2 // Copyright (C) 2010-2016 Rod Roark <rod@sunsetsystems.com>
4 // This program is free software; you can redistribute it and/or
5 // modify it under the terms of the GNU General Public License
6 // as published by the Free Software Foundation; either version 2
7 // of the License, or (at your option) any later version.
9 // This module provides for editing site-specific text files and
10 // for uploading site-specific image files.
12 // Disable magic quotes and fake register globals.
13 $sanitize_all_escapes = true;
14 $fake_register_globals = false;
16 require_once('../globals.php');
17 require_once($GLOBALS['srcdir'].'/acl.inc');
20 if (!acl_check('admin', 'super')) die(htmlspecialchars(xl('Not authorized')));
22 // Prepare array of names of editable files, relative to the site directory.
27 'referral_template.html',
29 'letter_templates/custom_pdf.php',
31 // Append LBF plugin filenames to the array.
32 $lres = sqlStatement('SELECT * FROM list_options ' .
33 "WHERE list_id = 'lbfnames' AND activity = 1 ORDER BY seq, title");
34 while ($lrow = sqlFetchArray($lres)) {
35 $option_id = $lrow['option_id']; // should start with LBF
36 $title = $lrow['title'];
37 $my_files[] = "LBF/$option_id.plugin.php";
40 $form_filename = strip_escape_custom($_REQUEST['form_filename']);
41 // Sanity check to prevent evildoing.
42 if (!in_array($form_filename, $my_files)) $form_filename = '';
43 $filepath = "$OE_SITE_DIR/$form_filename";
45 $imagedir = "$OE_SITE_DIR/images";
46 $educationdir = "$OE_SITE_DIR/documents/education";
48 if (!empty($_POST['bn_save'])) {
50 // Textareas, at least in Firefox, return a \r\n at the end of each line
51 // even though only \n was originally there. For consistency with
52 // normal OpenEMR usage we translate those back.
53 file_put_contents($filepath, str_replace("\r\n", "\n",
54 $_POST['form_filedata']));
58 // Handle image uploads.
59 if (is_uploaded_file($_FILES['form_image']['tmp_name']) && $_FILES['form_image']['size']) {
60 $form_dest_filename = $_POST['form_dest_filename'];
61 if ($form_dest_filename == '') {
62 $form_dest_filename = $_FILES['form_image']['name'];
64 $form_dest_filename = basename($form_dest_filename);
65 if ($form_dest_filename == '') {
66 die(htmlspecialchars(xl('Cannot find a destination filename')));
68 $imagepath = "$imagedir/$form_dest_filename";
69 // If the site's image directory does not yet exist, create it.
70 if (!is_dir($imagedir)) {
73 if (is_file($imagepath)) unlink($imagepath);
74 $tmp_name = $_FILES['form_image']['tmp_name'];
75 if (!move_uploaded_file($_FILES['form_image']['tmp_name'], $imagepath)) {
76 die(htmlspecialchars(xl('Unable to create') . " '$imagepath'"));
80 // Handle PDF uploads for patient education.
81 if (is_uploaded_file($_FILES['form_education']['tmp_name']) && $_FILES['form_education']['size']) {
82 $form_dest_filename = $_FILES['form_education']['name'];
83 $form_dest_filename = strtolower(basename($form_dest_filename));
84 if (substr($form_dest_filename, -4) != '.pdf') {
85 die(xlt('Filename must end with ".pdf"'));
87 $educationpath = "$educationdir/$form_dest_filename";
88 // If the site's education directory does not yet exist, create it.
