interface/super/manage_site_files.php

   1 <?php
   2 // Copyright (C) 2010 Rod Roark <rod@sunsetsystems.com>
   3 //
   4 // This program is free software; you can redistribute it and/or
   5 // modify it under the terms of the GNU General Public License
   6 // as published by the Free Software Foundation; either version 2
   7 // of the License, or (at your option) any later version.
   8
   9 // This module provides for editing site-specific text files and
  10 // for uploading site-specific image files.
  11
  12 // Disable magic quotes and fake register globals.
  13 $sanitize_all_escapes = true;
  14 $fake_register_globals = false;
  15
  16 require_once('../globals.php');
  17 require_once($GLOBALS['srcdir'].'/acl.inc');
  18 require_once($GLOBALS['srcdir'].'/htmlspecialchars.inc.php');
  19 /* for formData() */
  20 require_once($GLOBALS['srcdir'].'/formdata.inc.php');
  21
  22 if (!acl_check('admin', 'super')) die(htmlspecialchars(xl('Not authorized')));
  23
  24 // Prepare array of names of editable files, relative to the site directory.
  25 $my_files = array(
  26   'config.php',
  27   'faxcover.txt',
  28   'faxtitle.eps',
  29   'referral_template.html',
  30   'statement.inc.php',
  31   'letter_templates/custom_pdf.php',
  32 );
  33 // Append LBF plugin filenames to the array.
  34 $lres = sqlStatement('SELECT * FROM list_options ' .
  35   "WHERE list_id = 'lbfnames' ORDER BY seq, title");
  36 while ($lrow = sqlFetchArray($lres)) {
  37   $option_id = $lrow['option_id']; // should start with LBF
  38   $title = $lrow['title'];
  39   $my_files[] = "LBF/$option_id.plugin.php";
  40 }
  41
  42 $form_filename = strip_escape_custom($_REQUEST['form_filename']);
  43 // Sanity check to prevent evildoing.
  44 if (!in_array($form_filename, $my_files)) $form_filename = '';
  45 $filepath = "$OE_SITE_DIR/$form_filename";
  46
  47 $imagedir = "$OE_SITE_DIR/images";
  48
  49 if (!empty($_POST['bn_save'])) {
  50   if ($form_filename) {
  51     // Textareas, at least in Firefox, return a \r\n at the end of each line
  52     // even though only \n was originally there.  For consistency with
  53     // normal OpenEMR usage we translate those back.
  54     file_put_contents($filepath, str_replace("\r\n", "\n",
  55       $_POST['form_filedata']));
  56     $form_filename = '';
  57   }
  58
  59   // Handle uploads.
  60   if (is_uploaded_file($_FILES['form_image']['tmp_name']) && $_FILES['form_image']['size']) {
  61     $form_dest_filename = $_POST['form_dest_filename'];
  62     if ($form_dest_filename == '') {
  63       $form_dest_filename = $_FILES['form_image']['name'];
  64     }
  65     $form_dest_filename = basename($form_dest_filename);
  66     if ($form_dest_filename == '') {
  67       die(htmlspecialchars(xl('Cannot find a destination filename')));
  68     }
  69     $imagepath = "$imagedir/$form_dest_filename";
  70     // If the site's image directory does not yet exist, create it.
  71     if (!is_dir($imagedir)) {
  72       mkdir($imagedir);
  73     }
  74     if (is_file($imagepath)) unlink($imagepath);
  75     $tmp_name = $_FILES['form_image']['tmp_name'];
  76     if (!move_uploaded_file($_FILES['form_image']['tmp_name'], $imagepath)) {
  77       die(htmlspecialchars(xl('Unable to create') . " '$imagepath'"));
  78     }
  79   }
  80 }
  81 ?>
  82 <html>
  83
  84 <head>
  85 <title><?php echo xlt('File management'); ?></title>
  86 <link rel="stylesheet" href='<?php echo $css_header ?>' type='text/css'>
  87
  88 <style type="text/css">
  89  .dehead { color:#000000; font-family:sans-serif; font-size:10pt; font-weight:bold }
  90  .detail { color:#000000; font-family:sans-serif; font-size:10pt; font-weight:normal }
  91 </style>
  92
  93 <script language="JavaScript">
  94 // This is invoked when a filename selection changes in the drop-list.
  95 // In this case anything else entered into the form is discarded.
  96 function msfFileChanged() {
  97  top.restoreSession();
  98  document.forms[0].submit();
  99 }
 100 </script>
 101
 102 </head>
 103
 104 <body class="body_top">
 105 <form method='post' action='manage_site_files.php' enctype='multipart/form-data'
 106  onsubmit='return top.restoreSession()'>
 107
 108 <center>
 109
 110 <p>
 111 <table border='1' width='95%'>
 112
 113  <tr bgcolor='#dddddd' class='dehead'>
 114   <td colspan='2' align='center'><?php echo htmlspecialchars(xl('Edit File in') . " $OE_SITE_DIR"); ?></td>
 115  </tr>
 116
 117  <tr>
 118   <td valign='top' class='detail' nowrap>
 119    <select name='form_filename' onchange='msfFileChanged()'>
 120     <option value=''></option>
 121 <?php
 122   foreach ($my_files as $filename) {
 123     echo "    <option value='" . htmlspecialchars($filename, ENT_QUOTES) . "'";
 124     if ($filename == $form_filename) echo " selected";
 125     echo ">" . htmlspecialchars($filename) . "</option>\n";
 126   }
 127 ?>
 128    </select>
 129    <br />
 130    <textarea name='form_filedata' rows='30' style='width:100%'><?php
 131   if ($form_filename) {
 132     echo htmlspecialchars(@file_get_contents($filepath));
 133   }
 134 ?></textarea>
 135   </td>
 136  </tr>
 137
 138  <tr bgcolor='#dddddd' class='dehead'>
 139   <td colspan='2' align='center'><?php echo htmlspecialchars(xl('Upload Image to') . " $imagedir"); ?></td>
 140  </tr>
 141
 142  <tr>
 143   <td valign='top' class='detail' nowrap>
 144    <?php echo htmlspecialchars(xl('Source File')); ?>:
 145    <input type="hidden" name="MAX_FILE_SIZE" value="12000000" />
 146    <input type="file" name="form_image" size="40" />&nbsp;
 147    <?php echo htmlspecialchars(xl('Destination Filename')) ?>:
 148    <select name='form_dest_filename'>
 149     <option value=''>(<?php echo htmlspecialchars(xl('Use source filename')) ?>)</option>
 150 <?php
 151   // Generate an <option> for each file already in the images directory.
 152   $dh = opendir($imagedir);
 153   if (!$dh) die(htmlspecialchars(xl('Cannot read directory') . " '$imagedir'"));
 154   $imagesslist = array();
 155   while (false !== ($sfname = readdir($dh))) {
 156     if (substr($sfname, 0, 1) == '.') continue;
 157     if ($sfname == 'CVS'            ) continue;
 158     $imageslist[$sfname] = $sfname;
 159   }
 160   closedir($dh);
 161   ksort($imageslist);
 162   foreach ($imageslist as $sfname) {
 163     echo "    <option value='" . htmlspecialchars($sfname, ENT_QUOTES) . "'";
 164     echo ">" . htmlspecialchars($sfname) . "</option>\n";
 165   }
 166 ?>
 167    </select>
 168   </td>
 169  </tr>
 170
 171 </table>
 172
 173 <p>
 174 <input type='submit' name='bn_save' value='<?php echo htmlspecialchars(xl('Save')) ?>' />
 175 </p>
 176
 177 </center>
 178
 179 </form>
 180 </body>
 181 </html>
 182