actions_linkedfiles.inc.php 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288
  1. <?php
  2. /* Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr>
  3. * Copyright (C) 2015 Marcos García <marcosgdf@gmail.com>
  4. * Copyright (C) 2015 Ferran Marcet <fmarcet@2byte.es>
  5. *
  6. * This program is free software; you can redistribute it and/or modify
  7. * it under the terms of the GNU General Public License as published by
  8. * the Free Software Foundation; either version 3 of the License, or
  9. * (at your option) any later version.
  10. *
  11. * This program is distributed in the hope that it will be useful,
  12. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14. * GNU General Public License for more details.
  15. *
  16. * You should have received a copy of the GNU General Public License
  17. * along with this program. If not, see <https://www.gnu.org/licenses/>.
  18. * or see https://www.gnu.org/
  19. */
  20. // Variable $upload_dir must be defined when entering here.
  21. // Variable $upload_dirold may also exists.
  22. // Variable $confirm must be defined.
  23. // If variable $permissiontoadd is defined, we check it is true. Note: A test on permission should already have been done into the restrictedArea() method called by parent page.
  24. //var_dump($upload_dir);
  25. //var_dump($upload_dirold);
  26. // Protection to understand what happen when submitting files larger than post_max_size
  27. if (GETPOST('uploadform', 'int') && empty($_POST) && empty($_FILES)) {
  28. dol_syslog("The PHP parameter 'post_max_size' is too low. All POST parameters and FILES were set to empty.");
  29. $langs->loadLangs(array("errors", "install"));
  30. print $langs->trans("ErrorFileSizeTooLarge").' ';
  31. print $langs->trans("ErrorGoBackAndCorrectParameters");
  32. die;
  33. }
  34. if ((GETPOST('sendit', 'alpha')
  35. || GETPOST('linkit', 'restricthtml')
  36. || ($action == 'confirm_deletefile' && $confirm == 'yes')
  37. || ($action == 'confirm_updateline' && GETPOST('save', 'alpha') && GETPOST('link', 'alpha'))
  38. || ($action == 'renamefile' && GETPOST('renamefilesave', 'alpha'))) && empty($permissiontoadd)) {
  39. dol_syslog('The file actions_linkedfiles.inc.php was included but paramater $permissiontoadd as not set before.');
  40. print 'The file actions_linkedfiles.inc.php was included but paramater $permissiontoadd as not set before.';
  41. die;
  42. }
  43. // Submit file/link
  44. if (GETPOST('sendit', 'alpha') && !empty($conf->global->MAIN_UPLOAD_DOC) && !empty($permissiontoadd)) {
  45. if (!empty($_FILES)) {
  46. if (is_array($_FILES['userfile']['tmp_name'])) {
  47. $userfiles = $_FILES['userfile']['tmp_name'];
  48. } else {
  49. $userfiles = array($_FILES['userfile']['tmp_name']);
  50. }
  51. foreach ($userfiles as $key => $userfile) {
  52. if (empty($_FILES['userfile']['tmp_name'][$key])) {
  53. $error++;
  54. if ($_FILES['userfile']['error'][$key] == 1 || $_FILES['userfile']['error'][$key] == 2) {
  55. setEventMessages($langs->trans('ErrorFileSizeTooLarge'), null, 'errors');
  56. } else {
  57. setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("File")), null, 'errors');
  58. }
  59. }
  60. if (preg_match('/__.*__/', $_FILES['userfile']['name'][$key])) {
  61. $error++;
  62. setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
  63. }
  64. }
  65. if (!$error) {
  66. // Define if we have to generate thumbs or not
  67. $generatethumbs = 1;
  68. if (GETPOST('section_dir', 'alpha')) {
  69. $generatethumbs = 0;
  70. }
  71. $allowoverwrite = (GETPOST('overwritefile', 'int') ? 1 : 0);
  72. if (!empty($upload_dirold) && !empty($conf->global->PRODUCT_USE_OLD_PATH_FOR_PHOTO)) {
  73. $result = dol_add_file_process($upload_dirold, $allowoverwrite, 1, 'userfile', GETPOST('savingdocmask', 'alpha'), null, '', $generatethumbs, $object);
  74. } elseif (!empty($upload_dir)) {
  75. $result = dol_add_file_process($upload_dir, $allowoverwrite, 1, 'userfile', GETPOST('savingdocmask', 'alpha'), null, '', $generatethumbs, $object);
  76. }
  77. }
  78. }
  79. } elseif (GETPOST('linkit', 'restricthtml') && !empty($conf->global->MAIN_UPLOAD_DOC) && !empty($permissiontoadd)) {
  80. $link = GETPOST('link', 'alpha');
  81. if ($link) {
  82. if (substr($link, 0, 7) != 'http://' && substr($link, 0, 8) != 'https://' && substr($link, 0, 7) != 'file://' && substr($link, 0, 7) != 'davs://') {
  83. $link = 'http://'.$link;
  84. }
  85. dol_add_file_process($upload_dir, 0, 1, 'userfile', null, $link, '', 0);
  86. }
  87. }
  88. // Delete file/link
  89. if ($action == 'confirm_deletefile' && $confirm == 'yes' && !empty($permissiontoadd)) {
  90. $urlfile = GETPOST('urlfile', 'alpha', 0, null, null, 1); // Do not use urldecode here ($_GET and $_REQUEST are already decoded by PHP).
