interface/super/manage_document_templates.php

   1 <?php
   2 /**
   3  * Document Template Management Module.
   4  *
   5  * Copyright (C) 2013-2014 Rod Roark <rod@sunsetsystems.com>
   6  *
   7  * LICENSE: This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public License
   9  * as published by the Free Software Foundation; either version 2
  10  * of the License, or (at your option) any later version.
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  14  * GNU General Public License for more details.
  15  * You should have received a copy of the GNU General Public License
  16  * along with this program. If not, see <http://opensource.org/licenses/gpl-license.php>;.
  17  *
  18  * @package OpenEMR
  19  * @author  Rod Roark <rod@sunsetsystems.com>
  20  * @link    http://www.open-emr.org
  21  */
  22
  23 // Disable magic quotes and fake register globals.
  24 $sanitize_all_escapes = true;
  25 $fake_register_globals = false;
  26
  27 require_once('../globals.php');
  28 require_once($GLOBALS['srcdir'].'/acl.inc');
  29
  30 if (!acl_check('admin', 'super')) die(htmlspecialchars(xl('Not authorized')));
  31
  32 $form_filename = strip_escape_custom($_REQUEST['form_filename']);
  33
  34 $templatedir = "$OE_SITE_DIR/documents/doctemplates";
  35
  36 // If downloading a file, do the download and nothing else.
  37 // Thus the current browser page should remain displayed.
  38 //
  39 if (!empty($_POST['bn_download'])) {
  40   $templatepath = "$templatedir/$form_filename";
  41   header('Content-Description: File Transfer');
  42   header('Content-Transfer-Encoding: binary');
  43   header('Expires: 0');
  44   header('Cache-Control: must-revalidate, post-check=0, pre-check=0');
  45   header('Pragma: public');
  46   // attachment, not inline
  47   header("Content-Disposition: attachment; filename=\"$form_filename\"");
  48   // Note we avoid providing a mime type that suggests opening the file.
  49   header("Content-Type: application/octet-stream");
  50   header("Content-Length: " . filesize($templatepath));
  51   ob_clean();
  52   flush();
  53   readfile($templatepath);
  54   exit;
  55 }
  56
  57 if (!empty($_POST['bn_delete'])) {
  58   $templatepath = "$templatedir/$form_filename";
  59   if (is_file($templatepath)) unlink($templatepath);
  60 }
  61
  62 if (!empty($_POST['bn_upload'])) {
  63   // Handle uploads.
  64   $tmp_name = $_FILES['form_file']['tmp_name'];
  65   if (is_uploaded_file($tmp_name) && $_FILES['form_file']['size']) {
  66     // Choose the destination path/filename.
  67     $form_dest_filename = $_POST['form_dest_filename'];
  68     if ($form_dest_filename == '') {
  69       $form_dest_filename = $_FILES['form_file']['name'];
  70     }
  71     $form_dest_filename = preg_replace("/[^a-zA-Z0-9_.]/", "_", basename($form_dest_filename));
  72     if ($form_dest_filename == '') {
  73       die(htmlspecialchars(xl('Cannot determine a destination filename')));
  74     }
  75     $templatepath = "$templatedir/$form_dest_filename";
  76     // If the site's template directory does not yet exist, create it.
  77     if (!is_dir($templatedir)) {
  78       mkdir($templatedir);
  79     }
  80     // If the target file already exists, delete it.
  81     if (is_file($templatepath)) unlink($templatepath);
  82     // Put the new file in its desired location.
  83     if (!move_uploaded_file($tmp_name, $templatepath)) {
  84       die(htmlspecialchars(xl('Unable to create') . " '$templatepath'"));
  85     }
  86   }
  87 }
  88
  89 ?>
  90 <html>
  91
  92 <head>
  93 <title><?php echo xlt('Document Template Management'); ?></title>
  94 <link rel="stylesheet" href='<?php echo $css_header ?>' type='text/css'>
  95
  96 <style type="text/css">
  97  .dehead { color:#000000; font-family:sans-serif; font-size:10pt; font-weight:bold }
  98  .detail { color:#000000; font-family:sans-serif; font-size:10pt; font-weight:normal }
  99 </style>
 100
 101 </head>
 102
 103 <body class="body_top">
 104 <form method='post' action='manage_document_templates.php' enctype='multipart/form-data'
 105  onsubmit='return top.restoreSession()'>
 106
 107 <center>
 108
 109 <h2><?php echo xlt('Document Template Management'); ?></h2>
 110
 111 <p>
 112 <table border='1' width='95%'>
 113
 114  <tr bgcolor='#dddddd' class='dehead'>
 115   <td align='center'><?php echo xlt('Upload a Template'); ?></td>
 116  </tr>
 117
 118  <tr>
 119   <td valign='top' class='detail' style='padding:10pt;' nowrap>
 120    <?php echo htmlspecialchars(xl('Source File')); ?>:
 121    <input type="hidden" name="MAX_FILE_SIZE" value="250000000" />
 122    <input type="file" name="form_file" size="40" />&nbsp;
 123    <?php echo htmlspecialchars(xl('Destination Filename')) ?>:
 124    <input type='text' name='form_dest_filename' size='30' />
 125    &nbsp;
 126    <input type='submit' name='bn_upload' value='<?php echo xlt('Upload') ?>' />
 127   </td>
 128  </tr>
 129
 130 </table>
 131 </p>
 132
 133 <p>
 134 <table border='1' width='95%'>
 135
 136  <tr bgcolor='#dddddd' class='dehead'>
 137   <td align='center'><?php echo xlt('Download or Delete a Template'); ?></td>
 138  </tr>
 139
 140  <tr>
 141   <td valign='top' class='detail' style='padding:10pt;' nowrap>
 142    <select name='form_filename'>
 143 <?php
 144   // Generate an <option> for each existing file.
 145   $dh = opendir($templatedir);
 146   if ($dh) {
 147     $templateslist = array();
 148     while (false !== ($sfname = readdir($dh))) {
 149       if (substr($sfname, 0, 1) == '.') continue;
 150       $templateslist[$sfname] = $sfname;
 151     }
 152     closedir($dh);
 153     ksort($templateslist);
 154     foreach ($templateslist as $sfname) {
 155       echo "    <option value='" . htmlspecialchars($sfname, ENT_QUOTES) . "'";
 156       echo ">" . htmlspecialchars($sfname) . "</option>\n";
 157     }
 158   }
 159 ?>
 160    </select>
 161    &nbsp;
 162    <input type='submit' name='bn_download' value='<?php echo xlt('Download') ?>' />
 163    &nbsp;
 164    <input type='submit' name='bn_delete' value='<?php echo xlt('Delete') ?>' />
 165   </td>
 166  </tr>
 167
 168 </table>
 169 </p>
 170
 171 </center>
 172
 173 </form>
 174 </body>
 175 </html>
 176