mod/url/locallib.php

   1 <?php
   2
   3 // This file is part of Moodle - http://moodle.org/
   4 //
   5 // Moodle is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // Moodle is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // You should have received a copy of the GNU General Public License
  16 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  17
  18 /**
  19  * Private url module utility functions
  20  *
  21  * @package    mod_url
  22  * @copyright  2009 Petr Skoda  {@link http://skodak.org}
  23  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  24  */
  25
  26 defined('MOODLE_INTERNAL') || die;
  27
  28 require_once("$CFG->libdir/filelib.php");
  29 require_once("$CFG->libdir/resourcelib.php");
  30 require_once("$CFG->dirroot/mod/url/lib.php");
  31
  32 /**
  33  * This methods does weak url validation, we are looking for major problems only,
  34  * no strict RFE validation.
  35  *
  36  * @param $url
  37  * @return bool true is seems valid, false if definitely not valid URL
  38  */
  39 function url_appears_valid_url($url) {
  40     if (preg_match('/^(\/|https?:|ftp:)/i', $url)) {
  41         // note: this is not exact validation, we look for severely malformed URLs only
  42         return (bool) preg_match('/^[a-z]+:\/\/([^:@\s]+:[^@\s]+@)?[^ @]+(:[0-9]+)?(\/[^#]*)?(#.*)?$/i', $url);
  43     } else {
  44         return (bool)preg_match('/^[a-z]+:\/\/...*$/i', $url);
  45     }
  46 }
  47
  48 /**
  49  * Fix common URL problems that we want teachers to see fixed
  50  * the next time they edit the resource.
  51  *
  52  * This function does not include any XSS protection.
  53  *
  54  * @param string $url
  55  * @return string
  56  */
  57 function url_fix_submitted_url($url) {
  58     // note: empty urls are prevented in form validation
  59     $url = trim($url);
  60
  61     // remove encoded entities - we want the raw URI here
  62     $url = html_entity_decode($url, ENT_QUOTES, 'UTF-8');
  63
  64     if (!preg_match('|^[a-z]+:|i', $url) and !preg_match('|^/|', $url)) {
  65         // invalid URI, try to fix it by making it normal URL,
  66         // please note relative urls are not allowed, /xx/yy links are ok
  67         $url = 'http://'.$url;
  68     }
  69
  70     return $url;
  71 }
  72
  73 /**
  74  * Return full url with all extra parameters
  75  *
  76  * This function does not include any XSS protection.
  77  *
  78  * @param string $url
  79  * @param object $cm
  80  * @param object $course
  81  * @param object $config
  82  * @return string url with & encoded as &amp;
  83  */
  84 function url_get_full_url($url, $cm, $course, $config=null) {
  85
  86     $parameters = empty($url->parameters) ? [] : (array) unserialize_array($url->parameters);
  87
  88     // make sure there are no encoded entities, it is ok to do this twice
  89     $fullurl = html_entity_decode($url->externalurl, ENT_QUOTES, 'UTF-8');
  90
  91     $letters = '\pL';
  92     $latin = 'a-zA-Z';
  93     $digits = '0-9';
  94     $symbols = '\x{20E3}\x{00AE}\x{00A9}\x{203C}\x{2047}\x{2048}\x{2049}\x{3030}\x{303D}\x{2139}\x{2122}\x{3297}\x{3299}' .
  95                '\x{2300}-\x{23FF}\x{2600}-\x{27BF}\x{2B00}-\x{2BF0}';
  96     $arabic = '\x{FE00}-\x{FEFF}';
  97     $math = '\x{2190}-\x{21FF}\x{2900}-\x{297F}';
  98     $othernumbers = '\x{2460}-\x{24FF}';
  99     $geometric = '\x{25A0}-\x{25FF}';
 100     $emojis = '\x{1F000}-\x{1F6FF}';
 101
 102     if (preg_match('/^(\/|https?:|ftp:)/i', $fullurl) or preg_match('|^/|', $fullurl)) {
 103         // encode extra chars in URLs - this does not make it always valid, but it helps with some UTF-8 problems
 104         // Thanks to 💩.la emojis count as valid, too.
