Search moodle.org's
Developer Documentation
Developer Documentation
- Bug fixes for general core bugs in 4.0.x will end 8 May 2023 (12 months).
- Bug fixes for security issues in 4.0.x will end 13 November 2023 (18 months).
- PHP version: minimum PHP 7.3.0 Note: the minimum PHP version has increased since Moodle 3.10. PHP 7.4.x is also supported.
/lib/ -> filelib.php (source)
Differences Between: [Versions 310 and 400] [Versions 311 and 400] [Versions 39 and 400] [Versions 400 and 401] [Versions 400 and 402] [Versions 400 and 403]
1 <?php 2 // This file is part of Moodle - http://moodle.org/ 3 // 4 // Moodle is free software: you can redistribute it and/or modify 5 // it under the terms of the GNU General Public License as published by 6 // the Free Software Foundation, either version 3 of the License, or 7 // (at your option) any later version. 8 // 9 // Moodle is distributed in the hope that it will be useful, 10 // but WITHOUT ANY WARRANTY; without even the implied warranty of 11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 // GNU General Public License for more details. 13 // 14 // You should have received a copy of the GNU General Public License 15 // along with Moodle. If not, see <http://www.gnu.org/licenses/>. 16 17 /** 18 * Functions for file handling. 19 * 20 * @package core_files 21 * @copyright 1999 onwards Martin Dougiamas (http://dougiamas.com) 22 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later 23 */ 24 25 defined('MOODLE_INTERNAL') || die(); 26 27 /** 28 * BYTESERVING_BOUNDARY - string unique string constant. 29 */ 30 define('BYTESERVING_BOUNDARY', 's1k2o3d4a5k6s7'); 31 32 33 /** 34 * Do not process file merging when working with draft area files. 35 */ 36 define('IGNORE_FILE_MERGE', -1); 37 38 /** 39 * Unlimited area size constant 40 */ 41 define('FILE_AREA_MAX_BYTES_UNLIMITED', -1); 42 43 /** 44 * Capacity of the draft area bucket when using the leaking bucket technique to limit the draft upload rate. 45 */ 46 define('DRAFT_AREA_BUCKET_CAPACITY', 50); 47 48 /** 49 * Leaking rate of the draft area bucket when using the leaking bucket technique to limit the draft upload rate. 50 */ 51 define('DRAFT_AREA_BUCKET_LEAK', 0.2); 52 53 require_once("$CFG->libdir/filestorage/file_exceptions.php"); 54 require_once("$CFG->libdir/filestorage/file_storage.php"); 55 require_once("$CFG->libdir/filestorage/zip_packer.php"); 56 require_once("$CFG->libdir/filebrowser/file_browser.php"); 57 58 /** 59 * Encodes file serving url 60 * 61 * @deprecated use moodle_url factory methods instead 62 * 63 * @todo MDL-31071 deprecate this function 64 * @global stdClass $CFG 65 * @param string $urlbase 66 * @param string $path /filearea/itemid/dir/dir/file.exe 67 * @param bool $forcedownload 68 * @param bool $https https url required 69 * @return string encoded file url 70 */ 71 function file_encode_url($urlbase, $path, $forcedownload=false, $https=false) { 72 global $CFG; 73 74 //TODO: deprecate this 75 76 if ($CFG->slasharguments) { 77 $parts = explode('/', $path); 78 $parts = array_map('rawurlencode', $parts); 79 $path = implode('/', $parts); 80 $return = $urlbase.$path; 81 if ($forcedownload) { 82 $return .= '?forcedownload=1'; 83 } 84 } else { 85 $path = rawurlencode($path); 86 $return = $urlbase.'?file='.$path; 87 if ($forcedownload) { 88 $return .= '&forcedownload=1'; 89 } 90 } 91 92 if ($https) { 93 $return = str_replace('http://', 'https://', $return); 94 } 95 96 return $return; 97 } 98 99 /** 100 * Detects if area contains subdirs, 101 * this is intended for file areas that are attached to content 102 * migrated from 1.x where subdirs were allowed everywhere. 103 * 104 * @param context $context 105 * @param string $component 106 * @param string $filearea 107 * @param string $itemid 108 * @return bool 109 */ 110 function file_area_contains_subdirs(context $context, $component, $filearea, $itemid) { 111 global $DB; 112 113 if (!isset($itemid)) { 114 // Not initialised yet. 115 return false; 116 } 117 118 // Detect if any directories are already present, this is necessary for content upgraded from 1.x. 119 $select = "contextid = :contextid AND component = :component AND filearea = :filearea AND itemid = :itemid AND filepath <> '/' AND filename = '.'"; 120 $params = array('contextid'=>$context->id, 'component'=>$component, 'filearea'=>$filearea, 'itemid'=>$itemid); 121 return $DB->record_exists_select('files', $select, $params); 122 } 123 124 /** 125 * Prepares 'editor' formslib element from data in database 126 * 127 * The passed $data record must contain field foobar, foobarformat and optionally foobartrust. This 128 * function then copies the embedded files into draft area (assigning itemids automatically), 129 * creates the form element foobar_editor and rewrites the URLs so the embedded images can be 130 * displayed. 131 * In your mform definition, you must have an 'editor' element called foobar_editor. Then you call 132 * your mform's set_data() supplying the object returned by this function. 133 * 134 * @category files 135 * @param stdClass $data database field that holds the html text with embedded media 136 * @param string $field the name of the database field that holds the html text with embedded media 137 * @param array $options editor options (like maxifiles, maxbytes etc.) 138 * @param stdClass $context context of the editor 139 * @param string $component 140 * @param string $filearea file area name 141 * @param int $itemid item id, required if item exists 142 * @return stdClass modified data object 143 */ 144 function file_prepare_standard_editor($data, $field, array $options, $context=null, $component=null, $filearea=null, $itemid=null) { 145 $options = (array)$options; 146 if (!isset($options['trusttext'])) { 147 $options['trusttext'] = false; 148 } 149 if (!isset($options['forcehttps'])) { 150 $options['forcehttps'] = false; 151 } 152 if (!isset($options['subdirs'])) { 153 $options['subdirs'] = false; 154 } 155 if (!isset($options['maxfiles'])) { 156 $options['maxfiles'] = 0; // no files by default 157 } 158 if (!isset($options['noclean'])) { 159 $options['noclean'] = false; 160 } 161 162 //sanity check for passed context. This function doesn't expect $option['context'] to be set 163 //But this function is called before creating editor hence, this is one of the best places to check 164 //if context is used properly. This check notify developer that they missed passing context to editor. 165 if (isset($context) && !isset($options['context'])) { 166 //if $context is not null then make sure $option['context'] is also set. 167 debugging('Context for editor is not set in editoroptions. Hence editor will not respect editor filters', DEBUG_DEVELOPER); 168 } else if (isset($options['context']) && isset($context)) { 169 //If both are passed then they should be equal. 170 if ($options['context']->id != $context->id) { 171 $exceptionmsg = 'Editor context ['.$options['context']->id.'] is not equal to passed context ['.$context->id.']'; 172 throw new coding_exception($exceptionmsg); 173 } 174 } 175 176 if (is_null($itemid) or is_null($context)) { 177 $contextid = null; 178 $itemid = null; 179 if (!isset($data)) { 180 $data = new stdClass(); 181 } 182 if (!isset($data->{$field})) { 183 $data->{$field} = ''; 184 } 185 if (!isset($data->{$field.'format'})) { 186 $data->{$field.'format'} = editors_get_preferred_format(); 187 } 188 if (!$options['noclean']) { 189 $data->{$field} = clean_text($data->{$field}, $data->{$field.'format'}); 190 } 191 192 } else { 193 if ($options['trusttext']) { 194 // noclean ignored if trusttext enabled 195 if (!isset($data->{$field.'trust'})) { 196 $data->{$field.'trust'} = 0; 197 } 198 $data = trusttext_pre_edit($data, $field, $context); 199 } else { 200 if (!$options['noclean']) { 201 $data->{$field} = clean_text($data->{$field}, $data->{$field.'format'}); 202 } 203 } 204 $contextid = $context->id; 205 } 206 207 if ($options['maxfiles'] != 0) { 208 $draftid_editor = file_get_submitted_draft_itemid($field); 209 $currenttext = file_prepare_draft_area($draftid_editor, $contextid, $component, $filearea, $itemid, $options, $data->{$field}); 210 $data->{$field.'_editor'} = array('text'=>$currenttext, 'format'=>$data->{$field.'format'}, 'itemid'=>$draftid_editor); 211 } else { 212 $data->{$field.'_editor'} = array('text'=>$data->{$field}, 'format'=>$data->{$field.'format'}, 'itemid'=>0); 213 } 214 215 return $data; 216 } 217 218 /** 219 * Prepares the content of the 'editor' form element with embedded media files to be saved in database 220 * 221 * This function moves files from draft area to the destination area and 222 * encodes URLs to the draft files so they can be safely saved into DB. The 223 * form has to contain the 'editor' element named foobar_editor, where 'foobar' 224 * is the name of the database field to hold the wysiwyg editor content. The 225 * editor data comes as an array with text, format and itemid properties. This 226 * function automatically adds $data properties foobar, foobarformat and 227 * foobartrust, where foobar has URL to embedded files encoded. 228 * 229 * @category files 230 * @param stdClass $data raw data submitted by the form 231 * @param string $field name of the database field containing the html with embedded media files 232 * @param array $options editor options (trusttext, subdirs, maxfiles, maxbytes etc.) 233 * @param stdClass $context context, required for existing data 234 * @param string $component file component 235 * @param string $filearea file area name 236 * @param int $itemid item id, required if item exists 237 * @return stdClass modified data object 238 */ 239 function file_postupdate_standard_editor($data, $field, array $options, $context, $component=null, $filearea=null, $itemid=null) { 240 $options = (array)$options; 241 if (!isset($options['trusttext'])) { 242 $options['trusttext'] = false; 243 } 244 if (!isset($options['forcehttps'])) { 245 $options['forcehttps'] = false; 246 } 247 if (!isset($options['subdirs'])) { 248 $options['subdirs'] = false; 249 } 250 if (!isset($options['maxfiles'])) { 251 $options['maxfiles'] = 0; // no files by default 252 } 253 if (!isset($options['maxbytes'])) { 254 $options['maxbytes'] = 0; // unlimited 255 } 256 if (!isset($options['removeorphaneddrafts'])) { 257 $options['removeorphaneddrafts'] = false; // Don't remove orphaned draft files by default. 258 } 259 260 if ($options['trusttext']) { 261 $data->{$field.'trust'} = trusttext_trusted($context); 262 } else { 263 $data->{$field.'trust'} = 0; 264 } 265 266 $editor = $data->{$field.'_editor'}; 267 268 if ($options['maxfiles'] == 0 or is_null($filearea) or is_null($itemid) or empty($editor['itemid'])) { 269 $data->{$field} = $editor['text']; 270 } else { 271 // Clean the user drafts area of any files not referenced in the editor text. 272 if ($options['removeorphaneddrafts']) { 273 file_remove_editor_orphaned_files($editor); 274 } 275 $data->{$field} = file_save_draft_area_files($editor['itemid'], $context->id, $component, $filearea, $itemid, $options, $editor['text'], $options['forcehttps']); 276 } 277 $data->{$field.'format'} = $editor['format']; 278 279 return $data; 280 } 281 282 /** 283 * Saves text and files modified by Editor formslib element 284 * 285 * @category files 286 * @param stdClass $data $database entry field 287 * @param string $field name of data field 288 * @param array $options various options 289 * @param stdClass $context context - must already exist 290 * @param string $component 291 * @param string $filearea file area name 292 * @param int $itemid must already exist, usually means data is in db 293 * @return stdClass modified data obejct 294 */ 295 function file_prepare_standard_filemanager($data, $field, array $options, $context=null, $component=null, $filearea=null, $itemid=null) { 296 $options = (array)$options; 297 if (!isset($options['subdirs'])) { 298 $options['subdirs'] = false; 299 } 300 if (is_null($itemid) or is_null($context)) { 301 $itemid = null; 302 $contextid = null; 303 } else { 304 $contextid = $context->id; 305 } 306 307 $draftid_editor = file_get_submitted_draft_itemid($field.'_filemanager'); 308 file_prepare_draft_area($draftid_editor, $contextid, $component, $filearea, $itemid, $options); 309 $data->{$field.'_filemanager'} = $draftid_editor; 310 311 return $data; 312 } 313 314 /** 315 * Saves files modified by File manager formslib element 316 * 317 * @todo MDL-31073 review this function 318 * @category files 319 * @param stdClass $data $database entry field 320 * @param string $field name of data field 321 * @param array $options various options 322 * @param stdClass $context context - must already exist 323 * @param string $component 324 * @param string $filearea file area name 325 * @param int $itemid must already exist, usually means data is in db 326 * @return stdClass modified data obejct 327 */ 328 function file_postupdate_standard_filemanager($data, $field, array $options, $context, $component, $filearea, $itemid) { 329 $options = (array)$options; 330 if (!isset($options['subdirs'])) { 331 $options['subdirs'] = false; 332 } 333 if (!isset($options['maxfiles'])) { 334 $options['maxfiles'] = -1; // unlimited 335 } 336 if (!isset($options['maxbytes'])) { 337 $options['maxbytes'] = 0; // unlimited 338 } 339 340 if (empty($data->{$field.'_filemanager'})) { 341 $data->$field = ''; 342 343 } else { 344 file_save_draft_area_files($data->{$field.'_filemanager'}, $context->id, $component, $filearea, $itemid, $options); 345 $fs = get_file_storage(); 346 347 if ($fs->get_area_files($context->id, $component, $filearea, $itemid)) { 348 $data->$field = '1'; // TODO: this is an ugly hack (skodak) 349 } else { 350 $data->$field = ''; 351 } 352 } 353 354 return $data; 355 } 356 357 /** 358 * Generate a draft itemid 359 * 360 * @category files 361 * @global moodle_database $DB 362 * @global stdClass $USER 363 * @return int a random but available draft itemid that can be used to create a new draft 364 * file area. 365 */ 366 function file_get_unused_draft_itemid() { 367 global $DB, $USER; 368 369 if (isguestuser() or !isloggedin()) { 370 // guests and not-logged-in users can not be allowed to upload anything!!!!!! 371 print_error('noguest'); 372 } 373 374 $contextid = context_user::instance($USER->id)->id; 375 376 $fs = get_file_storage(); 377 $draftitemid = rand(1, 999999999); 378 while ($files = $fs->get_area_files($contextid, 'user', 'draft', $draftitemid)) { 379 $draftitemid = rand(1, 999999999); 380 } 381 382 return $draftitemid; 383 } 384 385 /** 386 * Initialise a draft file area from a real one by copying the files. A draft 387 * area will be created if one does not already exist. Normally you should 388 * get $draftitemid by calling file_get_submitted_draft_itemid('elementname'); 389 * 390 * @category files 391 * @global stdClass $CFG 392 * @global stdClass $USER 393 * @param int $draftitemid the id of the draft area to use, or 0 to create a new one, in which case this parameter is updated. 394 * @param int $contextid This parameter and the next two identify the file area to copy files from. 395 * @param string $component 396 * @param string $filearea helps indentify the file area. 397 * @param int $itemid helps identify the file area. Can be null if there are no files yet. 398 * @param array $options text and file options ('subdirs'=>false, 'forcehttps'=>false) 399 * @param string $text some html content that needs to have embedded links rewritten to point to the draft area. 400 * @return string|null returns string if $text was passed in, the rewritten $text is returned. Otherwise NULL. 401 */ 402 function file_prepare_draft_area(&$draftitemid, $contextid, $component, $filearea, $itemid, array $options=null, $text=null) { 403 global $CFG, $USER; 404 405 $options = (array)$options; 406 if (!isset($options['subdirs'])) { 407 $options['subdirs'] = false; 408 } 409 if (!isset($options['forcehttps'])) { 410 $options['forcehttps'] = false; 411 } 412 413 $usercontext = context_user::instance($USER->id); 414 $fs = get_file_storage(); 415 416 if (empty($draftitemid)) { 417 // create a new area and copy existing files into 418 $draftitemid = file_get_unused_draft_itemid(); 419 $file_record = array('contextid'=>$usercontext->id, 'component'=>'user', 'filearea'=>'draft', 'itemid'=>$draftitemid); 420 if (!is_null($itemid) and $files = $fs->get_area_files($contextid, $component, $filearea, $itemid)) { 421 foreach ($files as $file) { 422 if ($file->is_directory() and $file->get_filepath() === '/') { 423 // we need a way to mark the age of each draft area, 424 // by not copying the root dir we force it to be created automatically with current timestamp 425 continue; 426 } 427 if (!$options['subdirs'] and ($file->is_directory() or $file->get_filepath() !== '/')) { 428 continue; 429 } 430 $draftfile = $fs->create_file_from_storedfile($file_record, $file); 431 // XXX: This is a hack for file manager (MDL-28666) 432 // File manager needs to know the original file information before copying 433 // to draft area, so we append these information in mdl_files.source field 434 // {@link file_storage::search_references()} 435 // {@link file_storage::search_references_count()} 436 $sourcefield = $file->get_source(); 437 $newsourcefield = new stdClass; 438 $newsourcefield->source = $sourcefield; 439 $original = new stdClass; 440 $original->contextid = $contextid; 441 $original->component = $component; 442 $original->filearea = $filearea; 443 $original->itemid = $itemid; 444 $original->filename = $file->get_filename(); 445 $original->filepath = $file->get_filepath(); 446 $newsourcefield->original = file_storage::pack_reference($original); 447 $draftfile->set_source(serialize($newsourcefield)); 448 // End of file manager hack 449 } 450 } 451 if (!is_null($text)) { 452 // at this point there should not be any draftfile links yet, 453 // because this is a new text from database that should still contain the @@pluginfile@@ links 454 // this happens when developers forget to post process the text 455 $text = str_replace("\"$CFG->wwwroot/draftfile.php", "\"$CFG->wwwroot/brokenfile.php#", $text); 456 } 457 } else { 458 // nothing to do 459 } 460 461 if (is_null($text)) { 462 return null; 463 } 464 465 // relink embedded files - editor can not handle @@PLUGINFILE@@ ! 466 return file_rewrite_pluginfile_urls($text, 'draftfile.php', $usercontext->id, 'user', 'draft', $draftitemid, $options); 467 } 468 469 /** 470 * Convert encoded URLs in $text from the @@PLUGINFILE@@/... form to an actual URL. 471 * Passing a new option reverse = true in the $options var will make the function to convert actual URLs in $text to encoded URLs 472 * in the @@PLUGINFILE@@ form. 473 * 474 * @param string $text The content that may contain ULRs in need of rewriting. 475 * @param string $file The script that should be used to serve these files. pluginfile.php, draftfile.php, etc. 476 * @param int $contextid This parameter and the next two identify the file area to use. 477 * @param string $component 478 * @param string $filearea helps identify the file area. 479 * @param int $itemid helps identify the file area. 480 * @param array $options 481 * bool $options.forcehttps Force the user of https 482 * bool $options.reverse Reverse the behaviour of the function 483 * mixed $options.includetoken Use a token for authentication. True for current user, int value for other user id. 484 * string The processed text. 485 */ 486 function file_rewrite_pluginfile_urls($text, $file, $contextid, $component, $filearea, $itemid, array $options=null) { 487 global $CFG, $USER; 488 489 $options = (array)$options; 490 if (!isset($options['forcehttps'])) { 491 $options['forcehttps'] = false; 492 } 493 494 $baseurl = "{$CFG->wwwroot}/{$file}"; 495 if (!empty($options['includetoken'])) { 496 $userid = $options['includetoken'] === true ? $USER->id : $options['includetoken']; 497 $token = get_user_key('core_files', $userid); 498 $finalfile = basename($file); 499 $tokenfile = "token{$finalfile}"; 500 $file = substr($file, 0, strlen($file) - strlen($finalfile)) . $tokenfile; 501 $baseurl = "{$CFG->wwwroot}/{$file}"; 502 503 if (!$CFG->slasharguments) { 504 $baseurl .= "?token={$token}&file="; 505 } else { 506 $baseurl .= "/{$token}"; 507 } 508 } 509 510 $baseurl .= "/{$contextid}/{$component}/{$filearea}/"; 511 512 if ($itemid !== null) { 513 $baseurl .= "$itemid/"; 514 } 515 516 if ($options['forcehttps']) { 517 $baseurl = str_replace('http://', 'https://', $baseurl); 518 } 519 520 if (!empty($options['reverse'])) { 521 return str_replace($baseurl, '@@PLUGINFILE@@/', $text); 522 } else { 523 return str_replace('@@PLUGINFILE@@/', $baseurl, $text); 524 } 525 } 526 527 /** 528 * Returns information about files in a draft area. 529 * 530 * @global stdClass $CFG 531 * @global stdClass $USER 532 * @param int $draftitemid the draft area item id. 533 * @param string $filepath path to the directory from which the information have to be retrieved. 534 * @return array with the following entries: 535 * 'filecount' => number of files in the draft area. 536 * 'filesize' => total size of the files in the draft area. 537 * 'foldercount' => number of folders in the draft area. 538 * 'filesize_without_references' => total size of the area excluding file references. 539 * (more information will be added as needed). 540 */ 541 function file_get_draft_area_info($draftitemid, $filepath = '/') { 542 global $USER; 543 544 $usercontext = context_user::instance($USER->id); 545 return file_get_file_area_info($usercontext->id, 'user', 'draft', $draftitemid, $filepath); 546 } 547 548 /** 549 * Returns information about files in an area. 550 * 551 * @param int $contextid context id 552 * @param string $component component 553 * @param string $filearea file area name 554 * @param int $itemid item id or all files if not specified 555 * @param string $filepath path to the directory from which the information have to be retrieved. 556 * @return array with the following entries: 557 * 'filecount' => number of files in the area. 558 * 'filesize' => total size of the files in the area. 559 * 'foldercount' => number of folders in the area. 560 * 'filesize_without_references' => total size of the area excluding file references. 561 * @since Moodle 3.4 562 */ 563 function file_get_file_area_info($contextid, $component, $filearea, $itemid = 0, $filepath = '/') { 564 565 $fs = get_file_storage(); 566 567 $results = array( 568 'filecount' => 0, 569 'foldercount' => 0, 570 'filesize' => 0, 571 'filesize_without_references' => 0 572 ); 573 574 $draftfiles = $fs->get_directory_files($contextid, $component, $filearea, $itemid, $filepath, true, true); 575 576 foreach ($draftfiles as $file) { 577 if ($file->is_directory()) { 578 $results['foldercount'] += 1; 579 } else { 580 $results['filecount'] += 1; 581 } 582 583 $filesize = $file->get_filesize(); 584 $results['filesize'] += $filesize; 585 if (!$file->is_external_file()) { 586 $results['filesize_without_references'] += $filesize; 587 } 588 } 589 590 return $results; 591 } 592 593 /** 594 * Returns whether a draft area has exceeded/will exceed its size limit. 