record(MODULE_ID_DOCS);
require_once 'doc_init.php';
require_once 'doc_metadata.php';
require_once 'include/lib/forcedownload.php';
require_once 'include/lib/fileDisplayLib.inc.php';
require_once 'include/lib/fileManageLib.inc.php';
require_once 'include/lib/fileUploadLib.inc.php';
require_once 'include/lib/modalboxhelper.class.php';
require_once 'include/lib/multimediahelper.class.php';
require_once 'include/lib/mediaresource.factory.php';
require_once 'modules/search/indexer.class.php';
require_once 'include/log.class.php';
require_once 'modules/drives/clouddrive.php';
$require_help = true;
$helpTopic = 'Doc';
// Used to check for quotas
$diskUsed = dir_total_space($basedir);
if (defined('COMMON_DOCUMENTS')) {
$menuTypeID = 3;
$toolName = $langCommonDocs;
$diskQuotaDocument = $diskUsed + ini_get('upload_max_filesize') * 1024 * 1024;
} elseif (defined('MY_DOCUMENTS')) {
$menuTypeID = 1;
$toolName = $langMyDocs;
if ($session->status == USER_TEACHER) {
$diskQuotaDocument = get_config('mydocs_teacher_quota') * 1024 * 1024;
} else {
$diskQuotaDocument = get_config('mydocs_student_quota') * 1024 * 1024;
}
} else {
$menuTypeID = 2;
$toolName = $langDoc;
$type = ($subsystem == GROUP) ? 'group_quota' : 'doc_quota';
$diskQuotaDocument = Database::get()->querySingle("SELECT $type AS quotatype FROM course WHERE id = ?d", $course_id)->quotatype;
}
if ($is_in_tinymce) {
$menuTypeID = 5;
$_SESSION['embedonce'] = true; // necessary for baseTheme
$docsfilter = (isset($_REQUEST['docsfilter'])) ? 'docsfilter=' . $_REQUEST['docsfilter'] . '&' : '';
$base_url .= 'embedtype=tinymce&' . $docsfilter;
load_js('jquery-' . JQUERY_VERSION . '.min');
load_js('tinymce.popup.urlgrabber.min.js');
}
load_js('tools.js');
ModalBoxHelper::loadModalBox(true);
copyright_info_init();
if (defined('EBOOK_DOCUMENTS')) {
$navigation[] = array('url' => 'edit.php?course=' . $course_code . '&id=' . $ebook_id, 'name' => $langEBookEdit);
}
if (isset($_GET['showQuota'])) {
$navigation[] = array('url' => documentBackLink(''), 'name' => $pageName);
$tool_content .= showquota($diskQuotaDocument, $diskUsed);
draw($tool_content, $menuTypeID);
exit;
}
// ---------------------------
// download directory or file
// ---------------------------
if (isset($_GET['download'])) {
$downloadDir = $_GET['download'];
if ($downloadDir == '/') {
$format = '.dir';
$real_filename = remove_filename_unsafe_chars($langDoc . ' ' . $public_code);
} else {
$q = Database::get()->querySingle("SELECT filename, format, visible, extra_path, public FROM document
WHERE $group_sql AND
path = ?s", $downloadDir);
if (!$q) {
not_found($downloadDir);
}
$real_filename = $q->filename;
$format = $q->format;
$visible = $q->visible;
$extra_path = $q->extra_path;
$public = $q->public;
if (!(resource_access($visible, $public) or (isset($status) and $status == USER_TEACHER))) {
not_found($downloadDir);
}
}
// Allow unlimited time for creating the archive
set_time_limit(0);
if ($format == '.dir') {
if (!$uid) {
forbidden($downloadDir);
}
$real_filename = $real_filename . '.zip';
$dload_filename = $webDir . '/courses/temp/' . safe_filename('zip');
zip_documents_directory($dload_filename, $downloadDir, $can_upload);
$delete = true;
} elseif ($extra_path) {
if ($real_path = common_doc_path($extra_path, true)) {
// Common document
if (!$common_doc_visible) {
forbidden($downloadDir);
}
$dload_filename = $real_path;
$delete = false;
} else {
// External document - redirect to URL
redirect($extra_path);
}
} else {
$dload_filename = $basedir . $downloadDir;
$delete = false;
}
send_file_to_client($dload_filename, $real_filename, null, true, $delete);
exit;
}
if ($can_upload) {
$fileName = '';
$error = false;
$uploaded = false;
if (isset($_POST['uploadPath'])) {
$curDirPath = $uploadPath = $_POST['uploadPath'];
} elseif (isset($_POST['editPath'])) {
$curDirPath = $uploadPath = my_dirname($_POST['editPath']);
}
// Check if upload path exists
if (!empty($uploadPath)) {
