MDL-22950 adding new component column to the files table, unfortunately this change requires changes in all 2.0dev code, please review all custom code that was already upgraded to 2.0; fixing multiple problems and regressions in mod/assignment
This commit is contained in:
Petr Skoda
+474
-347
@@ -18,14 +18,15 @@
|
||||
/**
|
||||
* This script delegates file serving to individual plugins
|
||||
*
|
||||
* @package moodlecore
|
||||
* @package core
|
||||
* @subpackage file
|
||||
* @copyright 2008 Petr Skoda (http://skodak.org)
|
||||
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
|
||||
*/
|
||||
|
||||
// disable moodle specific debug messages and any errors in output
|
||||
define('NO_DEBUG_DISPLAY', true);
|
||||
//define('NO_DEBUG_DISPLAY', true);
|
||||
//TODO: uncomment this once the file api stabilises a bit more
|
||||
|
||||
require_once('config.php');
|
||||
require_once('lib/filelib.php');
|
||||
@@ -43,16 +44,16 @@ if (!$relativepath) {
|
||||
// extract relative path components
|
||||
$args = explode('/', ltrim($relativepath, '/'));
|
||||
|
||||
if (count($args) == 0) { // always at least user id
|
||||
if (count($args) < 3) { // always at least context, component and filearea
|
||||
print_error('invalidarguments');
|
||||
}
|
||||
|
||||
$contextid = (int)array_shift($args);
|
||||
$filearea = array_shift($args);
|
||||
$component = clean_param(array_shift($args), PARAM_SAFEDIR);
|
||||
$filearea = clean_param(array_shift($args), PARAM_SAFEDIR);
|
||||
|
||||
list($context, $course, $cm) = get_context_info_array($contextid);
|
||||
|
||||
if (!$context = get_context_instance_by_id($contextid)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
$fs = get_file_storage();
|
||||
|
||||
// If the file is a Flash file and that the user flash player is outdated return a flash upgrader MDL-20841
|
||||
@@ -60,116 +61,158 @@ $mimetype = mimeinfo('type', $args[count($args)-1]);
|
||||
if (!empty($CFG->excludeoldflashclients) && $mimetype == 'application/x-shockwave-flash'&& !empty($SESSION->flashversion)) {
|
||||
$userplayerversion = explode('.', $SESSION->flashversion);
|
||||
$requiredplayerversion = explode('.', $CFG->excludeoldflashclients);
|
||||
$sendflashupgrader = true;
|
||||
}
|
||||
if (!empty($sendflashupgrader) && (($userplayerversion[0] < $requiredplayerversion[0]) ||
|
||||
if (($userplayerversion[0] < $requiredplayerversion[0]) ||
|
||||
($userplayerversion[0] == $requiredplayerversion[0] && $userplayerversion[1] < $requiredplayerversion[1]) ||
|
||||
($userplayerversion[0] == $requiredplayerversion[0] && $userplayerversion[1] == $requiredplayerversion[1]
|
||||
&& $userplayerversion[2] < $requiredplayerversion[2]))) {
|
||||
&& $userplayerversion[2] < $requiredplayerversion[2])) {
|
||||
$path = $CFG->dirroot."/lib/flashdetect/flashupgrade.swf"; // Alternate content asking user to upgrade Flash
|
||||
$filename = "flashupgrade.swf";
|
||||
$lifetime = 0; // Do not cache
|
||||
send_file($path, $filename, $lifetime, 0, false, false, $mimetype);
|
||||
send_file($path, $filename, O, 0, false, false, 'application/x-shockwave-flash'); // Do not cache
|
||||
}
|
||||
}
|
||||
|
||||
} else if ($context->contextlevel == CONTEXT_SYSTEM) {
|
||||
if ($filearea === 'blog_attachment' || $filearea === 'blog_post') {
|
||||
// ========================================================================================================================
|
||||
if ($component === 'blog') {
|
||||
// Blog file serving
|
||||
if ($context->contextlevel != CONTEXT_SYSTEM) {
|
||||
send_file_not_found();
|
||||
}
|
||||
if ($filearea !== 'attachment' and $filearea !== 'post') {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if (empty($CFG->bloglevel)) {