595 * 596 * Please note that the unlimited value for $areamaxbytes is -1 {@link FILE_AREA_MAX_BYTES_UNLIMITED}, not 0. 597 * 598 * @param int $draftitemid the draft area item id. 599 * @param int $areamaxbytes the maximum size allowed in this draft area. 600 * @param int $newfilesize the size that would be added to the current area. 601 * @param bool $includereferences true to include the size of the references in the area size. 602 * @return bool true if the area will/has exceeded its limit. 603 * @since Moodle 2.4 604 */ 605 function file_is_draft_area_limit_reached($draftitemid, $areamaxbytes, $newfilesize = 0, $includereferences = false) { 606 if ($areamaxbytes != FILE_AREA_MAX_BYTES_UNLIMITED) { 607 $draftinfo = file_get_draft_area_info($draftitemid); 608 $areasize = $draftinfo['filesize_without_references']; 609 if ($includereferences) { 610 $areasize = $draftinfo['filesize']; 611 } 612 if ($areasize + $newfilesize > $areamaxbytes) { 613 return true; 614 } 615 } 616 return false; 617 } 618 619 /** 620 * Returns whether a user has reached their draft area upload rate. 621 * 622 * @param int $userid The user id 623 * @return bool 624 */ 625 function file_is_draft_areas_limit_reached(int $userid): bool { 626 global $CFG; 627 628 $capacity = $CFG->draft_area_bucket_capacity ?? DRAFT_AREA_BUCKET_CAPACITY; 629 $leak = $CFG->draft_area_bucket_leak ?? DRAFT_AREA_BUCKET_LEAK; 630 631 $since = time() - floor($capacity / $leak); // The items that were in the bucket before this time are already leaked by now. 632 // We are going to be a bit generous to the user when using the leaky bucket 633 // algorithm below. We are going to assume that the bucket is empty at $since. 634 // We have to do an assumption here unless we really want to get ALL user's draft 635 // items without any limit and put all of them in the leaking bucket. 636 // I decided to favour performance over accuracy here. 637 638 $fs = get_file_storage(); 639 $items = $fs->get_user_draft_items($userid, $since); 640 $items = array_reverse($items); // So that the items are sorted based on time in the ascending direction. 641 642 // We only need to store the time that each element in the bucket is going to leak. So $bucket is array of leaking times. 643 $bucket = []; 644 foreach ($items as $item) { 645 $now = $item->timemodified; 646 // First let's see if items can be dropped from the bucket as a result of leakage. 647 while (!empty($bucket) && ($now >= $bucket[0])) { 648 array_shift($bucket); 649 } 650 651 // Calculate the time that the new item we put into the bucket will be leaked from it, and store it into the bucket. 652 if ($bucket) { 653 $bucket[] = max($bucket[count($bucket) - 1], $now) + (1 / $leak); 654 } else { 655 $bucket[] = $now + (1 / $leak); 656 } 657 } 658 659 // Recalculate the bucket's content based on the leakage until now. 660 $now = time(); 661 while (!empty($bucket) && ($now >= $bucket[0])) { 662 array_shift($bucket); 663 } 664 665 return count($bucket) >= $capacity; 666 } 667 668 /** 669 * Get used space of files 670 * @global moodle_database $DB 671 * @global stdClass $USER 672 * @return int total bytes 673 */ 674 function file_get_user_used_space() { 675 global $DB, $USER; 676 677 $usercontext = context_user::instance($USER->id); 678 $sql = "SELECT SUM(files1.filesize) AS totalbytes FROM {files} files1 679 JOIN (SELECT contenthash, filename, MAX(id) AS id 680 FROM {files} 681 WHERE contextid = ? AND component = ? AND filearea != ? 682 GROUP BY contenthash, filename) files2 ON files1.id = files2.id"; 683 $params = array('contextid'=>$usercontext->id, 'component'=>'user', 'filearea'=>'draft'); 684 $record = $DB->get_record_sql($sql, $params); 685 return (int)$record->totalbytes; 686 } 687 688 /** 689 * Convert any string to a valid filepath 690 * @todo review this function 691 * @param string $str 692 * @return string path 693 */ 694 function file_correct_filepath($str) { //TODO: what is this? (skodak) - No idea (Fred) 695 if ($str == '/' or empty($str)) { 696 return '/'; 697 } else { 698 return '/'.trim($str, '/').'/'; 699 } 700 } 701 702 /** 703 * Generate a folder tree of draft area of current USER recursively 704 * 705 * @todo MDL-31073 use normal return value instead, this does not fit the rest of api here (skodak) 706 * @param int $draftitemid 707 * @param string $filepath 708 * @param mixed $data 709 */ 710 function file_get_drafarea_folders($draftitemid, $filepath, &$data) { 711 global $USER, $OUTPUT, $CFG; 712 $data->children = array(); 713 $context = context_user::instance($USER->id); 714 $fs = get_file_storage(); 715 if ($files = $fs->get_directory_files($context->id, 'user', 'draft', $draftitemid, $filepath, false)) { 716 foreach ($files as $file) { 717 if ($file->is_directory()) { 718 $item = new stdClass(); 719 $item->sortorder = $file->get_sortorder(); 720 $item->filepath = $file->get_filepath(); 721 722 $foldername = explode('/', trim($item->filepath, '/')); 723 $item->fullname = trim(array_pop($foldername), '/'); 724 725 $item->id = uniqid(); 726 file_get_drafarea_folders($draftitemid, $item->filepath, $item); 727 $data->children[] = $item; 728 } else { 729 continue; 730 } 731 } 732 } 733 } 734 735 /** 736 * Listing all files (including folders) in current path (draft area) 737 * used by file manager 738 * @param int $draftitemid 739 * @param string $filepath 740 * @return stdClass 741 */ 742 function file_get_drafarea_files($draftitemid, $filepath = '/') { 743 global $USER, $OUTPUT, $CFG; 744 745 $context = context_user::instance($USER->id); 746 $fs = get_file_storage(); 747 748 $data = new stdClass(); 749 $data->path = array(); 750 $data->path[] = array('name'=>get_string('files'), 'path'=>'/'); 751 752 // will be used to build breadcrumb 753 $trail = '/'; 754 if ($filepath !== '/') { 755 $filepath = file_correct_filepath($filepath); 756 $parts = explode('/', $filepath); 757 foreach ($parts as $part) { 758 if ($part != '' && $part != null) { 759 $trail .= ($part.'/'); 760 $data->path[] = array('name'=>$part, 'path'=>$trail); 761 } 762 } 763 } 764 765 $list = array(); 766 $maxlength = 12; 767 if ($files = $fs->get_directory_files($context->id, 'user', 'draft', $draftitemid, $filepath, false)) { 768 foreach ($files as $file) { 769 $item = new stdClass(); 770 $item->filename = $file->get_filename(); 771 $item->filepath = $file->get_filepath(); 772 $item->fullname = trim($item->filename, '/'); 773 $filesize = $file->get_filesize(); 774 $item->size = $filesize ? $filesize : null; 775 $item->filesize = $filesize ? display_size($filesize) : ''; 776 777 $item->sortorder = $file->get_sortorder(); 778 $item->author = $file->get_author(); 779 $item->license = $file->get_license(); 780 $item->datemodified = $file->get_timemodified(); 781 $item->datecreated = $file->get_timecreated(); 782 $item->isref = $file->is_external_file(); 783 if ($item->isref && $file->get_status() == 666) { 784 $item->originalmissing = true; 785 } 786 // find the file this draft file was created from and count all references in local 787 // system pointing to that file 788 $source = @unserialize($file->get_source()); 789 if (isset($source->original)) { 790 $item->refcount = $fs->search_references_count($source->original); 791 } 792 793 if ($file->is_directory()) { 794 $item->filesize = 0; 795 $item->icon = $OUTPUT->image_url(file_folder_icon(24))->out(false); 796 $item->type = 'folder'; 797 $foldername = explode('/', trim($item->filepath, '/')); 798 $item->fullname = trim(array_pop($foldername), '/'); 799 $item->thumbnail = $OUTPUT->image_url(file_folder_icon(90))->out(false); 800 } else { 801 // do NOT use file browser here! 802 $item->mimetype = get_mimetype_description($file); 803 if (file_extension_in_typegroup($file->get_filename(), 'archive')) { 804 $item->type = 'zip'; 805 } else { 806 $item->type = 'file'; 807 } 808 $itemurl = moodle_url::make_draftfile_url($draftitemid, $item->filepath, $item->filename); 809 $item->url = $itemurl->out(); 810 $item->icon = $OUTPUT->image_url(file_file_icon($file, 24))->out(false); 811 $item->thumbnail = $OUTPUT->image_url(file_file_icon($file, 90))->out(false); 812 813 // The call to $file->get_imageinfo() fails with an exception if the file can't be read on the file system. 814 // We still want to add such files to the list, so the owner can view and delete them if needed. So, we only call 815 // get_imageinfo() on files that can be read, and we also spoof the file status based on whether it was found. 816 // We'll use the same status types used by stored_file->get_status(), where 0 = OK. 1 = problem, as these will be 817 // used by the widget to display a warning about the problem files. 818 // The value of stored_file->get_status(), and the file record are unaffected by this. It's only superficially set. 819 $item->status = $fs->get_file_system()->is_file_readable_remotely_by_storedfile($file) ? 0 : 1; 820 if ($item->status == 0) { 821 if ($imageinfo = $file->get_imageinfo()) { 822 $item->realthumbnail = $itemurl->out(false, array('preview' => 'thumb', 823 'oid' => $file->get_timemodified())); 824 $item->realicon = $itemurl->out(false, array('preview' => 'tinyicon', 'oid' => $file->get_timemodified())); 825 $item->image_width = $imageinfo['width']; 826 $item->image_height = $imageinfo['height']; 827 } 828 } 829 } 830 $list[] = $item; 831 } 832 } 833 $data->itemid = $draftitemid; 834 $data->list = $list; 835 return $data; 836 } 837 838 /** 839 * Returns all of the files in the draftarea. 840 * 841 * @param int $draftitemid The draft item ID 842 * @param string $filepath path for the uploaded files. 843 * @return array An array of files associated with this draft item id. 844 */ 845 function file_get_all_files_in_draftarea(int $draftitemid, string $filepath = '/') : array { 846 $files = []; 847 $draftfiles = file_get_drafarea_files($draftitemid, $filepath); 848 file_get_drafarea_folders($draftitemid, $filepath, $draftfiles); 849 850 if (!empty($draftfiles)) { 851 foreach ($draftfiles->list as $draftfile) { 852 if ($draftfile->type == 'file') { 853 $files[] = $draftfile; 854 } 855 } 856 857 if (isset($draftfiles->children)) { 858 foreach ($draftfiles->children as $draftfile) { 859 $files = array_merge($files, file_get_all_files_in_draftarea($draftitemid, $draftfile->filepath)); 860 } 861 } 862 } 863 return $files; 864 } 865 866 /** 867 * Returns draft area itemid for a given element. 868 * 869 * @category files 870 * @param string $elname name of formlib editor element, or a hidden form field that stores the draft area item id, etc. 871 * @return int the itemid, or 0 if there is not one yet. 872 */ 873 function file_get_submitted_draft_itemid($elname) { 874 // this is a nasty hack, ideally all new elements should use arrays here or there should be a new parameter 875 if (!isset($_REQUEST[$elname])) { 876 return 0; 877 } 878 if (is_array($_REQUEST[$elname])) { 879 $param = optional_param_array($elname, 0, PARAM_INT); 880 if (!empty($param['itemid'])) { 881 $param = $param['itemid']; 882 } else { 883 debugging('Missing itemid, maybe caused by unset maxfiles option', DEBUG_DEVELOPER); 884 return false; 885 } 886 887 } else { 888 $param = optional_param($elname, 0, PARAM_INT); 889 } 890 891 if ($param) { 892 require_sesskey(); 893 } 894 895 return $param; 896 } 897 898 /** 899 * Restore the original source field from draft files 900 * 901 * Do not use this function because it makes field files.source inconsistent 902 * for draft area files. This function will be deprecated in 2.6 903 * 904 * @param stored_file $storedfile This only works with draft files 905 * @return stored_file 906 */ 907 function file_restore_source_field_from_draft_file($storedfile) { 908 $source = @unserialize($storedfile->get_source()); 909 if (!empty($source)) { 910 if (is_object($source)) { 911 $restoredsource = $source->source; 912 $storedfile->set_source($restoredsource); 913 } else { 914 throw new moodle_exception('invalidsourcefield', 'error'); 915 } 916 } 917 return $storedfile; 918 } 919 920 /** 921 * Removes those files from the user drafts filearea which are not referenced in the editor text. 922 * 923 * @param stdClass $editor The online text editor element from the submitted form data. 924 */ 925 function file_remove_editor_orphaned_files($editor) { 926 global $CFG, $USER; 927 928 // Find those draft files included in the text, and generate their hashes. 929 $context = context_user::instance($USER->id); 930 $baseurl = $CFG->wwwroot . '/draftfile.php/' . $context->id . '/user/draft/' . $editor['itemid'] . '/'; 931 $pattern = "/" . preg_quote($baseurl, '/') . "(.+?)[\?\"'<>\s:\\\\]/"; 932 preg_match_all($pattern, $editor['text'], $matches); 933 $usedfilehashes = []; 934 foreach ($matches[1] as $matchedfilename) { 935 $matchedfilename = urldecode($matchedfilename); 936 $usedfilehashes[] = \file_storage::get_pathname_hash($context->id, 'user', 'draft', $editor['itemid'], '/', 937 $matchedfilename); 938 } 939 940 // Now, compare the hashes of all draft files, and remove those which don't match used files. 941 $fs = get_file_storage(); 942 $files = $fs->get_area_files($context->id, 'user', 'draft', $editor['itemid'], 'id', false); 943 foreach ($files as $file) { 944 $tmphash = $file->get_pathnamehash(); 945 if (!in_array($tmphash, $usedfilehashes)) { 946 $file->delete(); 947 } 948 } 949 } 950 951 /** 952 * Finds all draft areas used in a textarea and copies the files into the primary textarea. If a user copies and pastes 953 * content from another draft area it's possible for a single textarea to reference multiple draft areas. 954 * 955 * @category files 956 * @param int $draftitemid the id of the primary draft area. 957 * When set to -1 (probably, by a WebService) it won't process file merging, keeping the original state of the file area. 958 * @param int $usercontextid the user's context id. 959 * @param string $text some html content that needs to have files copied to the correct draft area. 960 * @param bool $forcehttps force https urls. 961 * 962 * @return string $text html content modified with new draft links 963 */ 964 function file_merge_draft_areas($draftitemid, $usercontextid, $text, $forcehttps = false) { 965 if (is_null($text)) { 966 return null; 967 } 968 969 // Do not merge files, leave it as it was. 970 if ($draftitemid === IGNORE_FILE_MERGE) { 971 return null; 972 } 973 974 $urls = extract_draft_file_urls_from_text($text, $forcehttps, $usercontextid, 'user', 'draft'); 975 976 // No draft areas to rewrite. 977 if (empty($urls)) { 978 return $text; 979 } 980 981 foreach ($urls as $url) { 982 // Do not process the "home" draft area. 983 if ($url['itemid'] == $draftitemid) { 984 continue; 985 } 986 987 // Decode the filename. 988 $filename = urldecode($url['filename']); 989 990 // Copy the file. 991 file_copy_file_to_file_area($url, $filename, $draftitemid); 992 993 // Rewrite draft area. 994 $text = file_replace_file_area_in_text($url, $draftitemid, $text, $forcehttps); 995 } 996 return $text; 997 } 998 999 /** 1000 * Rewrites a file area in arbitrary text. 1001 * 1002 * @param array $file General information about the file. 1003 * @param int $newid The new file area itemid. 1004 * @param string $text The text to rewrite. 1005 * @param bool $forcehttps force https urls. 1006 * @return string The rewritten text. 1007 */ 1008 function file_replace_file_area_in_text($file, $newid, $text, $forcehttps = false) { 1009 global $CFG; 1010 1011 $wwwroot = $CFG->wwwroot; 1012 if ($forcehttps) { 1013 $wwwroot = str_replace('http://', 'https://', $wwwroot); 1014 } 1015 1016 $search = [ 1017 $wwwroot, 1018 $file['urlbase'], 1019 $file['contextid'], 1020 $file['component'], 1021 $file['filearea'], 1022 $file['itemid'], 1023 $file['filename'] 1024 ]; 1025 $replace = [ 1026 $wwwroot, 1027 $file['urlbase'], 1028 $file['contextid'], 1029 $file['component'], 1030 $file['filearea'], 1031 $newid, 1032 $file['filename'] 1033 ]; 1034 1035 $text = str_ireplace( implode('/', $search), implode('/', $replace), $text); 1036 return $text; 1037 } 1038 1039 /** 1040 * Copies a file from one file area to another. 1041 * 1042 * @param array $file Information about the file to be copied. 1043 * @param string $filename The filename. 1044 * @param int $itemid The new file area. 1045 */ 1046 function file_copy_file_to_file_area($file, $filename, $itemid) { 1047 $fs = get_file_storage(); 1048 1049 // Load the current file in the old draft area. 1050 $fileinfo = array( 1051 'component' => $file['component'], 1052 'filearea' => $file['filearea'], 1053 'itemid' => $file['itemid'], 1054 'contextid' => $file['contextid'], 1055 'filepath' => '/', 1056 'filename' => $filename 1057 ); 1058 $oldfile = $fs->get_file($fileinfo['contextid'], $fileinfo['component'], $fileinfo['filearea'], 1059 $fileinfo['itemid'], $fileinfo['filepath'], $fileinfo['filename']); 1060 $newfileinfo = array( 1061 'component' => $file['component'], 1062 'filearea' => $file['filearea'], 1063 'itemid' => $itemid, 1064 'contextid' => $file['contextid'], 1065 'filepath' => '/', 1066 'filename' => $filename 1067 ); 1068 1069 $newcontextid = $newfileinfo['contextid']; 1070 $newcomponent = $newfileinfo['component']; 1071 $newfilearea = $newfileinfo['filearea']; 1072 $newitemid = $newfileinfo['itemid']; 1073 $newfilepath = $newfileinfo['filepath']; 1074 $newfilename = $newfileinfo['filename']; 1075 1076 // Check if the file exists. 1077 if (!$fs->file_exists($newcontextid, $newcomponent, $newfilearea, $newitemid, $newfilepath, $newfilename)) { 1078 $fs->create_file_from_storedfile($newfileinfo, $oldfile); 1079 } 1080 } 1081 1082 /** 1083 * Saves files from a draft file area to a real one (merging the list of files). 1084 * Can rewrite URLs in some content at the same time if desired. 1085 * 1086 * @category files 1087 * @global stdClass $USER 1088 * @param int $draftitemid the id of the draft area to use. Normally obtained 1089 * from file_get_submitted_draft_itemid('elementname') or similar. 1090 * When set to -1 (probably, by a WebService) it won't process file merging, keeping the original state of the file area. 1091 * @param int $contextid This parameter and the next two identify the file area to save to. 1092 * @param string $component 1093 * @param string $filearea indentifies the file area. 1094 * @param int $itemid helps identifies the file area. 1095 * @param array $options area options (subdirs=>false, maxfiles=-1, maxbytes=0) 1096 * @param string $text some html content that needs to have embedded links rewritten 1097 * to the @@PLUGINFILE@@ form for saving in the database. 1098 * @param bool $forcehttps force https urls. 1099 * @return string|null if $text was passed in, the rewritten $text is returned. Otherwise NULL. 1100 */ 1101 function file_save_draft_area_files($draftitemid, $contextid, $component, $filearea, $itemid, array $options=null, $text=null, $forcehttps=false) { 1102 global $USER; 1103 1104 // Do not merge files, leave it as it was. 1105 if ($draftitemid === IGNORE_FILE_MERGE) { 1106 // Safely return $text, no need to rewrite pluginfile because this is mostly comming from an external client like the app. 1107 return $text; 1108 } 1109 1110 if ($itemid === false) { 1111 // Catch a potentially dangerous coding error. 1112 throw new coding_exception('file_save_draft_area_files was called with $itemid false. ' . 1113 "This suggests a bug, because it would wipe all ($contextid, $component, $filearea) files."); 1114 } 1115 1116 $usercontext = context_user::instance($USER->id); 1117 $fs = get_file_storage(); 1118 1119 $options = (array)$options; 1120 if (!isset($options['subdirs'])) { 1121 $options['subdirs'] = false; 1122 } 1123 if (!isset($options['maxfiles'])) { 1124 $options['maxfiles'] = -1; // unlimited 1125 } 1126 if (!isset($options['maxbytes']) || $options['maxbytes'] == USER_CAN_IGNORE_FILE_SIZE_LIMITS) { 1127 $options['maxbytes'] = 0; // unlimited 1128 } 1129 if (!isset($options['areamaxbytes'])) { 1130 $options['areamaxbytes'] = FILE_AREA_MAX_BYTES_UNLIMITED; // Unlimited. 1131 } 1132 $allowreferences = true; 1133 if (isset($options['return_types']) && !($options['return_types'] & (FILE_REFERENCE | FILE_CONTROLLED_LINK))) { 1134 // we assume that if $options['return_types'] is NOT specified, we DO allow references. 1135 // this is not exactly right. BUT there are many places in code where filemanager options 1136 // are not passed to file_save_draft_area_files() 1137 $allowreferences = false; 1138 } 1139 1140 // Check if the user has copy-pasted from other draft areas. Those files will be located in different draft 1141 // areas and need to be copied into the current draft area. 1142 $text = file_merge_draft_areas($draftitemid, $usercontext->id, $text, $forcehttps); 1143 1144 // Check if the draft area has exceeded the authorised limit. This should never happen as validation 1145 // should have taken place before, unless the user is doing something nauthly. If so, let's just not save 1146 // anything at all in the next area. 1147 if (file_is_draft_area_limit_reached($draftitemid, $options['areamaxbytes'])) { 1148 return null; 1149 } 1150 1151 $draftfiles = $fs->get_area_files($usercontext->id, 'user', 'draft', $draftitemid, 'id'); 1152 $oldfiles = $fs->get_area_files($contextid, $component, $filearea, $itemid, 'id'); 1153 1154 // One file in filearea means it is empty (it has only top-level directory '.'). 1155 if (count($draftfiles) > 1 || count($oldfiles) > 1) { 1156 // we have to merge old and new files - we want to keep file ids for files that were not changed 1157 // we change time modified for all new and changed files, we keep time created as is 1158 1159 $newhashes = array(); 1160 $filecount = 0; 1161 $context = context::instance_by_id($contextid, MUST_EXIST); 1162 foreach ($draftfiles as $file) { 1163 if (!$options['subdirs'] && $file->get_filepath() !== '/') { 1164 continue; 1165 } 1166 if (!$allowreferences && $file->is_external_file()) { 1167 continue; 1168 } 1169 if (!$file->is_directory()) { 1170 // Check to see if this file was uploaded by someone who can ignore the file size limits. 1171 $fileusermaxbytes = get_user_max_upload_file_size($context, $options['maxbytes'], 0, 0, $file->get_userid()); 1172 if ($fileusermaxbytes != USER_CAN_IGNORE_FILE_SIZE_LIMITS 1173 && ($options['maxbytes'] and $options['maxbytes'] < $file->get_filesize())) { 1174 // Oversized file. 1175 continue; 1176 } 1177 if ($options['maxfiles'] != -1 and $options['maxfiles'] <= $filecount) { 1178 // more files - should not get here at all 1179 continue; 1180 } 1181 $filecount++; 1182 } 1183 $newhash = $fs->get_pathname_hash($contextid, $component, $filearea, $itemid, $file->get_filepath(), $file->get_filename()); 1184 $newhashes[$newhash] = $file; 1185 } 1186 1187 // Loop through oldfiles and decide which we need to delete and which to update. 1188 // After this cycle the array $newhashes will only contain the files that need to be added. 1189 foreach ($oldfiles as $oldfile) { 1190 $oldhash = $oldfile->get_pathnamehash(); 1191 if (!isset($newhashes[$oldhash])) { 1192 // delete files not needed any more - deleted by user 1193 $oldfile->delete(); 1194 continue; 1195 } 1196 1197 $newfile = $newhashes[$oldhash]; 1198 // Now we know that we have $oldfile and $newfile for the same path. 1199 // Let's check if we can update this file or we need to delete and create. 