Merge commit 'catalyst/MOODLE_19_STABLE' into mdl19-linuxchix
[moodle-linuxchix.git] / file.php
blobb5486d2360c0a98c6c26827238dca6ec591a2639
1 <?php // $Id$
2 // This script fetches files from the dataroot directory
3 //
4 // You should use the get_file_url() function, available in lib/filelib.php, to link to file.php.
5 // This ensures proper formatting and offers useful options.
6 //
7 // Syntax: file.php/courseid/dir/dir/dir/filename.ext
8 // file.php/courseid/dir/dir/dir/filename.ext?forcedownload=1 (download instead of inline)
9 // file.php/courseid/dir (returns index.html from dir)
10 // Workaround: file.php?file=/courseid/dir/dir/dir/filename.ext
11 // Test: file.php/testslasharguments
14 //TODO: Blog attachments do not have access control implemented - anybody can read them!
15 // It might be better to move the code to separate file because the access
16 // control is quite complex - see bolg/index.php
18 require_once('config.php');
19 require_once('lib/filelib.php');
21 if (!isset($CFG->filelifetime)) {
22 $lifetime = 86400; // Seconds for files to remain in caches
23 } else {
24 $lifetime = $CFG->filelifetime;
27 // disable moodle specific debug messages
28 disable_debugging();
30 $relativepath = get_file_argument('file.php');
31 $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
33 // relative path must start with '/', because of backup/restore!!!
34 if (!$relativepath) {
35 error('No valid arguments supplied or incorrect server configuration');
36 } else if ($relativepath{0} != '/') {
37 error('No valid arguments supplied, path does not start with slash!');
40 $pathname = $CFG->dataroot.$relativepath;
42 // extract relative path components
43 $args = explode('/', trim($relativepath, '/'));
44 if (count($args) == 0) { // always at least courseid, may search for index.html in course root
45 error('No valid arguments supplied');
48 // security: limit access to existing course subdirectories
49 if (($args[0]!='blog') and (!$course = get_record_sql("SELECT * FROM {$CFG->prefix}course WHERE id='".(int)$args[0]."'"))) {
50 error('Invalid course ID');
53 // security: prevent access to "000" or "1 something" directories
54 // hack for blogs, needs proper security check too
55 if (($args[0] != 'blog') and ($args[0] != $course->id)) {
56 error('Invalid course ID');
59 // security: login to course if necessary
60 // Note: file.php always calls require_login() with $setwantsurltome=false
61 // in order to avoid messing redirects. MDL-14495
62 if ($args[0] == 'blog') {
63 if (empty($CFG->bloglevel)) {
64 error('Blogging is disabled!');
65 } else if ($CFG->bloglevel < BLOG_GLOBAL_LEVEL) {
66 require_login(0, true, null, false);
67 } else if ($CFG->forcelogin) {
68 require_login(0, true, null, false);
70 } else if ($course->id != SITEID) {
71 require_login($course->id, true, null, false);
72 } else if ($CFG->forcelogin) {
73 if (!empty($CFG->sitepolicy)
74 and ($CFG->sitepolicy == $CFG->wwwroot.'/file.php'.$relativepath
75 or $CFG->sitepolicy == $CFG->wwwroot.'/file.php?file='.$relativepath)) {
76 //do not require login for policy file
77 } else {
78 require_login(0, true, null, false);
82 // security: only editing teachers can access backups
83 if ((count($args) >= 2) and (strtolower($args[1]) == 'backupdata')) {
84 if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE, $course->id))) {
85 error('Access not allowed');
86 } else {
87 $lifetime = 0; //disable browser caching for backups
91 if (is_dir($pathname)) {
92 if (file_exists($pathname.'/index.html')) {
93 $pathname = rtrim($pathname, '/').'/index.html';
94 $args[] = 'index.html';
95 } else if (file_exists($pathname.'/index.htm')) {
96 $pathname = rtrim($pathname, '/').'/index.htm';
97 $args[] = 'index.htm';
98 } else if (file_exists($pathname.'/Default.htm')) {
99 $pathname = rtrim($pathname, '/').'/Default.htm';
100 $args[] = 'Default.htm';
101 } else {
102 // security: do not return directory node!
103 not_found($course->id);
107 // security: teachers can view all assignments, students only their own
108 if ((count($args) >= 3)
109 and (strtolower($args[1]) == 'moddata')
110 and (strtolower($args[2]) == 'assignment')) {
112 $lifetime = 0; // do not cache assignments, students may reupload them
113 if ($args[4] == $USER->id) {
114 //can view own assignemnt submissions
115 } else {
116 $instance = (int)$args[3];
117 if (!$cm = get_coursemodule_from_instance('assignment', $instance, $course->id)) {
118 not_found($course->id);
120 if (!has_capability('mod/assignment:grade', get_context_instance(CONTEXT_MODULE, $cm->id))) {
121 error('Access not allowed');
126 // security: force download of all attachments submitted by students
127 if ((count($args) >= 3)
128 and (strtolower($args[1]) == 'moddata')
129 and ((strtolower($args[2]) == 'forum')
130 or (strtolower($args[2]) == 'assignment')
131 or (strtolower($args[2]) == 'data')
132 or (strtolower($args[2]) == 'glossary')
133 or (strtolower($args[2]) == 'wiki')
134 or (strtolower($args[2]) == 'exercise')
135 or (strtolower($args[2]) == 'workshop')
136 )) {
137 $forcedownload = 1; // force download of all attachments
139 if ($args[0] == 'blog') {
140 $forcedownload = 1; // force download of all attachments
143 // security: some protection of hidden resource files
144 // warning: it may break backwards compatibility
145 if ((!empty($CFG->preventaccesstohiddenfiles))
146 and (count($args) >= 2)
147 and (!(strtolower($args[1]) == 'moddata' and strtolower($args[2]) != 'resource')) // do not block files from other modules!
148 and (!has_capability('moodle/course:viewhiddenactivities', get_context_instance(CONTEXT_COURSE, $course->id)))) {
150 $rargs = $args;
151 array_shift($rargs);
152 $reference = implode('/', $rargs);
154 $sql = "SELECT COUNT(r.id) " .
155 "FROM {$CFG->prefix}resource r, " .
156 "{$CFG->prefix}course_modules cm, " .
157 "{$CFG->prefix}modules m " .
158 "WHERE r.course = '{$course->id}' " .
159 "AND m.name = 'resource' " .
160 "AND cm.module = m.id " .
161 "AND cm.instance = r.id " .
162 "AND cm.visible = 0 " .
163 "AND r.type = 'file' " .
164 "AND r.reference = '{$reference}'";
165 if (count_records_sql($sql)) {
166 error('Access not allowed');
170 // check that file exists
171 if (!file_exists($pathname)) {
172 not_found($course->id);
175 // ========================================
176 // finally send the file
177 // ========================================
178 session_write_close(); // unlock session during fileserving
179 $filename = $args[count($args)-1];
180 send_file($pathname, $filename, $lifetime, $CFG->filteruploadedfiles, false, $forcedownload);
182 function not_found($courseid) {
183 global $CFG;
184 header('HTTP/1.0 404 not found');
185 print_error('filenotfound', 'error', $CFG->wwwroot.'/course/view.php?id='.$courseid); //this is not displayed on IIS??