 105         $allowed = "[" . $letters . $latin . $digits . $symbols . $arabic . $math . $othernumbers . $geometric .
 106             $emojis . "]" . preg_quote(';/?:@=&$_.+!*(),-#%', '/');
 107         $fullurl = preg_replace_callback("/[^$allowed]/u", 'url_filter_callback', $fullurl);
 108     } else {
 109         // encode special chars only
 110         $fullurl = str_replace('"', '%22', $fullurl);
 111         $fullurl = str_replace('\'', '%27', $fullurl);
 112         $fullurl = str_replace(' ', '%20', $fullurl);
 113         $fullurl = str_replace('<', '%3C', $fullurl);
 114         $fullurl = str_replace('>', '%3E', $fullurl);
 115     }
 116
 117     // add variable url parameters
 118     if (!empty($parameters)) {
 119         if (!$config) {
 120             $config = get_config('url');
 121         }
 122         $paramvalues = url_get_variable_values($url, $cm, $course, $config);
 123
 124         foreach ($parameters as $parse=>$parameter) {
 125             if (isset($paramvalues[$parameter])) {
 126                 $parameters[$parse] = rawurlencode($parse).'='.rawurlencode($paramvalues[$parameter]);
 127             } else {
 128                 unset($parameters[$parse]);
 129             }
 130         }
 131
 132         if (!empty($parameters)) {
 133             if (stripos($fullurl, 'teamspeak://') === 0) {
 134                 $fullurl = $fullurl.'?'.implode('?', $parameters);
 135             } else {
 136                 $join = (strpos($fullurl, '?') === false) ? '?' : '&';
 137                 $fullurl = $fullurl.$join.implode('&', $parameters);
 138             }
 139         }
 140     }
 141
 142     // encode all & to &amp; entity
 143     $fullurl = str_replace('&', '&amp;', $fullurl);
 144
 145     return $fullurl;
 146 }
 147
 148 /**
 149  * Unicode encoding helper callback
 150  * @internal
 151  * @param array $matches
 152  * @return string
 153  */
 154 function url_filter_callback($matches) {
 155     return rawurlencode($matches[0]);
 156 }
 157
 158 /**
 159  * Print url header.
 160  * @param object $url
 161  * @param object $cm
 162  * @param object $course
 163  * @return void
 164  */
 165 function url_print_header($url, $cm, $course) {
 166     global $PAGE, $OUTPUT;
 167
 168     $PAGE->set_title($course->shortname.': '.$url->name);
 169     $PAGE->set_heading($course->fullname);
 170     $PAGE->set_activity_record($url);
 171     echo $OUTPUT->header();
 172 }
 173
 174 /**
 175  * Print url heading.
 176  * @param object $url
 177  * @param object $cm
 178  * @param object $course
 179  * @param bool $notused This variable is no longer used.
 180  * @return void
 181  */
 182 function url_print_heading($url, $cm, $course, $notused = false) {
 183     global $OUTPUT;
 184     echo $OUTPUT->heading(format_string($url->name), 2);
 185 }
 186
 187 /**
 188  * Print url introduction.
 189  * @param object $url
 190  * @param object $cm
 191  * @param object $course
 192  * @param bool $ignoresettings print even if not specified in modedit
 193  * @return void
 194  */
 195 function url_print_intro($url, $cm, $course, $ignoresettings=false) {
 196     global $OUTPUT;
 197
 198     $options = empty($url->displayoptions) ? [] : (array) unserialize_array($url->displayoptions);
 199     if ($ignoresettings or !empty($options['printintro'])) {
 200         if (trim(strip_tags($url->intro))) {
 201             echo $OUTPUT->box_start('mod_introbox', 'urlintro');
 202             echo format_module_intro('url', $url, $cm->id);
 203             echo $OUTPUT->box_end();
 204         }
 205     }
 206 }
 207
 208 /**
 209  * Display url frames.