1200 if ($newfile->is_directory()) { 1201 // Directories are always ok to just update. 1202 } else if (($source = @unserialize($newfile->get_source())) && isset($source->original)) { 1203 // File has the 'original' - we need to update the file (it may even have not been changed at all). 1204 $original = file_storage::unpack_reference($source->original); 1205 if ($original['filename'] !== $oldfile->get_filename() || $original['filepath'] !== $oldfile->get_filepath()) { 1206 // Very odd, original points to another file. Delete and create file. 1207 $oldfile->delete(); 1208 continue; 1209 } 1210 } else { 1211 // The same file name but absence of 'original' means that file was deteled and uploaded again. 1212 // By deleting and creating new file we properly manage all existing references. 1213 $oldfile->delete(); 1214 continue; 1215 } 1216 1217 // status changed, we delete old file, and create a new one 1218 if ($oldfile->get_status() != $newfile->get_status()) { 1219 // file was changed, use updated with new timemodified data 1220 $oldfile->delete(); 1221 // This file will be added later 1222 continue; 1223 } 1224 1225 // Updated author 1226 if ($oldfile->get_author() != $newfile->get_author()) { 1227 $oldfile->set_author($newfile->get_author()); 1228 } 1229 // Updated license 1230 if ($oldfile->get_license() != $newfile->get_license()) { 1231 $oldfile->set_license($newfile->get_license()); 1232 } 1233 1234 // Updated file source 1235 // Field files.source for draftarea files contains serialised object with source and original information. 1236 // We only store the source part of it for non-draft file area. 1237 $newsource = $newfile->get_source(); 1238 if ($source = @unserialize($newfile->get_source())) { 1239 $newsource = $source->source; 1240 } 1241 if ($oldfile->get_source() !== $newsource) { 1242 $oldfile->set_source($newsource); 1243 } 1244 1245 // Updated sort order 1246 if ($oldfile->get_sortorder() != $newfile->get_sortorder()) { 1247 $oldfile->set_sortorder($newfile->get_sortorder()); 1248 } 1249 1250 // Update file timemodified 1251 if ($oldfile->get_timemodified() != $newfile->get_timemodified()) { 1252 $oldfile->set_timemodified($newfile->get_timemodified()); 1253 } 1254 1255 // Replaced file content 1256 if (!$oldfile->is_directory() && 1257 ($oldfile->get_contenthash() != $newfile->get_contenthash() || 1258 $oldfile->get_filesize() != $newfile->get_filesize() || 1259 $oldfile->get_referencefileid() != $newfile->get_referencefileid() || 1260 $oldfile->get_userid() != $newfile->get_userid())) { 1261 $oldfile->replace_file_with($newfile); 1262 } 1263 1264 // unchanged file or directory - we keep it as is 1265 unset($newhashes[$oldhash]); 1266 } 1267 1268 // Add fresh file or the file which has changed status 1269 // the size and subdirectory tests are extra safety only, the UI should prevent it 1270 foreach ($newhashes as $file) { 1271 $file_record = array('contextid'=>$contextid, 'component'=>$component, 'filearea'=>$filearea, 'itemid'=>$itemid, 'timemodified'=>time()); 1272 if ($source = @unserialize($file->get_source())) { 1273 // Field files.source for draftarea files contains serialised object with source and original information. 1274 // We only store the source part of it for non-draft file area. 1275 $file_record['source'] = $source->source; 1276 } 1277 1278 if ($file->is_external_file()) { 1279 $repoid = $file->get_repository_id(); 1280 if (!empty($repoid)) { 1281 $context = context::instance_by_id($contextid, MUST_EXIST); 1282 $repo = repository::get_repository_by_id($repoid, $context); 1283 if (!empty($options)) { 1284 $repo->options = $options; 1285 } 1286 $file_record['repositoryid'] = $repoid; 1287 // This hook gives the repo a place to do some house cleaning, and update the $reference before it's saved 1288 // to the file store. E.g. transfer ownership of the file to a system account etc. 1289 $reference = $repo->reference_file_selected($file->get_reference(), $context, $component, $filearea, $itemid); 1290 1291 $file_record['reference'] = $reference; 1292 } 1293 } 1294 1295 $fs->create_file_from_storedfile($file_record, $file); 1296 } 1297 } 1298 1299 // note: do not purge the draft area - we clean up areas later in cron, 1300 // the reason is that user might press submit twice and they would loose the files, 1301 // also sometimes we might want to use hacks that save files into two different areas 1302 1303 if (is_null($text)) { 1304 return null; 1305 } else { 1306 return file_rewrite_urls_to_pluginfile($text, $draftitemid, $forcehttps); 1307 } 1308 } 1309 1310 /** 1311 * Convert the draft file area URLs in some content to @@PLUGINFILE@@ tokens 1312 * ready to be saved in the database. Normally, this is done automatically by 1313 * {@link file_save_draft_area_files()}. 1314 * 1315 * @category files 1316 * @param string $text the content to process. 1317 * @param int $draftitemid the draft file area the content was using. 1318 * @param bool $forcehttps whether the content contains https URLs. Default false. 1319 * @return string the processed content. 1320 */ 1321 function file_rewrite_urls_to_pluginfile($text, $draftitemid, $forcehttps = false) { 1322 global $CFG, $USER; 1323 1324 $usercontext = context_user::instance($USER->id); 1325 1326 $wwwroot = $CFG->wwwroot; 1327 if ($forcehttps) { 1328 $wwwroot = str_replace('http://', 'https://', $wwwroot); 1329 } 1330 1331 // relink embedded files if text submitted - no absolute links allowed in database! 1332 $text = str_ireplace("$wwwroot/draftfile.php/$usercontext->id/user/draft/$draftitemid/", '@@PLUGINFILE@@/', $text); 1333 1334 if (strpos($text, 'draftfile.php?file=') !== false) { 1335 $matches = array(); 1336 preg_match_all("!$wwwroot/draftfile.php\?file=%2F{$usercontext->id}%2Fuser%2Fdraft%2F{$draftitemid}%2F[^'\",&<>|`\s:\\\\]+!iu", $text, $matches); 1337 if ($matches) { 1338 foreach ($matches[0] as $match) { 1339 $replace = str_ireplace('%2F', '/', $match); 1340 $text = str_replace($match, $replace, $text); 1341 } 1342 } 1343 $text = str_ireplace("$wwwroot/draftfile.php?file=/$usercontext->id/user/draft/$draftitemid/", '@@PLUGINFILE@@/', $text); 1344 } 1345 1346 return $text; 1347 } 1348 1349 /** 1350 * Set file sort order 1351 * 1352 * @global moodle_database $DB 1353 * @param int $contextid the context id 1354 * @param string $component file component 1355 * @param string $filearea file area. 1356 * @param int $itemid itemid. 1357 * @param string $filepath file path. 1358 * @param string $filename file name. 1359 * @param int $sortorder the sort order of file. 1360 * @return bool 1361 */ 1362 function file_set_sortorder($contextid, $component, $filearea, $itemid, $filepath, $filename, $sortorder) { 1363 global $DB; 1364 $conditions = array('contextid'=>$contextid, 'component'=>$component, 'filearea'=>$filearea, 'itemid'=>$itemid, 'filepath'=>$filepath, 'filename'=>$filename); 1365 if ($file_record = $DB->get_record('files', $conditions)) { 1366 $sortorder = (int)$sortorder; 1367 $file_record->sortorder = $sortorder; 1368 $DB->update_record('files', $file_record); 1369 return true; 1370 } 1371 return false; 1372 } 1373 1374 /** 1375 * reset file sort order number to 0 1376 * @global moodle_database $DB 1377 * @param int $contextid the context id 1378 * @param string $component 1379 * @param string $filearea file area. 1380 * @param int|bool $itemid itemid. 1381 * @return bool 1382 */ 1383 function file_reset_sortorder($contextid, $component, $filearea, $itemid=false) { 1384 global $DB; 1385 1386 $conditions = array('contextid'=>$contextid, 'component'=>$component, 'filearea'=>$filearea); 1387 if ($itemid !== false) { 1388 $conditions['itemid'] = $itemid; 1389 } 1390 1391 $file_records = $DB->get_records('files', $conditions); 1392 foreach ($file_records as $file_record) { 1393 $file_record->sortorder = 0; 1394 $DB->update_record('files', $file_record); 1395 } 1396 return true; 1397 } 1398 1399 /** 1400 * Returns description of upload error 1401 * 1402 * @param int $errorcode found in $_FILES['filename.ext']['error'] 1403 * @return string error description string, '' if ok 1404 */ 1405 function file_get_upload_error($errorcode) { 1406 1407 switch ($errorcode) { 1408 case 0: // UPLOAD_ERR_OK - no error 1409 $errmessage = ''; 1410 break; 1411 1412 case 1: // UPLOAD_ERR_INI_SIZE 1413 $errmessage = get_string('uploadserverlimit'); 1414 break; 1415 1416 case 2: // UPLOAD_ERR_FORM_SIZE 1417 $errmessage = get_string('uploadformlimit'); 1418 break; 1419 1420 case 3: // UPLOAD_ERR_PARTIAL 1421 $errmessage = get_string('uploadpartialfile'); 1422 break; 1423 1424 case 4: // UPLOAD_ERR_NO_FILE 1425 $errmessage = get_string('uploadnofilefound'); 1426 break; 1427 1428 // Note: there is no error with a value of 5 1429 1430 case 6: // UPLOAD_ERR_NO_TMP_DIR 1431 $errmessage = get_string('uploadnotempdir'); 1432 break; 1433 1434 case 7: // UPLOAD_ERR_CANT_WRITE 1435 $errmessage = get_string('uploadcantwrite'); 1436 break; 1437 1438 case 8: // UPLOAD_ERR_EXTENSION 1439 $errmessage = get_string('uploadextension'); 1440 break; 1441 1442 default: 1443 $errmessage = get_string('uploadproblem'); 1444 } 1445 1446 return $errmessage; 1447 } 1448 1449 /** 1450 * Recursive function formating an array in POST parameter 1451 * @param array $arraydata - the array that we are going to format and add into &$data array 1452 * @param string $currentdata - a row of the final postdata array at instant T 1453 * when finish, it's assign to $data under this format: name[keyname][][]...[]='value' 1454 * @param array $data - the final data array containing all POST parameters : 1 row = 1 parameter 1455 */ 1456 function format_array_postdata_for_curlcall($arraydata, $currentdata, &$data) { 1457 foreach ($arraydata as $k=>$v) { 1458 $newcurrentdata = $currentdata; 1459 if (is_array($v)) { //the value is an array, call the function recursively 1460 $newcurrentdata = $newcurrentdata.'['.urlencode($k).']'; 1461 format_array_postdata_for_curlcall($v, $newcurrentdata, $data); 1462 } else { //add the POST parameter to the $data array 1463 $data[] = $newcurrentdata.'['.urlencode($k).']='.urlencode($v); 1464 } 1465 } 1466 } 1467 1468 /** 1469 * Transform a PHP array into POST parameter 1470 * (see the recursive function format_array_postdata_for_curlcall) 1471 * @param array $postdata 1472 * @return array containing all POST parameters (1 row = 1 POST parameter) 1473 */ 1474 function format_postdata_for_curlcall($postdata) { 1475 $data = array(); 1476 foreach ($postdata as $k=>$v) { 1477 if (is_array($v)) { 1478 $currentdata = urlencode($k); 1479 format_array_postdata_for_curlcall($v, $currentdata, $data); 1480 } else { 1481 $data[] = urlencode($k).'='.urlencode($v); 1482 } 1483 } 1484 $convertedpostdata = implode('&', $data); 1485 return $convertedpostdata; 1486 } 1487 1488 /** 1489 * Fetches content of file from Internet (using proxy if defined). Uses cURL extension if present. 1490 * Due to security concerns only downloads from http(s) sources are supported. 1491 * 1492 * @category files 1493 * @param string $url file url starting with http(s):// 1494 * @param array $headers http headers, null if none. If set, should be an 1495 * associative array of header name => value pairs. 1496 * @param array $postdata array means use POST request with given parameters 1497 * @param bool $fullresponse return headers, responses, etc in a similar way snoopy does 1498 * (if false, just returns content) 1499 * @param int $timeout timeout for complete download process including all file transfer 1500 * (default 5 minutes) 1501 * @param int $connecttimeout timeout for connection to server; this is the timeout that 1502 * usually happens if the remote server is completely down (default 20 seconds); 1503 * may not work when using proxy 1504 * @param bool $skipcertverify If true, the peer's SSL certificate will not be checked. 1505 * Only use this when already in a trusted location. 1506 * @param string $tofile store the downloaded content to file instead of returning it. 1507 * @param bool $calctimeout false by default, true enables an extra head request to try and determine 1508 * filesize and appropriately larger timeout based on $CFG->curltimeoutkbitrate 1509 * @return stdClass|string|bool stdClass object if $fullresponse is true, false if request failed, true 1510 * if file downloaded into $tofile successfully or the file content as a string. 1511 */ 1512 function download_file_content($url, $headers=null, $postdata=null, $fullresponse=false, $timeout=300, $connecttimeout=20, $skipcertverify=false, $tofile=NULL, $calctimeout=false) { 1513 global $CFG; 1514 1515 // Only http and https links supported. 1516 if (!preg_match('|^https?://|i', $url)) { 1517 if ($fullresponse) { 1518 $response = new stdClass(); 1519 $response->status = 0; 1520 $response->headers = array(); 1521 $response->response_code = 'Invalid protocol specified in url'; 1522 $response->results = ''; 1523 $response->error = 'Invalid protocol specified in url'; 1524 return $response; 1525 } else { 1526 return false; 1527 } 1528 } 1529 1530 $options = array(); 1531 1532 $headers2 = array(); 1533 if (is_array($headers)) { 1534 foreach ($headers as $key => $value) { 1535 if (is_numeric($key)) { 1536 $headers2[] = $value; 1537 } else { 1538 $headers2[] = "$key: $value"; 1539 } 1540 } 1541 } 1542 1543 if ($skipcertverify) { 1544 $options['CURLOPT_SSL_VERIFYPEER'] = false; 1545 } else { 1546 $options['CURLOPT_SSL_VERIFYPEER'] = true; 1547 } 1548 1549 $options['CURLOPT_CONNECTTIMEOUT'] = $connecttimeout; 1550 1551 $options['CURLOPT_FOLLOWLOCATION'] = 1; 1552 $options['CURLOPT_MAXREDIRS'] = 5; 1553 1554 // Use POST if requested. 1555 if (is_array($postdata)) { 1556 $postdata = format_postdata_for_curlcall($postdata); 1557 } else if (empty($postdata)) { 1558 $postdata = null; 1559 } 1560 1561 // Optionally attempt to get more correct timeout by fetching the file size. 1562 if (!isset($CFG->curltimeoutkbitrate)) { 1563 // Use very slow rate of 56kbps as a timeout speed when not set. 1564 $bitrate = 56; 1565 } else { 1566 $bitrate = $CFG->curltimeoutkbitrate; 1567 } 1568 if ($calctimeout and !isset($postdata)) { 1569 $curl = new curl(); 1570 $curl->setHeader($headers2); 1571 1572 $curl->head($url, $postdata, $options); 1573 1574 $info = $curl->get_info(); 1575 $error_no = $curl->get_errno(); 1576 if (!$error_no && $info['download_content_length'] > 0) { 1577 // No curl errors - adjust for large files only - take max timeout. 1578 $timeout = max($timeout, ceil($info['download_content_length'] * 8 / ($bitrate * 1024))); 1579 } 1580 } 1581 1582 $curl = new curl(); 1583 $curl->setHeader($headers2); 1584 1585 $options['CURLOPT_RETURNTRANSFER'] = true; 1586 $options['CURLOPT_NOBODY'] = false; 1587 $options['CURLOPT_TIMEOUT'] = $timeout; 1588 1589 if ($tofile) { 1590 $fh = fopen($tofile, 'w'); 1591 if (!$fh) { 1592 if ($fullresponse) { 1593 $response = new stdClass(); 1594 $response->status = 0; 1595 $response->headers = array(); 1596 $response->response_code = 'Can not write to file'; 1597 $response->results = false; 1598 $response->error = 'Can not write to file'; 1599 return $response; 1600 } else { 1601 return false; 1602 } 1603 } 1604 $options['CURLOPT_FILE'] = $fh; 1605 } 1606 1607 if (isset($postdata)) { 1608 $content = $curl->post($url, $postdata, $options); 1609 } else { 1610 $content = $curl->get($url, null, $options); 1611 } 1612 1613 if ($tofile) { 1614 fclose($fh); 1615 @chmod($tofile, $CFG->filepermissions); 1616 } 1617 1618 /* 1619 // Try to detect encoding problems. 1620 if ((curl_errno($ch) == 23 or curl_errno($ch) == 61) and defined('CURLOPT_ENCODING')) { 1621 curl_setopt($ch, CURLOPT_ENCODING, 'none'); 1622 $result = curl_exec($ch); 1623 } 1624 */ 1625 1626 $info = $curl->get_info(); 1627 $error_no = $curl->get_errno(); 1628 $rawheaders = $curl->get_raw_response(); 1629 1630 if ($error_no) { 1631 $error = $content; 1632 if (!$fullresponse) { 1633 debugging("cURL request for \"$url\" failed with: $error ($error_no)", DEBUG_ALL); 1634 return false; 1635 } 1636 1637 $response = new stdClass(); 1638 if ($error_no == 28) { 1639 $response->status = '-100'; // Mimic snoopy. 1640 } else { 1641 $response->status = '0'; 1642 } 1643 $response->headers = array(); 1644 $response->response_code = $error; 1645 $response->results = false; 1646 $response->error = $error; 1647 return $response; 1648 } 1649 1650 if ($tofile) { 1651 $content = true; 1652 } 1653 1654 if (empty($info['http_code'])) { 1655 // For security reasons we support only true http connections (Location: file:// exploit prevention). 1656 $response = new stdClass(); 1657 $response->status = '0'; 1658 $response->headers = array(); 1659 $response->response_code = 'Unknown cURL error'; 1660 $response->results = false; // do NOT change this, we really want to ignore the result! 1661 $response->error = 'Unknown cURL error'; 1662 1663 } else { 1664 $response = new stdClass(); 1665 $response->status = (string)$info['http_code']; 1666 $response->headers = $rawheaders; 1667 $response->results = $content; 1668 $response->error = ''; 1669 1670 // There might be multiple headers on redirect, find the status of the last one. 1671 $firstline = true; 1672 foreach ($rawheaders as $line) { 1673 if ($firstline) { 1674 $response->response_code = $line; 1675 $firstline = false; 1676 } 1677 if (trim($line, "\r\n") === '') { 1678 $firstline = true; 1679 } 1680 } 1681 } 1682 1683 if ($fullresponse) { 1684 return $response; 1685 } 1686 1687 if ($info['http_code'] != 200) { 1688 debugging("cURL request for \"$url\" failed, HTTP response code: ".$response->response_code, DEBUG_ALL); 1689 return false; 1690 } 1691 return $response->results; 1692 } 1693 1694 /** 1695 * Returns a list of information about file types based on extensions. 1696 * 1697 * The following elements expected in value array for each extension: 1698 * 'type' - mimetype 1699 * 'icon' - location of the icon file. If value is FILENAME, then either pix/f/FILENAME.gif 1700 * or pix/f/FILENAME.png must be present in moodle and contain 16x16 filetype icon; 1701 * also files with bigger sizes under names 1702 * FILENAME-24, FILENAME-32, FILENAME-64, FILENAME-128, FILENAME-256 are recommended. 1703 * 'groups' (optional) - array of filetype groups this filetype extension is part of; 1704 * commonly used in moodle the following groups: 1705 * - web_image - image that can be included as <img> in HTML 1706 * - image - image that we can parse using GD to find it's dimensions, also used for portfolio format 1707 * - optimised_image - image that will be processed and optimised 1708 * - video - file that can be imported as video in text editor 1709 * - audio - file that can be imported as audio in text editor 1710 * - archive - we can extract files from this archive 1711 * - spreadsheet - used for portfolio format 1712 * - document - used for portfolio format 1713 * - presentation - used for portfolio format 1714 * 'string' (optional) - the name of the string from lang/en/mimetypes.php that displays 1715 * human-readable description for this filetype; 1716 * Function {@link get_mimetype_description()} first looks at the presence of string for 1717 * particular mimetype (value of 'type'), if not found looks for string specified in 'string' 1718 * attribute, if not found returns the value of 'type'; 1719 * 'defaulticon' (boolean, optional) - used by function {@link file_mimetype_icon()} to find 1720 * an icon for mimetype. If an entry with 'defaulticon' is not found for a particular mimetype, 1721 * this function will return first found icon; Especially usefull for types such as 'text/plain' 1722 * 1723 * @category files 1724 * @return array List of information about file types based on extensions. 1725 * Associative array of extension (lower-case) to associative array 1726 * from 'element name' to data. Current element names are 'type' and 'icon'. 1727 * Unknown types should use the 'xxx' entry which includes defaults. 1728 */ 1729 function &get_mimetypes_array() { 1730 // Get types from the core_filetypes function, which includes caching. 1731 return core_filetypes::get_types(); 1732 } 1733 1734 /** 1735 * Determine a file's MIME type based on the given filename using the function mimeinfo. 1736 * 1737 * This function retrieves a file's MIME type for a file that will be sent to the user. 1738 * This should only be used for file-sending purposes just like in send_stored_file, send_file, and send_temp_file. 1739 * Should the file's MIME type cannot be determined by mimeinfo, it will return 'application/octet-stream' as a default 1740 * MIME type which should tell the browser "I don't know what type of file this is, so just download it.". 1741 * 1742 * @param string $filename The file's filename. 1743 * @return string The file's MIME type or 'application/octet-stream' if it cannot be determined. 1744 */ 1745 function get_mimetype_for_sending($filename = '') { 1746 // Guess the file's MIME type using mimeinfo. 1747 $mimetype = mimeinfo('type', $filename); 1748 1749 // Use octet-stream as fallback if MIME type cannot be determined by mimeinfo. 1750 if (!$mimetype || $mimetype === 'document/unknown') { 1751 $mimetype = 'application/octet-stream'; 1752 } 1753 1754 return $mimetype; 1755 } 1756 1757 /** 1758 * Obtains information about a filetype based on its extension. Will 1759 * use a default if no information is present about that particular 1760 * extension. 1761 * 1762 * @category files 1763 * @param string $element Desired information (usually 'icon' 1764 * for icon filename or 'type' for MIME type. Can also be 1765 * 'icon24', ...32, 48, 64, 72, 80, 96, 128, 256) 1766 * @param string $filename Filename we're looking up 1767 * @return string Requested piece of information from array 1768 */ 1769 function mimeinfo($element, $filename) { 1770 global $CFG; 1771 $mimeinfo = & get_mimetypes_array(); 1772 static $iconpostfixes = array(256=>'-256', 128=>'-128', 96=>'-96', 80=>'-80', 72=>'-72', 64=>'-64', 48=>'-48', 32=>'-32', 24=>'-24', 16=>''); 1773 1774 $filetype = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); 1775 if (empty($filetype)) { 1776 $filetype = 'xxx'; // file without extension 1777 } 1778 if (preg_match('/^icon(\d*)$/', $element, $iconsizematch)) { 1779 $iconsize = max(array(16, (int)$iconsizematch[1])); 1780 $filenames = array($mimeinfo['xxx']['icon']); 1781 if ($filetype != 'xxx' && isset($mimeinfo[$filetype]['icon'])) { 1782 array_unshift($filenames, $mimeinfo[$filetype]['icon']); 1783 } 1784 // find the file with the closest size, first search for specific icon then for default icon 1785 foreach ($filenames as $filename) { 1786 foreach ($iconpostfixes as $size => $postfix) { 1787 $fullname = $CFG->dirroot.'/pix/f/'.$filename.$postfix; 1788 if ($iconsize >= $size && 1789 (file_exists($fullname.'.svg') || file_exists($fullname.'.png') || file_exists($fullname.'.gif'))) { 1790 return $filename.