diff --git a/main/dropbox/dropbox_functions.inc.php b/main/dropbox/dropbox_functions.inc.php index 30aa46c4f5..2e594f14a2 100644 --- a/main/dropbox/dropbox_functions.inc.php +++ b/main/dropbox/dropbox_functions.inc.php @@ -800,7 +800,6 @@ function store_add_dropbox() global $dropbox_cnf; global $_user; global $_course; - require_once(api_get_path(LIBRARY_PATH) . "/fileUpload.lib.php"); // ---------------------------------------------------------- // Validating the form data @@ -899,6 +898,12 @@ function store_add_dropbox() $dropbox_filename = replace_dangerous_char( $dropbox_filename); // Transform any .php file in .phps fo security $dropbox_filename = php2phps ( $dropbox_filename); + //filter extension + if(!filter_extension($dropbox_filename)) + { + return get_lang('UplUnableToSaveFileFilteredExtension'); + } + // set title $dropbox_title = $dropbox_filename; // set author @@ -911,7 +916,7 @@ function store_add_dropbox() if ( $dropbox_overwrite) // RH: Mailing: adapted { - $dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor); + $dropbox_person = new Dropbox_Person( $_user['user_id'], api_is_course_admin(), api_is_course_tutor()); foreach($dropbox_person->sentWork as $w) { @@ -949,7 +954,7 @@ function store_add_dropbox() $userList = GroupManager::get_subscribed_users(substr($rec, strlen('group_') )); foreach ($userList as $usr) { - if (! in_array($usr['user_id'], $newWorkRecipients) && $usr['user_id'] != $_user['user_id']) + if (! in_array($usr['user_id'], $new_work_recipients) && $usr['user_id'] != $_user['user_id']) { $new_work_recipients[] = $usr['user_id']; } diff --git a/main/dropbox/dropbox_submit.php b/main/dropbox/dropbox_submit.php index 3fc6896d61..f459a7e1c6 100644 --- a/main/dropbox/dropbox_submit.php +++ b/main/dropbox/dropbox_submit.php @@ -88,7 +88,7 @@ if ( isset( $_POST["submitWork"])) /** * -------------------------------------- - *      FORM SUBMIT : VALIDATE POSTED DATA + * �����FORM SUBMIT : VALIDATE POSTED DATA * -------------------------------------- */ // the author or description field is empty @@ -162,7 +162,7 @@ if ( isset( $_POST["submitWork"])) /** * -------------------------------------- - *     FORM SUBMIT : UPLOAD NEW FILE + * ����FORM SUBMIT : UPLOAD NEW FILE * -------------------------------------- */ if ( !$error) @@ -193,105 +193,112 @@ if ( isset( $_POST["submitWork"])) $dropbox_filename = replace_dangerous_char( $dropbox_filename); // Transform any .php file in .phps fo security $dropbox_filename = php2phps ( $dropbox_filename); - - // set title - $dropbox_title = $dropbox_filename; - - // set author - if ( $_POST['authors'] == '') + if(!filter_extension($dropbox_filename)) { - $_POST['authors'] = getUserNameFromId( $_user['user_id']); + $error = true; + $errormsg = get_lang('UplUnableToSaveFileFilteredExtension'); } - - if ( $dropbox_overwrite) // RH: Mailing: adapted - { - $dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor); - - foreach($dropbox_person->sentWork as $w) + else + { + // set title + $dropbox_title = $dropbox_filename; + + // set author + if ( $_POST['authors'] == '') + { + $_POST['authors'] = getUserNameFromId( $_user['user_id']); + } + + if ( $dropbox_overwrite) // RH: Mailing: adapted { - if ($w->title == $dropbox_filename) + $dropbox_person = new Dropbox_Person( $_user['user_id'], $is_courseAdmin, $is_courseTutor); + + foreach($dropbox_person->sentWork as $w) { - if ( ($w->recipients[0]['id'] > dropbox_cnf("mailingIdBase")) xor $thisIsAMailing) - { - $error = TRUE; - $errormsg = dropbox_lang("mailingNonMailingError"); - } - if ( ($w->recipients[0]['id'] == $_user['user_id']) xor $thisIsJustUpload) + if ($w->title == $dropbox_filename) { - $error = TRUE; - $errormsg = dropbox_lang("mailingJustUploadNoOther"); + if ( ($w->recipients[0]['id'] > dropbox_cnf("mailingIdBase")) xor $thisIsAMailing) + { + $error = TRUE; + $errormsg = dropbox_lang("mailingNonMailingError"); + } + if ( ($w->recipients[0]['id'] == $_user['user_id']) xor $thisIsJustUpload) + { + $error = TRUE; + $errormsg = dropbox_lang("mailingJustUploadNoOther"); + } + $dropbox_filename = $w->filename; $found = true; + break; } - $dropbox_filename = $w->filename; $found = true; - break; } } - } - else // rename file to login_filename_uniqueId format - { - $dropbox_filename = getLoginFromId( $_user['user_id']) . "_" . $dropbox_filename . "_".uniqid(''); - } - - if ( ( ! is_dir( dropbox_cnf("sysPath")))) - { - //The dropbox subdir doesn't exist yet so make it and create the .htaccess file - mkdir( dropbox_cnf("sysPath"), 0700) or die ( dropbox_lang("errorCreatingDir")." (code 404)"); - $fp = fopen( dropbox_cnf("sysPath")."/.htaccess", "w") or die (dropbox_lang("errorCreatingDir")." (code 405)"); - fwrite($fp, "AuthName AllowLocalAccess - AuthType Basic - - order deny,allow - deny from all - - php_flag zlib.output_compression off") or die (dropbox_lang("errorCreatingDir")." (code 406)"); - } - - if ( $error) {} - elseif ( $thisIsAMailing) // RH: $newWorkRecipients is integer - see class - { - if ( preg_match( dropbox_cnf("mailingZipRegexp"), $dropbox_title)) - { - $newWorkRecipients = dropbox_cnf("mailingIdBase"); - } - else + else // rename file to login_filename_uniqueId format { - $error = TRUE; - $errormsg = $dropbox_title . ": " . dropbox_lang("mailingWrongZipfile"); + $dropbox_filename = getLoginFromId( $_user['user_id']) . "_" . $dropbox_filename . "_".uniqid(''); } - } - elseif ( $thisIsJustUpload) // RH: $newWorkRecipients is empty array - { - $newWorkRecipients = array(); - } - else - { // creating the array that contains all the users who will receive the file - $newWorkRecipients = array(); - foreach ($_POST["recipients"] as $rec) + + if ( ( ! is_dir( dropbox_cnf("sysPath")))) { - if (strpos($rec, 'user_') === 0) { - $newWorkRecipients[] = substr($rec, strlen('user_') ); - } - elseif (strpos($rec, 'group_') === 0 ) - { - $userList = GroupManager::get_subscribed_users(substr($rec, strlen('group_') )); - foreach ($userList as $usr) - { - if (! in_array($usr['user_id'], $newWorkRecipients) && $usr['user_id'] != $_user['user_id']) - { - $newWorkRecipients[] = $usr['user_id']; - } - } - } + //The dropbox subdir doesn't exist yet so make it and create the .htaccess file + mkdir( dropbox_cnf("sysPath"), 0700) or die ( dropbox_lang("errorCreatingDir")." (code 404)"); + $fp = fopen( dropbox_cnf("sysPath")."/.htaccess", "w") or die (dropbox_lang("errorCreatingDir")." (code 405)"); + fwrite($fp, "AuthName AllowLocalAccess + AuthType Basic + + order deny,allow + deny from all + + php_flag zlib.output_compression off") or die (dropbox_lang("errorCreatingDir")." (code 406)"); } - } - - //After uploading the file, create the db entries - - if ( !