$result = Database::get()->querySingle("SELECT id FROM document
WHERE $group_sql AND path = ?s LIMIT 1", $uploadPath);
if (!$result or !$result->id) {
$error = $langImpossible;
}
}
/* ******************************************************************** *
UPLOAD FILE
* ******************************************************************** */
$action_message = $dialogBox = '';
$extra_path = '';
if (isset($_POST['fileCloudInfo']) or isset($_FILES['userFile'])) {
if (isset($_POST['fileCloudInfo'])) { // upload cloud file
$cloudfile = CloudFile::fromJSON($_POST['fileCloudInfo']);
$uploaded = true;
$fileName = $cloudfile->name();
} else if (isset($_FILES['userFile']) and is_uploaded_file($_FILES['userFile']['tmp_name'])) { // upload local file
$fileName = $_FILES['userFile']['name'];
$userFile = $_FILES['userFile']['tmp_name'];
}
validateUploadedFile($fileName, $menuTypeID); // check file type
// check for disk quotas
if ($diskUsed + @$_FILES['userFile']['size'] > $diskQuotaDocument) {
Session::Messages($langNoSpace, 'alert-danger');
redirect_to_current_dir();
} elseif (isset($_POST['uncompress']) and $_POST['uncompress'] == 1 and preg_match('/\.zip$/i', $fileName)) {
/* ** Unzipping stage ** */
$zipFile = new PclZip($userFile);
validateUploadedZipFile($zipFile->listContent(), $menuTypeID);
$realFileSize = 0;
$zipFile->extract(PCLZIP_CB_PRE_EXTRACT, 'process_extracted_file');
if ($diskUsed + $realFileSize > $diskQuotaDocument) {
Session::Messages($langNoSpace, 'alert-danger');
} else {
$session->setDocumentTimestamp($course_id);
Session::Messages($langDownloadAndZipEnd, 'alert-success');
}
redirect_to_current_dir();
} else {
$fileName = canonicalize_whitespace($fileName);
$uploaded = true;
}
} elseif (isset($_POST['fileURL']) and ($fileURL = trim($_POST['fileURL']))) {
$extra_path = canonicalize_url($fileURL);
if (preg_match('/^javascript/', $extra_path)) {
Session::Messages($langUnwantedFiletype . ': ' . q($extra_path), 'alert-danger');
redirect_to_current_dir();
} else {
$uploaded = true;
}
$components = explode('/', trim($extra_path, '/'));
$fileName = end($components);
} elseif (isset($_POST['file_content'])) {
if ($diskUsed + strlen($_POST['file_content']) > $diskQuotaDocument) {
Session::Messages($langNoSpace, 'alert-danger');
redirect_to_current_dir();
} else {
$fileName = newPageFileName($uploadPath, 'page_', '.html');
$uploaded = true;
}
}
if ($uploaded and !isset($_POST['editPath'])) {
// Check if file already exists
if (isset($fileURL)) {
$checkFileSQL = 'extra_path = ?s';
$checkFileName = $extra_path;
} else {
$checkFileSQL = 'filename = ?s';
$checkFileName = $fileName;
}
$result = Database::get()->querySingle("SELECT path, visible FROM document WHERE
$group_sql AND
path REGEXP ?s AND
$checkFileSQL LIMIT 1",
"^$uploadPath/[^/]+$", $checkFileName);
if ($result) {
if (isset($_POST['replace'])) {
// Delete old file record when replacing file
$file_path = $result->path;
$vis = $result->visible;
Database::get()->query("DELETE FROM document WHERE
$group_sql AND
path = ?s", $file_path);
} else {
$error = $langFileExists;
}
}
}
if ($error) {
Session::Messages($error, 'alert-danger');
redirect_to_current_dir();
} elseif ($uploaded) {
// No errors, so proceed with upload
// File date is current date
$file_date = date("Y\-m\-d G\:i\:s");
// Try to add an extension to files witout extension,
// change extension of PHP files
$fileName = php2phps(add_ext_on_mime($fileName));
// File name used in file system and path field
$safe_fileName = safe_filename(get_file_extension($fileName));
if ($uploadPath == '.') {
$file_path = '/' . $safe_fileName;
} else {
$file_path = $uploadPath . '/' . $safe_fileName;
}
$fileUploadOK = false;
if (isset($cloudfile)) {
$fileUploadOK = ($cloudfile->storeToLocalFile($basedir . $file_path) == CloudDriveResponse::OK);
} elseif (isset($userFile)) {
$fileUploadOK = @copy($userFile, $basedir . $file_path);
}
require_once 'modules/admin/extconfig/externals.php';
$connector = AntivirusApp::getAntivirus();