  91. if (GETPOST('section', 'alpha')) {
  92. // For a delete from the ECM module, upload_dir is ECM root dir and urlfile contains relative path from upload_dir
  93. $file = $upload_dir.(preg_match('/\/$/', $upload_dir) ? '' : '/').$urlfile;
  94. } else // For a delete from the file manager into another module, or from documents pages, upload_dir contains already path to file from module dir, so we clean path into urlfile.
  95. {
  96. $urlfile = basename($urlfile);
  97. $file = $upload_dir.(preg_match('/\/$/', $upload_dir) ? '' : '/').$urlfile;
  98. if (!empty($upload_dirold)) {
  99. $fileold = $upload_dirold."/".$urlfile;
  100. }
  101. }
  102. $linkid = GETPOST('linkid', 'int');
  103. if ($urlfile) {
  104. // delete of a file
  105. $dir = dirname($file).'/'; // Chemin du dossier contenant l'image d'origine
  106. $dirthumb = $dir.'/thumbs/'; // Chemin du dossier contenant la vignette (if file is an image)
  107. $ret = dol_delete_file($file, 0, 0, 0, (is_object($object) ? $object : null));
  108. if (!empty($fileold)) {
  109. dol_delete_file($fileold, 0, 0, 0, (is_object($object) ? $object : null)); // Delete file using old path
  110. }
  111. if ($ret) {
  112. // If it exists, remove thumb.
  113. $regs = array();
  114. if (preg_match('/(\.jpg|\.jpeg|\.bmp|\.gif|\.png|\.tiff)$/i', $file, $regs)) {
  115. $photo_vignette = basename(preg_replace('/'.$regs[0].'/i', '', $file).'_small'.$regs[0]);
  116. if (file_exists(dol_osencode($dirthumb.$photo_vignette))) {
  117. dol_delete_file($dirthumb.$photo_vignette);
  118. }
  119. $photo_vignette = basename(preg_replace('/'.$regs[0].'/i', '', $file).'_mini'.$regs[0]);
  120. if (file_exists(dol_osencode($dirthumb.$photo_vignette))) {
  121. dol_delete_file($dirthumb.$photo_vignette);
  122. }
  123. }
  124. setEventMessages($langs->trans("FileWasRemoved", $urlfile), null, 'mesgs');
  125. } else {
  126. setEventMessages($langs->trans("ErrorFailToDeleteFile", $urlfile), null, 'errors');
  127. }
  128. } elseif ($linkid) { // delete of external link
  129. require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
  130. $link = new Link($db);
  131. $link->fetch($linkid);
  132. $res = $link->delete($user);
  133. $langs->load('link');
  134. if ($res > 0) {
  135. setEventMessages($langs->trans("LinkRemoved", $link->label), null, 'mesgs');
  136. } else {
  137. if (count($link->errors)) {
  138. setEventMessages('', $link->errors, 'errors');
  139. } else {
  140. setEventMessages($langs->trans("ErrorFailedToDeleteLink", $link->label), null, 'errors');
  141. }
  142. }
  143. }
  144. if (is_object($object) && $object->id > 0) {
  145. if ($backtopage) {
  146. header('Location: '.$backtopage);
  147. exit;
  148. } else {
  149. $tmpurl = $_SERVER["PHP_SELF"].'?id='.$object->id.(GETPOST('section_dir', 'alpha') ? '&section_dir='.urlencode(GETPOST('section_dir', 'alpha')) : '').(!empty($withproject) ? '&withproject=1' : '');
  150. header('Location: '.$tmpurl);
  151. exit;
  152. }
  153. }
  154. } elseif ($action == 'confirm_updateline' && GETPOST('save', 'alpha') && GETPOST('link', 'alpha') && !empty($permissiontoadd)) {
  155. require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
  156. $langs->load('link');
  157. $link = new Link($db);
  158. $f = $link->fetch(GETPOST('linkid', 'int'));
  159. if ($f) {
  160. $link->url = GETPOST('link', 'alpha');
  161. if (substr($link->url, 0, 7) != 'http://' && substr($link->url, 0, 8) != 'https://' && substr($link->url, 0, 7) != 'file://') {
  162. $link->url = 'http://'.$link->url;
  163. }
  164. $link->label = GETPOST('label', 'alphanohtml');
  165. $res = $link->update($user);
  166. if (!$res) {
  167. setEventMessages($langs->trans("ErrorFailedToUpdateLink", $link->label), null, 'mesgs');
  168. }
  169. } else {
  170. //error fetching
  171. }
  172. } elseif ($action == 'renamefile' && GETPOST('renamefilesave', 'alpha') && !empty($permissiontoadd)) {
  173. // For documents pages, upload_dir contains already path to file from module dir, so we clean path into urlfile.
