From 2eab5359a917b16a7c2d0930da2327c983e67399 Mon Sep 17 00:00:00 2001 From: Christian Date: Thu, 11 May 2023 17:07:39 -0500 Subject: [PATCH 1/2] Upload: Add size limit to upload files for trainers - refs BT#20689 --- main/document/upload.php | 2 +- main/dropbox/dropbox_functions.inc.php | 4 +- main/forum/forumfunction.inc.php | 68 ++++++++++++++++--- main/inc/lib/fileUpload.lib.php | 39 ++++++++++- .../lib/formvalidator/Element/BigUpload.php | 3 + .../lib/formvalidator/FormValidator.class.php | 37 ++++++++-- .../lib/formvalidator/Rule/MaxFileSize.php | 2 +- .../lib/javascript/bigupload/js/bigUpload.js | 9 ++- main/inc/lib/message.lib.php | 10 +-- .../lib/pear/HTML/QuickForm/RuleRegistry.php | 6 +- main/install/configuration.dist.php | 3 + main/messages/new_message.php | 14 +++- .../Component/Editor/Driver/CourseDriver.php | 10 +++ 13 files changed, 173 insertions(+), 34 deletions(-) diff --git a/main/document/upload.php b/main/document/upload.php index d5ae884454..52400e3585 100755 --- a/main/document/upload.php +++ b/main/document/upload.php @@ -257,7 +257,7 @@ $form->addElement('hidden', 'curdirpath', $path); $courseQuota = format_file_size(DocumentManager::get_course_quota() - DocumentManager::documents_total_space()); $label = - get_lang('MaxFileSize').': '.ini_get('upload_max_filesize').'
'. + get_lang('MaxFileSize').': '.getIniMaxFileSizeInBytes(true).'
'. get_lang('DocumentQuota').': '.$courseQuota; $form->addElement('BigUpload', 'file', [get_lang('File'), $label], ['id' => 'bigUploadFile', 'data-origin' => 'document']); diff --git a/main/dropbox/dropbox_functions.inc.php b/main/dropbox/dropbox_functions.inc.php index bcfdbebc11..5729c25430 100755 --- a/main/dropbox/dropbox_functions.inc.php +++ b/main/dropbox/dropbox_functions.inc.php @@ -540,7 +540,7 @@ function display_add_form($viewReceivedCategory, $viewSentCategory, $view, $id = $form->addElement('hidden', 'sec_token', $token); $form->addElement('hidden', 'origin', $origin); if ('add' == $action) { - $maxFileSize = api_get_setting('dropbox_max_filesize'); + $maxFileSize = getIniMaxFileSizeInBytes(); $form->addElement('hidden', 'MAX_FILE_SIZE', $maxFileSize); $form->addElement( 'file', @@ -1070,7 +1070,7 @@ function store_add_dropbox($file = [], $work = null) $dropbox_filetmpname = $file['tmp_name']; // check if the filesize does not exceed the allowed size. - $maxFileSize = api_get_setting('dropbox_max_filesize'); + $maxFileSize = getIniMaxFileSizeInBytes(); if ($dropbox_filesize <= 0 || $dropbox_filesize > $maxFileSize) { Display::addFlash(Display::return_message(get_lang('DropboxFileTooBig'), 'warning')); diff --git a/main/forum/forumfunction.inc.php b/main/forum/forumfunction.inc.php index 9e83594138..edd0e90a53 100755 --- a/main/forum/forumfunction.inc.php +++ b/main/forum/forumfunction.inc.php @@ -749,7 +749,9 @@ function store_forum($values, $courseInfo = [], $returnId = false) // Forum images $has_attachment = false; $image_moved = true; - if (!empty($_FILES['picture']['name'])) { + + $maxFileSize = getIniMaxFileSizeInBytes(); + if (!empty($_FILES['picture']['name']) && !($maxFileSize > 0 && $_FILES['picture']['size'] > $maxFileSize)) { $upload_ok = process_uploaded_file($_FILES['picture']); $has_attachment = true; } @@ -822,7 +824,7 @@ function store_forum($values, $courseInfo = [], $returnId = false) // Move groups from one group to another if (isset($values['group_forum'])) { $forumData = get_forums($values['forum_id']); - $currentGroupId = $forumData['forum_of_group']; + $currentGroupId = $forumData['forum_of_group'] ?? 