|
||||
print_error('siteblogdisable', 'blog');
|
||||
}
|
||||
if ($CFG->bloglevel < BLOG_GLOBAL_LEVEL) {
|
||||
require_login();
|
||||
if (isguestuser()) {
|
||||
print_error('noguest');
|
||||
}
|
||||
if ($CFG->bloglevel == BLOG_USER_LEVEL) {
|
||||
if ($USER->id != $entry->userid) {
|
||||
send_file_not_found();
|
||||
}
|
||||
}
|
||||
}
|
||||
$entryid = (int)array_shift($args);
|
||||
if (!$entry = $DB->get_record('post', array('module'=>'blog', 'id'=>$entryid))) {
|
||||
send_file_not_found();
|
||||
}
|
||||
if ('publishstate' === 'public') {
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
if (empty($CFG->bloglevel)) {
|
||||
print_error('siteblogdisable', 'blog');
|
||||
}
|
||||
|
||||
} else if ('publishstate' === 'site') {
|
||||
require_login();
|
||||
//ok
|
||||
} else if ('publishstate' === 'draft') {
|
||||
require_login();
|
||||
if ($CFG->bloglevel < BLOG_GLOBAL_LEVEL) {
|
||||
require_login();
|
||||
if (isguestuser()) {
|
||||
print_error('noguest');
|
||||
}
|
||||
if ($CFG->bloglevel == BLOG_USER_LEVEL) {
|
||||
if ($USER->id != $entry->userid) {
|
||||
send_file_not_found();
|
||||
}
|
||||
}
|
||||
}
|
||||
$entryid = (int)array_shift($args);
|
||||
if (!$entry = $DB->get_record('post', array('module'=>'blog', 'id'=>$entryid))) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
//TODO: implement shared course and shared group access
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.$filearea.$entryid.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
send_stored_file($file, 10*60, 0, true); // download MUST be forced - security!
|
||||
} else if ($filearea === 'grade_outcome' || $filearea === 'grade_scale') { // CONTEXT_SYSTEM
|
||||
if ('publishstate' === 'public') {
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$fullpath = $context->id.$filearea.implode('/', $args);
|
||||
} else if ('publishstate' === 'site') {
|
||||
require_login();
|
||||
//ok
|
||||
} else if ('publishstate' === 'draft') {
|
||||
require_login();
|
||||
if ($USER->id != $entry->userid) {
|
||||
send_file_not_found();
|
||||
}
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
|
||||
if (!$file = $fs->get_file($context->id, $component, $filearea, $entryid, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
send_stored_file($file, 10*60, 0, true); // download MUST be forced - security!
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'grade') {
|
||||
if (($filearea === 'outcome' or $filearea === 'scale') and $context->contextlevel == CONTEXT_SYSTEM) {
|
||||
// Global gradebook files
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$fullpath = "/$context->id/$component/$filearea/".implode('/', $args);
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else if ($filearea === 'tag_description') { // CONTEXT_SYSTEM
|
||||
} else if ($filearea === 'feedback' and $context->contextlevel == CONTEXT_COURSE) {
|
||||
//TODO: nobody implemented this yet in grade edit form!!
|
||||
send_file_not_found();
|
||||
|
||||
if ($CFG->forcelogin || $course->id !== SITEID) {
|
||||
require_login($course);
|
||||
}
|
||||
|
||||
$fullpath = "/$context->id/$component/$filearea/".implode('/', $args);
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'tag') {
|
||||
if ($filearea === 'description' and $context->contextlevel == CONTEXT_SYSTEM) {
|
||||
|
||||
// All tag descriptions are going to be public but we still need to respect forcelogin
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$fullpath = $context->id.$filearea.implode('/', $args);
|
||||
$fullpath = "/$context->id/tage/description/".implode('/', $args);
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, true); // TODO: change timeout?
