lib/uploadlib.php

   1 <?php
   2
   3 // This file is part of Moodle - http://moodle.org/
   4 //
   5 // Moodle is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // Moodle is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // You should have received a copy of the GNU General Public License
  16 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  17
  18 /**
  19  * uploadlib.php - This class handles all aspects of fileuploading
  20  *
  21  * @package    core
  22  * @subpackage file
  23  * @copyright  1999 onwards Martin Dougiamas  {@link http://moodle.com}
  24  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  25  */
  26
  27 defined('MOODLE_INTERNAL') || die();
  28
  29 /**
  30  * This class handles all aspects of fileuploading
  31  *
  32  * @package   moodlecore
  33  * @copyright 1999 onwards Martin Dougiamas  {@link http://moodle.com}
  34  * @license   http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  35  */
  36 class upload_manager {
  37
  38    /**
  39     * Array to hold local copies of stuff in $_FILES
  40     * @var array $files
  41     */
  42     var $files;
  43    /**
  44     * Holds all configuration stuff
  45     * @var array $config
  46     */
  47     var $config;
  48    /**
  49     * Keep track of if we're ok
  50     * (errors for each file are kept in $files['whatever']['uploadlog']
  51     * @var boolean $status
  52     */
  53     var $status;
  54    /**
  55     * The course this file has been uploaded for. {@link $COURSE}
  56     * (for logging and virus notifications)
  57     * @var course $course
  58     */
  59     var $course;
  60    /**
  61     * If we're only getting one file.
  62     * (for logging and virus notifications)
  63     * @var string $inputname
  64     */
  65     var $inputname;
  66    /**
  67     * If we're given silent=true in the constructor, this gets built
  68     * up to hold info about the process.
  69     * @var string $notify
  70     */
  71     var $notify;
  72
  73     /**
  74      * Constructor, sets up configuration stuff so we know how to act.
  75      *
  76      * Note: destination not taken as parameter as some modules want to use the insertid in the path and we need to check the other stuff first.
  77      *
  78      * @uses $CFG
  79      * @param string $inputname If this is given the upload manager will only process the file in $_FILES with this name.
  80      * @param boolean $deleteothers Whether to delete other files in the destination directory (optional, defaults to false)
  81      * @param boolean $handlecollisions Whether to use {@link handle_filename_collision()} or not. (optional, defaults to false)
  82      * @param course $course The course the files are being uploaded for (for logging and virus notifications) {@link $COURSE}
  83      * @param boolean $recoverifmultiple If we come across a virus, or if a file doesn't validate or whatever, do we continue? optional, defaults to true.
  84      * @param int $modbytes Max bytes for this module - this and $course->maxbytes are used to get the maxbytes from {@link get_max_upload_file_size()}.
  85      * @param boolean $silent Whether to notify errors or not.
  86      * @param boolean $allownull Whether we care if there's no file when we've set the input name.
  87      * @param boolean $allownullmultiple Whether we care if there's no files AT ALL  when we've got multiples. This won't complain if we have file 1 and file 3 but not file 2, only for NO FILES AT ALL.
  88      */
  89     function upload_manager($inputname='', $deleteothers=false, $handlecollisions=false, $course=null, $recoverifmultiple=false, $modbytes=0, $silent=false, $allownull=false, $allownullmultiple=true) {
  90
  91         global $CFG, $SITE;
  92
  93         if (empty($course->id)) {
  94             $course = $SITE;
  95         }
  96
  97         $this->config->deleteothers = $deleteothers;
  98         $this->config->handlecollisions = $handlecollisions;
  99         $this->config->recoverifmultiple = $recoverifmultiple;
 100         $this->config->maxbytes = get_max_upload_file_size($CFG->maxbytes, $course->maxbytes, $modbytes);
 101         $this->config->silent = $silent;
 102         $this->config->allownull = $allownull;
 103         $this->files = array();
 104         $this->status = false;
 105         $this->course = $course;
 106         $this->inputname = $inputname;
 107         if (empty($this->inputname)) {
 108             $this->config->allownull = $allownullmultiple;
 109         }
 110     }
 111
 112     /**
 113      * Gets all entries out of $_FILES and stores them locally in $files and then
 114      * checks each one against {@link get_max_upload_file_size()} and calls {@link cleanfilename()}
 115      * and scans them for viruses etc.
