diff --git a/documentation/changelog.html b/documentation/changelog.html index 767de1217f..b0106a9fa1 100755 --- a/documentation/changelog.html +++ b/documentation/changelog.html @@ -111,6 +111,29 @@
+
+ + +

Chamilo 1.11.8 - ??????, ??/??/????

+

Release notes - summary

+

Chamilo 1.11.8 is a minor, bugfix release on top of 1.11.6.

+

Release name

+

?????????????

+

Security fixes

+

Possibly breaking changes

+

Notable new Features

+

For end-users, teachers and Chamilo admins

+

For developers and sysadmins

+ +

Improvements (minor features) and debug

+

Stylesheets and theming

+

Web services

+

Removals

+

Known issues

+
+
@@ -127,9 +150,10 @@ -

Notable new Features

+

Notable new Features

.

For end-users, teachers and Chamilo admins

'; diff --git a/main/work/download.php b/main/work/download.php index 7d9be0f18f..b3dd9d8ea6 100755 --- a/main/work/download.php +++ b/main/work/download.php @@ -18,17 +18,16 @@ $this_section = SECTION_COURSES; // Course protection api_protect_course_script(true); -$id = intval($_GET['id']); - +$id = isset($_GET['id']) ? (int) $_GET['id'] : 0; $courseInfo = api_get_course_info(); -if (empty($courseInfo)) { +if (empty($courseInfo) || empty($id)) { api_not_allowed(true); } $correction = isset($_REQUEST['correction']) ? true : false; $result = downloadFile($id, $courseInfo, $correction); -if ($result == false) { +if ($result === false) { api_not_allowed(true); } diff --git a/main/work/downloadfolder.inc.php b/main/work/downloadfolder.inc.php index daee244402..cf7060c4a9 100755 --- a/main/work/downloadfolder.inc.php +++ b/main/work/downloadfolder.inc.php @@ -8,21 +8,26 @@ * * @package chamilo.work */ -$work_id = $_GET['id']; require_once __DIR__.'/../inc/global.inc.php'; + +api_protect_course_script(true); + +$workId = isset($_GET['id']) ? (int) $_GET['id'] : 0; + $current_course_tool = TOOL_STUDENTPUBLICATION; $_course = api_get_course_info(); -// Protection -api_protect_course_script(true); +if (empty($_course)) { + api_not_allowed(); +} require_once 'work.lib.php'; -$work_data = get_work_data_by_id($work_id); +$work_data = get_work_data_by_id($workId); $groupId = api_get_group_id(); if (empty($work_data)) { - exit; + api_not_allowed(); } // Prevent some stuff. @@ -87,7 +92,7 @@ if (api_is_allowed_to_edit() || api_is_coach()) { props.tool = 'work' AND props.c_id = $course_id AND work.c_id = $course_id AND - work.parent_id = $work_id AND + work.parent_id = $workId AND work.filetype = 'file' AND props.visibility <> '2' AND work.active IN (0, 1) AND @@ -96,9 +101,8 @@ if (api_is_allowed_to_edit() || api_is_coach()) { "; } else { $courseInfo = api_get_course_info(); - protectWork($courseInfo, $work_id); - - $userCondition = null; + protectWork($courseInfo, $workId); + $userCondition = ''; // All users if ($courseInfo['show_score'] == 0) { @@ -129,7 +133,7 @@ if (api_is_allowed_to_edit() || api_is_coach()) { props.tool = 'work' AND work.accepted = 1 AND work.active = 1 AND - work.parent_id = $work_id AND + work.parent_id = $workId AND work.filetype = 'file' AND props.visibility = '1' AND work.post_group_id = $groupIid @@ -140,7 +144,7 @@ $query = Database::query($sql); //add tem to the zip file while ($not_deleted_file = Database::fetch_assoc($query)) { - $user_info = api_get_user_info($not_deleted_file['insert_user_id']); + $userInfo = api_get_user_info($not_deleted_file['insert_user_id']); $insert_date = api_get_local_time($not_deleted_file['sent_date']); $insert_date = str_replace([':', '-', ' '], '_', $insert_date); @@ -150,8 +154,8 @@ while ($not_deleted_file = Database::fetch_assoc($query)) { $title = $not_deleted_file['filename']; } } - - $filename = $insert_date.'_'.$user_info['username'].'_'.