|
||||
send_stored_file($file, 60*60, 0, true);
|
||||
|
||||
} else if ($filearea === 'calendar_event_description') { // CONTEXT_SYSTEM
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'calendar') {
|
||||
if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_SYSTEM) {
|
||||
|
||||
// All events here are public the one requirement is that we respect forcelogin
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$fullpath = $context->id.$filearea.implode('/', $args);
|
||||
// Get the event if from the args array
|
||||
$eventid = array_shift($args);
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
// Load the event from the database
|
||||
if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'eventtype'=>'site'))) {
|
||||
send_file_not_found();
|
||||
}
|
||||
// Check that we got an event and that it's userid is that of the user
|
||||
|
||||
// Get the file and serve if successful
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
} else if ($context->contextlevel == CONTEXT_USER) {
|
||||
|
||||
if ($filearea === 'calendar_event_description') { // CONTEXT_USER
|
||||
} else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_USER) {
|
||||
|
||||
// Must be logged in, if they are not then they obviously can't be this user
|
||||
require_login();
|
||||
@@ -181,167 +224,23 @@ if (!empty($sendflashupgrader) && (($userplayerversion[0] < $requiredplayervers
|
||||
|
||||
// Get the event if from the args array
|
||||
$eventid = array_shift($args);
|
||||
if ((int)$eventid <= 0) {
|
||||
|
||||
// Load the event from the database - user id must match
|
||||
if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'userid'=>$USER->id, 'eventtype'=>'user'))) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// Load the event from the database
|
||||
$event = $DB->get_record('event', array('id'=>(int)$eventid));
|
||||
// Check that we got an event and that it's userid is that of the user
|
||||
if (!$event || $event->userid !== $USER->id) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// Get the file and serve if succesfull
|
||||
$fullpath = $context->id.$filearea.$eventid.'/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
|
||||
} else if ($filearea === 'user_profile') { // CONTEXT_USER
|
||||
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$userid = array_shift($args);
|
||||
if ((int)$userid <= 0) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if (!empty($CFG->forceloginforprofiles)) {
|
||||
require_login();
|
||||
if (isguestuser()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if ($USER->id !== $userid) {
|
||||
$usercontext = get_context_instance(CONTEXT_USER, $userid);
|
||||
// The browsing user is not the current user
|
||||
if (!has_coursecontact_role($userid) && !has_capability('moodle/user:viewdetails', $usercontext)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
$canview = false;
|
||||
if (has_capability('moodle/user:viewdetails', $usercontext)) {
|
||||
$canview = true;
|
||||
} else {
|
||||
$courses = enrol_get_my_courses();
|
||||
}
|
||||
|
||||
while (!$canview && count($courses) > 0) {
|
||||
$course = array_shift($courses);
|
||||
if (has_capability('moodle/user:viewdetails', get_context_instance(CONTEXT_COURSE, $course->id))) {
|
||||
$canview = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$fullpath = $context->id.$filearea.$userid.'/'.implode('/', $args);
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, true);
|
||||
}
|
||||
|
||||
send_file_not_found();
|
||||
|
||||
|
||||
} else if ($context->contextlevel == CONTEXT_COURSECAT) {
|
||||
if ($filearea == 'coursecat_intro') {
|
||||
if ($CFG->forcelogin) {
|
||||
// no login necessary - unless login forced everywhere
|
||||
require_login();
|
||||
}
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'coursecat_intro0'.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->get_filename() == '.') {
|
||||
// Get the file and serve if successful
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
} else if ($filearea == 'category_description') {
|
||||
if ($CFG->forcelogin) {
|
||||
// no login necessary - unless login forced everywhere
|
||||
require_login();
|
||||
}
|
||||
$itemid = (int)array_shift($args);
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'category_description'.$itemid.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->get_filename() == '.') {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
|
||||
} else if ($context->contextlevel == CONTEXT_COURSE) {
|
||||
if (!$course = $DB->get_record('course', array('id'=>$context->instanceid))) {
|
||||
print_error('invalidcourseid');
|
||||
}
|
||||
|
||||
if ($filearea === 'course_backup') {
|
||||
require_login($course);
|
||||
require_capability('moodle/backup:downloadfile', $context);
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'course_backup0'.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, true);
|
||||
|
||||
} else if ($filearea === 'course_summary') {
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'course_summary0'.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
|
||||
|
||||
} else if ($filearea === 'course_grade_tree_feedback') {
|
||||
|
||||
if ($CFG->forcelogin || $course->id !== SITEID) {
|
||||
require_login($course);
|
||||
}
|
||||
|
||||
$fullpath = $context->id.$filearea.implode('/', $args);
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
|
||||
|
||||
} else if ($filearea === 'calendar_event_description') { // CONTEXT_COURSE
|
||||
|
||||
// This is for content used in course and group events
|
||||
} else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_COURSE) {
|
||||
|
||||
// Respect forcelogin and require login unless this is the site.... it probably
|
||||
// should NEVER be the site
|
||||
@@ -351,39 +250,222 @@ if (!empty($sendflashupgrader) && (($userplayerversion[0] < $requiredplayervers
|
||||
|
||||
// Must be able to at least view the course
|
||||
if (!is_enrolled($context) and !is_viewing($context)) {
|
||||
//TODO: hmm, do we really want to block guests here?