 116      * @uses $CFG
 117      * @uses $_FILES
 118      * @return boolean
 119      */
 120     function preprocess_files() {
 121         global $CFG, $OUTPUT;
 122
 123         foreach ($_FILES as $name => $file) {
 124             $this->status = true; // only set it to true here so that we can check if this function has been called.
 125             if (empty($this->inputname) || $name == $this->inputname) { // if we have input name, only process if it matches.
 126                 $file['originalname'] = $file['name']; // do this first for the log.
 127                 $this->files[$name] = $file; // put it in first so we can get uploadlog out in print_upload_log.
 128                 $this->files[$name]['uploadlog'] = ''; // initialize error log
 129                 $this->status = $this->validate_file($this->files[$name]); // default to only allowing empty on multiple uploads.
 130                 if (!$this->status && ($this->files[$name]['error'] == 0 || $this->files[$name]['error'] == 4) && ($this->config->allownull || empty($this->inputname))) {
 131                     // this shouldn't cause everything to stop.. modules should be responsible for knowing which if any are compulsory.
 132                     continue;
 133                 }
 134                 if ($this->status && !empty($CFG->runclamonupload)) {
 135                     $this->status = clam_scan_moodle_file($this->files[$name],$this->course);
 136                 }
 137                 if (!$this->status) {
 138                     if (!$this->config->recoverifmultiple && count($this->files) > 1) {
 139                         $a = new stdClass();
 140                         $a->name    = $this->files[$name]['originalname'];
 141                         $a->problem = $this->files[$name]['uploadlog'];
 142                         if (!$this->config->silent) {
 143                             echo $OUTPUT->notification(get_string('uploadfailednotrecovering','moodle',$a));
 144                         }
 145                         else {
 146                             $this->notify .= '<br />'. get_string('uploadfailednotrecovering','moodle',$a);
 147                         }
 148                         $this->status = false;
 149                         return false;
 150
 151                     } else if (count($this->files) == 1) {
 152
 153                         if (!$this->config->silent and !$this->config->allownull) {
 154                             echo $OUTPUT->notification($this->files[$name]['uploadlog']);
 155                         } else {
 156                             $this->notify .= '<br />'. $this->files[$name]['uploadlog'];
 157                         }
 158                         $this->status = false;
 159                         return false;
 160                     }
 161                 }
 162                 else {
 163                     $newname = clean_filename($this->files[$name]['name']);
 164                     if ($newname != $this->files[$name]['name']) {
 165                         $a = new stdClass();
 166                         $a->oldname = $this->files[$name]['name'];
 167                         $a->newname = $newname;
 168                         $this->files[$name]['uploadlog'] .= get_string('uploadrenamedchars','moodle', $a);
 169                     }
 170                     $this->files[$name]['name'] = $newname;
 171                     $this->files[$name]['clear'] = true; // ok to save.
 172                     $this->config->somethingtosave = true;
 173                 }
 174             }
 175         }
 176         if (!is_array($_FILES) || count($_FILES) == 0) {
 177             return $this->config->allownull;
 178         }
 179         $this->status = true;
 180         return true; // if we've got this far it means that we're recovering so we want status to be ok.
 181     }
 182
 183     /**
 184      * Validates a single file entry from _FILES
 185      *
 186      * @param object $file The entry from _FILES to validate
 187      * @return boolean True if ok.
 188      */
 189     function validate_file(&$file) {
 190         if (empty($file)) {
 191             return false;
 192         }
 193         if (!is_uploaded_file($file['tmp_name']) || $file['size'] == 0) {
 194             $file['uploadlog'] .= "\n".$this->get_file_upload_error($file);
 195             return false;
 196         }
 197         if ($file['size'] > $this->config->maxbytes) {
 198             $file['uploadlog'] .= "\n". get_string('uploadedfiletoobig', 'moodle', $this->config->maxbytes);
 199             return false;
 200         }
 201         return true;
 202     }
 203
 204     /**
 205      * Moves all the files to the destination directory.