  174. if (!empty($upload_dir)) {
  175. $filenamefrom = dol_sanitizeFileName(GETPOST('renamefilefrom', 'alpha'), '_', 0); // Do not remove accents
  176. $filenameto = dol_sanitizeFileName(GETPOST('renamefileto', 'alpha'), '_', 0); // Do not remove accents
  177. // We apply dol_string_nohtmltag also to clean file names (this remove duplicate spaces) because
  178. // this function is also applied when we upload and when we make try to download file (by the GETPOST(filename, 'alphanohtml') call).
  179. $filenameto = dol_string_nohtmltag($filenameto);
  180. if (preg_match('/__.*__/', $filenameto)) {
  181. $error++;
  182. setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
  183. }
  184. if (!$error && $filenamefrom != $filenameto) {
  185. // Security:
  186. // Disallow file with some extensions. We rename them.
  187. // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.
  188. if (isAFileWithExecutableContent($filenameto) && empty($conf->global->MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED)) {
  189. // $upload_dir ends with a slash, so be must be sure the medias dir to compare to ends with slash too.
  190. $publicmediasdirwithslash = $conf->medias->multidir_output[$conf->entity];
  191. if (!preg_match('/\/$/', $publicmediasdirwithslash)) {
  192. $publicmediasdirwithslash .= '/';
  193. }
  194. if (strpos($upload_dir, $publicmediasdirwithslash) !== 0) { // We never add .noexe on files into media directory
  195. $filenameto .= '.noexe';
  196. }
  197. }
  198. if ($filenamefrom && $filenameto) {
  199. $srcpath = $upload_dir.'/'.$filenamefrom;
  200. $destpath = $upload_dir.'/'.$filenameto;
  201. $reshook = $hookmanager->initHooks(array('actionlinkedfiles'));
  202. $parameters = array('filenamefrom' => $filenamefrom, 'filenameto' => $filenameto, 'upload_dir' => $upload_dir);
  203. $reshook = $hookmanager->executeHooks('renameUploadedFile', $parameters, $object);
  204. if (empty($reshook)) {
  205. if (preg_match('/^\./', $filenameto)) {
  206. $langs->load("errors"); // lang must be loaded because we can't rely on loading during output, we need var substitution to be done now.
  207. setEventMessages($langs->trans("ErrorFilenameCantStartWithDot", $filenameto), null, 'errors');
  208. } elseif (!file_exists($destpath)) {
  209. $result = dol_move($srcpath, $destpath);
  210. if ($result) {
  211. // Define if we have to generate thumbs or not
  212. $generatethumbs = 1;
  213. // When we rename a file from the file manager in ecm, we must not regenerate thumbs (not a problem, we do pass here)
  214. // When we rename a file from the website module, we must not regenerate thumbs (module = medias in such a case)
  215. // but when we rename from a tab "Documents", we must regenerate thumbs
  216. if (GETPOST('modulepart') == 'medias') {
  217. $generatethumbs = 0;
  218. }
  219. if ($generatethumbs) {
  220. if ($object->id) {
  221. $object->addThumbs($destpath);
  222. }
  223. // TODO Add revert function of addThumbs to remove thumbs with old name
  224. //$object->delThumbs($srcpath);
  225. }
  226. setEventMessages($langs->trans("FileRenamed"), null);
  227. } else {
  228. $langs->load("errors"); // lang must be loaded because we can't rely on loading during output, we need var substitution to be done now.
  229. setEventMessages($langs->trans("ErrorFailToRenameFile", $filenamefrom, $filenameto), null, 'errors');
  230. }
  231. } else {
  232. $langs->load("errors"); // lang must be loaded because we can't rely on loading during output, we need var substitution to be done now.
  233. setEventMessages($langs->trans("ErrorDestinationAlreadyExists", $filenameto), null, 'errors');
  234. }
  235. }
  236. }
  237. }
  238. }
  239. // Update properties in ECM table
  240. if (GETPOST('ecmfileid', 'int') > 0) {
  241. $shareenabled = GETPOST('shareenabled', 'alpha');
  242. include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
  243. $ecmfile = new EcmFiles($db);
  244. $result = $ecmfile->fetch(GETPOST('ecmfileid', 'int'));
  245. if ($result > 0) {
  246. if ($shareenabled) {
  247. if (empty($ecmfile->share)) {
  248. require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
  249. $ecmfile->share = getRandomPassword(true);
  250. }
  251. } else {
  252. $ecmfile->share = '';
  253. }
  254. $result = $ecmfile->update($user);
  255. if ($result < 0) {
  256. setEventMessages($ecmfile->error, $ecmfile->errors, 'warnings');
  257. }
  258. }
  259. }
  260. }