$postfix; 1791 } 1792 } 1793 } 1794 } else if (isset($mimeinfo[$filetype][$element])) { 1795 return $mimeinfo[$filetype][$element]; 1796 } else if (isset($mimeinfo['xxx'][$element])) { 1797 return $mimeinfo['xxx'][$element]; // By default 1798 } else { 1799 return null; 1800 } 1801 } 1802 1803 /** 1804 * Obtains information about a filetype based on the MIME type rather than 1805 * the other way around. 1806 * 1807 * @category files 1808 * @param string $element Desired information ('extension', 'icon', 'icon-24', etc.) 1809 * @param string $mimetype MIME type we're looking up 1810 * @return string Requested piece of information from array 1811 */ 1812 function mimeinfo_from_type($element, $mimetype) { 1813 /* array of cached mimetype->extension associations */ 1814 static $cached = array(); 1815 $mimeinfo = & get_mimetypes_array(); 1816 1817 if (!array_key_exists($mimetype, $cached)) { 1818 $cached[$mimetype] = null; 1819 foreach($mimeinfo as $filetype => $values) { 1820 if ($values['type'] == $mimetype) { 1821 if ($cached[$mimetype] === null) { 1822 $cached[$mimetype] = '.'.$filetype; 1823 } 1824 if (!empty($values['defaulticon'])) { 1825 $cached[$mimetype] = '.'.$filetype; 1826 break; 1827 } 1828 } 1829 } 1830 if (empty($cached[$mimetype])) { 1831 $cached[$mimetype] = '.xxx'; 1832 } 1833 } 1834 if ($element === 'extension') { 1835 return $cached[$mimetype]; 1836 } else { 1837 return mimeinfo($element, $cached[$mimetype]); 1838 } 1839 } 1840 1841 /** 1842 * Return the relative icon path for a given file 1843 * 1844 * Usage: 1845 * <code> 1846 * // $file - instance of stored_file or file_info 1847 * $icon = $OUTPUT->image_url(file_file_icon($file))->out(); 1848 * echo html_writer::empty_tag('img', array('src' => $icon, 'alt' => get_mimetype_description($file))); 1849 * </code> 1850 * or 1851 * <code> 1852 * echo $OUTPUT->pix_icon(file_file_icon($file), get_mimetype_description($file)); 1853 * </code> 1854 * 1855 * @param stored_file|file_info|stdClass|array $file (in case of object attributes $file->filename 1856 * and $file->mimetype are expected) 1857 * @param int $size The size of the icon. Defaults to 16 can also be 24, 32, 64, 128, 256 1858 * @return string 1859 */ 1860 function file_file_icon($file, $size = null) { 1861 if (!is_object($file)) { 1862 $file = (object)$file; 1863 } 1864 if (isset($file->filename)) { 1865 $filename = $file->filename; 1866 } else if (method_exists($file, 'get_filename')) { 1867 $filename = $file->get_filename(); 1868 } else if (method_exists($file, 'get_visible_name')) { 1869 $filename = $file->get_visible_name(); 1870 } else { 1871 $filename = ''; 1872 } 1873 if (isset($file->mimetype)) { 1874 $mimetype = $file->mimetype; 1875 } else if (method_exists($file, 'get_mimetype')) { 1876 $mimetype = $file->get_mimetype(); 1877 } else { 1878 $mimetype = ''; 1879 } 1880 $mimetypes = &get_mimetypes_array(); 1881 if ($filename) { 1882 $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); 1883 if ($extension && !empty($mimetypes[$extension])) { 1884 // if file name has known extension, return icon for this extension 1885 return file_extension_icon($filename, $size); 1886 } 1887 } 1888 return file_mimetype_icon($mimetype, $size); 1889 } 1890 1891 /** 1892 * Return the relative icon path for a folder image 1893 * 1894 * Usage: 1895 * <code> 1896 * $icon = $OUTPUT->image_url(file_folder_icon())->out(); 1897 * echo html_writer::empty_tag('img', array('src' => $icon)); 1898 * </code> 1899 * or 1900 * <code> 1901 * echo $OUTPUT->pix_icon(file_folder_icon(32), ''); 1902 * </code> 1903 * 1904 * @param int $iconsize The size of the icon. Defaults to 16 can also be 24, 32, 48, 64, 72, 80, 96, 128, 256 1905 * @return string 1906 */ 1907 function file_folder_icon($iconsize = null) { 1908 global $CFG; 1909 static $iconpostfixes = array(256=>'-256', 128=>'-128', 96=>'-96', 80=>'-80', 72=>'-72', 64=>'-64', 48=>'-48', 32=>'-32', 24=>'-24', 16=>''); 1910 static $cached = array(); 1911 $iconsize = max(array(16, (int)$iconsize)); 1912 if (!array_key_exists($iconsize, $cached)) { 1913 foreach ($iconpostfixes as $size => $postfix) { 1914 $fullname = $CFG->dirroot.'/pix/f/folder'.$postfix; 1915 if ($iconsize >= $size && 1916 (file_exists($fullname.'.svg') || file_exists($fullname.'.png') || file_exists($fullname.'.gif'))) { 1917 $cached[$iconsize] = 'f/folder'.$postfix; 1918 break; 1919 } 1920 } 1921 } 1922 return $cached[$iconsize]; 1923 } 1924 1925 /** 1926 * Returns the relative icon path for a given mime type 1927 * 1928 * This function should be used in conjunction with $OUTPUT->image_url to produce 1929 * a return the full path to an icon. 1930 * 1931 * <code> 1932 * $mimetype = 'image/jpg'; 1933 * $icon = $OUTPUT->image_url(file_mimetype_icon($mimetype))->out(); 1934 * echo html_writer::empty_tag('img', array('src' => $icon, 'alt' => get_mimetype_description($mimetype))); 1935 * </code> 1936 * 1937 * @category files 1938 * @todo MDL-31074 When an $OUTPUT->icon method is available this function should be altered 1939 * to conform with that. 1940 * @param string $mimetype The mimetype to fetch an icon for 1941 * @param int $size The size of the icon. Defaults to 16 can also be 24, 32, 64, 128, 256 1942 * @return string The relative path to the icon 1943 */ 1944 function file_mimetype_icon($mimetype, $size = NULL) { 1945 return 'f/'.mimeinfo_from_type('icon'.$size, $mimetype); 1946 } 1947 1948 /** 1949 * Returns the relative icon path for a given file name 1950 * 1951 * This function should be used in conjunction with $OUTPUT->image_url to produce 1952 * a return the full path to an icon. 1953 * 1954 * <code> 1955 * $filename = '.jpg'; 1956 * $icon = $OUTPUT->image_url(file_extension_icon($filename))->out(); 1957 * echo html_writer::empty_tag('img', array('src' => $icon, 'alt' => '...')); 1958 * </code> 1959 * 1960 * @todo MDL-31074 When an $OUTPUT->icon method is available this function should be altered 1961 * to conform with that. 1962 * @todo MDL-31074 Implement $size 1963 * @category files 1964 * @param string $filename The filename to get the icon for 1965 * @param int $size The size of the icon. Defaults to 16 can also be 24, 32, 64, 128, 256 1966 * @return string 1967 */ 1968 function file_extension_icon($filename, $size = NULL) { 1969 return 'f/'.mimeinfo('icon'.$size, $filename); 1970 } 1971 1972 /** 1973 * Obtains descriptions for file types (e.g. 'Microsoft Word document') from the 1974 * mimetypes.php language file. 1975 * 1976 * @param mixed $obj - instance of stored_file or file_info or array/stdClass with field 1977 * 'filename' and 'mimetype', or just a string with mimetype (though it is recommended to 1978 * have filename); In case of array/stdClass the field 'mimetype' is optional. 1979 * @param bool $capitalise If true, capitalises first character of result 1980 * @return string Text description 1981 */ 1982 function get_mimetype_description($obj, $capitalise=false) { 1983 $filename = $mimetype = ''; 1984 if (is_object($obj) && method_exists($obj, 'get_filename') && method_exists($obj, 'get_mimetype')) { 1985 // this is an instance of stored_file 1986 $mimetype = $obj->get_mimetype(); 1987 $filename = $obj->get_filename(); 1988 } else if (is_object($obj) && method_exists($obj, 'get_visible_name') && method_exists($obj, 'get_mimetype')) { 1989 // this is an instance of file_info 1990 $mimetype = $obj->get_mimetype(); 1991 $filename = $obj->get_visible_name(); 1992 } else if (is_array($obj) || is_object ($obj)) { 1993 $obj = (array)$obj; 1994 if (!empty($obj['filename'])) { 1995 $filename = $obj['filename']; 1996 } 1997 if (!empty($obj['mimetype'])) { 1998 $mimetype = $obj['mimetype']; 1999 } 2000 } else { 2001 $mimetype = $obj; 2002 } 2003 $mimetypefromext = mimeinfo('type', $filename); 2004 if (empty($mimetype) || $mimetypefromext !== 'document/unknown') { 2005 // if file has a known extension, overwrite the specified mimetype 2006 $mimetype = $mimetypefromext; 2007 } 2008 $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); 2009 if (empty($extension)) { 2010 $mimetypestr = mimeinfo_from_type('string', $mimetype); 2011 $extension = str_replace('.', '', mimeinfo_from_type('extension', $mimetype)); 2012 } else { 2013 $mimetypestr = mimeinfo('string', $filename); 2014 } 2015 $chunks = explode('/', $mimetype, 2); 2016 $chunks[] = ''; 2017 $attr = array( 2018 'mimetype' => $mimetype, 2019 'ext' => $extension, 2020 'mimetype1' => $chunks[0], 2021 'mimetype2' => $chunks[1], 2022 ); 2023 $a = array(); 2024 foreach ($attr as $key => $value) { 2025 $a[$key] = $value; 2026 $a[strtoupper($key)] = strtoupper($value); 2027 $a[ucfirst($key)] = ucfirst($value); 2028 } 2029 2030 // MIME types may include + symbol but this is not permitted in string ids. 2031 $safemimetype = str_replace('+', '_', $mimetype); 2032 $safemimetypestr = str_replace('+', '_', $mimetypestr); 2033 $customdescription = mimeinfo('customdescription', $filename); 2034 if ($customdescription) { 2035 // Call format_string on the custom description so that multilang 2036 // filter can be used (if enabled on system context). We use system 2037 // context because it is possible that the page context might not have 2038 // been defined yet. 2039 $result = format_string($customdescription, true, 2040 array('context' => context_system::instance())); 2041 } else if (get_string_manager()->string_exists($safemimetype, 'mimetypes')) { 2042 $result = get_string($safemimetype, 'mimetypes', (object)$a); 2043 } else if (get_string_manager()->string_exists($safemimetypestr, 'mimetypes')) { 2044 $result = get_string($safemimetypestr, 'mimetypes', (object)$a); 2045 } else if (get_string_manager()->string_exists('default', 'mimetypes')) { 2046 $result = get_string('default', 'mimetypes', (object)$a); 2047 } else { 2048 $result = $mimetype; 2049 } 2050 if ($capitalise) { 2051 $result=ucfirst($result); 2052 } 2053 return $result; 2054 } 2055 2056 /** 2057 * Returns array of elements of type $element in type group(s) 2058 * 2059 * @param string $element name of the element we are interested in, usually 'type' or 'extension' 2060 * @param string|array $groups one group or array of groups/extensions/mimetypes 2061 * @return array 2062 */ 2063 function file_get_typegroup($element, $groups) { 2064 static $cached = array(); 2065 if (!is_array($groups)) { 2066 $groups = array($groups); 2067 } 2068 if (!array_key_exists($element, $cached)) { 2069 $cached[$element] = array(); 2070 } 2071 $result = array(); 2072 foreach ($groups as $group) { 2073 if (!array_key_exists($group, $cached[$element])) { 2074 // retrieive and cache all elements of type $element for group $group 2075 $mimeinfo = & get_mimetypes_array(); 2076 $cached[$element][$group] = array(); 2077 foreach ($mimeinfo as $extension => $value) { 2078 $value['extension'] = '.'.$extension; 2079 if (empty($value[$element])) { 2080 continue; 2081 } 2082 if (($group === '.'.$extension || $group === $value['type'] || 2083 (!empty($value['groups']) && in_array($group, $value['groups']))) && 2084 !in_array($value[$element], $cached[$element][$group])) { 2085 $cached[$element][$group][] = $value[$element]; 2086 } 2087 } 2088 } 2089 $result = array_merge($result, $cached[$element][$group]); 2090 } 2091 return array_values(array_unique($result)); 2092 } 2093 2094 /** 2095 * Checks if file with name $filename has one of the extensions in groups $groups 2096 * 2097 * @see get_mimetypes_array() 2098 * @param string $filename name of the file to check 2099 * @param string|array $groups one group or array of groups to check 2100 * @param bool $checktype if true and extension check fails, find the mimetype and check if 2101 * file mimetype is in mimetypes in groups $groups 2102 * @return bool 2103 */ 2104 function file_extension_in_typegroup($filename, $groups, $checktype = false) { 2105 $extension = pathinfo($filename, PATHINFO_EXTENSION); 2106 if (!empty($extension) && in_array('.'.strtolower($extension), file_get_typegroup('extension', $groups))) { 2107 return true; 2108 } 2109 return $checktype && file_mimetype_in_typegroup(mimeinfo('type', $filename), $groups); 2110 } 2111 2112 /** 2113 * Checks if mimetype $mimetype belongs to one of the groups $groups 2114 * 2115 * @see get_mimetypes_array() 2116 * @param string $mimetype 2117 * @param string|array $groups one group or array of groups to check 2118 * @return bool 2119 */ 2120 function file_mimetype_in_typegroup($mimetype, $groups) { 2121 return !empty($mimetype) && in_array($mimetype, file_get_typegroup('type', $groups)); 2122 } 2123 2124 /** 2125 * Requested file is not found or not accessible, does not return, terminates script 2126 * 2127 * @global stdClass $CFG 2128 * @global stdClass $COURSE 2129 */ 2130 function send_file_not_found() { 2131 global $CFG, $COURSE; 2132 2133 // Allow cross-origin requests only for Web Services. 2134 // This allow to receive requests done by Web Workers or webapps in different domains. 2135 if (WS_SERVER) { 2136 header('Access-Control-Allow-Origin: *'); 2137 } 2138 2139 send_header_404(); 2140 print_error('filenotfound', 'error', $CFG->wwwroot.'/course/view.php?id='.$COURSE->id); //this is not displayed on IIS?? 2141 } 2142 /** 2143 * Helper function to send correct 404 for server. 2144 */ 2145 function send_header_404() { 2146 if (substr(php_sapi_name(), 0, 3) == 'cgi') { 2147 header("Status: 404 Not Found"); 2148 } else { 2149 header('HTTP/1.0 404 not found'); 2150 } 2151 } 2152 2153 /** 2154 * The readfile function can fail when files are larger than 2GB (even on 64-bit 2155 * platforms). This wrapper uses readfile for small files and custom code for 2156 * large ones. 2157 * 2158 * @param string $path Path to file 2159 * @param int $filesize Size of file (if left out, will get it automatically) 2160 * @return int|bool Size read (will always be $filesize) or false if failed 2161 */ 2162 function readfile_allow_large($path, $filesize = -1) { 2163 // Automatically get size if not specified. 2164 if ($filesize === -1) { 2165 $filesize = filesize($path); 2166 } 2167 if ($filesize <= 2147483647) { 2168 // If the file is up to 2^31 - 1, send it normally using readfile. 2169 return readfile($path); 2170 } else { 2171 // For large files, read and output in 64KB chunks. 2172 $handle = fopen($path, 'r'); 2173 if ($handle === false) { 2174 return false; 2175 } 2176 $left = $filesize; 2177 while ($left > 0) { 2178 $size = min($left, 65536); 2179 $buffer = fread($handle, $size); 2180 if ($buffer === false) { 2181 return false; 2182 } 2183 echo $buffer; 2184 $left -= $size; 2185 } 2186 return $filesize; 2187 } 2188 } 2189 2190 /** 2191 * Enhanced readfile() with optional acceleration. 2192 * @param string|stored_file $file 2193 * @param string $mimetype 2194 * @param bool $accelerate 2195 * @return void 2196 */ 2197 function readfile_accel($file, $mimetype, $accelerate) { 2198 global $CFG; 2199 2200 if ($mimetype === 'text/plain') { 2201 // there is no encoding specified in text files, we need something consistent 2202 header('Content-Type: text/plain; charset=utf-8'); 2203 } else { 2204 header('Content-Type: '.$mimetype); 2205 } 2206 2207 $lastmodified = is_object($file) ? $file->get_timemodified() : filemtime($file); 2208 header('Last-Modified: '. gmdate('D, d M Y H:i:s', $lastmodified) .' GMT'); 2209 2210 if (is_object($file)) { 2211 header('Etag: "' . $file->get_contenthash() . '"'); 2212 if (isset($_SERVER['HTTP_IF_NONE_MATCH']) and trim($_SERVER['HTTP_IF_NONE_MATCH'], '"') === $file->get_contenthash()) { 2213 header('HTTP/1.1 304 Not Modified'); 2214 return; 2215 } 2216 } 2217 2218 // if etag present for stored file rely on it exclusively 2219 if (!empty($_SERVER['HTTP_IF_MODIFIED_SINCE']) and (empty($_SERVER['HTTP_IF_NONE_MATCH']) or !is_object($file))) { 2220 // get unixtime of request header; clip extra junk off first 2221 $since = strtotime(preg_replace('/;.*$/', '', $_SERVER["HTTP_IF_MODIFIED_SINCE"])); 2222 if ($since && $since >= $lastmodified) { 2223 header('HTTP/1.1 304 Not Modified'); 2224 return; 2225 } 2226 } 2227 2228 if ($accelerate and empty($CFG->disablebyteserving) and $mimetype !== 'text/plain') { 2229 header('Accept-Ranges: bytes'); 2230 } else { 2231 header('Accept-Ranges: none'); 2232 } 2233 2234 if ($accelerate) { 2235 if (is_object($file)) { 2236 $fs = get_file_storage(); 2237 if ($fs->supports_xsendfile()) { 2238 if ($fs->xsendfile_file($file)) { 2239 return; 2240 } 2241 } 2242 } else { 2243 if (!empty($CFG->xsendfile)) { 2244 require_once("$CFG->libdir/xsendfilelib.php"); 2245 if (xsendfile($file)) { 2246 return; 2247 } 2248 } 2249 } 2250 } 2251 2252 $filesize = is_object($file) ? $file->get_filesize() : filesize($file); 2253 2254 header('Last-Modified: '. gmdate('D, d M Y H:i:s', $lastmodified) .' GMT'); 2255 2256 if ($accelerate and empty($CFG->disablebyteserving) and $mimetype !== 'text/plain') { 2257 2258 if (!empty($_SERVER['HTTP_RANGE']) and strpos($_SERVER['HTTP_RANGE'],'bytes=') !== FALSE) { 2259 // byteserving stuff - for acrobat reader and download accelerators 2260 // see: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.35 2261 // inspired by: http://www.coneural.org/florian/papers/04_byteserving.php 2262 $ranges = false; 2263 if (preg_match_all('/(\d*)-(\d*)/', $_SERVER['HTTP_RANGE'], $ranges, PREG_SET_ORDER)) { 2264 foreach ($ranges as $key=>$value) { 2265 if ($ranges[$key][1] == '') { 2266 //suffix case 2267 $ranges[$key][1] = $filesize - $ranges[$key][2]; 2268 $ranges[$key][2] = $filesize - 1; 2269 } else if ($ranges[$key][2] == '' || $ranges[$key][2] > $filesize - 1) { 2270 //fix range length 2271 $ranges[$key][2] = $filesize - 1; 2272 } 2273 if ($ranges[$key][2] != '' && $ranges[$key][2] < $ranges[$key][1]) { 2274 //invalid byte-range ==> ignore header 2275 $ranges = false; 2276 break; 2277 } 2278 //prepare multipart header 2279 $ranges[$key][0] = "\r\n--".BYTESERVING_BOUNDARY."\r\nContent-Type: $mimetype\r\n"; 2280 $ranges[$key][0] .= "Content-Range: bytes {$ranges[$key][1]}-{$ranges[$key][2]}/$filesize\r\n\r\n"; 2281 } 2282 } else { 2283 $ranges = false; 2284 } 2285 if ($ranges) { 2286 if (is_object($file)) { 2287 $handle = $file->get_content_file_handle(); 2288 if ($handle === false) { 2289 throw new file_exception('storedfilecannotreadfile', $file->get_filename()); 2290 } 2291 } else { 2292 $handle = fopen($file, 'rb'); 2293 if ($handle === false) { 2294 throw new file_exception('cannotopenfile', $file); 2295 } 2296 } 2297 byteserving_send_file($handle, $mimetype, $ranges, $filesize); 2298 } 2299 } 2300 } 2301 2302 header('Content-Length: ' . $filesize); 2303 2304 if (!empty($_SERVER['REQUEST_METHOD']) and $_SERVER['REQUEST_METHOD'] === 'HEAD') { 2305 exit; 2306 } 2307 2308 while (ob_get_level()) { 2309 $handlerstack = ob_list_handlers(); 2310 $activehandler = array_pop($handlerstack); 2311 if ($activehandler === 'default output handler') { 2312 // We do not expect any content in the buffer when we are serving files. 2313 $buffercontents = ob_get_clean(); 2314 if ($buffercontents !== '') { 2315 error_log('Non-empty default output handler buffer detected while serving the file ' . $file); 2316 } 2317 } else { 2318 // Some handlers such as zlib output compression may have file signature buffered - flush it. 2319 ob_end_flush(); 2320 } 2321 } 2322 2323 // send the whole file content 2324 if (is_object($file)) { 2325 $file->readfile(); 2326 } else { 2327 if (readfile_allow_large($file, $filesize) === false) { 2328 throw new file_exception('cannotopenfile', $file); 2329 } 2330 } 2331 } 2332 2333 /** 2334 * Similar to readfile_accel() but designed for strings. 2335 * @param string $string 2336 * @param string $mimetype 2337 * @param bool $accelerate Ignored 2338 * @return void 2339 */ 2340 function readstring_accel($string, $mimetype, $accelerate = false) { 2341 global $CFG; 2342 2343 if ($mimetype === 'text/plain') { 2344 // there is no encoding specified in text files, we need something consistent 2345 header('Content-Type: text/plain; charset=utf-8'); 2346 } else { 2347 header('Content-Type: '.$mimetype); 2348 } 2349 header('Last-Modified: '. gmdate('D, d M Y H:i:s', time()) .' GMT'); 2350 header('Accept-Ranges: none'); 2351 header('Content-Length: '.strlen($string)); 2352 echo $string; 2353 } 2354 2355 /** 2356 * Handles the sending of temporary file to user, download is forced. 2357 * File is deleted after abort or successful sending, does not return, script terminated 2358 * 2359 * @param string $path path to file, preferably from moodledata/temp/something; or content of file itself 2360 * @param string $filename proposed file name when saving file 2361 * @param bool $pathisstring If the path is string 2362 */ 2363 function send_temp_file($path, $filename, $pathisstring=false) { 2364 global $CFG; 2365 2366 // Guess the file's MIME type. 2367 $mimetype = get_mimetype_for_sending($filename); 2368 2369 // close session - not needed anymore 2370 \core\session\manager::write_close(); 2371 2372 if (!$pathisstring) { 2373 if (!file_exists($path)) { 2374 send_header_404(); 2375 print_error('filenotfound', 'error', $CFG->wwwroot.'/'); 2376 } 2377 // executed after normal finish or abort 2378 core_shutdown_manager::register_function('send_temp_file_finished', array($path)); 2379 } 2380 2381 // if user is using IE, urlencode the filename so that multibyte file name will show up correctly on popup 2382 if (core_useragent::is_ie() || core_useragent::is_edge()) { 2383 $filename = urlencode($filename); 2384 } 2385 2386 // If this file was requested from a form, then mark download as complete. 2387 \core_form\util::form_download_complete(); 2388 2389 header('Content-Disposition: attachment; filename="'.$filename.'"'); 2390 if (is_https()) { // HTTPS sites - watch out for IE! KB812935 and KB316431. 2391 header('Cache-Control: private, max-age=10, no-transform'); 2392 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2393 header('Pragma: '); 2394 } else { //normal http - prevent caching at all cost 2395 header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); 2396 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2397 header('Pragma: no-cache'); 2398 } 2399 2400 // send the contents - we can not accelerate this because the file will be deleted asap 2401 if ($pathisstring) { 2402 readstring_accel($path, $mimetype); 2403 } else { 2404 readfile_accel($path, $mimetype, false); 2405 @unlink($path); 2406 } 2407 2408 die; //no more chars to output 2409 } 2410 2411 /** 2412 * Internal callback function used by send_temp_file() 2413 * 2414 * @param string $path 2415 */ 2416 function send_temp_file_finished($path) { 2417 if (file_exists($path)) { 2418 @unlink($path); 2419 } 2420 } 2421 2422 /** 2423 * Serve content which is not meant to be cached. 2424 * 2425 * This is only intended to be used for volatile public files, for instance 2426 * when development is enabled, or when caching is not required on a public resource. 2427 * 2428 * @param string $content Raw content. 