 206      *
 207      * @uses $CFG
 208      * @uses $USER
 209      * @param string $destination The destination directory.
 210      * @return boolean status;
 211      */
 212     function save_files($destination) {
 213         global $CFG, $USER, $OUTPUT;
 214
 215         if (!$this->status) { // preprocess_files hasn't been run
 216             $this->preprocess_files();
 217         }
 218
 219         // if there are no files, bail before we create an empty directory.
 220         if (empty($this->config->somethingtosave)) {
 221             return true;
 222         }
 223
 224         $savedsomething = false;
 225
 226         if ($this->status) {
 227             if (!(strpos($destination, $CFG->dataroot) === false)) {
 228                 // take it out for giving to make_upload_directory
 229                 $destination = substr($destination, strlen($CFG->dataroot)+1);
 230             }
 231
 232             if ($destination{strlen($destination)-1} == '/') { // strip off a trailing / if we have one
 233                 $destination = substr($destination, 0, -1);
 234             }
 235
 236             if (!make_upload_directory($destination, true)) { //TODO maybe put this function here instead of moodlelib.php now.
 237                 $this->status = false;
 238                 return false;
 239             }
 240
 241             $destination = $CFG->dataroot .'/'. $destination; // now add it back in so we have a full path
 242
 243             $exceptions = array(); //need this later if we're deleting other files.
 244
 245             foreach (array_keys($this->files) as $i) {
 246
 247                 if (!$this->files[$i]['clear']) {
 248                     // not ok to save
 249                     continue;
 250                 }
 251
 252                 if ($this->config->handlecollisions) {
 253                     $this->handle_filename_collision($destination, $this->files[$i]);
 254                 }
 255                 if (move_uploaded_file($this->files[$i]['tmp_name'], $destination.'/'.$this->files[$i]['name'])) {
 256                     chmod($destination .'/'. $this->files[$i]['name'], $CFG->directorypermissions);
 257                     $this->files[$i]['fullpath'] = $destination.'/'.$this->files[$i]['name'];
 258                     $this->files[$i]['uploadlog'] .= "\n".get_string('uploadedfile');
 259                     $this->files[$i]['saved'] = true;
 260                     $exceptions[] = $this->files[$i]['name'];
 261                     // now add it to the log (this is important so we know who to notify if a virus is found later on)
 262                     clam_log_upload($this->files[$i]['fullpath'], $this->course);
 263                     $savedsomething=true;
 264                 }
 265             }
 266             if ($savedsomething && $this->config->deleteothers) {
 267                 $this->delete_other_files($destination, $exceptions);
 268             }
 269         }
 270         if (empty($savedsomething)) {
 271             $this->status = false;
 272             if ((empty($this->config->allownull) && !empty($this->inputname)) || (empty($this->inputname) && empty($this->config->allownullmultiple))) {
 273                 echo $OUTPUT->notification(get_string('uploadnofilefound'));
 274             }
 275             return false;
 276         }
 277         return $this->status;
 278     }
 279
 280     /**
 281      * Wrapper function that calls {@link preprocess_files()} and {@link viruscheck_files()} and then {@link save_files()}
 282      * Modules that require the insert id in the filepath should not use this and call these functions seperately in the required order.
 283      * @parameter string $destination Where to save the uploaded files to.
 284      * @return boolean
 285      */
 286     function process_file_uploads($destination) {
 287         if ($this->preprocess_files()) {
 288             return $this->save_files($destination);
 289         }
 290         return false;
 291     }
 292
 293     /**
 294      * Deletes all the files in a given directory except for the files in $exceptions (full paths)
 295      *
 296      * @param string $destination The directory to clean up.
 297      * @param array $exceptions Full paths of files to KEEP.