$title; + $filename = $insert_date.'_'.$userInfo['username'].'_'.$title; + $filename = api_replace_dangerous_char($filename); // File exists if (file_exists($sys_course_path.$_course['path'].'/'.$not_deleted_file['url']) && !empty($not_deleted_file['url']) @@ -198,8 +202,7 @@ if (!empty($files)) { exit; } -/* Extra function (only used here) */ - +/* Extra function (only used here) */ function my_pre_add_callback($p_event, &$p_header) { global $files; diff --git a/main/work/upload_corrections.php b/main/work/upload_corrections.php index 70275597d7..b50edae755 100644 --- a/main/work/upload_corrections.php +++ b/main/work/upload_corrections.php @@ -13,7 +13,7 @@ require_once 'work.lib.php'; $this_section = SECTION_COURSES; -$workId = isset($_REQUEST['id']) ? intval($_REQUEST['id']) : null; +$workId = isset($_REQUEST['id']) ? (int) $_REQUEST['id'] : 0; $is_allowed_to_edit = api_is_allowed_to_edit(); $course_id = api_get_course_int_id(); @@ -29,9 +29,12 @@ if (empty($workId)) { } protectWork($courseInfo, $workId); - $workInfo = get_work_data_by_id($workId); +if (empty($workInfo)) { + api_not_allowed(true); +} + $student_can_edit_in_session = api_is_allowed_to_session_edit(false, true); $homework = get_work_assignment_by_id($workInfo['id']); @@ -102,7 +105,7 @@ if ($form->validate()) { $destinationDir = api_get_path(SYS_ARCHIVE_PATH).$folder; mkdir($destinationDir, api_get_permissions_for_new_directories(), true); - /* Uncompress zip file*/ + // Uncompress zip file // We extract using a callback function that "cleans" the path $result = $zip->extract( PCLZIP_OPT_PATH, diff --git a/main/work/work.lib.php b/main/work/work.lib.php index 9f5d75a762..367d094f2c 100755 --- a/main/work/work.lib.php +++ b/main/work/work.lib.php @@ -47,12 +47,12 @@ function displayWorkActionLinks($id, $action, $isTutor) if (empty($id)) { $output .= ''; $output .= Display::return_icon( - 'new_work.png', - get_lang('CreateAssignment'), - '', - ICON_SIZE_MEDIUM - ). - ''; + 'new_work.png', + get_lang('CreateAssignment'), + '', + ICON_SIZE_MEDIUM + ); + $output .= ''; } } @@ -77,18 +77,6 @@ function displayWorkActionLinks($id, $action, $isTutor) ''; } - if (api_is_allowed_to_edit(null, true) && - $origin != 'learnpath' && - api_is_allowed_to_session_edit(false, true) - ) { - // Delete all files - if (api_get_setting('permanently_remove_deleted_files') == 'true') { - $message = get_lang('ConfirmYourChoiceDeleteAllfiles'); - } else { - $message = get_lang('ConfirmYourChoice'); - } - } - if ($output != '') { echo '
'; echo $output; @@ -108,9 +96,8 @@ function displayWorkActionLinks($id, $action, $isTutor) */ function settingsForm($defaults) { - $is_allowed_to_edit = api_is_allowed_to_edit(null, true); - - if (!$is_allowed_to_edit) { + $allowed = api_is_allowed_to_edit(null, true); + if (!$allowed) { return; } @@ -150,8 +137,8 @@ function get_work_data_by_path($path, $courseId = 0) $courseId = api_get_course_int_id(); } - $work_table = Database::get_course_table(TABLE_STUDENT_PUBLICATION); - $sql = "SELECT * FROM ".$work_table." + $table = Database::get_course_table(TABLE_STUDENT_PUBLICATION); + $sql = "SELECT * FROM $table WHERE url = '$path' AND c_id = $courseId "; $result = Database::query($sql); $return = []; @@ -178,7 +165,7 @@ function get_work_data_by_id($id, $courseId = 0, $sessionId = 0) } $table = Database::get_course_table(TABLE_STUDENT_PUBLICATION); - $sessionCondition = null; + $sessionCondition = ''; if (!empty($sessionId)) { $sessionCondition = api_get_session_condition($sessionId, true); } @@ -257,15 +244,13 @@ function get_work_count_by_student($user_id, $work_id) * * @return array */ -function get_work_assignment_by_id($id, $courseId = null) +function get_work_assignment_by_id($id, $courseId = 0) { + $courseId = intval($courseId); if (empty($courseId)) { $courseId = api_get_course_int_id(); - } else { - $courseId = intval($courseId); } $id = intval($id); - $table = Database::get_course_table(TABLE_STUDENT_PUBLICATION_ASSIGNMENT); $sql = "SELECT * FROM $table WHERE c_id = $courseId AND publication_id = $id"; @@ -299,11 +284,12 @@ function getWorkList($id, $my_folder_data, $add_in_where_query = null, $course_i $groupIid = 0; if ($group_id) { $groupInfo = GroupManager::get_group_properties($group_id); - $groupIid = $groupInfo['iid']; + if ($groupInfo) { + $groupIid = $groupInfo['iid']; + } } $is_allowed_to_edit = api_is_allowed_to_edit(null, true); - $linkInfo = GradebookUtils::isResourceInCourseGradebook( api_get_course_id(), 3, @@ -326,7 +312,6 @@ function getWorkList($id, $my_folder_data, $add_in_where_query = null, $course_i } $contains_file_query = ''; - // Get list from database if ($is_allowed_to_edit) { $active_condition = ' active IN (0, 1)'; @@ -604,9 +589,6 @@ function showTeacherWorkGrid() ['name' => 'amount', 'index' => 'amount', 'width' => '110', 'align' => 'center', 'sortable' => 'false'], ['name' => 'actions', 'index' => 'actions', 'width' => '110', 'align' => 'left', 'sortable' => 'false'], ]; - - $token = null; - $url = api_get_path(WEB_AJAX_PATH).'model.ajax.php?a=get_work_teacher&'.api_get_cidreq(); $deleteUrl = api_get_path(WEB_AJAX_PATH).'work.ajax.php?a=delete_work&'.api_get_cidreq(); @@ -659,7 +641,8 @@ function showTeacherWorkGrid() function build_work_directory_selector($folders, $curdirpath, $group_dir = '') { $form = ''; - $form .= get_lang('CurrentDirectory').' '; //group documents cannot be uploaded in the root if ($group_dir == '') { $form .= ''; @@ -686,7 +669,7 @@ function build_work_directory_selector($folders, $curdirpath, $group_dir = '') } /** - * Builds the form thats enables the user to + * Builds the form that enables the user to * move a document from one directory to another * This function has been copied from the document/document.inc.php library. * @@ -718,19 +701,18 @@ function build_work_move_to_selector($folders, $curdirpath, $move_file, $group_d $form->addHidden('item_id', $move_file); $form->addHidden('action', 'move_to'); - //group documents cannot be uploaded in the root + // Group documents cannot be uploaded in the root if ($group_dir == '') { - if ($curdirpath != '/') { - //$form .= ''; - } if (is_array($folders)) { foreach ($folders as $fid => $folder) { //you cannot move a file to: //1. current directory //2. inside the folder you want to move //3. inside a subfolder of the folder you want to move - if (($curdirpath != $folder) && ($folder != $move_file) && (substr($folder, 0, strlen($move_file) + 1) != $move_file.'/')) { - //$form .= ''; + if (($curdirpath != $folder) && + ($folder != $move_file) && + (substr($folder, 0, strlen($move_file) + 1) != $move_file.'/') + ) { $options[$fid] = $folder; } } @@ -740,7 +722,9 @@ function build_work_move_to_selector($folders, $curdirpath, $move_file, $group_d $form .= ''; } foreach ($folders as $fid => $folder) { - if (($curdirpath != $folder) && ($folder != $move_file) && (substr($folder, 0, strlen($move_file) + 1) != $move_file.'/')) { + if (($curdirpath != $folder) && ($folder != $move_file) && + (substr($folder, 0, strlen($move_file) + 1) != $move_file.'/') + ) { //cannot copy dir into his own subdir $display_folder = substr($folder, strlen($group_dir)); $display_folder = ($display_folder == '') ? '/ ('.get_lang('Root').')' : $display_folder; @@ -812,18 +796,15 @@ function deleteDirWork($id) $base_work_dir = api_get_path(SYS_COURSE_PATH).$_course['path'].'/work'; $work_data_url = $base_work_dir.$work_data['url']; $check = Security::check_abs_path($work_data_url.'