2429 * @param string $filename The file name. 2430 * @return void 2431 */ 2432 function send_content_uncached($content, $filename) { 2433 $mimetype = mimeinfo('type', $filename); 2434 $charset = strpos($mimetype, 'text/') === 0 ? '; charset=utf-8' : ''; 2435 2436 header('Content-Disposition: inline; filename="' . $filename . '"'); 2437 header('Last-Modified: ' . gmdate('D, d M Y H:i:s', time()) . ' GMT'); 2438 header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 2) . ' GMT'); 2439 header('Pragma: '); 2440 header('Accept-Ranges: none'); 2441 header('Content-Type: ' . $mimetype . $charset); 2442 header('Content-Length: ' . strlen($content)); 2443 2444 echo $content; 2445 die(); 2446 } 2447 2448 /** 2449 * Safely save content to a certain path. 2450 * 2451 * This function tries hard to be atomic by first copying the content 2452 * to a separate file, and then moving the file across. It also prevents 2453 * the user to abort a request to prevent half-safed files. 2454 * 2455 * This function is intended to be used when saving some content to cache like 2456 * $CFG->localcachedir. If you're not caching a file you should use the File API. 2457 * 2458 * @param string $content The file content. 2459 * @param string $destination The absolute path of the final file. 2460 * @return void 2461 */ 2462 function file_safe_save_content($content, $destination) { 2463 global $CFG; 2464 2465 clearstatcache(); 2466 if (!file_exists(dirname($destination))) { 2467 @mkdir(dirname($destination), $CFG->directorypermissions, true); 2468 } 2469 2470 // Prevent serving of incomplete file from concurrent request, 2471 // the rename() should be more atomic than fwrite(). 2472 ignore_user_abort(true); 2473 if ($fp = fopen($destination . '.tmp', 'xb')) { 2474 fwrite($fp, $content); 2475 fclose($fp); 2476 rename($destination . '.tmp', $destination); 2477 @chmod($destination, $CFG->filepermissions); 2478 @unlink($destination . '.tmp'); // Just in case anything fails. 2479 } 2480 ignore_user_abort(false); 2481 if (connection_aborted()) { 2482 die(); 2483 } 2484 } 2485 2486 /** 2487 * Handles the sending of file data to the user's browser, including support for 2488 * byteranges etc. 2489 * 2490 * @category files 2491 * @param string|stored_file $path Path of file on disk (including real filename), 2492 * or actual content of file as string, 2493 * or stored_file object 2494 * @param string $filename Filename to send 2495 * @param int $lifetime Number of seconds before the file should expire from caches (null means $CFG->filelifetime) 2496 * @param int $filter 0 (default)=no filtering, 1=all files, 2=html files only 2497 * @param bool $pathisstring If true (default false), $path is the content to send and not the pathname. 2498 * Forced to false when $path is a stored_file object. 2499 * @param bool $forcedownload If true (default false), forces download of file rather than view in browser/plugin 2500 * @param string $mimetype Include to specify the MIME type; leave blank to have it guess the type from $filename 2501 * @param bool $dontdie - return control to caller afterwards. this is not recommended and only used for cleanup tasks. 2502 * if this is passed as true, ignore_user_abort is called. if you don't want your processing to continue on cancel, 2503 * you must detect this case when control is returned using connection_aborted. Please not that session is closed 2504 * and should not be reopened. 2505 * @param array $options An array of options, currently accepts: 2506 * - (string) cacheability: public, or private. 2507 * - (string|null) immutable 2508 * - (bool) dontforcesvgdownload: true if force download should be disabled on SVGs. 2509 * Note: This overrides a security feature, so should only be applied to "trusted" content 2510 * (eg module content that is created using an XSS risk flagged capability, such as SCORM). 2511 * @return null script execution stopped unless $dontdie is true 2512 */ 2513 function send_file($path, $filename, $lifetime = null , $filter=0, $pathisstring=false, $forcedownload=false, $mimetype='', 2514 $dontdie=false, array $options = array()) { 2515 global $CFG, $COURSE; 2516 2517 if ($dontdie) { 2518 ignore_user_abort(true); 2519 } 2520 2521 if ($lifetime === 'default' or is_null($lifetime)) { 2522 $lifetime = $CFG->filelifetime; 2523 } 2524 2525 if (is_object($path)) { 2526 $pathisstring = false; 2527 } 2528 2529 \core\session\manager::write_close(); // Unlock session during file serving. 2530 2531 // Use given MIME type if specified, otherwise guess it. 2532 if (!$mimetype || $mimetype === 'document/unknown') { 2533 $mimetype = get_mimetype_for_sending($filename); 2534 } 2535 2536 // if user is using IE, urlencode the filename so that multibyte file name will show up correctly on popup 2537 if (core_useragent::is_ie() || core_useragent::is_edge()) { 2538 $filename = rawurlencode($filename); 2539 } 2540 2541 // Make sure we force download of SVG files, unless the module explicitly allows them (eg within SCORM content). 2542 // This is for security reasons (https://digi.ninja/blog/svg_xss.php). 2543 if (file_is_svg_image_from_mimetype($mimetype) && empty($options['dontforcesvgdownload'])) { 2544 $forcedownload = true; 2545 } 2546 2547 if ($forcedownload) { 2548 header('Content-Disposition: attachment; filename="'.$filename.'"'); 2549 2550 // If this file was requested from a form, then mark download as complete. 2551 \core_form\util::form_download_complete(); 2552 } else if ($mimetype !== 'application/x-shockwave-flash') { 2553 // If this is an swf don't pass content-disposition with filename as this makes the flash player treat the file 2554 // as an upload and enforces security that may prevent the file from being loaded. 2555 2556 header('Content-Disposition: inline; filename="'.$filename.'"'); 2557 } 2558 2559 if ($lifetime > 0) { 2560 $immutable = ''; 2561 if (!empty($options['immutable'])) { 2562 $immutable = ', immutable'; 2563 // Overwrite lifetime accordingly: 2564 // 90 days only - based on Moodle point release cadence being every 3 months. 2565 $lifetimemin = 60 * 60 * 24 * 90; 2566 $lifetime = max($lifetime, $lifetimemin); 2567 } 2568 $cacheability = ' public,'; 2569 if (!empty($options['cacheability']) && ($options['cacheability'] === 'public')) { 2570 // This file must be cache-able by both browsers and proxies. 2571 $cacheability = ' public,'; 2572 } else if (!empty($options['cacheability']) && ($options['cacheability'] === 'private')) { 2573 // This file must be cache-able only by browsers. 2574 $cacheability = ' private,'; 2575 } else if (isloggedin() and !isguestuser()) { 2576 // By default, under the conditions above, this file must be cache-able only by browsers. 2577 $cacheability = ' private,'; 2578 } 2579 $nobyteserving = false; 2580 header('Cache-Control:'.$cacheability.' max-age='.$lifetime.', no-transform'.$immutable); 2581 header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); 2582 header('Pragma: '); 2583 2584 } else { // Do not cache files in proxies and browsers 2585 $nobyteserving = true; 2586 if (is_https()) { // HTTPS sites - watch out for IE! KB812935 and KB316431. 2587 header('Cache-Control: private, max-age=10, no-transform'); 2588 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2589 header('Pragma: '); 2590 } else { //normal http - prevent caching at all cost 2591 header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); 2592 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2593 header('Pragma: no-cache'); 2594 } 2595 } 2596 2597 if (empty($filter)) { 2598 // send the contents 2599 if ($pathisstring) { 2600 readstring_accel($path, $mimetype); 2601 } else { 2602 readfile_accel($path, $mimetype, !$dontdie); 2603 } 2604 2605 } else { 2606 // Try to put the file through filters 2607 if ($mimetype == 'text/html' || $mimetype == 'application/xhtml+xml' || file_is_svg_image_from_mimetype($mimetype)) { 2608 $options = new stdClass(); 2609 $options->noclean = true; 2610 $options->nocache = true; // temporary workaround for MDL-5136 2611 if (is_object($path)) { 2612 $text = $path->get_content(); 2613 } else if ($pathisstring) { 2614 $text = $path; 2615 } else { 2616 $text = implode('', file($path)); 2617 } 2618 $output = format_text($text, FORMAT_HTML, $options, $COURSE->id); 2619 2620 readstring_accel($output, $mimetype); 2621 2622 } else if (($mimetype == 'text/plain') and ($filter == 1)) { 2623 // only filter text if filter all files is selected 2624 $options = new stdClass(); 2625 $options->newlines = false; 2626 $options->noclean = true; 2627 if (is_object($path)) { 2628 $text = htmlentities($path->get_content(), ENT_QUOTES, 'UTF-8'); 2629 } else if ($pathisstring) { 2630 $text = htmlentities($path, ENT_QUOTES, 'UTF-8'); 2631 } else { 2632 $text = htmlentities(implode('', file($path)), ENT_QUOTES, 'UTF-8'); 2633 } 2634 $output = '<pre>'. format_text($text, FORMAT_MOODLE, $options, $COURSE->id) .'</pre>'; 2635 2636 readstring_accel($output, $mimetype); 2637 2638 } else { 2639 // send the contents 2640 if ($pathisstring) { 2641 readstring_accel($path, $mimetype); 2642 } else { 2643 readfile_accel($path, $mimetype, !$dontdie); 2644 } 2645 } 2646 } 2647 if ($dontdie) { 2648 return; 2649 } 2650 die; //no more chars to output!!! 2651 } 2652 2653 /** 2654 * Handles the sending of file data to the user's browser, including support for 2655 * byteranges etc. 2656 * 2657 * The $options parameter supports the following keys: 2658 * (string|null) preview - send the preview of the file (e.g. "thumb" for a thumbnail) 2659 * (string|null) filename - overrides the implicit filename 2660 * (bool) dontdie - return control to caller afterwards. this is not recommended and only used for cleanup tasks. 2661 * if this is passed as true, ignore_user_abort is called. if you don't want your processing to continue on cancel, 2662 * you must detect this case when control is returned using connection_aborted. Please not that session is closed 2663 * and should not be reopened 2664 * (string|null) cacheability - force the cacheability setting of the HTTP response, "private" or "public", 2665 * when $lifetime is greater than 0. Cacheability defaults to "private" when logged in as other than guest; otherwise, 2666 * defaults to "public". 2667 * (string|null) immutable - set the immutable cache setting in the HTTP response, when served under HTTPS. 2668 * Note: it's up to the consumer to set it properly i.e. when serving a "versioned" URL. 2669 * 2670 * @category files 2671 * @param stored_file $stored_file local file object 2672 * @param int $lifetime Number of seconds before the file should expire from caches (null means $CFG->filelifetime) 2673 * @param int $filter 0 (default)=no filtering, 1=all files, 2=html files only 2674 * @param bool $forcedownload If true (default false), forces download of file rather than view in browser/plugin 2675 * @param array $options additional options affecting the file serving 2676 * @return null script execution stopped unless $options['dontdie'] is true 2677 */ 2678 function send_stored_file($stored_file, $lifetime=null, $filter=0, $forcedownload=false, array $options=array()) { 2679 global $CFG, $COURSE; 2680 2681 static $recursion = 0; 2682 2683 if (empty($options['filename'])) { 2684 $filename = null; 2685 } else { 2686 $filename = $options['filename']; 2687 } 2688 2689 if (empty($options['dontdie'])) { 2690 $dontdie = false; 2691 } else { 2692 $dontdie = true; 2693 } 2694 2695 if ($lifetime === 'default' or is_null($lifetime)) { 2696 $lifetime = $CFG->filelifetime; 2697 } 2698 2699 if (!empty($options['preview'])) { 2700 // replace the file with its preview 2701 $fs = get_file_storage(); 2702 $preview_file = $fs->get_file_preview($stored_file, $options['preview']); 2703 if (!$preview_file) { 2704 // unable to create a preview of the file, send its default mime icon instead 2705 if ($options['preview'] === 'tinyicon') { 2706 $size = 24; 2707 } else if ($options['preview'] === 'thumb') { 2708 $size = 90; 2709 } else { 2710 $size = 256; 2711 } 2712 $fileicon = file_file_icon($stored_file, $size); 2713 send_file($CFG->dirroot.'/pix/'.$fileicon.'.png', basename($fileicon).'.png'); 2714 } else { 2715 // preview images have fixed cache lifetime and they ignore forced download 2716 // (they are generated by GD and therefore they are considered reasonably safe). 2717 $stored_file = $preview_file; 2718 $lifetime = DAYSECS; 2719 $filter = 0; 2720 $forcedownload = false; 2721 } 2722 } 2723 2724 // handle external resource 2725 if ($stored_file && $stored_file->is_external_file() && !isset($options['sendcachedexternalfile'])) { 2726 2727 // Have we been here before? 2728 $recursion++; 2729 if ($recursion > 10) { 2730 throw new coding_exception('Recursive file serving detected'); 2731 } 2732 2733 $stored_file->send_file($lifetime, $filter, $forcedownload, $options); 2734 die; 2735 } 2736 2737 if (!$stored_file or $stored_file->is_directory()) { 2738 // nothing to serve 2739 if ($dontdie) { 2740 return; 2741 } 2742 die; 2743 } 2744 2745 $filename = is_null($filename) ? $stored_file->get_filename() : $filename; 2746 2747 // Use given MIME type if specified. 2748 $mimetype = $stored_file->get_mimetype(); 2749 2750 // Allow cross-origin requests only for Web Services. 2751 // This allow to receive requests done by Web Workers or webapps in different domains. 2752 if (WS_SERVER) { 2753 header('Access-Control-Allow-Origin: *'); 2754 } 2755 2756 send_file($stored_file, $filename, $lifetime, $filter, false, $forcedownload, $mimetype, $dontdie, $options); 2757 } 2758 2759 /** 2760 * Recursively delete the file or folder with path $location. That is, 2761 * if it is a file delete it. If it is a folder, delete all its content 2762 * then delete it. If $location does not exist to start, that is not 2763 * considered an error. 2764 * 2765 * @param string $location the path to remove. 2766 * @return bool 2767 */ 2768 function fulldelete($location) { 2769 if (empty($location)) { 2770 // extra safety against wrong param 2771 return false; 2772 } 2773 if (is_dir($location)) { 2774 if (!$currdir = opendir($location)) { 2775 return false; 2776 } 2777 while (false !== ($file = readdir($currdir))) { 2778 if ($file <> ".." && $file <> ".") { 2779 $fullfile = $location."/".$file; 2780 if (is_dir($fullfile)) { 2781 if (!fulldelete($fullfile)) { 2782 return false; 2783 } 2784 } else { 2785 if (!unlink($fullfile)) { 2786 return false; 2787 } 2788 } 2789 } 2790 } 2791 closedir($currdir); 2792 if (! rmdir($location)) { 2793 return false; 2794 } 2795 2796 } else if (file_exists($location)) { 2797 if (!unlink($location)) { 2798 return false; 2799 } 2800 } 2801 return true; 2802 } 2803 2804 /** 2805 * Send requested byterange of file. 2806 * 2807 * @param resource $handle A file handle 2808 * @param string $mimetype The mimetype for the output 2809 * @param array $ranges An array of ranges to send 2810 * @param string $filesize The size of the content if only one range is used 2811 */ 2812 function byteserving_send_file($handle, $mimetype, $ranges, $filesize) { 2813 // better turn off any kind of compression and buffering 2814 ini_set('zlib.output_compression', 'Off'); 2815 2816 $chunksize = 1*(1024*1024); // 1MB chunks - must be less than 2MB! 2817 if ($handle === false) { 2818 die; 2819 } 2820 if (count($ranges) == 1) { //only one range requested 2821 $length = $ranges[0][2] - $ranges[0][1] + 1; 2822 header('HTTP/1.1 206 Partial content'); 2823 header('Content-Length: '.$length); 2824 header('Content-Range: bytes '.$ranges[0][1].'-'.$ranges[0][2].'/'.$filesize); 2825 header('Content-Type: '.$mimetype); 2826 2827 while(@ob_get_level()) { 2828 if (!@ob_end_flush()) { 2829 break; 2830 } 2831 } 2832 2833 fseek($handle, $ranges[0][1]); 2834 while (!feof($handle) && $length > 0) { 2835 core_php_time_limit::raise(60*60); //reset time limit to 60 min - should be enough for 1 MB chunk 2836 $buffer = fread($handle, ($chunksize < $length ? $chunksize : $length)); 2837 echo $buffer; 2838 flush(); 2839 $length -= strlen($buffer); 2840 } 2841 fclose($handle); 2842 die; 2843 } else { // multiple ranges requested - not tested much 2844 $totallength = 0; 2845 foreach($ranges as $range) { 2846 $totallength += strlen($range[0]) + $range[2] - $range[1] + 1; 2847 } 2848 $totallength += strlen("\r\n--".BYTESERVING_BOUNDARY."--\r\n"); 2849 header('HTTP/1.1 206 Partial content'); 2850 header('Content-Length: '.$totallength); 2851 header('Content-Type: multipart/byteranges; boundary='.BYTESERVING_BOUNDARY); 2852 2853 while(@ob_get_level()) { 2854 if (!@ob_end_flush()) { 2855 break; 2856 } 2857 } 2858 2859 foreach($ranges as $range) { 2860 $length = $range[2] - $range[1] + 1; 2861 echo $range[0]; 2862 fseek($handle, $range[1]); 2863 while (!feof($handle) && $length > 0) { 2864 core_php_time_limit::raise(60*60); //reset time limit to 60 min - should be enough for 1 MB chunk 2865 $buffer = fread($handle, ($chunksize < $length ? $chunksize : $length)); 2866 echo $buffer; 2867 flush(); 2868 $length -= strlen($buffer); 2869 } 2870 } 2871 echo "\r\n--".BYTESERVING_BOUNDARY."--\r\n"; 2872 fclose($handle); 2873 die; 2874 } 2875 } 2876 2877 /** 2878 * Tells whether the filename is executable. 2879 * 2880 * @link http://php.net/manual/en/function.is-executable.php 2881 * @link https://bugs.php.net/bug.php?id=41062 2882 * @param string $filename Path to the file. 2883 * @return bool True if the filename exists and is executable; otherwise, false. 2884 */ 2885 function file_is_executable($filename) { 2886 if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') { 2887 if (is_executable($filename)) { 2888 return true; 2889 } else { 2890 $fileext = strrchr($filename, '.'); 2891 // If we have an extension we can check if it is listed as executable. 2892 if ($fileext && file_exists($filename) && !is_dir($filename)) { 2893 $winpathext = strtolower(getenv('PATHEXT')); 2894 $winpathexts = explode(';', $winpathext); 2895 2896 return in_array(strtolower($fileext), $winpathexts); 2897 } 2898 2899 return false; 2900 } 2901 } else { 2902 return is_executable($filename); 2903 } 2904 } 2905 2906 /** 2907 * Overwrite an existing file in a draft area. 2908 * 2909 * @param stored_file $newfile the new file with the new content and meta-data 2910 * @param stored_file $existingfile the file that will be overwritten 2911 * @throws moodle_exception 2912 * @since Moodle 3.2 2913 */ 2914 function file_overwrite_existing_draftfile(stored_file $newfile, stored_file $existingfile) { 2915 if ($existingfile->get_component() != 'user' or $existingfile->get_filearea() != 'draft') { 2916 throw new coding_exception('The file to overwrite is not in a draft area.'); 2917 } 2918 2919 $fs = get_file_storage(); 2920 // Remember original file source field. 2921 $source = @unserialize($existingfile->get_source()); 2922 // Remember the original sortorder. 2923 $sortorder = $existingfile->get_sortorder(); 2924 if ($newfile->is_external_file()) { 2925 // New file is a reference. Check that existing file does not have any other files referencing to it 2926 if (isset($source->original) && $fs->search_references_count($source->original)) { 2927 throw new moodle_exception('errordoublereference', 'repository'); 2928 } 2929 } 2930 2931 // Delete existing file to release filename. 2932 $newfilerecord = array( 2933 'contextid' => $existingfile->get_contextid(), 2934 'component' => 'user', 2935 'filearea' => 'draft', 2936 'itemid' => $existingfile->get_itemid(), 2937 'timemodified' => time() 2938 ); 2939 $existingfile->delete(); 2940 2941 // Create new file. 2942 $newfile = $fs->create_file_from_storedfile($newfilerecord, $newfile); 2943 // Preserve original file location (stored in source field) for handling references. 2944 if (isset($source->original)) { 2945 if (!($newfilesource = @unserialize($newfile->get_source()))) { 2946 $newfilesource = new stdClass(); 2947 } 2948 $newfilesource->original = $source->original; 2949 $newfile->set_source(serialize($newfilesource)); 2950 } 2951 $newfile->set_sortorder($sortorder); 2952 } 2953 2954 /** 2955 * Add files from a draft area into a final area. 2956 * 2957 * Most of the time you do not want to use this. It is intended to be used 2958 * by asynchronous services which cannot direcly manipulate a final 2959 * area through a draft area. Instead they add files to a new draft 2960 * area and merge that new draft into the final area when ready. 2961 * 2962 * @param int $draftitemid the id of the draft area to use. 2963 * @param int $contextid this parameter and the next two identify the file area to save to. 2964 * @param string $component component name 2965 * @param string $filearea indentifies the file area 2966 * @param int $itemid identifies the item id or false for all items in the file area 2967 * @param array $options area options (subdirs=false, maxfiles=-1, maxbytes=0, areamaxbytes=FILE_AREA_MAX_BYTES_UNLIMITED) 2968 * @see file_save_draft_area_files 2969 * @since Moodle 3.2 2970 */ 2971 function file_merge_files_from_draft_area_into_filearea($draftitemid, $contextid, $component, $filearea, $itemid, 2972 array $options = null) { 2973 // We use 0 here so file_prepare_draft_area creates a new one, finaldraftid will be updated with the new draft id. 2974 $finaldraftid = 0; 2975 file_prepare_draft_area($finaldraftid, $contextid, $component, $filearea, $itemid, $options); 2976 file_merge_draft_area_into_draft_area($draftitemid, $finaldraftid); 2977 file_save_draft_area_files($finaldraftid, $contextid, $component, $filearea, $itemid, $options); 2978 } 2979 2980 /** 2981 * Merge files from two draftarea areas. 2982 * 2983 * This does not handle conflict resolution, files in the destination area which appear 2984 * to be more recent will be kept disregarding the intended ones. 2985 * 2986 * @param int $getfromdraftid the id of the draft area where are the files to merge. 2987 * @param int $mergeintodraftid the id of the draft area where new files will be merged. 2988 * @throws coding_exception 2989 * @since Moodle 3.2 2990 */ 2991 function file_merge_draft_area_into_draft_area($getfromdraftid, $mergeintodraftid) { 2992 global $USER; 2993 2994 $fs = get_file_storage(); 2995 $contextid = context_user::instance($USER->id)->id; 2996 2997 if (!$filestomerge = $fs->get_area_files($contextid, 'user', 'draft', $getfromdraftid)) { 2998 throw new coding_exception('Nothing to merge or area does not belong to current user'); 2999 } 3000 3001 $currentfiles = $fs->get_area_files($contextid, 'user', 'draft', $mergeintodraftid); 3002 3003 // Get hashes of the files to merge. 3004 $newhashes = array(); 3005 foreach ($filestomerge as $filetomerge) { 3006 $filepath = $filetomerge->get_filepath(); 3007 $filename = $filetomerge->get_filename(); 3008 3009 $newhash = $fs->get_pathname_hash($contextid, 'user', 'draft', $mergeintodraftid, $filepath, $filename); 3010 $newhashes[$newhash] = $filetomerge; 3011 } 3012 3013 // Calculate wich files must be added. 3014 foreach ($currentfiles as $file) { 3015 $filehash = $file->get_pathnamehash(); 3016 // One file to be merged already exists. 3017 if (isset($newhashes[$filehash])) { 3018 $updatedfile = $newhashes[$filehash]; 3019 3020 // Avoid race conditions. 3021 if ($file->get_timemodified() > $updatedfile->get_timemodified()) { 3022 // The existing file is more recent, do not copy the suposedly "new" one. 3023 unset($newhashes[$filehash]); 3024 continue; 3025 } 3026 // Update existing file (not only content, meta-data too). 