 298      */
 299     function delete_other_files($destination, $exceptions=null) {
 300         global $OUTPUT;
 301         $deletedsomething = false;
 302         if ($filestodel = get_directory_list($destination)) {
 303             foreach ($filestodel as $file) {
 304                 if (!is_array($exceptions) || !in_array($file, $exceptions)) {
 305                     unlink($destination .'/'. $file);
 306                     $deletedsomething = true;
 307                 }
 308             }
 309         }
 310         if ($deletedsomething) {
 311             if (!$this->config->silent) {
 312                 echo $OUTPUT->notification(get_string('uploadoldfilesdeleted'));
 313             }
 314             else {
 315                 $this->notify .= '<br />'. get_string('uploadoldfilesdeleted');
 316             }
 317         }
 318     }
 319
 320     /**
 321      * Handles filename collisions - if the desired filename exists it will rename it according to the pattern in $format
 322      * @param string $destination Destination directory (to check existing files against)
 323      * @param object $file Passed in by reference. The current file from $files we're processing.
 324      * @return void - modifies &$file parameter.
 325      */
 326     function handle_filename_collision($destination, &$file) {
 327         if (!file_exists($destination .'/'. $file['name'])) {
 328             return;
 329         }
 330
 331         $parts     = explode('.', $file['name']);
 332         if (count($parts) > 1) {
 333             $extension = '.'.array_pop($parts);
 334             $name      = implode('.', $parts);
 335         } else {
 336             $extension = '';
 337             $name      = $file['name'];
 338         }
 339
 340         $current = 0;
 341         if (preg_match('/^(.*)_(\d*)$/s', $name, $matches)) {
 342             $name    = $matches[1];
 343             $current = (int)$matches[2];
 344         }
 345         $i = $current + 1;
 346
 347         while (!$this->check_before_renaming($destination, $name.'_'.$i.$extension, $file)) {
 348             $i++;
 349         }
 350         $a = new stdClass();
 351         $a->oldname = $file['name'];
 352         $file['name'] = $name.'_'.$i.$extension;
 353         $a->newname = $file['name'];
 354         $file['uploadlog'] .= "\n". get_string('uploadrenamedcollision','moodle', $a);
 355     }
 356
 357     /**
 358      * This function checks a potential filename against what's on the filesystem already and what's been saved already.
 359      * @param string $destination Destination directory (to check existing files against)
 360      * @param string $nametocheck The filename to be compared.
 361      * @param object $file The current file from $files we're processing.
 362      * return boolean
 363      */
 364     function check_before_renaming($destination, $nametocheck, $file) {
 365         if (!file_exists($destination .'/'. $nametocheck)) {
 366             return true;
 367         }
 368         if ($this->config->deleteothers) {
 369             foreach ($this->files as $tocheck) {
 370                 // if we're deleting files anyway, it's not THIS file and we care about it and it has the same name and has already been saved..
 371                 if ($file['tmp_name'] != $tocheck['tmp_name'] && $tocheck['clear'] && $nametocheck == $tocheck['name'] && $tocheck['saved']) {
 372                     $collision = true;
 373                 }
 374             }
 375             if (!$collision) {
 376                 return true;
 377             }
 378         }
 379         return false;
 380     }
 381
 382     /**
 383      * ?
 384      *
 385      * @param object $file Passed in by reference. The current file from $files we're processing.
 386      * @return string
 387      * @todo Finish documenting this function
 388      */
 389     function get_file_upload_error(&$file) {
 390
 391         switch ($file['error']) {
 392         case 0: // UPLOAD_ERR_OK
 393             if ($file['size'] > 0) {
 394                 $errmessage = get_string('uploadproblem', $file['name']);
 395             } else {
 396                 $errmessage = get_string('uploadnofilefound'); /// probably a dud file name
 397             }
 398             break;
 399
 400         case 1: // UPLOAD_ERR_INI_SIZE
 401             $errmessage = get_string('uploadserverlimit');
 402             break;
 403
 404         case 2: // UPLOAD_ERR_FORM_SIZE
 405             $errmessage = get_string('uploadformlimit');
 406             break;
 407
 408         case 3: // UPLOAD_ERR_PARTIAL