 210  * @param object $url
 211  * @param object $cm
 212  * @param object $course
 213  * @return does not return
 214  */
 215 function url_display_frame($url, $cm, $course) {
 216     global $PAGE, $OUTPUT, $CFG;
 217
 218     $frame = optional_param('frameset', 'main', PARAM_ALPHA);
 219
 220     if ($frame === 'top') {
 221         $PAGE->set_pagelayout('frametop');
 222         url_print_header($url, $cm, $course);
 223         url_print_heading($url, $cm, $course);
 224         url_print_intro($url, $cm, $course);
 225         echo $OUTPUT->footer();
 226         die;
 227
 228     } else {
 229         $config = get_config('url');
 230         $context = context_module::instance($cm->id);
 231         $exteurl = url_get_full_url($url, $cm, $course, $config);
 232         $navurl = "$CFG->wwwroot/mod/url/view.php?id=$cm->id&amp;frameset=top";
 233         $coursecontext = context_course::instance($course->id);
 234         $courseshortname = format_string($course->shortname, true, array('context' => $coursecontext));
 235         $title = strip_tags($courseshortname.': '.format_string($url->name));
 236         $framesize = $config->framesize;
 237         $modulename = s(get_string('modulename','url'));
 238         $contentframetitle = s(format_string($url->name));
 239         $dir = get_string('thisdirection', 'langconfig');
 240
 241         $extframe = <<<EOF
 242 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Frameset//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-frameset.dtd">
 243 <html dir="$dir">
 244   <head>
 245     <meta http-equiv="content-type" content="text/html; charset=utf-8" />
 246     <title>$title</title>
 247   </head>
 248   <frameset rows="$framesize,*">
 249     <frame src="$navurl" title="$modulename"/>
 250     <frame src="$exteurl" title="$contentframetitle"/>
 251   </frameset>
 252 </html>
 253 EOF;
 254
 255         @header('Content-Type: text/html; charset=utf-8');
 256         echo $extframe;
 257         die;
 258     }
 259 }
 260
 261 /**
 262  * Print url info and link.
 263  * @param object $url
 264  * @param object $cm
 265  * @param object $course
 266  * @return does not return
 267  */
 268 function url_print_workaround($url, $cm, $course) {
 269     global $OUTPUT, $USER;
 270
 271     url_print_header($url, $cm, $course);
 272     url_print_heading($url, $cm, $course, true);
 273
 274     // Display any activity information (eg completion requirements / dates).
 275     $cminfo = cm_info::create($cm);
 276     $completiondetails = \core_completion\cm_completion_details::get_instance($cminfo, $USER->id);
 277     $activitydates = \core\activity_dates::get_dates_for_module($cminfo, $USER->id);
 278     echo $OUTPUT->activity_information($cminfo, $completiondetails, $activitydates);
 279
 280     url_print_intro($url, $cm, $course, true);
 281
 282     $fullurl = url_get_full_url($url, $cm, $course);
 283
 284     $display = url_get_final_display_type($url);
 285     if ($display == RESOURCELIB_DISPLAY_POPUP) {
 286         $jsfullurl = addslashes_js($fullurl);
 287         $options = empty($url->displayoptions) ? [] : (array) unserialize_array($url->displayoptions);
 288         $width  = empty($options['popupwidth'])  ? 620 : $options['popupwidth'];
 289         $height = empty($options['popupheight']) ? 450 : $options['popupheight'];
 290         $wh = "width=$width,height=$height,toolbar=no,location=no,menubar=no,copyhistory=no,status=no,directories=no,scrollbars=yes,resizable=yes";
 291         $extra = "onclick=\"window.open('$jsfullurl', '', '$wh'); return false;\"";
 292
 293     } else if ($display == RESOURCELIB_DISPLAY_NEW) {
 294         $extra = "onclick=\"this.target='_blank';\"";
 295
 296     } else {
 297         $extra = '';
 298     }
 299
 300     echo '<div class="urlworkaround">';
 301     print_string('clicktoopen', 'url', "<a href=\"$fullurl\" $extra>$fullurl</a>");
 302     echo '</div>';
 303
 304     echo $OUTPUT->footer();
 305     die;
 306 }
 307
 308 /**
 309  * Display embedded url file.
