pluginfile.php

   1 <?php
   2
   3 // This file is part of Moodle - http://moodle.org/
   4 //
   5 // Moodle is free software: you can redistribute it and/or modify
   6 // it under the terms of the GNU General Public License as published by
   7 // the Free Software Foundation, either version 3 of the License, or
   8 // (at your option) any later version.
   9 //
  10 // Moodle is distributed in the hope that it will be useful,
  11 // but WITHOUT ANY WARRANTY; without even the implied warranty of
  12 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  13 // GNU General Public License for more details.
  14 //
  15 // You should have received a copy of the GNU General Public License
  16 // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
  17
  18 /**
  19  * This script delegates file serving to individual plugins
  20  *
  21  * @package    moodlecore
  22  * @subpackage file
  23  * @copyright  2008 Petr Skoda (http://skodak.org)
  24  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
  25  */
  26
  27 // disable moodle specific debug messages and any errors in output
  28 define('NO_DEBUG_DISPLAY', true);
  29
  30 require_once('config.php');
  31 require_once('lib/filelib.php');
  32
  33 $relativepath = get_file_argument();
  34 $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
  35
  36 // relative path must start with '/'
  37 if (!$relativepath) {
  38     print_error('invalidargorconf');
  39 } else if ($relativepath[0] != '/') {
  40     print_error('pathdoesnotstartslash');
  41 }
  42
  43 // extract relative path components
  44 $args = explode('/', ltrim($relativepath, '/'));
  45
  46 if (count($args) == 0) { // always at least user id
  47     print_error('invalidarguments');
  48 }
  49
  50 $contextid = (int)array_shift($args);
  51 $filearea = array_shift($args);
  52
  53 if (!$context = get_context_instance_by_id($contextid)) {
  54     send_file_not_found();
  55 }
  56 $fs = get_file_storage();
  57
  58 // If the file is a Flash file and that the user flash player is outdated return a flash upgrader MDL-20841
  59 $mimetype = mimeinfo('type', $args[count($args)-1]);
  60 if (!empty($CFG->excludeoldflashclients) && $mimetype == 'application/x-shockwave-flash'&& !empty($SESSION->flashversion)) {
  61     $userplayerversion = explode('.', $SESSION->flashversion);
  62     $requiredplayerversion = explode('.', $CFG->excludeoldflashclients);
  63     $sendflashupgrader = true;
  64 }
  65 if (!empty($sendflashupgrader) && (($userplayerversion[0] <  $requiredplayerversion[0]) ||
  66         ($userplayerversion[0] == $requiredplayerversion[0] && $userplayerversion[1] < $requiredplayerversion[1]) ||
  67         ($userplayerversion[0] == $requiredplayerversion[0] && $userplayerversion[1] == $requiredplayerversion[1]
  68          && $userplayerversion[2] < $requiredplayerversion[2]))) {
  69         $path = $CFG->dirroot."/lib/flashdetect/flashupgrade.swf";  // Alternate content asking user to upgrade Flash
  70         $filename = "flashupgrade.swf";
  71         $lifetime = 0;  // Do not cache
  72         send_file($path, $filename, $lifetime, 0, false, false, $mimetype);
  73
  74 } else if ($context->contextlevel == CONTEXT_SYSTEM) {
  75     if ($filearea === 'blog_attachment' || $filearea === 'blog_post') {
  76
  77         if (empty($CFG->bloglevel)) {
  78             print_error('siteblogdisable', 'blog');
  79         }
  80         if ($CFG->bloglevel < BLOG_GLOBAL_LEVEL) {
  81             require_login();
  82             if (isguestuser()) {
  83                 print_error('noguest');
  84             }
  85             if ($CFG->bloglevel == BLOG_USER_LEVEL) {
  86                 if ($USER->id != $entry->userid) {
  87                     send_file_not_found();
  88                 }
  89             }
  90         }
  91         $entryid = (int)array_shift($args);
  92         if (!$entry = $DB->get_record('post', array('module'=>'blog', 'id'=>$entryid))) {
  93             send_file_not_found();
  94         }
  95         if ('publishstate' === 'public') {
  96             if ($CFG->forcelogin) {
  97                 require_login();
  98             }
  99
 100         } else if ('publishstate' === 'site') {
 101             require_login();
 102             //ok
 103         } else if ('publishstate' === 'draft') {
 104             require_login();
 105             if ($USER->id != $entry->userid) {
 106                 send_file_not_found();
 107             }
 108         }
 109
 110         //TODO: implement shared course and shared group access
 111
 112         $relativepath = '/'.implode('/', $args);
 113         $fullpath = $context->id.$filearea.$entryid.$relativepath;
 114
 115         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 116             send_file_not_found();
 117         }
 118
 119         send_stored_file($file, 10*60, 0, true); // download MUST be forced - security!