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// Get the event id
|
||||
$eventid = array_shift($args);
|
||||
if ((int)$eventid <= 0) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// Load the event from the database we need to check whether it is
|
||||
// a) valid
|
||||
// a) valid course event
|
||||
// b) a group event
|
||||
// Group events use the course context (there is no group context)
|
||||
$event = $DB->get_record('event', array('id'=>(int)$eventid));
|
||||
if (!$event || $event->userid !== $USER->id) {
|
||||
if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'courseid'=>$course->id))) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// If its a group event require either membership of manage groups capability
|
||||
if ($event->eventtype === 'group' && !has_capability('moodle/course:managegroups', $context) && !groups_is_member($event->groupid, $USER->id)) {
|
||||
// If its a group event require either membership of view all groups capability
|
||||
if ($event->eventtype === 'group') {
|
||||
if (!has_capability('moodle/site:accessallgroups', $context) && !groups_is_member($event->groupid, $USER->id)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
} else if ($event->eventtype === 'course') {
|
||||
//ok
|
||||
} else {
|
||||
// some other type
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// If we get this far we can serve the file
|
||||
$fullpath = $context->id.$filearea.$eventid.'/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else if ($filearea === 'course_section') {
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'user') {
|
||||
if ($filearea === 'private' and $context->contextlevel == CONTEXT_USER) {
|
||||
require_login();
|
||||
|
||||
if (isguestuser()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if ($USER->id !== $context->instanceid) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, $component, $filearea, 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, true); // must force download - security!
|
||||
|
||||
} else if ($filearea === 'profile' and $context->contextlevel == CONTEXT_USER) {
|
||||
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$userid = $context->instanceid;
|
||||
|
||||
if ($USER->id == $userid) {
|
||||
// always can access own
|
||||
|
||||
} else if (!empty($CFG->forceloginforprofiles)) {
|
||||
require_login();
|
||||
|
||||
if (isguestuser()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// we allow access to site profile of all course contacts (usually teachers)
|
||||
if (!has_coursecontact_role($userid) && !has_capability('moodle/user:viewdetails', $context)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
$canview = false;
|
||||
if (has_capability('moodle/user:viewdetails', $context)) {
|
||||
$canview = true;
|
||||
} else {
|
||||
$courses = enrol_get_my_courses();
|
||||
}
|
||||
|
||||
while (!$canview && count($courses) > 0) {
|
||||
$course = array_shift($courses);
|
||||
if (has_capability('moodle/user:viewdetails', get_context_instance(CONTEXT_COURSE, $course->id))) {
|
||||
$canview = true;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, $component, $filearea, 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, true); // must force download - security!
|
||||
|
||||
} else if ($filearea === 'profile' and $context->contextlevel == CONTEXT_COURSE) {
|
||||
$userid = (int)array_shift($args);
|
||||
$usercontext = get_context_instance(CONTEXT_USER, $userid);
|
||||
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
if (!empty($CFG->forceloginforprofiles)) {
|
||||
require_login();
|
||||
if (isguestuser()) {
|
||||
print_error('noguest');
|
||||
}
|
||||
|
||||
//TODO: review this logic of user profile access prevention
|
||||
if (!has_coursecontact_role($userid) and !has_capability('moodle/user:viewdetails', $usercontext)) {
|
||||
print_error('usernotavailable');
|
||||
}
|
||||
if (!has_capability('moodle/user:viewdetails', $context) && !has_capability('moodle/user:viewdetails', $usercontext)) {
|
||||
print_error('cannotviewprofile');
|
||||
}
|
||||
if (!is_enrolled($context, $userid)) {
|
||||
print_error('notenrolledprofile');
|
||||
}
|
||||
if (groups_get_course_groupmode($course) == SEPARATEGROUPS and !has_capability('moodle/site:accessallgroups', $context)) {
|
||||
print_error('groupnotamember');
|
||||
}
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'user', 'profile', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, true); // must force download - security!