 409             $errmessage = get_string('uploadpartialfile');
 410             break;
 411
 412         case 4: // UPLOAD_ERR_NO_FILE
 413             $errmessage = get_string('uploadnofilefound');
 414             break;
 415
 416         // Note: there is no error with a value of 5
 417
 418         case 6: // UPLOAD_ERR_NO_TMP_DIR
 419             $errmessage = get_string('uploadnotempdir');
 420             break;
 421
 422         case 7: // UPLOAD_ERR_CANT_WRITE
 423             $errmessage = get_string('uploadcantwrite');
 424             break;
 425
 426         case 8: // UPLOAD_ERR_EXTENSION
 427             $errmessage = get_string('uploadextension');
 428             break;
 429
 430         default:
 431             $errmessage = get_string('uploadproblem', $file['name']);
 432         }
 433         return $errmessage;
 434     }
 435
 436     /**
 437      * prints a log of everything that happened (of interest) to each file in _FILES
 438      * @param $return - optional, defaults to false (log is echoed)
 439      */
 440     function print_upload_log($return=false,$skipemptyifmultiple=false) {
 441         $str = '';
 442         foreach (array_keys($this->files) as $i => $key) {
 443             if (count($this->files) > 1 && !empty($skipemptyifmultiple) && $this->files[$key]['error'] == 4) {
 444                 continue;
 445             }
 446             $str .= '<strong>'. get_string('uploadfilelog', 'moodle', $i+1) .' '
 447                 .((!empty($this->files[$key]['originalname'])) ? '('.$this->files[$key]['originalname'].')' : '')
 448                 .'</strong> :'. nl2br($this->files[$key]['uploadlog']) .'<br />';
 449         }
 450         if ($return) {
 451             return $str;
 452         }
 453         echo $str;
 454     }
 455
 456     /**
 457      * If we're only handling one file (if inputname was given in the constructor) this will return the (possibly changed) filename of the file.
 458      @return boolean
 459      */
 460     function get_new_filename() {
 461         if (!empty($this->inputname) and count($this->files) == 1 and $this->files[$this->inputname]['error'] != 4) {
 462             return $this->files[$this->inputname]['name'];
 463         }
 464         return false;
 465     }
 466
 467     /**
 468      * If we're only handling one file (if input name was given in the constructor) this will return the full path to the saved file.
 469      * @return boolean
 470      */
 471     function get_new_filepath() {
 472         if (!empty($this->inputname) and count($this->files) == 1 and $this->files[$this->inputname]['error'] != 4) {
 473             return $this->files[$this->inputname]['fullpath'];
 474         }
 475         return false;
 476     }
 477
 478     /**
 479      * If we're only handling one file (if inputname was given in the constructor) this will return the ORIGINAL filename of the file.
 480      * @return boolean
 481      */
 482     function get_original_filename() {
 483         if (!empty($this->inputname) and count($this->files) == 1 and $this->files[$this->inputname]['error'] != 4) {
 484             return $this->files[$this->inputname]['originalname'];
 485         }
 486         return false;
 487     }
 488
 489     /**
 490      * This function returns any errors wrapped up in red.
 491      * @return string
 492      */
 493     function get_errors() {
 494         if (!empty($this->notify)) {
 495             return '<p class="notifyproblem">'. $this->notify .'</p>';
 496         } else {
 497             return null;
 498         }
 499     }
 500 }
 501
 502 /**************************************************************************************
 503 THESE FUNCTIONS ARE OUTSIDE THE CLASS BECAUSE THEY NEED TO BE CALLED FROM OTHER PLACES.
 504 FOR EXAMPLE CLAM_HANDLE_INFECTED_FILE AND CLAM_REPLACE_INFECTED_FILE USED FROM CRON
 505 UPLOAD_PRINT_FORM_FRAGMENT DOESN'T REALLY BELONG IN THE CLASS BUT CERTAINLY IN THIS FILE
 506 ***************************************************************************************/
 507
 508 /**
 509  * Deals with an infected file - either moves it to a quarantinedir
 510  * (specified in CFG->quarantinedir) or deletes it.
 511  *
 512  * If moving it fails, it deletes it.
 513  *
 514  * @global object
 515  * @global object
 516  * @param string $file Full path to the file
 517  * @param int $userid If not used, defaults to $USER->id (there in case called from cron)
 518  * @param boolean $basiconly Admin level reporting or user level reporting.
 519  * @return string Details of what the function did.