 120     } else if ($filearea === 'grade_outcome' || $filearea === 'grade_scale') { // CONTEXT_SYSTEM
 121         if ($CFG->forcelogin) {
 122             require_login();
 123         }
 124
 125         $fullpath = $context->id.$filearea.implode('/', $args);
 126
 127         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 128             send_file_not_found();
 129         }
 130
 131         session_get_instance()->write_close(); // unlock session during fileserving
 132         send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
 133
 134     } else if ($filearea === 'tag_description') { // CONTEXT_SYSTEM
 135
 136         // All tag descriptions are going to be public but we still need to respect forcelogin
 137         if ($CFG->forcelogin) {
 138             require_login();
 139         }
 140
 141         $fullpath = $context->id.$filearea.implode('/', $args);
 142
 143         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 144             send_file_not_found();
 145         }
 146
 147         session_get_instance()->write_close(); // unlock session during fileserving
 148         send_stored_file($file, 60*60, 0, true); // TODO: change timeout?
 149
 150     } else if ($filearea === 'calendar_event_description') { // CONTEXT_SYSTEM
 151
 152         // All events here are public the one requirement is that we respect forcelogin
 153         if ($CFG->forcelogin) {
 154             require_login();
 155         }
 156
 157         $fullpath = $context->id.$filearea.implode('/', $args);
 158
 159         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 160             send_file_not_found();
 161         }
 162
 163         session_get_instance()->write_close(); // unlock session during fileserving
 164         send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
 165
 166     } else {
 167         send_file_not_found();
 168     }
 169
 170 } else if ($context->contextlevel == CONTEXT_USER) {
 171
 172     if ($filearea === 'calendar_event_description') { // CONTEXT_USER
 173
 174         // Must be logged in, if they are not then they obviously can't be this user
 175         require_login();
 176
 177         // Don't want guests here, potentially saves a DB call
 178         if (isguestuser()) {
 179             send_file_not_found();
 180         }
 181
 182         // Get the event if from the args array
 183         $eventid = array_shift($args);
 184         if ((int)$eventid <= 0) {
 185             send_file_not_found();
 186         }
 187
 188         // Load the event from the database
 189         $event = $DB->get_record('event', array('id'=>(int)$eventid));
 190         // Check that we got an event and that it's userid is that of the user
 191         if (!$event || $event->userid !== $USER->id) {
 192             send_file_not_found();
 193         }
 194
 195         // Get the file and serve if succesfull
 196         $fullpath = $context->id.$filearea.$eventid.'/'.implode('/', $args);
 197         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 198             send_file_not_found();
 199         }
 200
 201         session_get_instance()->write_close(); // unlock session during fileserving
 202         send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
 203     } else if ($filearea === 'user_profile') { // CONTEXT_USER
 204
 205         if ($CFG->forcelogin) {
 206             require_login();
 207         }
 208
 209         $userid = array_shift($args);
 210         if ((int)$userid <= 0) {
 211             send_file_not_found();
 212         }
 213
 214         if (!empty($CFG->forceloginforprofiles)) {
 215             require_login();
 216             if (isguestuser()) {
 217                 send_file_not_found();
 218             }
 219
 220             if ($USER->id !== $userid) {
 221                 $usercontext = get_context_instance(CONTEXT_USER, $userid);
 222                 // The browsing user is not the current user
 223                 if (!has_coursecontact_role($userid) && !has_capability('moodle/user:viewdetails', $usercontext)) {
 224                     send_file_not_found();
 225                 }
 226
 227                 $canview = false;
 228                 if (has_capability('moodle/user:viewdetails', $usercontext)) {
 229                     $canview = true;
 230                 } else {
 231                     $courses = enrol_get_my_courses();
 232                 }
 233
 234                 while (!$canview && count($courses) > 0) {
 235                     $course = array_shift($courses);
 236                     if (has_capability('moodle/user:viewdetails', get_context_instance(CONTEXT_COURSE, $course->id))) {
