forked from moodle/moodle
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
new handling of uploaded files, please TEST, TEST, TEST
- Loading branch information
skodak
committed
Dec 14, 2004
1 parent
93c7d6d
commit e7f927a
Showing
9 changed files
with
377 additions
and
394 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,111 +1,114 @@ | ||
| <?php | ||
|
|
||
| /** | ||
| * file.php - Used to fetch file from the data directory | ||
| * | ||
| * This script file fetches files from the data directory (dataroot)<br> | ||
| * Syntax: file.php/courseid/dir/.../dir/filename.ext | ||
| * | ||
| * @uses $CFG | ||
| * @uses FORMAT_HTML | ||
| * @uses FORMAT_MOODLE | ||
| * @author Martin Dougiamas | ||
| * @version $Id$ | ||
| * @package moodlecore | ||
| */ | ||
|
|
||
| <?php // $Id$ | ||
| // This script fetches files from the dataroot directory | ||
| // Syntax: file.php/courseid/dir/dir/dir/filename.ext | ||
| // file.php/courseid/dir (returns index.html from dir) | ||
| // Workaround: file.php?file=/courseid/dir/dir/dir/filename.ext | ||
| // Test: file.php/test | ||
|
|
||
| require_once('config.php'); | ||
| require_once('files/mimetypes.php'); | ||
|
|
||
| if (empty($CFG->filelifetime)) { | ||
| $CFG->filelifetime = 86400; /// Seconds for files to remain in caches | ||
| } | ||
|
|
||
| if (isset($file)) { // workaround for situations where / syntax doesn't work | ||
| $pathinfo = $file; | ||
| $lifetime = 86400; // Seconds for files to remain in caches | ||
| } else { | ||
| $pathinfo = get_slash_arguments('file.php'); | ||
| $lifetime = $CFG->filelifetime; | ||
| } | ||
|
|
||
|
|
||
| if (!$pathinfo) { | ||
| error('No file parameters!'); | ||
| $relativepath = get_file_argument('file.php'); | ||
|
|
||
| // relative path must start with '/', because of backup/restore!!! | ||
| if (!$relativepath) { | ||
| error('No valid arguments supplied or incorrect server configuration'); | ||
| } else if ($relativepath{0} != '/') { | ||
| error('No valid arguments supplied, path does not start with slash!'); | ||
| } | ||
|
|
||
| $pathinfo = urldecode($pathinfo); | ||
| $pathname = $CFG->dataroot.$relativepath; | ||
|
|
||
| if (! $args = parse_slash_arguments($pathinfo)) { | ||
| // extract relative path components | ||
| $args = explode('/', trim($relativepath, '/')); | ||
| if (count($args) == 0) { // always at least courseid, may search for index.html in course root | ||
| error('No valid arguments supplied'); | ||
| } | ||
|
|
||
| $numargs = count($args); | ||
| if ($numargs < 2 or empty($args[1])) { | ||
| error('No valid arguments supplied'); | ||
| // security: limit access to existing course subdirectories | ||
| // note: course ID must be specified | ||
| // note: the lang field is needed for the course language switching hack in weblib.php | ||
| if (!$course = get_record_sql("SELECT id, lang FROM {$CFG->prefix}course WHERE id='".(int)$args[0]."'")) { | ||
| error('Invalid course ID'); | ||
| } | ||
|
|
||
| $courseid = (integer)$args[0]; | ||
|
|
||
| if (!$course = get_record('course', 'id', $courseid)) { // Course ID must be specified | ||
| // security: prevent access to "000" or "1 something" directories | ||
| if ($args[0] != $course->id) { | ||
| error('Invalid course ID'); | ||
| } | ||
|
|
||
| if ($course->category) { | ||
| require_login($courseid); | ||
| // security: login to course if necessary | ||
| if ($course->id != SITEID) { | ||
| require_login($course->id); | ||
| } else if ($CFG->forcelogin) { | ||
| require_login(); | ||
| } | ||
|
|
||
| $pathname = $CFG->dataroot . $pathinfo; | ||
| if ($pathargs = explode('?', $pathname)) { | ||
| $pathname = $pathargs[0]; // Only keep what's before the '?' | ||
| } | ||
| $filename = $args[$numargs-1]; | ||
| if ($fileargs = explode('?', $filename)) { | ||
| $filename = $fileargs[0]; // Only keep what's before the '?' | ||
| } | ||
| // security: only editing teachers can access backups | ||