 520  */
 521 function clam_handle_infected_file($file, $userid=0, $basiconly=false) {
 522
 523     global $CFG, $USER;
 524     if ($USER && !$userid) {
 525         $userid = $USER->id;
 526     }
 527     $delete = true;
 528     if (file_exists($CFG->quarantinedir) && is_dir($CFG->quarantinedir) && is_writable($CFG->quarantinedir)) {
 529         $now = date('YmdHis');
 530         if (rename($file, $CFG->quarantinedir .'/'. $now .'-user-'. $userid .'-infected')) {
 531             $delete = false;
 532             clam_log_infected($file, $CFG->quarantinedir.'/'. $now .'-user-'. $userid .'-infected', $userid);
 533             if ($basiconly) {
 534                 $notice .= "\n". get_string('clammovedfilebasic');
 535             }
 536             else {
 537                 $notice .= "\n". get_string('clammovedfile', 'moodle', $CFG->quarantinedir.'/'. $now .'-user-'. $userid .'-infected');
 538             }
 539         }
 540         else {
 541             if ($basiconly) {
 542                 $notice .= "\n". get_string('clamdeletedfile');
 543             }
 544             else {
 545                 $notice .= "\n". get_string('clamquarantinedirfailed', 'moodle', $CFG->quarantinedir);
 546             }
 547         }
 548     }
 549     else {
 550         if ($basiconly) {
 551             $notice .= "\n". get_string('clamdeletedfile');
 552         }
 553         else {
 554             $notice .= "\n". get_string('clamquarantinedirfailed', 'moodle', $CFG->quarantinedir);
 555         }
 556     }
 557     if ($delete) {
 558         if (unlink($file)) {
 559             clam_log_infected($file, '', $userid);
 560             $notice .= "\n". get_string('clamdeletedfile');
 561         }
 562         else {
 563             if ($basiconly) {
 564                 // still tell the user the file has been deleted. this is only for admins.
 565                 $notice .= "\n". get_string('clamdeletedfile');
 566             }
 567             else {
 568                 $notice .= "\n". get_string('clamdeletedfilefailed');
 569             }
 570         }
 571     }
 572     return $notice;
 573 }
 574
 575 /**
 576  * Replaces the given file with a string.
 577  *
 578  * The replacement string is used to notify that the original file had a virus
 579  * This is to avoid missing files but could result in the wrong content-type.
 580  *
 581  * @param string $file Full path to the file.
 582  * @return boolean
 583  */
 584 function clam_replace_infected_file($file) {
 585     $newcontents = get_string('virusplaceholder');
 586     if (!$f = fopen($file, 'w')) {
 587         return false;
 588     }
 589     if (!fwrite($f, $newcontents)) {
 590         return false;
 591     }
 592     return true;
 593 }
 594
 595
 596 /**
 597  * If $CFG->runclamonupload is set, we scan a given file. (called from {@link preprocess_files()})
 598  *
 599  * This function will add on a uploadlog index in $file.
 600  *
 601  * @global object
 602  * @global object
 603  * @param mixed $file The file to scan from $files. or an absolute path to a file.
 604  * @param course $course {@link $COURSE}
 605  * @return int 1 if good, 0 if something goes wrong (opposite from actual error code from clam)
 606  */
 607 function clam_scan_moodle_file(&$file, $course) {
 608     global $CFG, $USER;
 609
 610     if (is_array($file) && is_uploaded_file($file['tmp_name'])) { // it's from $_FILES
 611         $appendlog = true;
 612         $fullpath = $file['tmp_name'];
 613     }
 614     else if (file_exists($file)) { // it's a path to somewhere on the filesystem!
 615         $fullpath = $file;
 616     }
 617     else {
 618         return false; // erm, what is this supposed to be then, huh?