0; if ($currentGroupId != $values['group_forum']) { $threads = get_threads($values['forum_id']); $toGroupId = 'NULL'; @@ -2868,16 +2870,22 @@ function store_thread( $upload_ok = 1; $has_attachment = false; + $maxFileSize = getIniMaxFileSizeInBytes(); if (!empty($_FILES['user_upload']['name'])) { - $upload_ok = process_uploaded_file($_FILES['user_upload']); - $has_attachment = true; + $upload_ok = 0; + $has_attachment = false; + if ($maxFileSize > 0 && $_FILES['user_upload']['size'] <= $maxFileSize) { + $upload_ok = process_uploaded_file($_FILES['user_upload']); + $has_attachment = true; + } } if (!$upload_ok) { if ($showMessage) { + $errorUploadMessage = get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true); Display::addFlash( Display::return_message( - get_lang('UplNoFileUploaded'), + $errorUploadMessage, 'error', false ) @@ -3314,8 +3322,10 @@ function show_add_post_form($current_forum, $action, $form_values = [], $showPre null, ['id' => 'reply-add-attachment'] ); + $form->addRule('user_upload[]', get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true), 'maxfilesize', getIniMaxFileSizeInBytes()); } else { - $form->addFile('user_upload', get_lang('Attachment')); + $form->addFile('user_upload', get_lang('Attachment').' ('.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true).')'); + $form->addRule('user_upload', get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true), 'maxfilesize', getIniMaxFileSizeInBytes()); } if ($giveRevision) { @@ -3435,12 +3445,20 @@ function show_add_post_form($current_forum, $action, $form_values = [], $showPre $threadId = $myThread->getIid(); Skill::saveSkills($form, ITEM_TYPE_FORUM_THREAD, $threadId); $postId = $myThread->getThreadLastPost(); + } else { + header('Location: '.api_request_uri()); + exit; } break; case 'quote': case 'replythread': case 'replymessage': $postId = store_reply($current_forum, $values); + if (!$postId) { + header('Location: '.api_request_uri()); + exit; + } + break; } @@ -3849,6 +3867,29 @@ function store_reply($current_forum, $values, $courseId = 0, $userId = 0) $upload_ok = 1; $new_post_id = 0; + $errMessage = get_lang('UplNoFileUploaded').' '.get_lang('UplSelectFileFirst'); + $maxFileSize = getIniMaxFileSizeInBytes(); + + if (!empty($_FILES['user_upload']['name'])) { + if (is_array($_FILES['user_upload']['name'])) { + $totalFileSize = 0; + for ($i = 0; $i < count($_FILES['user_upload']['name']); $i++) { + $totalFileSize += $_FILES['user_upload']['size'][$i]; + } + if ($totalFileSize > $maxFileSize) { + $upload_ok = 0; + $errMessage = get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true); + } + } else { + if ($maxFileSize > 0 && $_FILES['user_upload']['size'] <= $maxFileSize) { + $upload_ok = process_uploaded_file($_FILES['user_upload']); + } else { + $upload_ok = 0; + $errMessage = get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true); + } + } + } + if ($upload_ok) { // We first store an entry in the forum_post table. $new_post_id = Database::insert( @@ -3954,10 +3995,12 @@ function store_reply($current_forum, $values, $courseId = 0, $userId = 0) } else { Display::addFlash( Display::return_message( - get_lang('UplNoFileUploaded').' '.get_lang('UplSelectFileFirst'), + $errMessage, 'error' ) ); + + return false; } return $new_post_id; @@ -5251,11 +5294,16 @@ function add_forum_attachment_file($file_comment, $last_id) } } + $maxFileSize = getIniMaxFileSizeInBytes(); foreach ($filesData as $attachment) { if (empty($attachment['name'])) { continue; } + if ($maxFileSize > 0 && $attachment['size'] > $maxFileSize) { + continue; + } + $upload_ok = process_uploaded_file($attachment); if (!