$error) - { - @move_uploaded_file( $dropbox_filetmpname, dropbox_cnf("sysPath") . '/' . $dropbox_filename) - or die( dropbox_lang("uploadError")." (code 407)"); - new Dropbox_SentWork( $_user['user_id'], $dropbox_title, $_POST['description'], strip_tags($_POST['authors']), $dropbox_filename, $dropbox_filesize, $newWorkRecipients); - } + + if ( $error) {} + elseif ( $thisIsAMailing) // RH: $newWorkRecipients is integer - see class + { + if ( preg_match( dropbox_cnf("mailingZipRegexp"), $dropbox_title)) + { + $newWorkRecipients = dropbox_cnf("mailingIdBase"); + } + else + { + $error = TRUE; + $errormsg = $dropbox_title . ": " . dropbox_lang("mailingWrongZipfile"); + } + } + elseif ( $thisIsJustUpload) // RH: $newWorkRecipients is empty array + { + $newWorkRecipients = array(); + } + else + { // creating the array that contains all the users who will receive the file + $newWorkRecipients = array(); + foreach ($_POST["recipients"] as $rec) + { + if (strpos($rec, 'user_') === 0) { + $newWorkRecipients[] = substr($rec, strlen('user_') ); + } + elseif (strpos($rec, 'group_') === 0 ) + { + $userList = GroupManager::get_subscribed_users(substr($rec, strlen('group_') )); + foreach ($userList as $usr) + { + if (! in_array($usr['user_id'], $newWorkRecipients) && $usr['user_id'] != $_user['user_id']) + { + $newWorkRecipients[] = $usr['user_id']; + } + } + } + } + } + + //After uploading the file, create the db entries + + if ( !$error) + { + @move_uploaded_file( $dropbox_filetmpname, dropbox_cnf("sysPath") . '/' . $dropbox_filename) + or die( dropbox_lang("uploadError")." (code 407)"); + new Dropbox_SentWork( $_user['user_id'], $dropbox_title, $_POST['description'], strip_tags($_POST['authors']), $dropbox_filename, $dropbox_filesize, $newWorkRecipients); + } + } } } //end if(!$error) diff --git a/main/inc/lib/fileUpload.lib.php b/main/inc/lib/fileUpload.lib.php index 9f7625678d..59fdeb36f9 100644 --- a/main/inc/lib/fileUpload.lib.php +++ b/main/inc/lib/fileUpload.lib.php @@ -309,131 +309,106 @@ function handle_uploaded_document($_course,$uploaded_file,$base_work_dir,$upload $clean_name = replace_dangerous_char($uploaded_file['name']); //no "dangerous" files $clean_name = disable_dangerous_file($clean_name); - //echo "
clean name = ".$clean_name; - //echo "
upload_path = ".$upload_path; - //if the upload path differs from / (= root) it will need a slash at the end - if ($upload_path!='/') - $upload_path = $upload_path.'/'; - //echo "
upload_path = ".$upload_path; - $file_path = $upload_path.$clean_name; - //echo "
file path = ".$file_path; - //full path to where we want to store the file with trailing slash - $where_to_save = $base_work_dir.$upload_path; - //at least if the directory doesn't exist, tell so - if(!is_dir($where_to_save)){ - Display::display_error_message(get_lang('DestDirectoryDoesntExist').' ('.$upload_path.')'); + if(!filter_extension($clean_name)) + { + Display::display_error_message(get_lang('UplUnableToSaveFileFilteredExtension')); return false; } - //echo "
where to save = ".$where_to_save; - // full path of the destination - $store_path = $where_to_save.$clean_name; - //echo "
store path = ".$store_path; - //name of the document without the extension (for the title) - $document_name = get_document_title($uploaded_file['name']); - //size of the uploaded file (in bytes) - $file_size = $uploaded_file['size']; - //what to do if the target file exists - switch ($what_if_file_exists) - { - //overwrite the file if it exists - case 'overwrite': - - //check if the target file exists, so we can give another message - if (file_exists($store_path)) - { - $file_exists = true; - } - else - { - $file_exists = false; - } - if (@move_uploaded_file($uploaded_file['tmp_name'], $store_path)) + else + { + //extension is good + //echo "
clean name = ".$clean_name; + //echo "
upload_path = ".$upload_path; + //if the upload path differs from / (= root) it will need a slash at the end + if ($upload_path!='/') + $upload_path = $upload_path.'/'; + //echo "