 619     }
 620
 621     $CFG->pathtoclam = trim($CFG->pathtoclam);
 622
 623     if (!$CFG->pathtoclam || !file_exists($CFG->pathtoclam) || !is_executable($CFG->pathtoclam)) {
 624         $newreturn = 1;
 625         $notice = get_string('clamlost', 'moodle', $CFG->pathtoclam);
 626         if ($CFG->clamfailureonupload == 'actlikevirus') {
 627             $notice .= "\n". get_string('clamlostandactinglikevirus');
 628             $notice .= "\n". clam_handle_infected_file($fullpath);
 629             $newreturn = false;
 630         }
 631         clam_message_admins($notice);
 632         if ($appendlog) {
 633             $file['uploadlog'] .= "\n". get_string('clambroken');
 634             $file['clam'] = 1;
 635         }
 636         return $newreturn; // return 1 if we're allowing clam failures
 637     }
 638
 639     $cmd = $CFG->pathtoclam .' '. $fullpath ." 2>&1";
 640
 641     // before we do anything we need to change perms so that clamscan can read the file (clamdscan won't work otherwise)
 642     chmod($fullpath, $CFG->directorypermissions);
 643
 644     exec($cmd, $output, $return);
 645
 646
 647     switch ($return) {
 648     case 0: // glee! we're ok.
 649         return 1; // translate clam return code into reasonable return code consistent with everything else.
 650     case 1:  // bad wicked evil, we have a virus.
 651         $info = new stdClass();
 652         if (!empty($course)) {
 653             $info->course = format_string($course->fullname, true, array('context' => context_course::instance($course->id)));
 654         }
 655         else {
 656             $info->course = 'No course';
 657         }
 658         $info->user = fullname($USER);
 659         $notice = get_string('virusfound', 'moodle', $info);
 660         $notice .= "\n\n". implode("\n", $output);
 661         $notice .= "\n\n". clam_handle_infected_file($fullpath);
 662         clam_message_admins($notice);
 663         if ($appendlog) {
 664             $info->filename = $file['originalname'];
 665             $file['uploadlog'] .= "\n". get_string('virusfounduser', 'moodle', $info);
 666             $file['virus'] = 1;
 667         }
 668         return false; // in this case, 0 means bad.
 669     default:
 670         // error - clam failed to run or something went wrong
 671         $notice .= get_string('clamfailed', 'moodle', get_clam_error_code($return));
 672         $notice .= "\n\n". implode("\n", $output);
 673         $newreturn = true;
 674         if ($CFG->clamfailureonupload == 'actlikevirus') {
 675             $notice .= "\n". clam_handle_infected_file($fullpath);
 676             $newreturn = false;
 677         }
 678         clam_message_admins($notice);
 679         if ($appendlog) {
 680             $file['uploadlog'] .= "\n". get_string('clambroken');
 681             $file['clam'] = 1;
 682         }
 683         return $newreturn; // return 1 if we're allowing failures.
 684     }
 685 }
 686
 687 /**
 688  * Emails admins about a clam outcome
 689  *
 690  * @param string $notice The body of the email to be sent.
 691  */
 692 function clam_message_admins($notice) {
 693
 694     $site = get_site();
 695
 696     $subject = get_string('clamemailsubject', 'moodle', format_string($site->fullname));
 697     $admins = get_admins();
 698     foreach ($admins as $admin) {
 699         $eventdata = new stdClass();
 700         $eventdata->component         = 'moodle';
 701         $eventdata->name              = 'errors';
 702         $eventdata->userfrom          = get_admin();
 703         $eventdata->userto            = $admin;
 704         $eventdata->subject           = $subject;
 705         $eventdata->fullmessage       = $notice;
 706         $eventdata->fullmessageformat = FORMAT_PLAIN;
 707         $eventdata->fullmessagehtml   = '';
 708         $eventdata->smallmessage      = '';
 709         message_send($eventdata);
 710     }
 711 }
 712
 713
 714 /**
 715  * Returns the string equivalent of a numeric clam error code
 716  *
 717  * @param int $returncode The numeric error code in question.