3027 file_overwrite_existing_draftfile($updatedfile, $file); 3028 unset($newhashes[$filehash]); 3029 } 3030 } 3031 3032 foreach ($newhashes as $newfile) { 3033 $newfilerecord = array( 3034 'contextid' => $contextid, 3035 'component' => 'user', 3036 'filearea' => 'draft', 3037 'itemid' => $mergeintodraftid, 3038 'timemodified' => time() 3039 ); 3040 3041 $fs->create_file_from_storedfile($newfilerecord, $newfile); 3042 } 3043 } 3044 3045 /** 3046 * Attempt to determine whether the specified mime-type is an SVG image or not. 3047 * 3048 * @param string $mimetype Mime-type 3049 * @return bool True if it is an SVG file 3050 */ 3051 function file_is_svg_image_from_mimetype(string $mimetype): bool { 3052 return preg_match('|^image/svg|', $mimetype); 3053 } 3054 3055 /** 3056 * RESTful cURL class 3057 * 3058 * This is a wrapper class for curl, it is quite easy to use: 3059 * <code> 3060 * $c = new curl; 3061 * // enable cache 3062 * $c = new curl(array('cache'=>true)); 3063 * // enable cookie 3064 * $c = new curl(array('cookie'=>true)); 3065 * // enable proxy 3066 * $c = new curl(array('proxy'=>true)); 3067 * 3068 * // HTTP GET Method 3069 * $html = $c->get('http://example.com'); 3070 * // HTTP POST Method 3071 * $html = $c->post('http://example.com/', array('q'=>'words', 'name'=>'moodle')); 3072 * // HTTP PUT Method 3073 * $html = $c->put('http://example.com/', array('file'=>'/var/www/test.txt'); 3074 * </code> 3075 * 3076 * @package core_files 3077 * @category files 3078 * @copyright Dongsheng Cai <dongsheng@moodle.com> 3079 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License 3080 */ 3081 class curl { 3082 /** @var bool Caches http request contents */ 3083 public $cache = false; 3084 /** @var bool Uses proxy, null means automatic based on URL */ 3085 public $proxy = null; 3086 /** @var string library version */ 3087 public $version = '0.4 dev'; 3088 /** @var array http's response */ 3089 public $response = array(); 3090 /** @var array Raw response headers, needed for BC in download_file_content(). */ 3091 public $rawresponse = array(); 3092 /** @var array http header */ 3093 public $header = array(); 3094 /** @var string cURL information */ 3095 public $info; 3096 /** @var string error */ 3097 public $error; 3098 /** @var int error code */ 3099 public $errno; 3100 /** @var bool Perform redirects at PHP level instead of relying on native cURL functionality. Always true now. */ 3101 public $emulateredirects = null; 3102 3103 /** @var array cURL options */ 3104 private $options; 3105 3106 /** @var string Proxy host */ 3107 private $proxy_host = ''; 3108 /** @var string Proxy auth */ 3109 private $proxy_auth = ''; 3110 /** @var string Proxy type */ 3111 private $proxy_type = ''; 3112 /** @var bool Debug mode on */ 3113 private $debug = false; 3114 /** @var bool|string Path to cookie file */ 3115 private $cookie = false; 3116 /** @var bool tracks multiple headers in response - redirect detection */ 3117 private $responsefinished = false; 3118 /** @var security helper class, responsible for checking host/ports against allowed/blocked entries.*/ 3119 private $securityhelper; 3120 /** @var bool ignoresecurity a flag which can be supplied to the constructor, allowing security to be bypassed. */ 3121 private $ignoresecurity; 3122 /** @var array $mockresponses For unit testing only - return the head of this list instead of making the next request. */ 3123 private static $mockresponses = []; 3124 3125 /** 3126 * Curl constructor. 3127 * 3128 * Allowed settings are: 3129 * proxy: (bool) use proxy server, null means autodetect non-local from url 3130 * debug: (bool) use debug output 3131 * cookie: (string) path to cookie file, false if none 3132 * cache: (bool) use cache 3133 * module_cache: (string) type of cache 3134 * securityhelper: (\core\files\curl_security_helper_base) helper object providing URL checking for requests. 3135 * ignoresecurity: (bool) set true to override and ignore the security helper when making requests. 3136 * 3137 * @param array $settings 3138 */ 3139 public function __construct($settings = array()) { 3140 global $CFG; 3141 if (!function_exists('curl_init')) { 3142 $this->error = 'cURL module must be enabled!'; 3143 trigger_error($this->error, E_USER_ERROR); 3144 return false; 3145 } 3146 3147 // All settings of this class should be init here. 3148 $this->resetopt(); 3149 if (!empty($settings['debug'])) { 3150 $this->debug = true; 3151 } 3152 if (!empty($settings['cookie'])) { 3153 if($settings['cookie'] === true) { 3154 $this->cookie = $CFG->dataroot.'/curl_cookie.txt'; 3155 } else { 3156 $this->cookie = $settings['cookie']; 3157 } 3158 } 3159 if (!empty($settings['cache'])) { 3160 if (class_exists('curl_cache')) { 3161 if (!empty($settings['module_cache'])) { 3162 $this->cache = new curl_cache($settings['module_cache']); 3163 } else { 3164 $this->cache = new curl_cache('misc'); 3165 } 3166 } 3167 } 3168 if (!empty($CFG->proxyhost)) { 3169 if (empty($CFG->proxyport)) { 3170 $this->proxy_host = $CFG->proxyhost; 3171 } else { 3172 $this->proxy_host = $CFG->proxyhost.':'.$CFG->proxyport; 3173 } 3174 if (!empty($CFG->proxyuser) and !empty($CFG->proxypassword)) { 3175 $this->proxy_auth = $CFG->proxyuser.':'.$CFG->proxypassword; 3176 $this->setopt(array( 3177 'proxyauth'=> CURLAUTH_BASIC | CURLAUTH_NTLM, 3178 'proxyuserpwd'=>$this->proxy_auth)); 3179 } 3180 if (!empty($CFG->proxytype)) { 3181 if ($CFG->proxytype == 'SOCKS5') { 3182 $this->proxy_type = CURLPROXY_SOCKS5; 3183 } else { 3184 $this->proxy_type = CURLPROXY_HTTP; 3185 $this->setopt([ 3186 'httpproxytunnel' => false, 3187 ]); 3188 if (defined('CURLOPT_SUPPRESS_CONNECT_HEADERS')) { 3189 $this->setopt([ 3190 'suppress_connect_headers' => true, 3191 ]); 3192 } 3193 } 3194 $this->setopt(array('proxytype'=>$this->proxy_type)); 3195 } 3196 3197 if (isset($settings['proxy'])) { 3198 $this->proxy = $settings['proxy']; 3199 } 3200 } else { 3201 $this->proxy = false; 3202 } 3203 3204 // All redirects are performed at PHP level now and each one is checked against blocked URLs rules. We do not 3205 // want to let cURL naively follow the redirect chain and visit every URL for security reasons. Even when the 3206 // caller explicitly wants to ignore the security checks, we would need to fall back to the original 3207 // implementation and use emulated redirects if open_basedir is in effect to avoid the PHP warning 3208 // "CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir". So it is better to simply 3209 // ignore this property and always handle redirects at this PHP wrapper level and not inside the native cURL. 3210 $this->emulateredirects = true; 3211 3212 // Curl security setup. Allow injection of a security helper, but if not found, default to the core helper. 3213 if (isset($settings['securityhelper']) && $settings['securityhelper'] instanceof \core\files\curl_security_helper_base) { 3214 $this->set_security($settings['securityhelper']); 3215 } else { 3216 $this->set_security(new \core\files\curl_security_helper()); 3217 } 3218 $this->ignoresecurity = isset($settings['ignoresecurity']) ? $settings['ignoresecurity'] : false; 3219 } 3220 3221 /** 3222 * Resets the CURL options that have already been set 3223 */ 3224 public function resetopt() { 3225 $this->options = array(); 3226 $this->options['CURLOPT_USERAGENT'] = \core_useragent::get_moodlebot_useragent(); 3227 // True to include the header in the output 3228 $this->options['CURLOPT_HEADER'] = 0; 3229 // True to Exclude the body from the output 3230 $this->options['CURLOPT_NOBODY'] = 0; 3231 // Redirect ny default. 3232 $this->options['CURLOPT_FOLLOWLOCATION'] = 1; 3233 $this->options['CURLOPT_MAXREDIRS'] = 10; 3234 $this->options['CURLOPT_ENCODING'] = ''; 3235 // TRUE to return the transfer as a string of the return 3236 // value of curl_exec() instead of outputting it out directly. 3237 $this->options['CURLOPT_RETURNTRANSFER'] = 1; 3238 $this->options['CURLOPT_SSL_VERIFYPEER'] = 0; 3239 $this->options['CURLOPT_SSL_VERIFYHOST'] = 2; 3240 $this->options['CURLOPT_CONNECTTIMEOUT'] = 30; 3241 3242 if ($cacert = self::get_cacert()) { 3243 $this->options['CURLOPT_CAINFO'] = $cacert; 3244 } 3245 } 3246 3247 /** 3248 * Get the location of ca certificates. 3249 * @return string absolute file path or empty if default used 3250 */ 3251 public static function get_cacert() { 3252 global $CFG; 3253 3254 // Bundle in dataroot always wins. 3255 if (is_readable("$CFG->dataroot/moodleorgca.crt")) { 3256 return realpath("$CFG->dataroot/moodleorgca.crt"); 3257 } 3258 3259 // Next comes the default from php.ini 3260 $cacert = ini_get('curl.cainfo'); 3261 if (!empty($cacert) and is_readable($cacert)) { 3262 return realpath($cacert); 3263 } 3264 3265 // Windows PHP does not have any certs, we need to use something. 3266 if ($CFG->ostype === 'WINDOWS') { 3267 if (is_readable("$CFG->libdir/cacert.pem")) { 3268 return realpath("$CFG->libdir/cacert.pem"); 3269 } 3270 } 3271 3272 // Use default, this should work fine on all properly configured *nix systems. 3273 return null; 3274 } 3275 3276 /** 3277 * Reset Cookie 3278 */ 3279 public function resetcookie() { 3280 if (!empty($this->cookie)) { 3281 if (is_file($this->cookie)) { 3282 $fp = fopen($this->cookie, 'w'); 3283 if (!empty($fp)) { 3284 fwrite($fp, ''); 3285 fclose($fp); 3286 } 3287 } 3288 } 3289 } 3290 3291 /** 3292 * Set curl options. 3293 * 3294 * Do not use the curl constants to define the options, pass a string 3295 * corresponding to that constant. Ie. to set CURLOPT_MAXREDIRS, pass 3296 * array('CURLOPT_MAXREDIRS' => 10) or array('maxredirs' => 10) to this method. 3297 * 3298 * @param array $options If array is null, this function will reset the options to default value. 3299 * @return void 3300 * @throws coding_exception If an option uses constant value instead of option name. 3301 */ 3302 public function setopt($options = array()) { 3303 if (is_array($options)) { 3304 foreach ($options as $name => $val) { 3305 if (!is_string($name)) { 3306 throw new coding_exception('Curl options should be defined using strings, not constant values.'); 3307 } 3308 if (stripos($name, 'CURLOPT_') === false) { 3309 // Only prefix with CURLOPT_ if the option doesn't contain CURLINFO_, 3310 // which is a valid prefix for at least one option CURLINFO_HEADER_OUT. 3311 if (stripos($name, 'CURLINFO_') === false) { 3312 $name = strtoupper('CURLOPT_'.$name); 3313 } 3314 } else { 3315 $name = strtoupper($name); 3316 } 3317 $this->options[$name] = $val; 3318 } 3319 } 3320 } 3321 3322 /** 3323 * Reset http method 3324 */ 3325 public function cleanopt() { 3326 unset($this->options['CURLOPT_HTTPGET']); 3327 unset($this->options['CURLOPT_POST']); 3328 unset($this->options['CURLOPT_POSTFIELDS']); 3329 unset($this->options['CURLOPT_PUT']); 3330 unset($this->options['CURLOPT_INFILE']); 3331 unset($this->options['CURLOPT_INFILESIZE']); 3332 unset($this->options['CURLOPT_CUSTOMREQUEST']); 3333 unset($this->options['CURLOPT_FILE']); 3334 } 3335 3336 /** 3337 * Resets the HTTP Request headers (to prepare for the new request) 3338 */ 3339 public function resetHeader() { 3340 $this->header = array(); 3341 } 3342 3343 /** 3344 * Set HTTP Request Header 3345 * 3346 * @param array $header 3347 */ 3348 public function setHeader($header) { 3349 if (is_array($header)) { 3350 foreach ($header as $v) { 3351 $this->setHeader($v); 3352 } 3353 } else { 3354 // Remove newlines, they are not allowed in headers. 3355 $newvalue = preg_replace('/[\r\n]/', '', $header); 3356 if (!in_array($newvalue, $this->header)) { 3357 $this->header[] = $newvalue; 3358 } 3359 } 3360 } 3361 3362 /** 3363 * Get HTTP Response Headers 3364 * @return array of arrays 3365 */ 3366 public function getResponse() { 3367 return $this->response; 3368 } 3369 3370 /** 3371 * Get raw HTTP Response Headers 3372 * @return array of strings 3373 */ 3374 public function get_raw_response() { 3375 return $this->rawresponse; 3376 } 3377 3378 /** 3379 * private callback function 3380 * Formatting HTTP Response Header 3381 * 3382 * We only keep the last headers returned. For example during a redirect the 3383 * redirect headers will not appear in {@link self::getResponse()}, if you need 3384 * to use those headers, refer to {@link self::get_raw_response()}. 3385 * 3386 * @param resource $ch Apparently not used 3387 * @param string $header 3388 * @return int The strlen of the header 3389 */ 3390 private function formatHeader($ch, $header) { 3391 $this->rawresponse[] = $header; 3392 3393 if (trim($header, "\r\n") === '') { 3394 // This must be the last header. 3395 $this->responsefinished = true; 3396 } 3397 3398 if (strlen($header) > 2) { 3399 if ($this->responsefinished) { 3400 // We still have headers after the supposedly last header, we must be 3401 // in a redirect so let's empty the response to keep the last headers. 3402 $this->responsefinished = false; 3403 $this->response = array(); 3404 } 3405 $parts = explode(" ", rtrim($header, "\r\n"), 2); 3406 $key = rtrim($parts[0], ':'); 3407 $value = isset($parts[1]) ? $parts[1] : null; 3408 if (!empty($this->response[$key])) { 3409 if (is_array($this->response[$key])) { 3410 $this->response[$key][] = $value; 3411 } else { 3412 $tmp = $this->response[$key]; 3413 $this->response[$key] = array(); 3414 $this->response[$key][] = $tmp; 3415 $this->response[$key][] = $value; 3416 3417 } 3418 } else { 3419 $this->response[$key] = $value; 3420 } 3421 } 3422 return strlen($header); 3423 } 3424 3425 /** 3426 * Set options for individual curl instance 3427 * 3428 * @param resource $curl A curl handle 3429 * @param array $options 3430 * @return resource The curl handle 3431 */ 3432 private function apply_opt($curl, $options) { 3433 // Clean up 3434 $this->cleanopt(); 3435 // set cookie 3436 if (!empty($this->cookie) || !empty($options['cookie'])) { 3437 $this->setopt(array('cookiejar'=>$this->cookie, 3438 'cookiefile'=>$this->cookie 3439 )); 3440 } 3441 3442 // Bypass proxy if required. 3443 if ($this->proxy === null) { 3444 if (!empty($this->options['CURLOPT_URL']) and is_proxybypass($this->options['CURLOPT_URL'])) { 3445 $proxy = false; 3446 } else { 3447 $proxy = true; 3448 } 3449 } else { 3450 $proxy = (bool)$this->proxy; 3451 } 3452 3453 // Set proxy. 3454 if ($proxy) { 3455 $options['CURLOPT_PROXY'] = $this->proxy_host; 3456 } else { 3457 unset($this->options['CURLOPT_PROXY']); 3458 } 3459 3460 $this->setopt($options); 3461 3462 // Reset before set options. 3463 curl_setopt($curl, CURLOPT_HEADERFUNCTION, array(&$this,'formatHeader')); 3464 3465 // Setting the User-Agent based on options provided. 3466 $useragent = ''; 3467 3468 if (!empty($options['CURLOPT_USERAGENT'])) { 3469 $useragent = $options['CURLOPT_USERAGENT']; 3470 } else if (!empty($this->options['CURLOPT_USERAGENT'])) { 3471 $useragent = $this->options['CURLOPT_USERAGENT']; 3472 } else { 3473 $useragent = \core_useragent::get_moodlebot_useragent(); 3474 } 3475 3476 // Set headers. 3477 if (empty($this->header)) { 3478 $this->setHeader(array( 3479 'User-Agent: ' . $useragent, 3480 'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7', 3481 'Connection: keep-alive' 3482 )); 3483 } else if (!in_array('User-Agent: ' . $useragent, $this->header)) { 3484 // Remove old User-Agent if one existed. 3485 // We have to partial search since we don't know what the original User-Agent is. 3486 if ($match = preg_grep('/User-Agent.*/', $this->header)) { 3487 $key = array_keys($match)[0]; 3488 unset($this->header[$key]); 3489 } 3490 $this->setHeader(array('User-Agent: ' . $useragent)); 3491 } 3492 curl_setopt($curl, CURLOPT_HTTPHEADER, $this->header); 3493 3494 if ($this->debug) { 3495 echo '<h1>Options</h1>'; 3496 var_dump($this->options); 3497 echo '<h1>Header</h1>'; 3498 var_dump($this->header); 3499 } 3500 3501 // Do not allow infinite redirects. 3502 if (!isset($this->options['CURLOPT_MAXREDIRS'])) { 3503 $this->options['CURLOPT_MAXREDIRS'] = 0; 3504 } else if ($this->options['CURLOPT_MAXREDIRS'] > 100) { 3505 $this->options['CURLOPT_MAXREDIRS'] = 100; 3506 } else { 3507 $this->options['CURLOPT_MAXREDIRS'] = (int)$this->options['CURLOPT_MAXREDIRS']; 3508 } 3509 3510 // Make sure we always know if redirects expected. 3511 if (!isset($this->options['CURLOPT_FOLLOWLOCATION'])) { 3512 $this->options['CURLOPT_FOLLOWLOCATION'] = 0; 3513 } 3514 3515 // Limit the protocols to HTTP and HTTPS. 3516 if (defined('CURLOPT_PROTOCOLS')) { 3517 $this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS); 3518 $this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS); 3519 } 3520 3521 // Set options. 3522 foreach($this->options as $name => $val) { 3523 if ($name === 'CURLOPT_FOLLOWLOCATION') { 3524 // All the redirects are emulated at PHP level. 3525 curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 0); 3526 continue; 3527 } 3528 $name = constant($name); 3529 curl_setopt($curl, $name, $val); 3530 } 3531 3532 return $curl; 3533 } 3534 3535 /** 3536 * Download multiple files in parallel 3537 * 3538 * Calls {@link multi()} with specific download headers 3539 * 3540 * <code> 3541 * $c = new curl(); 3542 * $file1 = fopen('a', 'wb'); 3543 * $file2 = fopen('b', 'wb'); 3544 * $c->download(array( 3545 * array('url'=>'http://localhost/', 'file'=>$file1), 3546 * array('url'=>'http://localhost/20/', 'file'=>$file2) 3547 * )); 3548 * fclose($file1); 3549 * fclose($file2); 3550 * </code> 3551 * 3552 * or 3553 * 3554 * <code> 3555 * $c = new curl(); 3556 * $c->download(array( 3557 * array('url'=>'http://localhost/', 'filepath'=>'/tmp/file1.tmp'), 3558 * array('url'=>'http://localhost/20/', 'filepath'=>'/tmp/file2.tmp') 3559 * )); 3560 * </code> 3561 * 3562 * @param array $requests An array of files to request { 3563 * url => url to download the file [required] 3564 * file => file handler, or 3565 * filepath => file path 3566 * } 3567 * If 'file' and 'filepath' parameters are both specified in one request, the 3568 * open file handle in the 'file' parameter will take precedence and 'filepath' 3569 * will be ignored. 3570 * 3571 * @param array $options An array of options to set 3572 * @return array An array of results 3573 */ 3574 public function download($requests, $options = array()) { 3575 $options['RETURNTRANSFER'] = false; 3576 return $this->multi($requests, $options); 3577 } 3578 3579 /** 3580 * Returns the current curl security helper. 3581 * 3582 * @return \core\files\curl_security_helper instance. 3583 */ 3584 public function get_security() { 3585 return $this->securityhelper; 3586 } 3587 3588 /** 3589 * Sets the curl security helper. 3590 * 3591 * @param \core\files\curl_security_helper $securityobject instance/subclass of the base curl_security_helper class. 3592 * @return bool true if the security helper could be set, false otherwise. 3593 */ 3594 public function set_security($securityobject) { 3595 if ($securityobject instanceof \core\files\curl_security_helper) { 3596 $this->securityhelper = $securityobject; 3597 return true; 3598 } 3599 return false; 3600 } 3601 3602 /** 3603 * Multi HTTP Requests 3604 * This function could run multi-requests in parallel. 3605 * 3606 * @param array $requests An array of files to request 3607 * @param array $options An array of options to set 3608 * @return array An array of results 3609 */ 3610 protected function multi($requests, $options = array()) { 3611 $count = count($requests); 3612 $handles = array(); 3613 $results = array(); 3614 $main = curl_multi_init(); 3615 for ($i = 0; $i < $count; $i++) { 3616 if (!empty($requests[$i]['filepath']) and empty($requests[$i]['file'])) { 3617 // open file 3618 $requests[$i]['file'] = fopen($requests[$i]['filepath'], 'w'); 3619 $requests[$i]['auto-handle'] = true; 3620 } 3621 foreach($requests[$i] as $n=>$v) { 3622 $options[$n] = $v; 3623 } 3624 $handles[$i] = curl_init($requests[$i]['url']); 3625 $this->apply_opt($handles[$i], $options); 3626 curl_multi_add_handle($main, $handles[$i]); 3627 } 3628 $running = 0; 3629 do { 3630 curl_multi_exec($main, $running); 3631 } while($running > 0); 3632 for ($i = 0; $i < $count; $i++) { 3633 if (!empty($options['CURLOPT_RETURNTRANSFER'])) { 3634 $results[] = true; 3635 } else { 3636 $results[] = curl_multi_getcontent($handles[$i]); 3637 } 3638 curl_multi_remove_handle($main, $handles[$i]); 3639 } 3640 curl_multi_close($main); 3641 3642 for ($i = 0; $i < $count; $i++) { 3643 if (!empty($requests[$i]['filepath']) and !empty($requests[$i]['auto-handle'])) { 3644 // close file handler if file is opened in this function 3645 fclose($requests[$i]['file']); 3646 } 3647 } 3648 return $results; 3649 } 3650 3651 /** 3652 * Helper function to reset the request state vars. 3653 * 3654 * @return void. 3655 */ 3656 protected function reset_request_state_vars() { 3657 $this->info = array(); 3658 $this->error = ''; 3659 $this->errno = 0; 3660 $this->response = array(); 3661 $this->rawresponse = array(); 3662 $this->responsefinished = false; 3663 } 3664 3665 /** 3666 * For use only in unit tests - we can pre-set the next curl response. 3667 * This is useful for unit testing APIs that call external systems. 3668 * @param string $response 3669 */ 3670 public static function mock_response($response) { 3671 if ((defined('PHPUNIT_TEST') && PHPUNIT_TEST)) { 3672 array_push(self::$mockresponses, $response); 3673 } else { 3674 throw new coding_exception('mock_response function is only available for unit tests.'); 3675 } 3676 } 3677 3678 /** 3679 * check_securityhelper_blocklist. 3680 * Checks whether the given URL is blocked by checking both plugin's security helpers 3681 * and core curl security helper or any curl security helper that passed to curl class constructor. 3682 * If ignoresecurity is set to true, skip checking and consider the url is not blocked. 3683 * This augments all installed plugin's security helpers if there is any. 3684 * 3685 * @param string $url the url to check. 3686 * @return string - an error message if URL is blocked or null if URL is not blocked. 3687 */ 3688 protected function check_securityhelper_blocklist(string $url): ?string { 3689 3690 // If curl security is not enabled, do not proceed. 3691 if ($this->ignoresecurity) { 3692 return null; 3693 } 3694 3695 // Augment all installed plugin's security helpers if there is any. 3696 // The plugin's function has to be defined as plugintype_pluginname_curl_security_helper in pluginname/lib.php. 3697 $plugintypes = get_plugins_with_function('curl_security_helper'); 3698 3699 // If any of the security helper's function returns true, treat as URL is blocked. 3700 foreach ($plugintypes as $plugins) { 3701 foreach ($plugins as $pluginfunction) { 3702 // Get curl security helper object from plugin lib.php. 3703 $pluginsecurityhelper = $pluginfunction(); 3704 if ($pluginsecurityhelper instanceof \core\files\curl_security_helper_base) { 3705 if ($pluginsecurityhelper->url_is_blocked($url)) { 3706 $this->error = $pluginsecurityhelper->get_blocked_url_string(); 3707 return $this->error; 3708 } 3709 } 3710 } 3711 } 3712 3713 // Check if the URL is blocked in core curl_security_helper or 3714 // curl security helper that passed to curl class constructor. 