89 if (!is_dir($educationdir)) {
92 if (is_file($educationpath)) unlink($educationpath);
93 $tmp_name = $_FILES['form_education']['tmp_name'];
94 if (!move_uploaded_file($tmp_name, $educationpath)) {
95 die(text(xl('Unable to create') . " '$educationpath'"));
102 * Thumbnails generator
103 * generating thumbnail image to all images files from documents table
106 if(isset($_POST['generate_thumbnails'])) {
108 $thumb_generator = new ThumbnailGenerator();
109 $results = $thumb_generator->generate_all();
111 $thumbnail_msg = "<p style='color: green'>" . xlt('Generated thumbnail(s)') . " : " . text($results['sum_success']) . "</p>";
112 $thumbnail_msg .= "<p style='color: red'>" . xlt('Failed to generate') . " : " . text($results['sum_failed']) . "</p>";
113 foreach($results['failed'] as $key => $file){
115 $thumbnail_msg .= "<p style='color: red; font-size: 11px'> " .text($num) . ". " . text($file) . "</p>";
119 $count_not_generated = ThumbnailGenerator
::count_not_generated();
121 $thumbnail_msg = "<p>" . xlt('Files with empty thumbnail') . ": " . text($count_not_generated) . " </p>";
127 * Security feature that enable to upload only file with mime-type from white list.
128 * Important to prevention upload of virus script.
129 * Dependence - turn on global setting 'secure_upload'
132 if($GLOBALS['secure_upload']){
134 $mime_types = array('image/*', 'text/*', 'audio/*', 'video/*');
139 curl_setopt_array($curl, array(
140 CURLOPT_RETURNTRANSFER
=> 1,
141 CURLOPT_URL
=> 'https://cdn.rawgit.com/jshttp/mime-db/master/db.json',
142 CURLOPT_CONNECTTIMEOUT
=> 5,
145 // Send the request & save response to $resp
146 $resp = curl_exec($curl);
147 $httpinfo = curl_getinfo($curl);
148 if($resp && $httpinfo['http_code'] == 200 && $httpinfo['content_type'] == 'application/json;charset=utf-8'){
149 $all_mime_types = json_decode($resp, true);
150 foreach ($all_mime_types as $name => $value){
151 $mime_types[] = $name;
154 error_log('Get list of mime-type error: "' . curl_error($curl) . '" - Code: ' . curl_errno($curl));
155 $mime_types_list = array(
160 'application/msword',
161 'application/vnd.oasis.opendocument.spreadsheet',
164 $mime_types = array_merge($mime_types, $mime_types_list);
168 if(isset($_POST['submit_form'])){
170 $new_white_list = empty($_POST['white_list']) ?
array() : $_POST['white_list'];
172 // truncate white list from list_options table
173 sqlStatement("DELETE FROM `list_options` WHERE `list_id` = 'files_white_list'");
174 foreach ($new_white_list as $mimetype){
175 sqlStatement("INSERT INTO `list_options` (`list_id`, `option_id`, `title`, `activity`) VALUES ('files_white_list', ?, ?, 1)", array($mimetype, $mimetype));
178 $white_list = $new_white_list;
180 $white_list = array();
181 $lres = sqlStatement("SELECT option_id FROM list_options WHERE list_id = 'files_white_list' AND activity = 1");
182 while ($lrow = sqlFetchArray($lres)) {
183 $white_list[] = $lrow['option_id'];
193 <title
><?php
echo xlt('File management'); ?
></title
>
194 <link rel
="stylesheet" href
='<?php echo $css_header ?>' type
='text/css'>
196 <style type
="text/css">
197 .dehead
{ color
:#000000; font-family:sans-serif; font-size:10pt; font-weight:bold }
198 .detail
{ color
:#000000; font-family:sans-serif; font-size:10pt; font-weight:normal }
199 #generate_thumb, #file_type_whitelist{
202 border
: 2px solid dimgrey
;
204 #generate_thumb table{
208 #generate_thumb table td{
209 border
-right
: 1px solid dimgrey
;
214 <script type
="text/javascript" src
="<?php echo $GLOBALS['assets_static_relative'] ?>/jquery-min-3-1-1/index.js"></script
>
216 <script language
="JavaScript">
217 // This is invoked when a filename selection changes in the drop-list.