upload_path = ".$upload_path; + $file_path = $upload_path.$clean_name; + //echo "
file path = ".$file_path; + //full path to where we want to store the file with trailing slash + $where_to_save = $base_work_dir.$upload_path; + //at least if the directory doesn't exist, tell so + if(!is_dir($where_to_save)){ + Display::display_error_message(get_lang('DestDirectoryDoesntExist').' ('.$upload_path.')'); + return false; + } + //echo "
where to save = ".$where_to_save; + // full path of the destination + $store_path = $where_to_save.$clean_name; + //echo "
store path = ".$store_path; + //name of the document without the extension (for the title) + $document_name = get_document_title($uploaded_file['name']); + //size of the uploaded file (in bytes) + $file_size = $uploaded_file['size']; + //what to do if the target file exists + switch ($what_if_file_exists) { - if($file_exists) + //overwrite the file if it exists + case 'overwrite': + + //check if the target file exists, so we can give another message + if (file_exists($store_path)) { - //UPDATE DATABASE! - $document_id = DocumentManager::get_document_id($_course,$file_path); - if ($document_id) - { - //update filesize - update_existing_document($_course,$document_id,$uploaded_file['size']); - //update document item_property - api_item_property_update($_course,TOOL_DOCUMENT,$document_id,'DocumentUpdated',$user_id,$to_group_id,$to_user_id); - } - //if the file is in a folder, we need to update all parent folders - item_property_update_on_folder($_course,$upload_path,$user_id); - //display success message with extra info to user - if($output){ - Display::display_confirmation_message(get_lang('UplUploadSucceeded')."
".$file_path .' '. get_lang('UplFileOverwritten'),false); - } - return $file_path; + $file_exists = true; } else { - //put the document data in the database - $document_id = add_document($_course,$file_path,'file',$file_size,$document_name); - if ($document_id) + $file_exists = false; + } + if (@move_uploaded_file($uploaded_file['tmp_name'], $store_path)) + { + if($file_exists) { - //put the document in item_property update - api_item_property_update($_course,TOOL_DOCUMENT,$document_id,'DocumentAdded',$user_id,$to_group_id,$to_user_id); + //UPDATE DATABASE! + $document_id = DocumentManager::get_document_id($_course,$file_path); + if ($document_id) + { + //update filesize + update_existing_document($_course,$document_id,$uploaded_file['size']); + //update document item_property + api_item_property_update($_course,TOOL_DOCUMENT,$document_id,'DocumentUpdated',$user_id,$to_group_id,$to_user_id); + } + //if the file is in a folder, we need to update all parent folders + item_property_update_on_folder($_course,$upload_path,$user_id); + //display success message with extra info to user + if($output){ + Display::display_confirmation_message(get_lang('UplUploadSucceeded')."
".$file_path .' '. get_lang('UplFileOverwritten'),false); + } + return $file_path; + } + else + { + //put the document data in the database + $document_id = add_document($_course,$file_path,'file',$file_size,$document_name); + if ($document_id) + { + //put the document in item_property update + api_item_property_update($_course,TOOL_DOCUMENT,$document_id,'DocumentAdded',$user_id,$to_group_id,$to_user_id); + } + //if the file is in a folder, we need to update all parent folders + item_property_update_on_folder($_course,$upload_path,$user_id); + //display success message to user + Display::display_confirmation_message(get_lang('UplUploadSucceeded')."