/', $base_work_dir.'/'); - $table = Database::get_course_table(TABLE_STUDENT_PUBLICATION); $TSTDPUBASG = Database::get_course_table(TABLE_STUDENT_PUBLICATION_ASSIGNMENT); $t_agenda = Database::get_course_table(TABLE_AGENDA); - $course_id = api_get_course_int_id(); $sessionId = api_get_session_id(); if (!empty($work_data['url'])) { if ($check) { $consideredWorkingTime = api_get_configuration_value('considered_working_time'); - if (!empty($consideredWorkingTime)) { $fieldValue = new ExtraFieldValue('work'); $resultExtra = $fieldValue->getAllValuesForAnItem( @@ -832,7 +813,6 @@ function deleteDirWork($id) ); $workingTime = null; - foreach ($resultExtra as $field) { $field = $field['value']; if ($consideredWorkingTime == $field->getField()->getVariable()) { @@ -843,7 +823,6 @@ function deleteDirWork($id) } $courseUsers = CourseManager::get_user_list_from_course_code($_course['code'], $sessionId); - if (!empty($workingTime)) { foreach ($courseUsers as $user) { $userWorks = get_work_user_list( @@ -862,7 +841,6 @@ function deleteDirWork($id) if (count($userWorks) != 1) { continue; } - Event::eventRemoveVirtualCourseTime($course_id, $user['user_id'], $sessionId, $workingTime); } } @@ -919,14 +897,14 @@ function deleteDirWork($id) $sessionId ); - $link_info = GradebookUtils::isResourceInCourseGradebook( + $linkInfo = GradebookUtils::isResourceInCourseGradebook( api_get_course_id(), 3, $id, api_get_session_id() ); - $link_id = $link_info['id']; - if ($link_info !== false) { + $link_id = $linkInfo['id']; + if ($linkInfo !== false) { GradebookUtils::remove_resource_from_course_gradebook($link_id); } @@ -1031,151 +1009,6 @@ function updateDirName($work_data, $newPath) } } -/** - * Return an array with all the folder's ids that are in the given path. - * - * @param string Path of the directory - * - * @return array The list of ids of all the directories in the path - * - * @author Julio Montoya - * - * @version April 2008 - */ -function get_parent_directories($id) -{ - $course_id = api_get_course_int_id(); - $em = Database::getManager(); - - $directories = $em - ->getRepository('ChamiloCourseBundle:CStudentPublication') - ->findBy([ - 'cId' => $course_id, - 'parentId' => $id, - ]); - - $list_id = []; - foreach ($directories as $directory) { - $list_id[] = $directory->getId(); - } - - return $list_id; -} - -/** - * Transform an all directory structure (only directories) in an array. - * - * @param string path of the directory - * - * @return array the directory structure into an array - * - * @author Julio Montoya - * - * @version April 2008 - */ -function directory_to_array($directory) -{ - $array_items = []; - if ($handle = @opendir($directory)) { - while (false !== ($file = readdir($handle))) { - if ($file != '.' && $file != '..') { - if (is_dir($directory.'/'.$file)) { - $array_items = array_merge($array_items, directory_to_array($directory.'/'.$file)); - $file = $directory.'/'.$file; - $array_items[] = preg_replace("/\/\//si", '/', $file); - } - } - } - closedir($handle); - } - - return $array_items; -} - -/** - * Insert into the DB of the course all the directories. - * - * @param string $base_work_dir path of the /work directory of the course - * - * @return mixed Int -1 on error, sql query result on success - * - * @author Julio Montoya - * - * @version April 2008 - */ -function insert_all_directory_in_course_table($base_work_dir) -{ - $dir_to_array = directory_to_array($base_work_dir, true); - $only_dir = []; - - for ($i = 0; $i < count($dir_to_array); $i++) { - $only_dir[] = substr($dir_to_array[$i], strlen($base_work_dir), strlen($dir_to_array[$i])); - } - $course_id = api_get_course_int_id(); - $group_id = api_get_group_id(); - $work_table = Database::get_course_table(TABLE_STUDENT_PUBLICATION); - $groupIid = 0; - if ($group_id) { - $groupInfo = GroupManager::get_group_properties($group_id); - $groupIid = $groupInfo['iid']; - } - - for ($i = 0; $i < count($only_dir); $i++) { - $url = $only_dir[$i]; - - $params = [ - 'c_id' => $course_id, - 'url' => $url, - 'title' => '', - 'description' => '', - 'author' => '', - 'active' => '1', - 'accepted' => '1', - 'filetype' => 'folder', - 'post_group_id' => $groupIid, - ]; - - Database::insert($work_table, $params); - } -} -/** - * This function displays the number of files contained in a directory. - * - * @param string the path of the directory - * @param bool true if we want the total quantity of files - * include in others child directories, false only files in the directory - * - * @return array the first element is an integer with the number of files - * in the folder, the second element is the number of directories - * - * @author Julio Montoya - * - * @version April 2008 - */ -function count_dir($path_dir, $recurse) -{ - $count = 0; - $count_dir = 0; - $d = dir($path_dir); - while ($entry = $d->Read()) { - if (!(($entry == '..') || ($entry == '.'))) { - if (is_dir($path_dir.'/'.$entry)) { - $count_dir++; - if ($recurse) { - $count += count_dir($path_dir.'/'.$entry, $recurse); - } - } else { - $count++; - } - } - } - $return_array = []; - $return_array[] = $count; - $return_array[] = $count_dir; - - return $return_array; -} - /** * returns all the javascript that is required for easily * validation when you create a work @@ -1183,11 +1016,9 @@ function count_dir($path_dir, $recurse) */ function to_javascript_work() { - $js = ' '; $content .= getAllDocumentsFromWorkToString($workId, $courseInfo); - $tableWork = Display::grid_html('results'); $content .= Display::panel($tableWork); } diff --git a/main/work/work_list_all.php b/main/work/work_list_all.php index 3e71a4070f..0db30ba4b9 100755 --- a/main/work/work_list_all.php +++ b/main/work/work_list_all.php @@ -124,7 +124,7 @@ switch ($action) { exit; break; case 'make_visible': - /* Visible */ + /* Visible */ if ($is_allowed_to_edit) { if (!empty($itemId)) { if (isset($itemId) && $itemId == 'all') { @@ -138,7 +138,7 @@ switch ($action) { } break; case 'make_invisible': - /* Invisible */ + /* Invisible */ if (!empty($itemId)) { if (isset($itemId) && $itemId == 'all') { } else { @@ -370,7 +370,6 @@ echo $documentsAddedInWork; $tableWork = Display::grid_html('results'); echo workGetExtraFieldData($workId); - echo Display::panel($tableWork); echo '
'; diff --git a/main/work/work_list_others.php b/main/work/work_list_others.php index 46f8f3bd07..934e734c95 100755 --- a/main/work/work_list_others.php +++ b/main/work/work_list_others.php @@ -37,7 +37,7 @@ protectWork($courseInfo, $workId); $htmlHeadXtra[] = api_get_jqgrid_js(); if (!empty($group_id)) { - $group_properties = GroupManager :: get_group_properties($group_id); + $group_properties = GroupManager::get_group_properties($group_id); $show_work = false; if (api_is_allowed_to_edit(false, true)) { @@ -82,7 +82,8 @@ echo ''. - Display::return_icon('exercice_uncheck.png', get_lang('ViewUsersWithoutTask'), '', ICON_SIZE_MEDIUM).""; + Display::return_icon('exercice_uncheck.png', get_lang('ViewUsersWithoutTask'), '', ICON_SIZE_MEDIUM). + ""; } else { if (!isset($_GET['action']) || (isset($_GET['action']) && $_GET['action'] != 'send_mail')) { $output .= ''. - Display::return_icon('mail_send.png', get_lang('ReminderMessage'), '', ICON_SIZE_MEDIUM).""; + Display::return_icon('mail_send.png', get_lang('ReminderMessage'), '', ICON_SIZE_MEDIUM). + ""; } else { $output .= Display::return_icon('mail_send_na.png', get_lang('ReminderMessage'), '', ICON_SIZE_MEDIUM); }