|
||||
|
||||
} else if ($filearea === 'backup' and $context->contextlevel == CONTEXT_USER) {
|
||||
require_login();
|
||||
|
||||
if (isguestuser()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
if ($USER->id != $userid) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'user', 'backup', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, true); // must force download - security!
|
||||
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'coursecat') {
|
||||
if ($context->contextlevel != CONTEXT_COURSECAT) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if ($filearea === 'description') {
|
||||
if ($CFG->forcelogin) {
|
||||
// no login necessary - unless login forced everywhere
|
||||
require_login();
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'coursecat', 'description', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'course') {
|
||||
if ($context->contextlevel != CONTEXT_COURSE) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if ($filearea === 'summary') {
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'course', 'summary', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else if ($filearea === 'section') {
|
||||
if ($CFG->forcelogin) {
|
||||
require_login($course);
|
||||
} else if ($course->id !== SITEID) {
|
||||
@@ -400,115 +482,147 @@ if (!empty($sendflashupgrader) && (($userplayerversion[0] < $requiredplayervers
|
||||
}
|
||||
}
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'course_section'.$sectionid.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'course', 'section', $sectionid, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, false); // TODO: change timeout?
|
||||
|
||||
} else if ($filearea === 'section_backup') {
|
||||
require_login($course);
|
||||
require_capability('moodle/backup:downloadfile', $context);
|
||||
|
||||
$sectionid = (int)array_shift($args);
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'section_backup'.$sectionid.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close();
|
||||
send_stored_file($file, 60*60, 0, false);
|
||||
|
||||
} else if ($filearea === 'user_profile') {
|
||||
$userid = (int)array_shift($args);
|
||||
$usercontext = get_context_instance(CONTEXT_USER, $userid);
|
||||
|
||||
if ($CFG->forcelogin) {
|
||||
require_login();
|
||||
}
|
||||
|
||||
if (!empty($CFG->forceloginforprofiles)) {
|
||||
require_login();
|
||||
if (isguestuser()) {
|
||||
print_error('noguest');
|
||||
}
|
||||
|
||||
if (!has_coursecontact_role($userid) and !has_capability('moodle/user:viewdetails', $usercontext)) {
|
||||
print_error('usernotavailable');
|
||||
}
|
||||
if (!has_capability('moodle/user:viewdetails', $context) &&
|
||||
!has_capability('moodle/user:viewdetails', $usercontext)) {
|
||||
print_error('cannotviewprofile');
|
||||
}
|
||||
if (!is_enrolled($context, $userid)) {
|
||||
print_error('notenrolledprofile');
|
||||
}
|
||||
if (groups_get_course_groupmode($course) == SEPARATEGROUPS and !has_capability('moodle/site:accessallgroups', $context)) {
|
||||
print_error('groupnotamember');
|
||||
}
|
||||
}
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $usercontext->id.'user_profile0'.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, true); // must force download - security!