$upload_ok) { @@ -5347,13 +5395,17 @@ function edit_forum_attachment_file($file_comment, $post_id, $id_attach) } } + $maxFileSize = getIniMaxFileSizeInBytes(); foreach ($filesData as $attachment) { if (empty($attachment['name'])) { continue; } - $upload_ok = process_uploaded_file($attachment); + if ($maxFileSize > 0 && $attachment['size'] > $maxFileSize) { + continue; + } + $upload_ok = process_uploaded_file($attachment); if (!$upload_ok) { continue; } diff --git a/main/inc/lib/fileUpload.lib.php b/main/inc/lib/fileUpload.lib.php index 69fa54b341..aea81fc7a5 100755 --- a/main/inc/lib/fileUpload.lib.php +++ b/main/inc/lib/fileUpload.lib.php @@ -2183,10 +2183,29 @@ function add_all_documents_in_folder_to_database( * * @return int */ -function getIniMaxFileSizeInBytes() +function getIniMaxFileSizeInBytes($humanReadable = false, $checkMessageSetting = false) { $maxSize = 0; - if (preg_match('/^([0-9]+)([a-zA-Z]*)$/', ini_get('upload_max_filesize'), $matches)) { + $uploadMaxFilesize = ini_get('upload_max_filesize'); + $fileSizeForTeacher = getFileUploadSizeLimitForTeacher(); + if (!empty($fileSizeForTeacher)) { + $uploadMaxFilesize = $fileSizeForTeacher.'M'; + } + + if (empty($fileSizeForTeacher) && $checkMessageSetting) { + $uploadMaxFilesize = api_get_setting('message_max_upload_filesize'); // in bytes + if ($humanReadable) { + $uploadMaxFilesize = format_file_size($uploadMaxFilesize); + } + + return $uploadMaxFilesize; + } + + if ($humanReadable) { + return $uploadMaxFilesize; + } + + if (preg_match('/^([0-9]+)([a-zA-Z]*)$/', $uploadMaxFilesize, $matches)) { // see http://www.php.net/manual/en/faq.using.php#faq.using.shorthandbytes switch (strtoupper($matches['2'])) { case 'G': @@ -2206,3 +2225,19 @@ function getIniMaxFileSizeInBytes() return $maxSize; } + +/** + * Get the uploax max filesize from configuration.php for trainers in bytes. + * + * @return int + */ +function getFileUploadSizeLimitForTeacher() +{ + $size = 0; + $settingValue = (int) api_get_configuration_value('file_upload_size_limit_for_teacher'); // setting value in MB + if ($settingValue > 0 && (api_is_allowed_to_create_course() && !api_is_platform_admin())) { + $size = $settingValue; + } + + return $size; +} diff --git a/main/inc/lib/formvalidator/Element/BigUpload.php b/main/inc/lib/formvalidator/Element/BigUpload.php index 219cbef791..73f56a88bb 100644 --- a/main/inc/lib/formvalidator/Element/BigUpload.php +++ b/main/inc/lib/formvalidator/Element/BigUpload.php @@ -26,6 +26,7 @@ class BigUpload extends HTML_QuickForm_file $origin = $this->getAttribute('data-origin'); $id = $this->getAttribute('id'); $maxSize = getIniMaxFileSizeInBytes(); + $errorUploadMessage = get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true); $html = parent::toHtml(); $html .= '
@@ -75,6 +76,8 @@ class BigUpload extends HTML_QuickForm_file bigUpload.settings.formParams = uploadForm.serialize(); //Max file size allowed bigUpload.settings.maxFileSize = "'.$maxSize.'"; + // Message error upload filesize + bigUpload.settings.errMessageFileSize = "'.$errorUploadMessage.'"; } '; diff --git a/main/inc/lib/formvalidator/FormValidator.class.php b/main/inc/lib/formvalidator/FormValidator.class.php index c790985615..3474da9713 100755 --- a/main/inc/lib/formvalidator/FormValidator.class.php +++ b/main/inc/lib/formvalidator/FormValidator.class.php @@ -1820,7 +1820,9 @@ EOT; if (!empty($urlToRedirect)) { $redirectCondition = "window.location.replace('$urlToRedirect'); "; } + $maxFileSize = getIniMaxFileSizeInBytes(); $icon = Display::return_icon('file_txt.gif'); + $errorUploadMessage = get_lang('FileSizeIsTooBig').' '.get_lang('MaxFileSize').' : '.getIniMaxFileSizeInBytes(true); $this->addHtml("