218 // In this case anything else entered into the form is discarded.
219 function msfFileChanged() {
220 top
.restoreSession();
221 document
.forms
[0].submit();
227 <body
class="body_top">
228 <form method
='post' action
='manage_site_files.php' enctype
='multipart/form-data'
229 onsubmit
='return top.restoreSession()'>
234 <table border
='1' width
='95%'>
236 <tr bgcolor
='#dddddd' class='dehead'>
237 <td colspan
='2' align
='center'><?php
echo htmlspecialchars(xl('Edit File in') . " $OE_SITE_DIR"); ?
></td
>
241 <td valign
='top' class='detail' nowrap
>
242 <select name
='form_filename' onchange
='msfFileChanged()'>
243 <option value
=''></option
>
245 foreach ($my_files as $filename) {
246 echo " <option value='" . htmlspecialchars($filename, ENT_QUOTES
) . "'";
247 if ($filename == $form_filename) echo " selected";
248 echo ">" . htmlspecialchars($filename) . "</option>\n";
253 <textarea name
='form_filedata' rows
='25' style
='width:100%'><?php
254 if ($form_filename) {
255 echo htmlspecialchars(@file_get_contents
($filepath));
261 <tr bgcolor
='#dddddd' class='dehead'>
262 <td colspan
='2' align
='center'><?php
echo htmlspecialchars(xl('Upload Image to') . " $imagedir"); ?
></td
>
266 <td valign
='top' class='detail' nowrap
>
267 <?php
echo htmlspecialchars(xl('Source File')); ?
>:
268 <input type
="hidden" name
="MAX_FILE_SIZE" value
="12000000" />
269 <input type
="file" name
="form_image" size
="40" /> 
;
270 <?php
echo htmlspecialchars(xl('Destination Filename')) ?
>:
271 <select name
='form_dest_filename'>
272 <option value
=''>(<?php
echo htmlspecialchars(xl('Use source filename')) ?
>)</option
>
274 // Generate an <option> for each file already in the images directory.
275 $dh = opendir($imagedir);
276 if (!$dh) die(htmlspecialchars(xl('Cannot read directory') . " '$imagedir'"));
277 $imagesslist = array();
278 while (false !== ($sfname = readdir($dh))) {
279 if (substr($sfname, 0, 1) == '.') continue;
280 if ($sfname == 'CVS' ) continue;
281 $imageslist[$sfname] = $sfname;
285 foreach ($imageslist as $sfname) {
286 echo " <option value='" . htmlspecialchars($sfname, ENT_QUOTES
) . "'";
287 echo ">" . htmlspecialchars($sfname) . "</option>\n";
294 <tr bgcolor
='#dddddd' class='dehead'>
295 <td colspan
='2' align
='center'><?php
echo text(xl('Upload Patient Education PDF to') . " $educationdir"); ?
></td
>
298 <td valign
='top' class='detail' nowrap
>
299 <?php
echo xlt('Source File'); ?
>:
300 <input type
="file" name
="form_education" size
="40" /> 
;
301 <?php
echo xlt('Name must be like codetype_code_language.pdf, for example icd9_274.11_en.pdf'); ?
>
308 <input type
='submit' name
='bn_save' value
='<?php echo htmlspecialchars(xl('Save
')) ?>' />
315 <div id
="generate_thumb">
316 <table style
="width: 100%">
318 <td
class="thumb_title" style
="width: 33%">
319 <b
><?php
echo xlt('Generate Thumbnails')?
></b
>
321 <td
class="thumb_msg" style
="width: 50%">
322 <span
><?php
echo $thumbnail_msg ?
></span
>
324 <td
class="thumb_form" style
="width:17%;border-right:none">
325 <form method
='post' action
='manage_site_files.php#generate_thumb'>
326 <input style
="margin-top: 10px" type
="submit" name
="generate_thumbnails" value
="<?php echo xla('Generate') ?>">
333 <?php
if($GLOBALS['secure_upload']) { ?