".$file_path,false); + return $file_path; } - //if the file is in a folder, we need to update all parent folders - item_property_update_on_folder($_course,$upload_path,$user_id); - //display success message to user - Display::display_confirmation_message(get_lang('UplUploadSucceeded')."
".$file_path,false); - return $file_path; } - } - else - { - Display::display_error_message(get_lang('UplUnableToSaveFile')); - return false; - } - break; - - //rename the file if it exists - case 'rename': - $new_name = unique_name($where_to_save, $clean_name); - $store_path = $where_to_save.$new_name; - $new_file_path = $upload_path.$new_name; - - if (@move_uploaded_file($uploaded_file['tmp_name'], $store_path)) - { - //put the document data in the database - $document_id = add_document($_course,$new_file_path,'file',$file_size,$document_name); - if ($document_id) + else { - //update document item_property - api_item_property_update($_course,TOOL_DOCUMENT,$document_id,'DocumentAdded',$user_id,$to_group_id,$to_user_id); - } - //if the file is in a folder, we need to update all parent folders - item_property_update_on_folder($_course,$upload_path,$user_id); - //display success message to user - if($output){ - Display::display_confirmation_message(get_lang('UplUploadSucceeded'). "
" .get_lang('UplFileSavedAs') . $new_file_path,false); + Display::display_error_message(get_lang('UplUnableToSaveFile')); + return false; } - return $new_file_path; - } - else - { - Display::display_error_message(get_lang('UplUnableToSaveFile')); - return false; - } - break; - - //only save the file if it doesn't exist or warn user if it does exist - default: - if (file_exists($store_path)) - { - Display::display_error_message($clean_name.' '.get_lang('UplAlreadyExists')); - } - else - { + break; + + //rename the file if it exists + case 'rename': + $new_name = unique_name($where_to_save, $clean_name); + $store_path = $where_to_save.$new_name; + $new_file_path = $upload_path.$new_name; + if (@move_uploaded_file($uploaded_file['tmp_name'], $store_path)) { - //put the document data in the database - $document_id = add_document($_course,$file_path,'file',$file_size,$document_name); + $document_id = add_document($_course,$new_file_path,'file',$file_size,$document_name); if ($document_id) { //update document item_property @@ -443,18 +418,52 @@ function handle_uploaded_document($_course,$uploaded_file,$base_work_dir,$upload item_property_update_on_folder($_course,$upload_path,$user_id); //display success message to user if($output){ - Display::display_confirmation_message(get_lang('UplUploadSucceeded')."
".$file_path,false); + Display::display_confirmation_message(get_lang('UplUploadSucceeded'). "
" .get_lang('UplFileSavedAs') . $new_file_path,false); } - return $file_path; + return $new_file_path; } else { Display::display_error_message(get_lang('UplUnableToSaveFile')); return false; } + break; + + //only save the file if it doesn't exist or warn user if it does exist + default: + if (file_exists($store_path)) + { + Display::display_error_message($clean_name.' '.get_lang('UplAlreadyExists')); + } + else + { + if (@move_uploaded_file($uploaded_file['tmp_name'], $store_path)) + { + + //put the document data in the database + $document_id = add_document($_course,$file_path,'file',$file_size,$document_name); + if ($document_id) + { + //update document item_property + api_item_property_update($_course,TOOL_DOCUMENT,$document_id,'DocumentAdded',$user_id,$to_group_id,$to_user_id); + } + //if the file is in a folder, we need to update all parent folders + item_property_update_on_folder($_course,$upload_path,$user_id); + //display success message to user + if($output){ + Display::display_confirmation_message(get_lang('UplUploadSucceeded')."