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
} else if ($context->contextlevel == CONTEXT_MODULE) {
|
||||
|
||||
if (!$coursecontext = get_context_instance_by_id(get_parent_contextid($context))) {
|
||||
} else if ($component === 'group') {
|
||||
if ($context->contextlevel != CONTEXT_COURSE) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
if (!$course = $DB->get_record('course', array('id'=>$coursecontext->instanceid))) {
|
||||
send_file_not_found();
|
||||
}
|
||||
$modinfo = get_fast_modinfo($course);
|
||||
if (empty($modinfo->cms[$context->instanceid])) {
|
||||
require_login($course);
|
||||
|
||||
$groupid = (int)array_shift($args);
|
||||
|
||||
$group = $DB->get_record('groups', array('id'=>$groupid, 'courseid'=>$course->id), '*', MUST_EXIST);
|
||||
if (!has_capability('moodle/site:accessallgroups', $context) && !groups_is_member($group->id, $USER->id)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
$cminfo = $modinfo->cms[$context->instanceid];
|
||||
$modname = $cminfo->modname;
|
||||
$libfile = "$CFG->dirroot/mod/$modname/lib.php";
|
||||
if (!file_exists($libfile)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
if ($filearea === 'description' or $filearea === 'icon') {
|
||||
|
||||
require_once($libfile);
|
||||
if ($filearea === $modname.'_intro') {
|
||||
if (!plugin_supports('mod', $modname, FEATURE_MOD_INTRO, true)) {
|
||||
//TODO: implement group image storage in file pool
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'group', 'description', $group->id, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
if (!$cm = get_coursemodule_from_instance($modname, $cminfo->instance, $course->id)) {
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
} else if ($component === 'grouping') {
|
||||
if ($context->contextlevel != CONTEXT_COURSE) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
require_login($course);
|
||||
|
||||
$groupingid = (int)array_shift($args);
|
||||
|
||||
// note: everybody has access to grouping desc images for now
|
||||
if ($filearea === 'description') {
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'grouping', 'description', $groupingid->id, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if ($component === 'backup') {
|
||||
if ($filearea === 'course' and $context->contextlevel == CONTEXT_COURSE) {
|
||||
require_login($course);
|
||||
require_capability('moodle/backup:downloadfile', $context);
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'backup', 'course', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close(); // unlock session during fileserving
|
||||
send_stored_file($file, 0, 0, $forcedownload);
|
||||
|
||||
} else if ($filearea === 'section' and $context->contextlevel == CONTEXT_COURSE) {
|
||||
require_login($course);
|
||||
require_capability('moodle/backup:downloadfile', $context);
|
||||
|
||||
$sectionid = (int)array_shift($args);
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'backup', 'section', $sectionid, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close();
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else if ($filearea === 'activity' and $context->contextlevel == CONTEXT_MODULE) {
|
||||
require_login($course, false, $cm);
|
||||
require_capability('moodle/backup:downloadfile', $context);
|
||||
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'backup', 'activity', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close();
|
||||
send_stored_file($file, 60*60, 0, $forcedownload);
|
||||
|
||||
} else {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
// ========================================================================================================================
|
||||
} else if (strpos($component, 'mod_') === 0) {
|
||||
$modname = substr($component, 4);
|
||||
if (!file_exists("$CFG->dirroot/mod/$modname/lib.php")) {
|
||||
send_file_not_found();
|
||||
}
|
||||
require_once("$CFG->dirroot/mod/$modname/lib.php");
|
||||
|
||||
if ($context->contextlevel == CONTEXT_MODULE) {
|
||||
if ($cm->modname !== $modname) {
|
||||
// somebody tries to gain illegal access, cm type must match the component!