 237                         $canview = true;
 238                     }
 239                 }
 240             }
 241         }
 242
 243         $fullpath = $context->id.$filearea.$userid.'/'.implode('/', $args);
 244
 245         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 246             send_file_not_found();
 247         }
 248
 249         session_get_instance()->write_close(); // unlock session during fileserving
 250         send_stored_file($file, 60*60, 0, true);
 251     }
 252
 253     send_file_not_found();
 254
 255
 256 } else if ($context->contextlevel == CONTEXT_COURSECAT) {
 257     if ($filearea == 'coursecat_intro') {
 258         if ($CFG->forcelogin) {
 259             // no login necessary - unless login forced everywhere
 260             require_login();
 261         }
 262
 263         $relativepath = '/'.implode('/', $args);
 264         $fullpath = $context->id.'coursecat_intro0'.$relativepath;
 265
 266         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->get_filename() == '.') {
 267             send_file_not_found();
 268         }
 269
 270         session_get_instance()->write_close(); // unlock session during fileserving
 271         send_stored_file($file, 60*60, 0, $forcedownload);
 272     } else if ($filearea == 'category_description') {
 273         if ($CFG->forcelogin) {
 274             // no login necessary - unless login forced everywhere
 275             require_login();
 276         }
 277         $itemid = (int)array_shift($args);
 278
 279         $relativepath = '/'.implode('/', $args);
 280         $fullpath = $context->id.'category_description'.$itemid.$relativepath;
 281
 282         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->get_filename() == '.') {
 283             send_file_not_found();
 284         }
 285
 286         session_get_instance()->write_close(); // unlock session during fileserving
 287         send_stored_file($file, 60*60, 0, $forcedownload);
 288     } else {
 289         send_file_not_found();
 290     }
 291
 292
 293 } else if ($context->contextlevel == CONTEXT_COURSE) {
 294     if (!$course = $DB->get_record('course', array('id'=>$context->instanceid))) {
 295         print_error('invalidcourseid');
 296     }
 297
 298     if ($filearea === 'course_backup') {
 299         require_login($course);
 300         require_capability('moodle/backup:downloadfile', $context);
 301
 302         $relativepath = '/'.implode('/', $args);
 303         $fullpath = $context->id.'course_backup0'.$relativepath;
 304
 305         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 306             send_file_not_found();
 307         }
 308
 309         session_get_instance()->write_close(); // unlock session during fileserving
 310         send_stored_file($file, 0, 0, true);
 311
 312     } else if ($filearea === 'course_summary') {
 313         if ($CFG->forcelogin) {
 314             require_login();
 315         }
 316
 317         $relativepath = '/'.implode('/', $args);
 318         $fullpath = $context->id.'course_summary0'.$relativepath;
 319
 320         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 321             send_file_not_found();
 322         }
 323
 324         session_get_instance()->write_close(); // unlock session during fileserving
 325         send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
 326
 327     } else if ($filearea === 'course_grade_tree_feedback') {
 328
 329         if ($CFG->forcelogin || $course->id !== SITEID) {
 330             require_login($course);
 331         }
 332
 333         $fullpath = $context->id.$filearea.implode('/', $args);
 334
 335         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 336             send_file_not_found();
 337         }
 338
 339         session_get_instance()->write_close(); // unlock session during fileserving
 340         send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
 341
 342     } else if ($filearea === 'calendar_event_description') { // CONTEXT_COURSE
 343
 344         // This is for content used in course and group events
 345
 346         // Respect forcelogin and require login unless this is the site.... it probably
 347         // should NEVER be the site
 348         if ($CFG->forcelogin || $course->id !== SITEID) {
 349             require_login($course);
 350         }
 351
 352         // Must be able to at least view the course
 353         if (!is_enrolled($context) and !is_viewing($context)) {
 354             send_file_not_found();
 355         }
 356
 357         // Get the event id
 358         $eventid = array_shift($args);