 310  * @param object $url
 311  * @param object $cm
 312  * @param object $course
 313  * @return does not return
 314  */
 315 function url_display_embed($url, $cm, $course) {
 316     global $PAGE, $OUTPUT, $USER;
 317
 318     $mimetype = resourcelib_guess_url_mimetype($url->externalurl);
 319     $fullurl  = url_get_full_url($url, $cm, $course);
 320     $title    = $url->name;
 321
 322     $link = html_writer::tag('a', $fullurl, array('href'=>str_replace('&amp;', '&', $fullurl)));
 323     $clicktoopen = get_string('clicktoopen', 'url', $link);
 324     $moodleurl = new moodle_url($fullurl);
 325
 326     $extension = resourcelib_get_extension($url->externalurl);
 327
 328     $mediamanager = core_media_manager::instance($PAGE);
 329     $embedoptions = array(
 330         core_media_manager::OPTION_TRUSTED => true,
 331         core_media_manager::OPTION_BLOCK => true
 332     );
 333
 334     if (in_array($mimetype, array('image/gif','image/jpeg','image/png'))) {  // It's an image
 335         $code = resourcelib_embed_image($fullurl, $title);
 336
 337     } else if ($mediamanager->can_embed_url($moodleurl, $embedoptions)) {
 338         // Media (audio/video) file.
 339         $code = $mediamanager->embed_url($moodleurl, $title, 0, 0, $embedoptions);
 340
 341     } else {
 342         // anything else - just try object tag enlarged as much as possible
 343         $code = resourcelib_embed_general($fullurl, $title, $clicktoopen, $mimetype);
 344     }
 345
 346     url_print_header($url, $cm, $course);
 347     url_print_heading($url, $cm, $course);
 348
 349     // Display any activity information (eg completion requirements / dates).
 350     $cminfo = cm_info::create($cm);
 351     $completiondetails = \core_completion\cm_completion_details::get_instance($cminfo, $USER->id);
 352     $activitydates = \core\activity_dates::get_dates_for_module($cminfo, $USER->id);
 353     echo $OUTPUT->activity_information($cminfo, $completiondetails, $activitydates);
 354
 355     echo $code;
 356
 357     url_print_intro($url, $cm, $course);
 358
 359     echo $OUTPUT->footer();
 360     die;
 361 }
 362
 363 /**
 364  * Decide the best display format.
 365  * @param object $url
 366  * @return int display type constant
 367  */
 368 function url_get_final_display_type($url) {
 369     global $CFG;
 370
 371     if ($url->display != RESOURCELIB_DISPLAY_AUTO) {
 372         return $url->display;
 373     }
 374
 375     // detect links to local moodle pages
 376     if (strpos($url->externalurl, $CFG->wwwroot) === 0) {
 377         if (strpos($url->externalurl, 'file.php') === false and strpos($url->externalurl, '.php') !== false ) {
 378             // most probably our moodle page with navigation
 379             return RESOURCELIB_DISPLAY_OPEN;
 380         }
 381     }
 382
 383     // Binaries and other formats that are known to cause trouble for external links.