>
335 <div id
="file_type_whitelist">
336 <h2
><?php
echo xlt('Create custom white list of MIME content type of a files to secure your documents system');?
></h2
>
337 <form id
="whitelist_form" method
="post">
338 <div
class="subject-black-list">
339 <div
class="top-list">
340 <h2
><?php
echo xlt('Black list'); ?
></h2
>
341 <b
><?php
echo xlt('Filter');?
>:</b
> <input type
="text" id
="filter-black-list" >
343 <select multiple
="multiple" id
='black-list' class="form-control">
345 foreach ($mime_types as $type) {
346 if(!in_array($type, $white_list)){
347 echo "<option value='" . attr($type) . "'> " . text($type) . "</option>";
354 <div
class="subject-info-arrows">
355 <input type
="button" id
="btnAllRight" value
=">>" /><br
/>
356 <input type
="button" id
="btnRight" value
=">" /><br
/>
357 <input type
="button" id
="btnLeft" value
="<" /><br
/>
358 <input type
="button" id
="btnAllLeft" value
="<<" />
361 <div
class="subject-white-list">
362 <div
class="top-list">
363 <h2
><?php
echo xlt('White list'); ?
></h2
>
364 <b
><?php
echo xlt('Add manually');?
>:</b
> <input type
="text" id
="add-manually-input"> <input type
="button" id
="add-manually" value
="+">
366 <select name
="white_list[]" multiple
="multiple" id
='white-list' class="form-control">
368 foreach ($white_list as $type) {
369 echo "<option value='" . attr($type) . "'> " . text($type) . "</option>";
374 <div
class="subject-info-save">
375 <input type
="button" id
="submit-whitelist" value
="<?php echo xlt('Save'); ?>" />
376 <input type
="hidden" name
="submit_form" value
="1" />
385 $
('#btnRight').click(function (e
) {
386 var selectedOpts
= $
('#black-list option:selected');
387 if (selectedOpts
.length
== 0) {
391 $
('#white-list').append($
(selectedOpts
).clone());
392 $
(selectedOpts
).remove();
396 $
('#btnAllRight').click(function (e
) {
397 var selectedOpts
= $
('#black-list option');
398 if (selectedOpts
.length
== 0) {
402 $
('#white-list').append($
(selectedOpts
).clone());
403 $
(selectedOpts
).remove();
407 $
('#btnLeft').click(function (e
) {
408 var selectedOpts
= $
('#white-list option:selected');
409 if (selectedOpts
.length
== 0) {
413 $
('#black-list').append($
(selectedOpts
).clone());
414 $
(selectedOpts
).remove();
418 $
('#btnAllLeft').click(function (e
) {
419 var selectedOpts
= $
('#white-list option');
420 if (selectedOpts
.length
== 0) {
424 $
('#black-list').append($
(selectedOpts
).clone());
425 $
(selectedOpts
).remove();
429 var storeElements
= [];
431 $
('#filter-black-list').on('keyup', function() {
432 var val
= this
.value
.toLowerCase();
434 $
('#black-list option').each(function(){
436 if(this
.value
.toLowerCase().indexOf( val
) == -1){
437 if(storeElements
.indexOf(this
) == -1){
438 storeElements
.unshift(this
)
444 $
(storeElements
).each(function(key
, element
){
446 if(element
.value
.toLowerCase().indexOf( val
) > -1){
448 $
('#black-list').prepend(element
);
449 storeElements
.splice(key
, 1)
456 $
('#add-manually').on('click', function () {
457 var new_type
= $
("#add-manually-input").val();
458 if(new_type
.length
< 1)return;
459 $
('#white-list').prepend("<option value="+new_type+
">"+new_type+
"</option>")
462 $
('#submit-whitelist').on('click', function () {
463 $
('#white-list option').prop('selected', true);
464 $
('#whitelist_form').submit();