|
||||
send_file_not_found();
|
||||
}
|
||||
}
|
||||
|
||||
if ($filearea === 'intro') {
|
||||
if (!plugin_supports('mod', $modname, FEATURE_MOD_INTRO, true)) {
|
||||
send_file_not_found();
|
||||
}
|
||||
require_course_login($course, true, $cm);
|
||||
|
||||
if (!$cminfo->uservisible) {
|
||||
send_file_not_found();
|
||||
}
|
||||
// all users may access it
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.$filearea.'0'.$relativepath;
|
||||
|
||||
$fs = get_file_storage();
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.implode('/', $args);
|
||||
if (!$file = $fs->get_file($context->id, 'mod_'.$modname, 'intro', 0, $filepath, $filename) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
@@ -516,51 +630,64 @@ if (!empty($sendflashupgrader) && (($userplayerversion[0] < $requiredplayervers
|
||||
|
||||
// finally send the file
|
||||
send_stored_file($file, $lifetime, 0);
|
||||
} else if ($filearea === 'activity_backup') {
|
||||
require_login($course);
|
||||
require_capability('moodle/backup:downloadfile', $context);
|
||||
|
||||
$relativepath = '/'.implode('/', $args);
|
||||
$fullpath = $context->id.'activity_backup0'.$relativepath;
|
||||
|
||||
if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
session_get_instance()->write_close();
|
||||
send_stored_file($file, 60*60, 0, false);
|
||||
}
|
||||
|
||||
$filefunction = $modname.'_pluginfile';
|
||||
$filefunction = $component.'_pluginfile';
|
||||
$filefunctionold = $modname.'_pluginfile';
|
||||
if (function_exists($filefunction)) {
|
||||
// if the function exists, it must send the file and terminate. Whatever it returns leads to "not found"
|
||||
$filefunction($course, $cminfo, $context, $filearea, $args, $forcedownload);
|
||||
$filefunction($course, $cm, $context, $filearea, $args, $forcedownload);
|
||||
} else if (function_exists($filefunctionold)) {
|
||||
// if the function exists, it must send the file and terminate. Whatever it returns leads to "not found"
|
||||
$filefunctionold($course, $cm, $context, $filearea, $args, $forcedownload);
|
||||
}
|
||||
|
||||
send_file_not_found();
|
||||
|
||||
} else if ($context->contextlevel == CONTEXT_BLOCK) {
|
||||
|
||||
if (!$context = get_context_instance_by_id($contextid)) {
|
||||
// ========================================================================================================================
|
||||
} else if (strpos($component, 'block_') === 0) {
|
||||
$blockname = substr($component, 6);
|
||||
// note: no more class methods in blocks please, that is ....
|
||||
if (!file_exists("$CFG->dirroot/blocks/$blockname/lib.php")) {
|
||||
send_file_not_found();
|
||||
}
|
||||
$birecord = $DB->get_record('block_instances', array('id'=>$context->instanceid), '*',MUST_EXIST);
|
||||
$blockinstance = block_instance($birecord->blockname, $birecord);
|
||||
require_once("$CFG->dirroot/blocks/$blockname/lib.php");
|
||||
|
||||
if (strpos(get_class($blockinstance), $filearea) !== 0) {
|
||||
send_file_not_found();
|
||||
if ($context->contextlevel == CONTEXT_BLOCK) {
|
||||
$birecord = $DB->get_record('block_instances', array('id'=>$context->instanceid), '*',MUST_EXIST);
|
||||
if ($birecord->blockname !== $blockname) {
|
||||
// somebody tries to gain illegal access, cm type must match the component!
|
||||
send_file_not_found();
|
||||
}
|
||||
} else {
|
||||
$birecord = null;
|
||||
}
|
||||
|
||||
$itemid = array_shift($args);
|
||||
$filename = array_pop($args);
|
||||
$filepath = '/'.join('/', $args);
|
||||
|
||||
if (method_exists($blockinstance, 'send_file')) {
|
||||
$blockinstance->send_file($context, $filearea, $itemid, $filepath, $filename);
|
||||
$filefunction = $component.'_pluginfile';
|
||||
if (function_exists($filefunction)) {
|
||||
// if the function exists, it must send the file and terminate. Whatever it returns leads to "not found"
|
||||
$filefunction($course, $birecord, $context, $filearea, $args, $forcedownload);
|
||||
}
|
||||
|
||||
send_file_not_found();
|
||||
|
||||
} else if (strpos($component, '_') === false) {
|
||||
// all core subsystems have to be specified above, no more guessing here!
|
||||
send_file_not_found();
|
||||
|
||||
} else {
|
||||
// try to serve general plugin file in arbitrary context
|
||||
$dir = get_component_directory($component);
|
||||
if (!file_exists("$dir/lib.php")) {
|
||||
send_file_not_found();
|
||||
}
|
||||
require_once("$dir/lib.php");
|
||||
|
||||
$filefunction = $component.'_pluginfile';
|
||||
if (function_exists($filefunction)) {
|
||||
// if the function exists, it must send the file and terminate. Whatever it returns leads to "not found"
|
||||
$filefunction($course, $cm, $context, $filearea, $args, $forcedownload);
|
||||
}
|
||||
|
||||
send_file_not_found();
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user