 384     static $download = ['application/zip', 'application/x-tar', 'application/g-zip',
 385                         'application/pdf', 'text/html', 'document/unknown'];
 386     static $embed    = array('image/gif', 'image/jpeg', 'image/png', 'image/svg+xml',         // images
 387                              'application/x-shockwave-flash', 'video/x-flv', 'video/x-ms-wm', // video formats
 388                              'video/quicktime', 'video/mpeg', 'video/mp4',
 389                              'audio/mp3', 'audio/x-realaudio-plugin', 'x-realaudio-plugin',   // audio formats,
 390                             );
 391
 392     $mimetype = resourcelib_guess_url_mimetype($url->externalurl);
 393
 394     if (in_array($mimetype, $download)) {
 395         return RESOURCELIB_DISPLAY_DOWNLOAD;
 396     }
 397     if (in_array($mimetype, $embed)) {
 398         return RESOURCELIB_DISPLAY_EMBED;
 399     }
 400
 401     // let the browser deal with it somehow
 402     return RESOURCELIB_DISPLAY_OPEN;
 403 }
 404
 405 /**
 406  * Get the parameters that may be appended to URL
 407  * @param object $config url module config options
 408  * @return array array describing opt groups
 409  */
 410 function url_get_variable_options($config) {
 411     global $CFG;
 412
 413     $options = array();
 414     $options[''] = array('' => get_string('chooseavariable', 'url'));
 415
 416     $options[get_string('course')] = array(
 417         'courseid'        => 'id',
 418         'coursefullname'  => get_string('fullnamecourse'),
 419         'courseshortname' => get_string('shortnamecourse'),
 420         'courseidnumber'  => get_string('idnumbercourse'),
 421         'coursesummary'   => get_string('summary'),
 422         'courseformat'    => get_string('format'),
 423     );
 424
 425     $options[get_string('modulename', 'url')] = array(
 426         'urlinstance'     => 'id',
 427         'urlcmid'         => 'cmid',
 428         'urlname'         => get_string('name'),
 429         'urlidnumber'     => get_string('idnumbermod'),
 430     );
 431
 432     $options[get_string('miscellaneous')] = array(
 433         'sitename'        => get_string('fullsitename'),
 434         'serverurl'       => get_string('serverurl', 'url'),
 435         'currenttime'     => get_string('time'),
 436         'lang'            => get_string('language'),
 437     );
 438     if (!empty($config->secretphrase)) {
 439         $options[get_string('miscellaneous')]['encryptedcode'] = get_string('encryptedcode');
 440     }
 441
 442     $options[get_string('user')] = array(
 443         'userid'          => 'id',
 444         'userusername'    => get_string('username'),
 445         'useridnumber'    => get_string('idnumber'),
 446         'userfirstname'   => get_string('firstname'),
 447         'userlastname'    => get_string('lastname'),
 448         'userfullname'    => get_string('fullnameuser'),
 449         'useremail'       => get_string('email'),
 450         'userphone1'      => get_string('phone1'),
 451         'userphone2'      => get_string('phone2'),
 452         'userinstitution' => get_string('institution'),
 453         'userdepartment'  => get_string('department'),
 454         'useraddress'     => get_string('address'),
 455         'usercity'        => get_string('city'),
 456         'usertimezone'    => get_string('timezone'),
 457     );
 458
 459     if ($config->rolesinparams) {
 460         $roles = role_fix_names(get_all_roles());
 461         $roleoptions = array();
 462         foreach ($roles as $role) {
 463             $roleoptions['course'.$role->shortname] = get_string('yourwordforx', '', $role->localname);
 464         }
 465         $options[get_string('roles')] = $roleoptions;
 466     }
 467
 468     return $options;
 469 }
 470
 471 /**
 472  * Get the parameter values that may be appended to URL
 473  * @param object $url module instance
 474  * @param object $cm
 475  * @param object $course
 476  * @param object $config module config options
 477  * @return array of parameter values
 478  */
 479 function url_get_variable_values($url, $cm, $course, $config) {
 480     global $USER, $CFG;
 481
 482     $site = get_site();
 483
 484     $coursecontext = context_course::instance($course->id);
 485
 486     $values = array (
 487         'courseid'        => $course->id,
 488         'coursefullname'  => format_string($course->fullname, true, array('context' => $coursecontext)),
 489         'courseshortname' => format_string($course->shortname, true, array('context' => $coursecontext)),
 490         'courseidnumber'  => $course->idnumber,
 491         'coursesummary'   => $course->summary,
 492         'courseformat'    => $course->format,
 493         'lang'            => current_language(),
 494         'sitename'        => format_string($site->fullname, true, array('context' => $coursecontext)),
 495         'serverurl'       => $CFG->wwwroot,
 496         'currenttime'     => time(),
 497         'urlinstance'     => $url->id,
 498         'urlcmid'         => $cm->id,
 499         'urlname'         => format_string($url->name, true, array('context' => $coursecontext)),
 500         'urlidnumber'     => $cm->idnumber,
 501     );
 502
 503     if (isloggedin()) {
 504         $values['userid']          = $USER->id;
 505         $values['userusername']    = $USER->username;
 506         $values['useridnumber']    = $USER->idnumber;
 507         $values['userfirstname']   = $USER->firstname;
 508         $values['userlastname']    = $USER->lastname;
 509         $values['userfullname']    = fullname($USER);
 510         $values['useremail']       = $USER->email;
 511         $values['userphone1']      = $USER->phone1;
 512         $values['userphone2']      = $USER->phone2;
 513         $values['userinstitution'] = $USER->institution;
 514         $values['userdepartment']  = $USER->department;
 515         $values['useraddress']     = $USER->address;
 516         $values['usercity']        = $USER->city;
 517         $now = new DateTime('now', core_date::get_user_timezone_object());
 518         $values['usertimezone']    = $now->getOffset() / 3600.0; // Value in hours for BC.