| if ((!isteacheredit($course->id)) | ||
| and (count($args) >= 2) | ||
| and (strtolower($args[1]) == 'backupdata')) { | ||
|
|
||
| if (file_exists($pathname)) { | ||
| $lastmodified = filemtime($pathname); | ||
| $mimetype = mimeinfo('type', $filename); | ||
| error('Access not allowed'); | ||
| } | ||
|
|
||
| header('Last-Modified: ' . gmdate("D, d M Y H:i:s", $lastmodified) . ' GMT'); | ||
| header('Expires: ' . gmdate("D, d M Y H:i:s", time() + $CFG->filelifetime) . ' GMT'); | ||
| header('Cache-control: max_age = '. $CFG->filelifetime); | ||
| header('Pragma: '); | ||
| header('Content-disposition: inline; filename='. $filename); | ||
| // security: teachers can view all assignments, students only their own | ||
| if ((count($args) >= 3) | ||
| and (strtolower($args[1]) == 'moddata') | ||
| and (strtolower($args[2]) == 'assignment')) { | ||
|
|
||
| $lifetime = 0; // do not cache assignments, students may reupload them | ||
| if ((!isteacher($course->id)) && (count($args) != 6 || $args[4] != $USER->id)) { | ||
| error('Access not allowed'); | ||
| } | ||
| } | ||
|
|
||
| if (empty($CFG->filteruploadedfiles)) { | ||
| header('Content-length: '. filesize($pathname)); | ||
| header('Content-type: '. $mimetype); | ||
| readfile($pathname); | ||
| if (is_dir($pathname)) { | ||
| if (file_exists($pathname.'/index.html')) { | ||
| $pathname = rtrim($pathname, '/').'/index.html'; | ||
| $args[] = 'index.html'; | ||
| } else if (file_exists($pathname.'/index.htm')) { | ||
| $pathname = rtrim($pathname, '/').'/index.htm'; | ||
| $args[] = 'index.htm'; | ||
| } else if (file_exists($pathname.'/Default.htm')) { | ||
| $pathname = rtrim($pathname, '/').'/Default.htm'; | ||
| $args[] = 'Default.htm'; | ||
| } else { | ||
| // security: do not return directory node! | ||
| not_found($course->id); | ||
| } | ||
| } | ||
|
|
||
| } else { /// Try and put the file through filters | ||
| if ($mimetype == 'text/html') { | ||
| $options->noclean = true; | ||
| $output = format_text(implode('', file($pathname)), FORMAT_HTML, $options, $courseid); | ||
| // check that file exists | ||
| if (!file_exists($pathname)) { | ||
| not_found($course->id); | ||
| } | ||
|
|
||
| header('Content-length: '. strlen($output)); | ||
| header('Content-type: text/html'); | ||
| echo $output; | ||
|
|
||
| } else if ($mimetype == 'text/plain') { | ||
| $options->newlines = false; | ||
| $options->noclean = true; | ||
| $output = '<pre>'. format_text(implode('', file($pathname)), FORMAT_MOODLE, $options, $courseid) .'</pre>'; | ||
| header('Content-length: '. strlen($output)); | ||
| header('Content-type: text/html'); | ||
| echo $output; | ||
|
|
||
| } else { /// Just send it out raw | ||
| header('Content-length: '. filesize($pathname)); | ||
| header('Content-type: '. $mimetype); | ||
| readfile($pathname); | ||
| } | ||
| // extra security: keep symbolic links inside dataroot/courseid if required | ||
| /*if (!empty($CFG->checksymlinks)) { | ||
| $realpath = realpath($pathname); | ||
| $realdataroot = realpath($CFG->dataroot.'/'.$course->id); | ||
| if (strpos($realpath, $realdataroot) !== 0) { | ||
| not_found($course->id); | ||
| } | ||
| } else { | ||
| }*/ | ||
|
|
||
| // ======================================== | ||
| // finally send the file | ||
| // ======================================== | ||
| $filename = $args[count($args)-1]; | ||
| send_file($pathname, $filename, $lifetime, !empty($CFG->filteruploadedfiles)); | ||
|
|
||
| function not_found($courseid) { | ||
| global $CFG; | ||
| header('HTTP/1.0 404 not found'); | ||
| error(get_string('filenotfound', 'error'), $CFG->wwwroot .'/course/view.php?id='. $courseid); | ||
| error(get_string('filenotfound', 'error'), $CFG->wwwroot.'/course/view.php?id='.$courseid); //this is not displayed on IIS?? | ||
| } | ||
|
|
||
| exit; | ||
| ?> | ||
| ?> |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.