Document: Fix sec_token in actions links - refs BT#20762

main/document/document.php

@@ -550,7 +550,7 @@ if ($action && Security::check_token('get')) {
                         }
                     }
                 } else {
-                    if (!copy($file, $copyfile)) {
+                    if (!@copy($file, $copyfile)) {
                         Display::addFlash(Display::return_message(get_lang('CopyFailed'), 'error'));
                     } else {
                         Display::addFlash(
@@ -637,6 +637,7 @@ if ($action && Security::check_token('get')) {
     Security::clear_token();
 }
 
+$secToken = Security::get_token();
 // If no actions we proceed to show the document (Hack in order to use document.php?id=X)
 if (isset($document_id) && empty($action)) {
     // Get the document data from the ID
@@ -2071,7 +2072,7 @@ if (!empty($documentAndFolders)) {
                     ICON_SIZE_MEDIUM
                 ),
                 api_get_path(WEB_CODE_PATH).'document/document.php?'
-                    .api_get_cidreq().'&action=downloadfolder&id='.$document_id
+                    .api_get_cidreq().'&action=downloadfolder&id='.$document_id.'&sec_token='.$secToken
             );
         }
     }
@@ -2162,7 +2163,7 @@ if ($groupId) {
 $queryVars['cidReq'] = api_get_course_id();
 $queryVars['id_session'] = api_get_session_id();
 $queryVars['id'] = $document_id;
-$queryVars['sec_token'] = Security::get_token();
+$queryVars['sec_token'] = $secToken;
 $table->set_additional_parameters($queryVars);
 $column = 0;
 

main/inc/lib/document.lib.php

@@ -5235,6 +5235,8 @@ class DocumentManager
         global $dbl_click_id;
         $www = $documentWebPath;
 
+        $secToken = Security::getTokenFromSession();
+
         $sessionId = api_get_session_id();
         $courseParams = api_get_cidreq();
         $webODFList = self::get_web_odf_extension_list();
@@ -5266,8 +5268,8 @@ class DocumentManager
         if (!$show_as_icon) {
             // Build download link (icon)
             $forcedownload_link = $filetype === 'folder'
-                ? $pageUrl.'?'.$courseParams.'&action=downloadfolder&id='.$document_data['id']
-                : $pageUrl.'?'.$courseParams.'&action=download&id='.$document_data['id'];
+                ? $pageUrl.'?'.$courseParams.'&action=downloadfolder&id='.$document_data['id'].'&sec_token='.$secToken
+                : $pageUrl.'?'.$courseParams.'&action=download&id='.$document_data['id'].'&sec_token='.$secToken;
             // Folder download or file download?
             $forcedownload_icon = $filetype === 'folder' ? 'save_pack.png' : 'save.png';
             // Prevent multiple clicks on zipped folder download
@@ -5380,7 +5382,7 @@ class DocumentManager
             if (api_get_setting('allow_my_files') === 'true' &&
                 api_get_setting('users_copy_files') === 'true' && api_is_anonymous() === false
             ) {
-                $copy_myfiles_link = $filetype === 'file' ? $pageUrl.'?'.$courseParams.'&action=copytomyfiles&id='.$document_data['id'] : api_get_self().'?'.$courseParams;
+                $copy_myfiles_link = $filetype === 'file' ? $pageUrl.'?'.$courseParams.'&action=copytomyfiles&id='.$document_data['id'].'&sec_token='.$secToken : api_get_self().'?'.$courseParams.'&sec_token='.$secToken;
                 if ($filetype === 'file') {
                     $copyToMyFiles = '<a href="'.$copy_myfiles_link.'" style="float:right"'.$prevent_multiple_click.'>'.
                         Display::return_icon('briefcase.png', get_lang('CopyToMyFiles'), [], ICON_SIZE_SMALL).'&nbsp;&nbsp;</a>';
@@ -5397,7 +5399,7 @@ class DocumentManager
                 api_get_setting('students_export2pdf') == 'true' &&
                 in_array($extension, ['html', 'htm'])
             ) {
-                $pdf_icon = ' <a style="float:right".'.$prevent_multiple_click.' href="'.$pageUrl.'?'.$courseParams.'&action=export_to_pdf&id='.$document_data['id'].'&curdirpath='.$curdirpath.'">'.
+                $pdf_icon = ' <a style="float:right".'.$prevent_multiple_click.' href="'.$pageUrl.'?'.$courseParams.'&action=export_to_pdf&id='.$document_data['id'].'&sec_token='.$secToken.'&curdirpath='.$curdirpath.'">'.
                     Display::return_icon('pdf.png', get_lang('Export2PDF'), [], ICON_SIZE_SMALL).'</a> ';
             }