 519     }
 520
 521     // weak imitation of Single-Sign-On, for backwards compatibility only
 522     // NOTE: login hack is not included in 2.0 any more, new contrib auth plugin
 523     //       needs to be createed if somebody needs the old functionality!
 524     if (!empty($config->secretphrase)) {
 525         $values['encryptedcode'] = url_get_encrypted_parameter($url, $config);
 526     }
 527
 528     //hmm, this is pretty fragile and slow, why do we need it here??
 529     if ($config->rolesinparams) {
 530         $coursecontext = context_course::instance($course->id);
 531         $roles = role_fix_names(get_all_roles($coursecontext), $coursecontext, ROLENAME_ALIAS);
 532         foreach ($roles as $role) {
 533             $values['course'.$role->shortname] = $role->localname;
 534         }
 535     }
 536
 537     return $values;
 538 }
 539
 540 /**
 541  * BC internal function
 542  * @param object $url
 543  * @param object $config
 544  * @return string
 545  */
 546 function url_get_encrypted_parameter($url, $config) {
 547     global $CFG;
 548
 549     if (file_exists("$CFG->dirroot/local/externserverfile.php")) {
 550         require_once("$CFG->dirroot/local/externserverfile.php");
 551         if (function_exists('extern_server_file')) {
 552             return extern_server_file($url, $config);
 553         }
 554     }
 555     return md5(getremoteaddr().$config->secretphrase);
 556 }
 557
 558 /**
 559  * Optimised mimetype detection from general URL
 560  * @param $fullurl
 561  * @param int $size of the icon.
 562  * @return string|null mimetype or null when the filetype is not relevant.
 563  */
 564 function url_guess_icon($fullurl, $size = null) {
 565     global $CFG;
 566     require_once("$CFG->libdir/filelib.php");
 567
 568     if (substr_count($fullurl, '/') < 3 or substr($fullurl, -1) === '/') {
 569         // Most probably default directory - index.php, index.html, etc. Return null because
 570         // we want to use the default module icon instead of the HTML file icon.
 571         return null;
 572     }
 573
 574     try {
 575         // There can be some cases where the url is invalid making parse_url() to return false.
 576         // That will make moodle_url class to throw an exception, so we need to catch the exception to prevent errors.
 577         $moodleurl = new moodle_url($fullurl);
 578         $fullurl = $moodleurl->out_omit_querystring();
 579     } catch (\moodle_exception $e) {
 580         // If an exception is thrown, means the url is invalid. No need to log exception.
 581         return null;
 582     }
 583
 584     $icon = file_extension_icon($fullurl, $size);
 585     $htmlicon = file_extension_icon('.htm', $size);
 586     $unknownicon = file_extension_icon('', $size);
 587     $phpicon = file_extension_icon('.php', $size); // Exception for php files.
 588
 589     // We do not want to return those icon types, the module icon is more appropriate.
 590     if ($icon === $unknownicon || $icon === $htmlicon || $icon === $phpicon) {
 591         return null;
 592     }
 593
 594     return $icon;
 595 }