3715 if ($this->securityhelper->url_is_blocked($url)) { 3716 $this->error = $this->securityhelper->get_blocked_url_string(); 3717 return $this->error; 3718 } 3719 3720 return null; 3721 } 3722 3723 /** 3724 * Single HTTP Request 3725 * 3726 * @param string $url The URL to request 3727 * @param array $options 3728 * @return bool 3729 */ 3730 protected function request($url, $options = array()) { 3731 // Reset here so that the data is valid when result returned from cache, or if we return due to a blocked URL hit. 3732 $this->reset_request_state_vars(); 3733 3734 if ((defined('PHPUNIT_TEST') && PHPUNIT_TEST)) { 3735 $mockresponse = array_pop(self::$mockresponses); 3736 if ($mockresponse !== null) { 3737 $this->info = [ 'http_code' => 200 ]; 3738 return $mockresponse; 3739 } 3740 } 3741 3742 if (empty($this->emulateredirects)) { 3743 // Just in case someone had tried to explicitly disable emulated redirects in legacy code. 3744 debugging('Attempting to disable emulated redirects has no effect any more!', DEBUG_DEVELOPER); 3745 } 3746 3747 $urlisblocked = $this->check_securityhelper_blocklist($url); 3748 if (!is_null($urlisblocked)) { 3749 return $urlisblocked; 3750 } 3751 3752 // Set the URL as a curl option. 3753 $this->setopt(array('CURLOPT_URL' => $url)); 3754 3755 // Create curl instance. 3756 $curl = curl_init(); 3757 3758 $this->apply_opt($curl, $options); 3759 if ($this->cache && $ret = $this->cache->get($this->options)) { 3760 return $ret; 3761 } 3762 3763 $ret = curl_exec($curl); 3764 $this->info = curl_getinfo($curl); 3765 $this->error = curl_error($curl); 3766 $this->errno = curl_errno($curl); 3767 // Note: $this->response and $this->rawresponse are filled by $hits->formatHeader callback. 3768 3769 if (intval($this->info['redirect_count']) > 0) { 3770 // For security reasons we do not allow the cURL handle to follow redirects on its own. 3771 // See setting CURLOPT_FOLLOWLOCATION in {@see self::apply_opt()} method. 3772 throw new coding_exception('Internal cURL handle should never follow redirects on its own!', 3773 'Reported number of redirects: ' . $this->info['redirect_count']); 3774 } 3775 3776 if ($this->options['CURLOPT_FOLLOWLOCATION'] && $this->info['http_code'] != 200) { 3777 $redirects = 0; 3778 3779 while($redirects <= $this->options['CURLOPT_MAXREDIRS']) { 3780 3781 if ($this->info['http_code'] == 301) { 3782 // Moved Permanently - repeat the same request on new URL. 3783 3784 } else if ($this->info['http_code'] == 302) { 3785 // Found - the standard redirect - repeat the same request on new URL. 3786 3787 } else if ($this->info['http_code'] == 303) { 3788 // 303 See Other - repeat only if GET, do not bother with POSTs. 3789 if (empty($this->options['CURLOPT_HTTPGET'])) { 3790 break; 3791 } 3792 3793 } else if ($this->info['http_code'] == 307) { 3794 // Temporary Redirect - must repeat using the same request type. 3795 3796 } else if ($this->info['http_code'] == 308) { 3797 // Permanent Redirect - must repeat using the same request type. 3798 3799 } else { 3800 // Some other http code means do not retry! 3801 break; 3802 } 3803 3804 $redirects++; 3805 3806 $redirecturl = null; 3807 if (isset($this->info['redirect_url'])) { 3808 if (preg_match('|^https?://|i', $this->info['redirect_url'])) { 3809 $redirecturl = $this->info['redirect_url']; 3810 } else { 3811 // Emulate CURLOPT_REDIR_PROTOCOLS behaviour which we have set to (CURLPROTO_HTTP | CURLPROTO_HTTPS) only. 3812 $this->errno = CURLE_UNSUPPORTED_PROTOCOL; 3813 $this->error = 'Redirect to a URL with unsuported protocol: ' . $this->info['redirect_url']; 3814 curl_close($curl); 3815 return $this->error; 3816 } 3817 } 3818 if (!$redirecturl) { 3819 foreach ($this->response as $k => $v) { 3820 if (strtolower($k) === 'location') { 3821 $redirecturl = $v; 3822 break; 3823 } 3824 } 3825 if (preg_match('|^https?://|i', $redirecturl)) { 3826 // Great, this is the correct location format! 3827 3828 } else if ($redirecturl) { 3829 $current = curl_getinfo($curl, CURLINFO_EFFECTIVE_URL); 3830 if (strpos($redirecturl, '/') === 0) { 3831 // Relative to server root - just guess. 3832 $pos = strpos('/', $current, 8); 3833 if ($pos === false) { 3834 $redirecturl = $current.$redirecturl; 3835 } else { 3836 $redirecturl = substr($current, 0, $pos).$redirecturl; 3837 } 3838 } else { 3839 // Relative to current script. 3840 $redirecturl = dirname($current).'/'.$redirecturl; 3841 } 3842 } 3843 } 3844 3845 $urlisblocked = $this->check_securityhelper_blocklist($redirecturl); 3846 if (!is_null($urlisblocked)) { 3847 $this->reset_request_state_vars(); 3848 curl_close($curl); 3849 return $urlisblocked; 3850 } 3851 3852 // If the response body is written to a seekable stream resource, reset the stream pointer to avoid 3853 // appending multiple response bodies to the same resource. 3854 if (!empty($this->options['CURLOPT_FILE'])) { 3855 $streammetadata = stream_get_meta_data($this->options['CURLOPT_FILE']); 3856 if ($streammetadata['seekable']) { 3857 ftruncate($this->options['CURLOPT_FILE'], 0); 3858 rewind($this->options['CURLOPT_FILE']); 3859 } 3860 } 3861 3862 curl_setopt($curl, CURLOPT_URL, $redirecturl); 3863 $ret = curl_exec($curl); 3864 3865 $this->info = curl_getinfo($curl); 3866 $this->error = curl_error($curl); 3867 $this->errno = curl_errno($curl); 3868 3869 $this->info['redirect_count'] = $redirects; 3870 3871 if ($this->info['http_code'] === 200) { 3872 // Finally this is what we wanted. 3873 break; 3874 } 3875 if ($this->errno != CURLE_OK) { 3876 // Something wrong is going on. 3877 break; 3878 } 3879 } 3880 if ($redirects > $this->options['CURLOPT_MAXREDIRS']) { 3881 $this->errno = CURLE_TOO_MANY_REDIRECTS; 3882 $this->error = 'Maximum ('.$this->options['CURLOPT_MAXREDIRS'].') redirects followed'; 3883 } 3884 } 3885 3886 if ($this->cache) { 3887 $this->cache->set($this->options, $ret); 3888 } 3889 3890 if ($this->debug) { 3891 echo '<h1>Return Data</h1>'; 3892 var_dump($ret); 3893 echo '<h1>Info</h1>'; 3894 var_dump($this->info); 3895 echo '<h1>Error</h1>'; 3896 var_dump($this->error); 3897 } 3898 3899 curl_close($curl); 3900 3901 if (empty($this->error)) { 3902 return $ret; 3903 } else { 3904 return $this->error; 3905 // exception is not ajax friendly 3906 //throw new moodle_exception($this->error, 'curl'); 3907 } 3908 } 3909 3910 /** 3911 * HTTP HEAD method 3912 * 3913 * @see request() 3914 * 3915 * @param string $url 3916 * @param array $options 3917 * @return bool 3918 */ 3919 public function head($url, $options = array()) { 3920 $options['CURLOPT_HTTPGET'] = 0; 3921 $options['CURLOPT_HEADER'] = 1; 3922 $options['CURLOPT_NOBODY'] = 1; 3923 return $this->request($url, $options); 3924 } 3925 3926 /** 3927 * HTTP PATCH method 3928 * 3929 * @param string $url 3930 * @param array|string $params 3931 * @param array $options 3932 * @return bool 3933 */ 3934 public function patch($url, $params = '', $options = array()) { 3935 $options['CURLOPT_CUSTOMREQUEST'] = 'PATCH'; 3936 if (is_array($params)) { 3937 $this->_tmp_file_post_params = array(); 3938 foreach ($params as $key => $value) { 3939 if ($value instanceof stored_file) { 3940 $value->add_to_curl_request($this, $key); 3941 } else { 3942 $this->_tmp_file_post_params[$key] = $value; 3943 } 3944 } 3945 $options['CURLOPT_POSTFIELDS'] = $this->_tmp_file_post_params; 3946 unset($this->_tmp_file_post_params); 3947 } else { 3948 // The variable $params is the raw post data. 3949 $options['CURLOPT_POSTFIELDS'] = $params; 3950 } 3951 return $this->request($url, $options); 3952 } 3953 3954 /** 3955 * HTTP POST method 3956 * 3957 * @param string $url 3958 * @param array|string $params 3959 * @param array $options 3960 * @return bool 3961 */ 3962 public function post($url, $params = '', $options = array()) { 3963 $options['CURLOPT_POST'] = 1; 3964 if (is_array($params)) { 3965 $this->_tmp_file_post_params = array(); 3966 foreach ($params as $key => $value) { 3967 if ($value instanceof stored_file) { 3968 $value->add_to_curl_request($this, $key); 3969 } else { 3970 $this->_tmp_file_post_params[$key] = $value; 3971 } 3972 } 3973 $options['CURLOPT_POSTFIELDS'] = $this->_tmp_file_post_params; 3974 unset($this->_tmp_file_post_params); 3975 } else { 3976 // $params is the raw post data 3977 $options['CURLOPT_POSTFIELDS'] = $params; 3978 } 3979 return $this->request($url, $options); 3980 } 3981 3982 /** 3983 * HTTP GET method 3984 * 3985 * @param string $url 3986 * @param array $params 3987 * @param array $options 3988 * @return bool 3989 */ 3990 public function get($url, $params = array(), $options = array()) { 3991 $options['CURLOPT_HTTPGET'] = 1; 3992 3993 if (!empty($params)) { 3994 $url .= (stripos($url, '?') !== false) ? '&' : '?'; 3995 $url .= http_build_query($params, '', '&'); 3996 } 3997 return $this->request($url, $options); 3998 } 3999 4000 /** 4001 * Downloads one file and writes it to the specified file handler 4002 * 4003 * <code> 4004 * $c = new curl(); 4005 * $file = fopen('savepath', 'w'); 4006 * $result = $c->download_one('http://localhost/', null, 4007 * array('file' => $file, 'timeout' => 5, 'followlocation' => true, 'maxredirs' => 3)); 4008 * fclose($file); 4009 * $download_info = $c->get_info(); 4010 * if ($result === true) { 4011 * // file downloaded successfully 4012 * } else { 4013 * $error_text = $result; 4014 * $error_code = $c->get_errno(); 4015 * } 4016 * </code> 4017 * 4018 * <code> 4019 * $c = new curl(); 4020 * $result = $c->download_one('http://localhost/', null, 4021 * array('filepath' => 'savepath', 'timeout' => 5, 'followlocation' => true, 'maxredirs' => 3)); 4022 * // ... see above, no need to close handle and remove file if unsuccessful 4023 * </code> 4024 * 4025 * @param string $url 4026 * @param array|null $params key-value pairs to be added to $url as query string 4027 * @param array $options request options. Must include either 'file' or 'filepath' 4028 * @return bool|string true on success or error string on failure 4029 */ 4030 public function download_one($url, $params, $options = array()) { 4031 $options['CURLOPT_HTTPGET'] = 1; 4032 if (!empty($params)) { 4033 $url .= (stripos($url, '?') !== false) ? '&' : '?'; 4034 $url .= http_build_query($params, '', '&'); 4035 } 4036 if (!empty($options['filepath']) && empty($options['file'])) { 4037 // open file 4038 if (!($options['file'] = fopen($options['filepath'], 'w'))) { 4039 $this->errno = 100; 4040 return get_string('cannotwritefile', 'error', $options['filepath']); 4041 } 4042 $filepath = $options['filepath']; 4043 } 4044 unset($options['filepath']); 4045 $result = $this->request($url, $options); 4046 if (isset($filepath)) { 4047 fclose($options['file']); 4048 if ($result !== true) { 4049 unlink($filepath); 4050 } 4051 } 4052 return $result; 4053 } 4054 4055 /** 4056 * HTTP PUT method 4057 * 4058 * @param string $url 4059 * @param array $params 4060 * @param array $options 4061 * @return bool 4062 */ 4063 public function put($url, $params = array(), $options = array()) { 4064 $file = ''; 4065 $fp = false; 4066 if (isset($params['file'])) { 4067 $file = $params['file']; 4068 if (is_file($file)) { 4069 $fp = fopen($file, 'r'); 4070 $size = filesize($file); 4071 $options['CURLOPT_PUT'] = 1; 4072 $options['CURLOPT_INFILESIZE'] = $size; 4073 $options['CURLOPT_INFILE'] = $fp; 4074 } else { 4075 return null; 4076 } 4077 if (!isset($this->options['CURLOPT_USERPWD'])) { 4078 $this->setopt(array('CURLOPT_USERPWD' => 'anonymous: noreply@moodle.org')); 4079 } 4080 } else { 4081 $options['CURLOPT_CUSTOMREQUEST'] = 'PUT'; 4082 $options['CURLOPT_POSTFIELDS'] = $params; 4083 } 4084 4085 $ret = $this->request($url, $options); 4086 if ($fp !== false) { 4087 fclose($fp); 4088 } 4089 return $ret; 4090 } 4091 4092 /** 4093 * HTTP DELETE method 4094 * 4095 * @param string $url 4096 * @param array $param 4097 * @param array $options 4098 * @return bool 4099 */ 4100 public function delete($url, $param = array(), $options = array()) { 4101 $options['CURLOPT_CUSTOMREQUEST'] = 'DELETE'; 4102 if (!isset($options['CURLOPT_USERPWD'])) { 4103 $options['CURLOPT_USERPWD'] = 'anonymous: noreply@moodle.org'; 4104 } 4105 $ret = $this->request($url, $options); 4106 return $ret; 4107 } 4108 4109 /** 4110 * HTTP TRACE method 4111 * 4112 * @param string $url 4113 * @param array $options 4114 * @return bool 4115 */ 4116 public function trace($url, $options = array()) { 4117 $options['CURLOPT_CUSTOMREQUEST'] = 'TRACE'; 4118 $ret = $this->request($url, $options); 4119 return $ret; 4120 } 4121 4122 /** 4123 * HTTP OPTIONS method 4124 * 4125 * @param string $url 4126 * @param array $options 4127 * @return bool 4128 */ 4129 public function options($url, $options = array()) { 4130 $options['CURLOPT_CUSTOMREQUEST'] = 'OPTIONS'; 4131 $ret = $this->request($url, $options); 4132 return $ret; 4133 } 4134 4135 /** 4136 * Get curl information 4137 * 4138 * @return string 4139 */ 4140 public function get_info() { 4141 return $this->info; 4142 } 4143 4144 /** 4145 * Get curl error code 4146 * 4147 * @return int 4148 */ 4149 public function get_errno() { 4150 return $this->errno; 4151 } 4152 4153 /** 4154 * When using a proxy, an additional HTTP response code may appear at 4155 * the start of the header. For example, when using https over a proxy 4156 * there may be 'HTTP/1.0 200 Connection Established'. Other codes are 4157 * also possible and some may come with their own headers. 4158 * 4159 * If using the return value containing all headers, this function can be 4160 * called to remove unwanted doubles. 4161 * 4162 * Note that it is not possible to distinguish this situation from valid 4163 * data unless you know the actual response part (below the headers) 4164 * will not be included in this string, or else will not 'look like' HTTP 4165 * headers. As a result it is not safe to call this function for general 4166 * data. 4167 * 4168 * @param string $input Input HTTP response 4169 * @return string HTTP response with additional headers stripped if any 4170 */ 4171 public static function strip_double_headers($input) { 4172 // I have tried to make this regular expression as specific as possible 4173 // to avoid any case where it does weird stuff if you happen to put 4174 // HTTP/1.1 200 at the start of any line in your RSS file. This should 4175 // also make it faster because it can abandon regex processing as soon 4176 // as it hits something that doesn't look like an http header. The 4177 // header definition is taken from RFC 822, except I didn't support 4178 // folding which is never used in practice. 4179 $crlf = "\r\n"; 4180 return preg_replace( 4181 // HTTP version and status code (ignore value of code). 4182 '~^HTTP/[1-9](\.[0-9])?.*' . $crlf . 4183 // Header name: character between 33 and 126 decimal, except colon. 4184 // Colon. Header value: any character except \r and \n. CRLF. 4185 '(?:[\x21-\x39\x3b-\x7e]+:[^' . $crlf . ']+' . $crlf . ')*' . 4186 // Headers are terminated by another CRLF (blank line). 4187 $crlf . 4188 // Second HTTP status code, this time must be 200. 4189 '(HTTP/[1-9](\.[0-9])? 200)~', '$2', $input); 4190 } 4191 } 4192 4193 /** 4194 * This class is used by cURL class, use case: 4195 * 4196 * <code> 4197 * $CFG->repositorycacheexpire = 120; 4198 * $CFG->curlcache = 120; 4199 * 4200 * $c = new curl(array('cache'=>true), 'module_cache'=>'repository'); 4201 * $ret = $c->get('http://www.google.com'); 4202 * </code> 4203 * 4204 * @package core_files 4205 * @copyright Dongsheng Cai <dongsheng@moodle.com> 4206 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later 4207 */ 4208 class curl_cache { 4209 /** @var string Path to cache directory */ 4210 public $dir = ''; 4211 4212 /** 4213 * Constructor 4214 * 4215 * @global stdClass $CFG 4216 * @param string $module which module is using curl_cache 4217 */ 4218 public function __construct($module = 'repository') { 4219 global $CFG; 4220 if (!empty($module)) { 4221 $this->dir = $CFG->cachedir.'/'.$module.'/'; 4222 } else { 4223 $this->dir = $CFG->cachedir.'/misc/'; 4224 } 4225 if (!file_exists($this->dir)) { 4226 mkdir($this->dir, $CFG->directorypermissions, true); 4227 } 4228 if ($module == 'repository') { 4229 if (empty($CFG->repositorycacheexpire)) { 4230 $CFG->repositorycacheexpire = 120; 4231 } 4232 $this->ttl = $CFG->repositorycacheexpire; 4233 } else { 4234 if (empty($CFG->curlcache)) { 4235 $CFG->curlcache = 120; 4236 } 4237 $this->ttl = $CFG->curlcache; 4238 } 4239 } 4240 4241 /** 4242 * Get cached value 4243 * 4244 * @global stdClass $CFG 4245 * @global stdClass $USER 4246 * @param mixed $param 4247 * @return bool|string 4248 */ 4249 public function get($param) { 4250 global $CFG, $USER; 4251 $this->cleanup($this->ttl); 4252 $filename = 'u'.$USER->id.'_'.md5(serialize($param)); 4253 if(file_exists($this->dir.$filename)) { 4254 $lasttime = filemtime($this->dir.$filename); 4255 if (time()-$lasttime > $this->ttl) { 4256 return false; 4257 } else { 4258 $fp = fopen($this->dir.$filename, 'r'); 4259 $size = filesize($this->dir.$filename); 4260 $content = fread($fp, $size); 4261 return unserialize($content); 4262 } 4263 } 4264 return false; 4265 } 4266 4267 /** 4268 * Set cache value 4269 * 4270 * @global object $CFG 4271 * @global object $USER 4272 * @param mixed $param 4273 * @param mixed $val 4274 */ 4275 public function set($param, $val) { 4276 global $CFG, $USER; 4277 $filename = 'u'.$USER->id.'_'.md5(serialize($param)); 4278 $fp = fopen($this->dir.$filename, 'w'); 4279 fwrite($fp, serialize($val)); 4280 fclose($fp); 4281 @chmod($this->dir.$filename, $CFG->filepermissions); 4282 } 4283 4284 /** 4285 * Remove cache files 4286 * 4287 * @param int $expire The number of seconds before expiry 4288 */ 4289 public function cleanup($expire) { 4290 if ($dir = opendir($this->dir)) { 4291 while (false !== ($file = readdir($dir))) { 4292 if(!is_dir($file) && $file != '.' && $file != '..') { 4293 $lasttime = @filemtime($this->dir.$file); 4294 if (time() - $lasttime > $expire) { 4295 @unlink($this->dir.$file); 4296 } 4297 } 4298 } 4299 closedir($dir); 4300 } 4301 } 4302 /** 4303 * delete current user's cache file 4304 * 4305 * @global object $CFG 4306 * @global object $USER 4307 */ 4308 public function refresh() { 4309 global $CFG, $USER; 4310 if ($dir = opendir($this->dir)) { 4311 while (false !== ($file = readdir($dir))) { 4312 if (!is_dir($file) && $file != '.' && $file != '..') { 4313 if (strpos($file, 'u'.$USER->id.'_') !== false) { 4314 @unlink($this->dir.$file); 4315 } 4316 } 4317 } 4318 } 4319 } 4320 } 4321 4322 /** 4323 * This function delegates file serving to individual plugins 4324 * 4325 * @param string $relativepath 4326 * @param bool $forcedownload 4327 * @param null|string $preview the preview mode, defaults to serving the original file 4328 * @param boolean $offline If offline is requested - don't serve a redirect to an external file, return a file suitable for viewing 4329 * offline (e.g. mobile app). 4330 * @param bool $embed Whether this file will be served embed into an iframe. 4331 * @todo MDL-31088 file serving improments 4332 */ 4333 function file_pluginfile($relativepath, $forcedownload, $preview = null, $offline = false, $embed = false) { 4334 global $DB, $CFG, $USER; 4335 // relative path must start with '/' 4336 if (!$relativepath) { 4337 print_error('invalidargorconf'); 4338 } else if ($relativepath[0] != '/') { 4339 print_error('pathdoesnotstartslash'); 4340 } 4341 4342 // extract relative path components 4343 $args = explode('/', ltrim($relativepath, '/')); 4344 4345 if (count($args) < 3) { // always at least context, component and filearea 4346 print_error('invalidarguments'); 4347 } 4348 4349 $contextid = (int)array_shift($args); 4350 $component = clean_param(array_shift($args), PARAM_COMPONENT); 4351 $filearea = clean_param(array_shift($args), PARAM_AREA); 4352 4353 list($context, $course, $cm) = get_context_info_array($contextid); 4354 4355 $fs = get_file_storage(); 4356 4357 $sendfileoptions = ['preview' => $preview, 'offline' => $offline, 'embed' => $embed]; 4358 4359 // ======================================================================================================================== 4360 if ($component === 'blog') { 4361 // Blog file serving 4362 if ($context->contextlevel != CONTEXT_SYSTEM) { 4363 send_file_not_found(); 4364 } 4365 if ($filearea !== 'attachment' and $filearea !== 'post') { 4366 send_file_not_found(); 4367 } 4368 4369 if (empty($CFG->enableblogs)) { 4370 print_error('siteblogdisable', 'blog'); 4371 } 4372 4373 $entryid = (int)array_shift($args); 4374 if (!$entry = $DB->get_record('post', array('module'=>'blog', 'id'=>$entryid))) { 4375 send_file_not_found(); 4376 } 4377 if ($CFG->bloglevel < BLOG_GLOBAL_LEVEL) { 4378 require_login(); 4379 if (isguestuser()) { 4380 print_error('noguest'); 4381 } 4382 if ($CFG->bloglevel == BLOG_USER_LEVEL) { 4383 if ($USER->id != $entry->userid) { 4384 send_file_not_found(); 4385 } 4386 } 4387 } 4388 4389 if ($entry->publishstate === 'public') { 4390 if ($CFG->forcelogin) { 4391 require_login(); 4392 } 4393 4394 } else if ($entry->publishstate === 'site') { 4395 require_login(); 4396 //ok 4397 } else if ($entry->publishstate === 'draft') { 4398 require_login(); 4399 if ($USER->id != $entry->userid) { 4400 send_file_not_found(); 4401 } 4402 } 4403 4404 $filename = array_pop($args); 4405 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4406 4407 if (!$file = $fs->get_file($context->id, $component, $filearea, $entryid, $filepath, $filename) or $file->is_directory()) { 4408 send_file_not_found(); 4409 } 4410 4411 send_stored_file($file, 10*60, 0, true, $sendfileoptions); // download MUST be forced - security! 4412 4413 // ======================================================================================================================== 4414 } else if ($component === 'grade') { 4415 4416 require_once($CFG->libdir . '/grade/constants.php'); 4417 4418 if (($filearea === 'outcome' or $filearea === 'scale') and $context->contextlevel == CONTEXT_SYSTEM) { 4419 // Global gradebook files 4420 if ($CFG->forcelogin) { 4421 require_login(); 4422 } 4423 4424 $fullpath = "/$context->id/$component/$filearea/".implode('/', $args); 4425 4426 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 4427 send_file_not_found(); 4428 } 4429 4430 \core\session\manager::write_close(); // Unlock session during file serving. 4431 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4432 4433 } else if ($filearea == GRADE_FEEDBACK_FILEAREA || $filearea == GRADE_HISTORY_FEEDBACK_FILEAREA) { 4434 if ($context->contextlevel != CONTEXT_MODULE) { 4435 send_file_not_found(); 4436 } 4437 4438 require_login($course, false); 4439 4440 $gradeid = (int) array_shift($args); 4441 $filename = array_pop($args); 4442 if ($filearea == GRADE_HISTORY_FEEDBACK_FILEAREA) { 4443 $grade = $DB->get_record('grade_grades_history', ['id' => $gradeid]); 4444 } else { 4445 $grade = $DB->get_record('grade_grades', ['id' => $gradeid]); 4446 } 4447 4448 if (!$grade) { 4449 send_file_not_found(); 4450 } 4451 4452 $iscurrentuser = $USER->id == $grade->userid; 4453 4454 if (!$iscurrentuser) { 4455 $coursecontext = context_course::instance($course->id); 4456 if (!has_capability('moodle/grade:viewall', $coursecontext)) { 4457 send_file_not_found(); 4458 } 4459 } 4460 4461 $fullpath = "/$context->id/$component/$filearea/$gradeid/$filename"; 4462 4463 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 4464 send_file_not_found(); 4465 } 4466 4467 \core\session\manager::write_close(); // Unlock session during file serving. 