if($connector->isEnabled() == true ){
$output=$connector->check($basedir . $file_path);
if($output->status==$output::STATUS_INFECTED){
AntivirusApp::block($output->output);
}
}
if ($extra_path or $fileUploadOK) {
$vis = 1;
$file_format = get_file_extension($fileName);
$id = Database::get()->query("INSERT INTO document SET
course_id = ?d,
subsystem = ?d,
subsystem_id = ?d,
path = ?s,
extra_path = ?s,
filename = ?s,
visible = ?d,
comment = ?s,
category = ?d,
title = ?s,
creator = ?s,
date = ?t,
date_modified = ?t,
subject = ?s,
description = ?s,
author = ?s,
format = ?s,
language = ?s,
copyrighted = ?d"
, $course_id, $subsystem, $subsystem_id, $file_path, $extra_path, $fileName, $vis
, $_POST['file_comment'], $_POST['file_category'], $_POST['file_title'], $_POST['file_creator']
, $file_date, $file_date, $_POST['file_subject'], $_POST['file_description'], $_POST['file_author']
, $file_format, $_POST['file_language'], $_POST['file_copyrighted'])->lastInsertID;
Indexer::queueAsync(Indexer::REQUEST_STORE, Indexer::RESOURCE_DOCUMENT, $id);
// Logging
Log::record($course_id, MODULE_ID_DOCS, LOG_INSERT, array('id' => $id,
'filepath' => $file_path,
'filename' => $fileName,
'comment' => $_POST['file_comment'],
'title' => $_POST['file_title']));
Session::Messages($langDownloadEnd, 'alert-success');
$session->setDocumentTimestamp($course_id);
redirect_to_current_dir();
} elseif (isset($_POST['file_content'])) {
$v = new Valitron\Validator($_POST);
$v->rule('required', array('file_title'));
$v->labels(array(
'file_title' => "$langTheField $langTitle"
));
if($v->validate()) {
$q = false;
if (isset($_POST['editPath'])) {
$fileInfo = Database::get()->querySingle("SELECT * FROM document
WHERE $group_sql AND path = ?s", $_POST['editPath']);
if ($fileInfo->editable) {
$file_path = $fileInfo->path;
$q = Database::get()->query("UPDATE document
SET date_modified = NOW(), title = ?s
WHERE $group_sql AND path = ?s",
$_POST['file_title'], $_POST['editPath']);
$id = $fileInfo->id;
$fileName = $fileInfo->filename;
}
} else {
$safe_fileName = safe_filename(get_file_extension($fileName));
$file_path = $uploadPath . '/' . $safe_fileName;
$file_date = date("Y\-m\-d G\:i\:s");
$file_format = get_file_extension($fileName);
$file_creator = "$_SESSION[givenname] $_SESSION[surname]";
$q = Database::get()->query("INSERT INTO document SET
course_id = ?d,
subsystem = ?d,
subsystem_id = ?d,
path = ?s,
extra_path = '',
filename = ?s,
visible = 1,
comment = '',
category = 0,
title = ?s,
creator = ?s,
date = ?s,
date_modified = ?s,
subject = '',
description = '',
author = ?s,
format = ?s,
language = ?s,
copyrighted = 0,
editable = 1",
$course_id, $subsystem, $subsystem_id, $file_path,
$fileName, $_POST['file_title'], $file_creator,
$file_date, $file_date, $file_creator, $file_format,
$language);
}
if ($q) {
if (!isset($id)) {
$id = $q->lastInsertID;
$log_action = LOG_INSERT;
} else {
$log_action = LOG_MODIFY;
}
$ebookSectionTitle = $_POST['file_title'] ? $_POST['file_title'] : $fileName;
if (isset($_GET['ebook_id']) && isset($_POST['section_id'])){
if(isset($_POST['editPath'])){
Database::get()->query("UPDATE ebook_subsection
SET section_id = ?s, title = ?s WHERE file_id = ?d",
$_POST['section_id'], $ebookSectionTitle, $id);
} else {
$subsectionOrder = Database::get()->querySingle("SELECT COALESCE(MAX(public_id), 0) + 1
FROM ebook_subsection WHERE section_id = ?d", $_POST['section_id']);
Database::get()->query("INSERT INTO ebook_subsection
SET section_id = ?s, file_id = ?d, title = ?s, public_id = ?s",
$_POST['section_id'], $id, $ebookSectionTitle, $subsectionOrder);
}
}
Log::record($course_id, MODULE_ID_DOCS, $log_action,
array('id' => $id,
'filepath' => $file_path,
'filename' => $fileName,
'title' => $_POST['file_title']));
$title = $_POST['file_title']? $_POST['file_title']: $fileName;
file_put_contents($basedir . $file_path,
"\n" .
"\n" .
" \n" .
' ' . q($title) . "\n\n\n" .
purify($_POST['file_content']) .
"\n\n