 718  * return string The definition of the error code
 719  */
 720 function get_clam_error_code($returncode) {
 721     $returncodes = array();
 722     $returncodes[0] = 'No virus found.';
 723     $returncodes[1] = 'Virus(es) found.';
 724     $returncodes[2] = ' An error occured'; // specific to clamdscan
 725     // all after here are specific to clamscan
 726     $returncodes[40] = 'Unknown option passed.';
 727     $returncodes[50] = 'Database initialization error.';
 728     $returncodes[52] = 'Not supported file type.';
 729     $returncodes[53] = 'Can\'t open directory.';
 730     $returncodes[54] = 'Can\'t open file. (ofm)';
 731     $returncodes[55] = 'Error reading file. (ofm)';
 732     $returncodes[56] = 'Can\'t stat input file / directory.';
 733     $returncodes[57] = 'Can\'t get absolute path name of current working directory.';
 734     $returncodes[58] = 'I/O error, please check your filesystem.';
 735     $returncodes[59] = 'Can\'t get information about current user from /etc/passwd.';
 736     $returncodes[60] = 'Can\'t get information about user \'clamav\' (default name) from /etc/passwd.';
 737     $returncodes[61] = 'Can\'t fork.';
 738     $returncodes[63] = 'Can\'t create temporary files/directories (check permissions).';
 739     $returncodes[64] = 'Can\'t write to temporary directory (please specify another one).';
 740     $returncodes[70] = 'Can\'t allocate and clear memory (calloc).';
 741     $returncodes[71] = 'Can\'t allocate memory (malloc).';
 742     if ($returncodes[$returncode])
 743        return $returncodes[$returncode];
 744     return get_string('clamunknownerror');
 745
 746 }
 747
 748 /**
 749  * Adds a file upload to the log table so that clam can resolve the filename to the user later if necessary
 750  *
 751  * @global object
 752  * @global object
 753  * @param string $newfilepath ?
 754  * @param course $course {@link $COURSE}
 755  * @param boolean $nourl ?
 756  * @todo Finish documenting this function
 757  */
 758 function clam_log_upload($newfilepath, $course=null, $nourl=false) {
 759     global $CFG, $USER;
 760     // get rid of any double // that might have appeared
 761     $newfilepath = preg_replace('/\/\//', '/', $newfilepath);
 762     if (strpos($newfilepath, $CFG->dataroot) === false) {
 763         $newfilepath = $CFG->dataroot .'/'. $newfilepath;
 764     }
 765     $courseid = 0;
 766     if ($course) {
 767         $courseid = $course->id;
 768     }
 769     add_to_log($courseid, 'upload', 'upload', ((!$nourl) ? substr($_SERVER['HTTP_REFERER'], 0, 100) : ''), $newfilepath);
 770 }
 771
 772 /**
 773  * This function logs to error_log and to the log table that an infected file has been found and what's happened to it.
 774  *
 775  * @global object
 776  * @param string $oldfilepath Full path to the infected file before it was moved.
 777  * @param string $newfilepath Full path to the infected file since it was moved to the quarantine directory (if the file was deleted, leave empty).
 778  * @param int $userid The user id of the user who uploaded the file.
 779  */
 780 function clam_log_infected($oldfilepath='', $newfilepath='', $userid=0) {
 781     global $DB;
 782
 783     add_to_log(0, 'upload', 'infected', $_SERVER['HTTP_REFERER'], $oldfilepath, 0, $userid);
 784
 785     $user = $DB->get_record('user', array('id'=>$userid));
 786
 787     $errorstr = 'Clam AV has found a file that is infected with a virus. It was uploaded by '
 788         . ((empty($user)) ? ' an unknown user ' : fullname($user))
 789         . ((empty($oldfilepath)) ? '. The infected file was caught on upload ('.$oldfilepath.')'
 790            : '. The original file path of the infected file was '. $oldfilepath)
 791         . ((empty($newfilepath)) ? '. The file has been deleted ' : '. The file has been moved to a quarantine directory and the new path is '. $newfilepath);
 792
 793     error_log($errorstr);
 794 }
 795
 796
 797 /**
 798  * Some of the modules allow moving attachments (glossary), in which case we need to hunt down an original log and change the path.
 799  *
 800  * @global object
 801  * @param string $oldpath The old path to the file (should be in the log)
 802  * @param string $newpath The new path to the file
 803  * @param boolean $update If true this function will overwrite old record (used for forum moving etc).
 804  */
 805 function clam_change_log($oldpath, $newpath, $update=true) {
 806     global $DB;
 807
 808     if (!$record = $DB->get_record('log', array('info'=>$oldpath, 'module'=>'upload'))) {
 809         return false;
 810     }
 811     $record->info = $newpath;
 812     if ($update) {
 813         $DB->update_record('log', $record);
 814     } else {
 815         unset($record->id);
 816         $DB->insert_record('log', $record);
 817     }
 818 }