 359         if ((int)$eventid <= 0) {
 360             send_file_not_found();
 361         }
 362
 363         // Load the event from the database we need to check whether it is
 364         // a) valid
 365         // b) a group event
 366         // Group events use the course context (there is no group context)
 367         $event = $DB->get_record('event', array('id'=>(int)$eventid));
 368         if (!$event || $event->userid !== $USER->id) {
 369             send_file_not_found();
 370         }
 371
 372         // If its a group event require either membership of manage groups capability
 373         if ($event->eventtype === 'group' && !has_capability('moodle/course:managegroups', $context) && !groups_is_member($event->groupid, $USER->id)) {
 374             send_file_not_found();
 375         }
 376
 377         // If we get this far we can serve the file
 378         $fullpath = $context->id.$filearea.$eventid.'/'.implode('/', $args);
 379         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 380             send_file_not_found();
 381         }
 382
 383         session_get_instance()->write_close(); // unlock session during fileserving
 384         send_stored_file($file, 60*60, 0, $forcedownload); // TODO: change timeout?
 385
 386     } else if ($filearea === 'course_section') {
 387         if ($CFG->forcelogin) {
 388             require_login($course);
 389         } else if ($course->id !== SITEID) {
 390             require_login($course);
 391         }
 392
 393         $sectionid = (int)array_shift($args);
 394
 395         if ($course->numsections < $sectionid) {
 396             if (!has_capability('moodle/course:update', $context)) {
 397                 // disable access to invisible sections if can not edit course
 398                 // this is going to break some ugly hacks, but is necessary
 399                 send_file_not_found();
 400             }
 401         }
 402
 403         $relativepath = '/'.implode('/', $args);
 404         $fullpath = $context->id.'course_section'.$sectionid.$relativepath;
 405
 406         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 407             send_file_not_found();
 408         }
 409
 410         session_get_instance()->write_close(); // unlock session during fileserving
 411         send_stored_file($file, 60*60, 0, false); // TODO: change timeout?
 412
 413     } else if ($filearea === 'section_backup') {
 414         require_login($course);
 415         require_capability('moodle/backup:downloadfile', $context);
 416
 417         $sectionid = (int)array_shift($args);
 418
 419         $relativepath = '/'.implode('/', $args);
 420         $fullpath = $context->id.'section_backup'.$sectionid.$relativepath;
 421
 422         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 423             send_file_not_found();
 424         }
 425
 426         session_get_instance()->write_close();
 427         send_stored_file($file, 60*60, 0, false);
 428
 429     } else if ($filearea === 'user_profile') {
 430         $userid = (int)array_shift($args);
 431         $usercontext = get_context_instance(CONTEXT_USER, $userid);
 432
 433         if ($CFG->forcelogin) {
 434             require_login();
 435         }
 436
 437         if (!empty($CFG->forceloginforprofiles)) {
 438             require_login();
 439             if (isguestuser()) {
 440                 print_error('noguest');
 441             }
 442
 443             if (!has_coursecontact_role($userid) and !has_capability('moodle/user:viewdetails', $usercontext)) {
 444                 print_error('usernotavailable');
 445             }
 446             if (!has_capability('moodle/user:viewdetails', $context) &&
 447                 !has_capability('moodle/user:viewdetails', $usercontext)) {
 448                 print_error('cannotviewprofile');
 449             }
 450             if (!is_enrolled($context, $userid)) {
 451                 print_error('notenrolledprofile');
 452             }
 453             if (groups_get_course_groupmode($course) == SEPARATEGROUPS and !has_capability('moodle/site:accessallgroups', $context)) {
 454                 print_error('groupnotamember');
 455             }
 456         }
 457
 458         $relativepath = '/'.implode('/', $args);
 459         $fullpath = $usercontext->id.'user_profile0'.$relativepath;
 460
 461         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 462             send_file_not_found();
 463         }
 464
 465         session_get_instance()->write_close(); // unlock session during fileserving
 466         send_stored_file($file, 0, 0, true); // must force download - security!