".$file_path,false); + } + return $file_path; + } + else + { + Display::display_error_message(get_lang('UplUnableToSaveFile')); + return false; + } + } + break; } - break; - } + } } } diff --git a/main/work/work.php b/main/work/work.php index c3fc1972cc..f1a1122881 100644 --- a/main/work/work.php +++ b/main/work/work.php @@ -23,7 +23,7 @@ * @author Patrick Cool , Ghent University - ability for course admins to specify wether uploaded documents are visible or invisible by default. * @author Roan Embrechts, code refactoring and virtual course support * @author Frederic Vauthier, directories management -* @version $Id: work.php 13756 2007-11-23 16:30:17Z elixir_inter $ +* @version $Id: work.php 13804 2007-11-28 06:08:00Z yannoo $ * * @todo refactor more code into functions, use quickforms, coding standards, ... */ @@ -631,56 +631,65 @@ if($_POST['submitWork'] && $is_course_member && $check) // Transform any .php file in .phps fo security $new_file_name = php2phps($new_file_name); - - if( ! $title ) - { - $title = $_FILES['file']['name']; - } - - if ( ! $authors) - { - $authors = $currentUserFirstName." ".$currentUserLastName; - } - - // compose a unique file name to avoid any conflict - - $new_file_name = uniqid('').$new_file_name; - - if (isset($_SESSION['toolgroup'])) - { - $post_group_id = $_SESSION['toolgroup']; - } - else + //filter extension + if(!filter_extension($new_file_name)) + { + Display::display_error_message(get_lang('UplUnableToSaveFileFilteredExtension')); + $succeed = false; + } + else { - $post_group_id = '0'; - } - //if we come from the group tools the groupid will be saved in $work_table - - move_uploaded_file($_FILES['file']['tmp_name'],$updir.$my_cur_dir_path.$new_file_name); - $url = "work/".$my_cur_dir_path.$new_file_name; - $result = api_sql_query("SHOW FIELDS FROM ".$work_table." LIKE 'sent_date'",__FILE__,__LINE__); - - if(!mysql_num_rows($result)) - { - api_sql_query("ALTER TABLE ".$work_table." ADD sent_date DATETIME NOT NULL"); + if( ! $title ) + { + $title = $_FILES['file']['name']; + } + + if ( ! $authors) + { + $authors = $currentUserFirstName." ".$currentUserLastName; + } + + // compose a unique file name to avoid any conflict + + $new_file_name = uniqid('').$new_file_name; + + if (isset($_SESSION['toolgroup'])) + { + $post_group_id = $_SESSION['toolgroup']; + } + else + { + $post_group_id = '0'; + } + //if we come from the group tools the groupid will be saved in $work_table + + move_uploaded_file($_FILES['file']['tmp_name'],$updir.$my_cur_dir_path.$new_file_name); + + $url = "work/".$my_cur_dir_path.$new_file_name; + $result = api_sql_query("SHOW FIELDS FROM ".$work_table." LIKE 'sent_date'",__FILE__,__LINE__); + + if(!mysql_num_rows($result)) + { + api_sql_query("ALTER TABLE ".$work_table." ADD sent_date DATETIME NOT NULL"); + } + + $sql_add_publication = "INSERT INTO ".$work_table." + SET url = '".$url."', + title = '".$title."', + description = '".$description."', + author = '".$authors."', + active = '".$active."', + accepted = '".(!$uploadvisibledisabled)."', + post_group_id = '".$post_group_id."', + sent_date = NOW()"; + + api_sql_query($sql_add_publication,__FILE__,__LINE__); + + $Id = mysql_insert_id(); + api_item_property_update($_course,'work',$Id,get_lang('DocumentAdded'),$user_id); + $succeed = true; } - - $sql_add_publication = "INSERT INTO ".$work_table." - SET url = '".$url."', - title = '".$title."', - description = '".$description."', - author = '".$authors."', - active = '".$active."', - accepted = '".(!$uploadvisibledisabled)."', - post_group_id = '".$post_group_id."', - sent_date = NOW()"; - - api_sql_query($sql_add_publication,__FILE__,__LINE__); - - $Id = mysql_insert_id(); - api_item_property_update($_course,'work',$Id,get_lang('DocumentAdded'),$user_id); - $succeed = true; } /*