
echo '<div align="center" style="padding-top:150; font-family:Arial, Helvetica, Sans-serif;font-size:25px;color:#aaa;font-weight:bold;">'.get_lang('PleaseStandBy').'</div>'; |
|
|
|
|
$location = api_get_path(WEB_CODE_PATH).'document/document.php?id='.Security::remove_XSS($_SESSION['exit_pixlr']); |
|
|
|
|
echo '<script>window.parent.location.href="'.$location.'"</script>'; |
|
|
|
|
unset($_SESSION['exit_pixlr']); |
|
|
|
|
} |
|
|
|
|
|
jmontoyaa
9 years ago