 467
 468     } else {
 469         send_file_not_found();
 470     }
 471
 472 } else if ($context->contextlevel == CONTEXT_MODULE) {
 473
 474     if (!$coursecontext = get_context_instance_by_id(get_parent_contextid($context))) {
 475         send_file_not_found();
 476     }
 477
 478     if (!$course = $DB->get_record('course', array('id'=>$coursecontext->instanceid))) {
 479         send_file_not_found();
 480     }
 481     $modinfo = get_fast_modinfo($course);
 482     if (empty($modinfo->cms[$context->instanceid])) {
 483         send_file_not_found();
 484     }
 485
 486     $cminfo = $modinfo->cms[$context->instanceid];
 487     $modname = $cminfo->modname;
 488     $libfile = "$CFG->dirroot/mod/$modname/lib.php";
 489     if (!file_exists($libfile)) {
 490         send_file_not_found();
 491     }
 492
 493     require_once($libfile);
 494     if ($filearea === $modname.'_intro') {
 495         if (!plugin_supports('mod', $modname, FEATURE_MOD_INTRO, true)) {
 496             send_file_not_found();
 497         }
 498         if (!$cm = get_coursemodule_from_instance($modname, $cminfo->instance, $course->id)) {
 499             send_file_not_found();
 500         }
 501         require_course_login($course, true, $cm);
 502
 503         if (!$cminfo->uservisible) {
 504             send_file_not_found();
 505         }
 506         // all users may access it
 507         $relativepath = '/'.implode('/', $args);
 508         $fullpath = $context->id.$filearea.'0'.$relativepath;
 509
 510         $fs = get_file_storage();
 511         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 512             send_file_not_found();
 513         }
 514
 515         $lifetime = isset($CFG->filelifetime) ? $CFG->filelifetime : 86400;
 516
 517         // finally send the file
 518         send_stored_file($file, $lifetime, 0);
 519     } else if ($filearea === 'activity_backup') {
 520         require_login($course);
 521         require_capability('moodle/backup:downloadfile', $context);
 522
 523         $relativepath = '/'.implode('/', $args);
 524         $fullpath = $context->id.'activity_backup0'.$relativepath;
 525
 526         if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) {
 527             send_file_not_found();
 528         }
 529
 530         session_get_instance()->write_close();
 531         send_stored_file($file, 60*60, 0, false);
 532     }
 533
 534     $filefunction = $modname.'_pluginfile';
 535     if (function_exists($filefunction)) {
 536         // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found"
 537         $filefunction($course, $cminfo, $context, $filearea, $args, $forcedownload);
 538     }
 539
 540     send_file_not_found();
 541
 542 } else if ($context->contextlevel == CONTEXT_BLOCK) {
 543
 544     if (!$context = get_context_instance_by_id($contextid)) {
 545         send_file_not_found();
 546     }
 547     $birecord = $DB->get_record('block_instances', array('id'=>$context->instanceid), '*',MUST_EXIST);
 548     $blockinstance = block_instance($birecord->blockname, $birecord);
 549
 550     if (strpos(get_class($blockinstance), $filearea) !== 0) {
 551         send_file_not_found();
 552     }
 553
 554     $itemid = array_shift($args);
 555     $filename = array_pop($args);
 556     $filepath = '/'.join('/', $args);
 557
 558     if (method_exists($blockinstance, 'send_file')) {
 559         $blockinstance->send_file($context, $filearea, $itemid, $filepath, $filename);
 560     }
 561
 562     send_file_not_found();
 563
 564 } else {
 565     send_file_not_found();
 566 }