4468 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4469 } else { 4470 send_file_not_found(); 4471 } 4472 4473 // ======================================================================================================================== 4474 } else if ($component === 'tag') { 4475 if ($filearea === 'description' and $context->contextlevel == CONTEXT_SYSTEM) { 4476 4477 // All tag descriptions are going to be public but we still need to respect forcelogin 4478 if ($CFG->forcelogin) { 4479 require_login(); 4480 } 4481 4482 $fullpath = "/$context->id/tag/description/".implode('/', $args); 4483 4484 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 4485 send_file_not_found(); 4486 } 4487 4488 \core\session\manager::write_close(); // Unlock session during file serving. 4489 send_stored_file($file, 60*60, 0, true, $sendfileoptions); 4490 4491 } else { 4492 send_file_not_found(); 4493 } 4494 // ======================================================================================================================== 4495 } else if ($component === 'badges') { 4496 require_once($CFG->libdir . '/badgeslib.php'); 4497 4498 $badgeid = (int)array_shift($args); 4499 $badge = new badge($badgeid); 4500 $filename = array_pop($args); 4501 4502 if ($filearea === 'badgeimage') { 4503 if ($filename !== 'f1' && $filename !== 'f2' && $filename !== 'f3') { 4504 send_file_not_found(); 4505 } 4506 if (!$file = $fs->get_file($context->id, 'badges', 'badgeimage', $badge->id, '/', $filename.'.png')) { 4507 send_file_not_found(); 4508 } 4509 4510 \core\session\manager::write_close(); 4511 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4512 } else if ($filearea === 'userbadge' and $context->contextlevel == CONTEXT_USER) { 4513 if (!$file = $fs->get_file($context->id, 'badges', 'userbadge', $badge->id, '/', $filename.'.png')) { 4514 send_file_not_found(); 4515 } 4516 4517 \core\session\manager::write_close(); 4518 send_stored_file($file, 60*60, 0, true, $sendfileoptions); 4519 } 4520 // ======================================================================================================================== 4521 } else if ($component === 'calendar') { 4522 if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_SYSTEM) { 4523 4524 // All events here are public the one requirement is that we respect forcelogin 4525 if ($CFG->forcelogin) { 4526 require_login(); 4527 } 4528 4529 // Get the event if from the args array 4530 $eventid = array_shift($args); 4531 4532 // Load the event from the database 4533 if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'eventtype'=>'site'))) { 4534 send_file_not_found(); 4535 } 4536 4537 // Get the file and serve if successful 4538 $filename = array_pop($args); 4539 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4540 if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) { 4541 send_file_not_found(); 4542 } 4543 4544 \core\session\manager::write_close(); // Unlock session during file serving. 4545 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4546 4547 } else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_USER) { 4548 4549 // Must be logged in, if they are not then they obviously can't be this user 4550 require_login(); 4551 4552 // Don't want guests here, potentially saves a DB call 4553 if (isguestuser()) { 4554 send_file_not_found(); 4555 } 4556 4557 // Get the event if from the args array 4558 $eventid = array_shift($args); 4559 4560 // Load the event from the database - user id must match 4561 if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'userid'=>$USER->id, 'eventtype'=>'user'))) { 4562 send_file_not_found(); 4563 } 4564 4565 // Get the file and serve if successful 4566 $filename = array_pop($args); 4567 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4568 if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) { 4569 send_file_not_found(); 4570 } 4571 4572 \core\session\manager::write_close(); // Unlock session during file serving. 4573 send_stored_file($file, 0, 0, true, $sendfileoptions); 4574 4575 } else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_COURSECAT) { 4576 if ($CFG->forcelogin) { 4577 require_login(); 4578 } 4579 4580 // Get category, this will also validate access. 4581 $category = core_course_category::get($context->instanceid); 4582 4583 // Get the event ID from the args array, load event. 4584 $eventid = array_shift($args); 4585 $event = $DB->get_record('event', [ 4586 'id' => (int) $eventid, 4587 'eventtype' => 'category', 4588 'categoryid' => $category->id, 4589 ]); 4590 4591 if (!$event) { 4592 send_file_not_found(); 4593 } 4594 4595 // Retrieve file from storage, and serve. 4596 $filename = array_pop($args); 4597 $filepath = $args ? '/' . implode('/', $args) .'/' : '/'; 4598 $file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename); 4599 if (!$file || $file->is_directory()) { 4600 send_file_not_found(); 4601 } 4602 4603 // Unlock session during file serving. 4604 \core\session\manager::write_close(); 4605 send_stored_file($file, HOURSECS, 0, $forcedownload, $sendfileoptions); 4606 } else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_COURSE) { 4607 4608 // Respect forcelogin and require login unless this is the site.... it probably 4609 // should NEVER be the site 4610 if ($CFG->forcelogin || $course->id != SITEID) { 4611 require_login($course); 4612 } 4613 4614 // Must be able to at least view the course. This does not apply to the front page. 4615 if ($course->id != SITEID && (!is_enrolled($context)) && (!is_viewing($context))) { 4616 //TODO: hmm, do we really want to block guests here? 4617 send_file_not_found(); 4618 } 4619 4620 // Get the event id 4621 $eventid = array_shift($args); 4622 4623 // Load the event from the database we need to check whether it is 4624 // a) valid course event 4625 // b) a group event 4626 // Group events use the course context (there is no group context) 4627 if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'courseid'=>$course->id))) { 4628 send_file_not_found(); 4629 } 4630 4631 // If its a group event require either membership of view all groups capability 4632 if ($event->eventtype === 'group') { 4633 if (!has_capability('moodle/site:accessallgroups', $context) && !groups_is_member($event->groupid, $USER->id)) { 4634 send_file_not_found(); 4635 } 4636 } else if ($event->eventtype === 'course' || $event->eventtype === 'site') { 4637 // Ok. Please note that the event type 'site' still uses a course context. 4638 } else { 4639 // Some other type. 4640 send_file_not_found(); 4641 } 4642 4643 // If we get this far we can serve the file 4644 $filename = array_pop($args); 4645 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4646 if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) { 4647 send_file_not_found(); 4648 } 4649 4650 \core\session\manager::write_close(); // Unlock session during file serving. 4651 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4652 4653 } else { 4654 send_file_not_found(); 4655 } 4656 4657 // ======================================================================================================================== 4658 } else if ($component === 'user') { 4659 if ($filearea === 'icon' and $context->contextlevel == CONTEXT_USER) { 4660 if (count($args) == 1) { 4661 $themename = theme_config::DEFAULT_THEME; 4662 $filename = array_shift($args); 4663 } else { 4664 $themename = array_shift($args); 4665 $filename = array_shift($args); 4666 } 4667 4668 // fix file name automatically 4669 if ($filename !== 'f1' and $filename !== 'f2' and $filename !== 'f3') { 4670 $filename = 'f1'; 4671 } 4672 4673 if ((!empty($CFG->forcelogin) and !isloggedin()) || 4674 (!empty($CFG->forceloginforprofileimage) && (!isloggedin() || isguestuser()))) { 4675 // protect images if login required and not logged in; 4676 // also if login is required for profile images and is not logged in or guest 4677 // do not use require_login() because it is expensive and not suitable here anyway 4678 $theme = theme_config::load($themename); 4679 redirect($theme->image_url('u/'.$filename, 'moodle')); // intentionally not cached 4680 } 4681 4682 if (!$file = $fs->get_file($context->id, 'user', 'icon', 0, '/', $filename.'.png')) { 4683 if (!$file = $fs->get_file($context->id, 'user', 'icon', 0, '/', $filename.'.jpg')) { 4684 if ($filename === 'f3') { 4685 // f3 512x512px was introduced in 2.3, there might be only the smaller version. 4686 if (!$file = $fs->get_file($context->id, 'user', 'icon', 0, '/', 'f1.png')) { 4687 $file = $fs->get_file($context->id, 'user', 'icon', 0, '/', 'f1.jpg'); 4688 } 4689 } 4690 } 4691 } 4692 if (!$file) { 4693 // bad reference - try to prevent future retries as hard as possible! 4694 if ($user = $DB->get_record('user', array('id'=>$context->instanceid), 'id, picture')) { 4695 if ($user->picture > 0) { 4696 $DB->set_field('user', 'picture', 0, array('id'=>$user->id)); 4697 } 4698 } 4699 // no redirect here because it is not cached 4700 $theme = theme_config::load($themename); 4701 $imagefile = $theme->resolve_image_location('u/'.$filename, 'moodle', null); 4702 send_file($imagefile, basename($imagefile), 60*60*24*14); 4703 } 4704 4705 $options = $sendfileoptions; 4706 if (empty($CFG->forcelogin) && empty($CFG->forceloginforprofileimage)) { 4707 // Profile images should be cache-able by both browsers and proxies according 4708 // to $CFG->forcelogin and $CFG->forceloginforprofileimage. 4709 $options['cacheability'] = 'public'; 4710 } 4711 send_stored_file($file, 60*60*24*365, 0, false, $options); // enable long caching, there are many images on each page 4712 4713 } else if ($filearea === 'private' and $context->contextlevel == CONTEXT_USER) { 4714 require_login(); 4715 4716 if (isguestuser()) { 4717 send_file_not_found(); 4718 } 4719 4720 if ($USER->id !== $context->instanceid) { 4721 send_file_not_found(); 4722 } 4723 4724 $filename = array_pop($args); 4725 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4726 if (!$file = $fs->get_file($context->id, $component, $filearea, 0, $filepath, $filename) or $file->is_directory()) { 4727 send_file_not_found(); 4728 } 4729 4730 \core\session\manager::write_close(); // Unlock session during file serving. 4731 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4732 4733 } else if ($filearea === 'profile' and $context->contextlevel == CONTEXT_USER) { 4734 4735 if ($CFG->forcelogin) { 4736 require_login(); 4737 } 4738 4739 $userid = $context->instanceid; 4740 4741 if (!empty($CFG->forceloginforprofiles)) { 4742 require_once("{$CFG->dirroot}/user/lib.php"); 4743 4744 require_login(); 4745 4746 // Verify the current user is able to view the profile of the supplied user anywhere. 4747 $user = core_user::get_user($userid); 4748 if (!user_can_view_profile($user, null, $context)) { 4749 send_file_not_found(); 4750 } 4751 } 4752 4753 $filename = array_pop($args); 4754 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4755 if (!$file = $fs->get_file($context->id, $component, $filearea, 0, $filepath, $filename) or $file->is_directory()) { 4756 send_file_not_found(); 4757 } 4758 4759 \core\session\manager::write_close(); // Unlock session during file serving. 4760 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4761 4762 } else if ($filearea === 'profile' and $context->contextlevel == CONTEXT_COURSE) { 4763 $userid = (int)array_shift($args); 4764 $usercontext = context_user::instance($userid); 4765 4766 if ($CFG->forcelogin) { 4767 require_login(); 4768 } 4769 4770 if (!empty($CFG->forceloginforprofiles)) { 4771 require_once("{$CFG->dirroot}/user/lib.php"); 4772 4773 require_login(); 4774 4775 // Verify the current user is able to view the profile of the supplied user in current course. 4776 $user = core_user::get_user($userid); 4777 if (!user_can_view_profile($user, $course, $usercontext)) { 4778 send_file_not_found(); 4779 } 4780 } 4781 4782 $filename = array_pop($args); 4783 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4784 if (!$file = $fs->get_file($usercontext->id, 'user', 'profile', 0, $filepath, $filename) or $file->is_directory()) { 4785 send_file_not_found(); 4786 } 4787 4788 \core\session\manager::write_close(); // Unlock session during file serving. 4789 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4790 4791 } else if ($filearea === 'backup' and $context->contextlevel == CONTEXT_USER) { 4792 require_login(); 4793 4794 if (isguestuser()) { 4795 send_file_not_found(); 4796 } 4797 $userid = $context->instanceid; 4798 4799 if ($USER->id != $userid) { 4800 send_file_not_found(); 4801 } 4802 4803 $filename = array_pop($args); 4804 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4805 if (!$file = $fs->get_file($context->id, 'user', 'backup', 0, $filepath, $filename) or $file->is_directory()) { 4806 send_file_not_found(); 4807 } 4808 4809 \core\session\manager::write_close(); // Unlock session during file serving. 4810 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4811 4812 } else { 4813 send_file_not_found(); 4814 } 4815 4816 // ======================================================================================================================== 4817 } else if ($component === 'coursecat') { 4818 if ($context->contextlevel != CONTEXT_COURSECAT) { 4819 send_file_not_found(); 4820 } 4821 4822 if ($filearea === 'description') { 4823 if ($CFG->forcelogin) { 4824 // no login necessary - unless login forced everywhere 4825 require_login(); 4826 } 4827 4828 // Check if user can view this category. 4829 if (!core_course_category::get($context->instanceid, IGNORE_MISSING)) { 4830 send_file_not_found(); 4831 } 4832 4833 $filename = array_pop($args); 4834 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4835 if (!$file = $fs->get_file($context->id, 'coursecat', 'description', 0, $filepath, $filename) or $file->is_directory()) { 4836 send_file_not_found(); 4837 } 4838 4839 \core\session\manager::write_close(); // Unlock session during file serving. 4840 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4841 } else { 4842 send_file_not_found(); 4843 } 4844 4845 // ======================================================================================================================== 4846 } else if ($component === 'course') { 4847 if ($context->contextlevel != CONTEXT_COURSE) { 4848 send_file_not_found(); 4849 } 4850 4851 if ($filearea === 'summary' || $filearea === 'overviewfiles') { 4852 if ($CFG->forcelogin) { 4853 require_login(); 4854 } 4855 4856 $filename = array_pop($args); 4857 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4858 if (!$file = $fs->get_file($context->id, 'course', $filearea, 0, $filepath, $filename) or $file->is_directory()) { 4859 send_file_not_found(); 4860 } 4861 4862 \core\session\manager::write_close(); // Unlock session during file serving. 4863 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4864 4865 } else if ($filearea === 'section') { 4866 if ($CFG->forcelogin) { 4867 require_login($course); 4868 } else if ($course->id != SITEID) { 4869 require_login($course); 4870 } 4871 4872 $sectionid = (int)array_shift($args); 4873 4874 if (!$section = $DB->get_record('course_sections', array('id'=>$sectionid, 'course'=>$course->id))) { 4875 send_file_not_found(); 4876 } 4877 4878 $filename = array_pop($args); 4879 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4880 if (!$file = $fs->get_file($context->id, 'course', 'section', $sectionid, $filepath, $filename) or $file->is_directory()) { 4881 send_file_not_found(); 4882 } 4883 4884 \core\session\manager::write_close(); // Unlock session during file serving. 4885 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4886 4887 } else { 4888 send_file_not_found(); 4889 } 4890 4891 } else if ($component === 'cohort') { 4892 4893 $cohortid = (int)array_shift($args); 4894 $cohort = $DB->get_record('cohort', array('id' => $cohortid), '*', MUST_EXIST); 4895 $cohortcontext = context::instance_by_id($cohort->contextid); 4896 4897 // The context in the file URL must be either cohort context or context of the course underneath the cohort's context. 4898 if ($context->id != $cohort->contextid && 4899 ($context->contextlevel != CONTEXT_COURSE || !in_array($cohort->contextid, $context->get_parent_context_ids()))) { 4900 send_file_not_found(); 4901 } 4902 4903 // User is able to access cohort if they have view cap on cohort level or 4904 // the cohort is visible and they have view cap on course level. 4905 $canview = has_capability('moodle/cohort:view', $cohortcontext) || 4906 ($cohort->visible && has_capability('moodle/cohort:view', $context)); 4907 4908 if ($filearea === 'description' && $canview) { 4909 $filename = array_pop($args); 4910 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4911 if (($file = $fs->get_file($cohortcontext->id, 'cohort', 'description', $cohort->id, $filepath, $filename)) 4912 && !$file->is_directory()) { 4913 \core\session\manager::write_close(); // Unlock session during file serving. 4914 send_stored_file($file, 60 * 60, 0, $forcedownload, $sendfileoptions); 4915 } 4916 } 4917 4918 send_file_not_found(); 4919 4920 } else if ($component === 'group') { 4921 if ($context->contextlevel != CONTEXT_COURSE) { 4922 send_file_not_found(); 4923 } 4924 4925 require_course_login($course, true, null, false); 4926 4927 $groupid = (int)array_shift($args); 4928 4929 $group = $DB->get_record('groups', array('id'=>$groupid, 'courseid'=>$course->id), '*', MUST_EXIST); 4930 if (($course->groupmodeforce and $course->groupmode == SEPARATEGROUPS) and !has_capability('moodle/site:accessallgroups', $context) and !groups_is_member($group->id, $USER->id)) { 4931 // do not allow access to separate group info if not member or teacher 4932 send_file_not_found(); 4933 } 4934 4935 if ($filearea === 'description') { 4936 4937 require_login($course); 4938 4939 $filename = array_pop($args); 4940 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4941 if (!$file = $fs->get_file($context->id, 'group', 'description', $group->id, $filepath, $filename) or $file->is_directory()) { 4942 send_file_not_found(); 4943 } 4944 4945 \core\session\manager::write_close(); // Unlock session during file serving. 4946 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4947 4948 } else if ($filearea === 'icon') { 4949 $filename = array_pop($args); 4950 4951 if ($filename !== 'f1' and $filename !== 'f2') { 4952 send_file_not_found(); 4953 } 4954 if (!$file = $fs->get_file($context->id, 'group', 'icon', $group->id, '/', $filename.'.png')) { 4955 if (!$file = $fs->get_file($context->id, 'group', 'icon', $group->id, '/', $filename.'.jpg')) { 4956 send_file_not_found(); 4957 } 4958 } 4959 4960 \core\session\manager::write_close(); // Unlock session during file serving. 4961 send_stored_file($file, 60*60, 0, false, $sendfileoptions); 4962 4963 } else { 4964 send_file_not_found(); 4965 } 4966 4967 } else if ($component === 'grouping') { 4968 if ($context->contextlevel != CONTEXT_COURSE) { 4969 send_file_not_found(); 4970 } 4971 4972 require_login($course); 4973 4974 $groupingid = (int)array_shift($args); 4975 4976 // note: everybody has access to grouping desc images for now 4977 if ($filearea === 'description') { 4978 4979 $filename = array_pop($args); 4980 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4981 if (!$file = $fs->get_file($context->id, 'grouping', 'description', $groupingid, $filepath, $filename) or $file->is_directory()) { 4982 send_file_not_found(); 4983 } 4984 4985 \core\session\manager::write_close(); // Unlock session during file serving. 4986 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4987 4988 } else { 4989 send_file_not_found(); 4990 } 4991 4992 // ======================================================================================================================== 4993 } else if ($component === 'backup') { 4994 if ($filearea === 'course' and $context->contextlevel == CONTEXT_COURSE) { 4995 require_login($course); 4996 require_capability('moodle/backup:downloadfile', $context); 4997 4998 $filename = array_pop($args); 4999 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5000 if (!$file = $fs->get_file($context->id, 'backup', 'course', 0, $filepath, $filename) or $file->is_directory()) { 5001 send_file_not_found(); 5002 } 5003 5004 \core\session\manager::write_close(); // Unlock session during file serving. 5005 send_stored_file($file, 0, 0, $forcedownload, $sendfileoptions); 5006 5007 } else if ($filearea === 'section' and $context->contextlevel == CONTEXT_COURSE) { 5008 require_login($course); 5009 require_capability('moodle/backup:downloadfile', $context); 5010 5011 $sectionid = (int)array_shift($args); 5012 5013 $filename = array_pop($args); 5014 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5015 if (!$file = $fs->get_file($context->id, 'backup', 'section', $sectionid, $filepath, $filename) or $file->is_directory()) { 5016 send_file_not_found(); 5017 } 5018 5019 \core\session\manager::write_close(); 5020 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5021 5022 } else if ($filearea === 'activity' and $context->contextlevel == CONTEXT_MODULE) { 5023 require_login($course, false, $cm); 5024 require_capability('moodle/backup:downloadfile', $context); 5025 5026 $filename = array_pop($args); 5027 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5028 if (!$file = $fs->get_file($context->id, 'backup', 'activity', 0, $filepath, $filename) or $file->is_directory()) { 5029 send_file_not_found(); 5030 } 5031 5032 \core\session\manager::write_close(); 5033 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5034 5035 } else if ($filearea === 'automated' and $context->contextlevel == CONTEXT_COURSE) { 5036 // Backup files that were generated by the automated backup systems. 5037 5038 require_login($course); 5039 require_capability('moodle/backup:downloadfile', $context); 5040 require_capability('moodle/restore:userinfo', $context); 5041 5042 $filename = array_pop($args); 5043 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5044 if (!$file = $fs->get_file($context->id, 'backup', 'automated', 0, $filepath, $filename) or $file->is_directory()) { 5045 send_file_not_found(); 5046 } 5047 5048 \core\session\manager::write_close(); // Unlock session during file serving. 5049 send_stored_file($file, 0, 0, $forcedownload, $sendfileoptions); 5050 5051 } else { 5052 send_file_not_found(); 5053 } 5054 5055 // ======================================================================================================================== 5056 } else if ($component === 'question') { 5057 require_once($CFG->libdir . '/questionlib.php'); 5058 question_pluginfile($course, $context, 'question', $filearea, $args, $forcedownload, $sendfileoptions); 5059 send_file_not_found(); 5060 5061 // ======================================================================================================================== 5062 } else if ($component === 'grading') { 5063 if ($filearea === 'description') { 5064 // files embedded into the form definition description 5065 5066 if ($context->contextlevel == CONTEXT_SYSTEM) { 5067 require_login(); 5068 5069 } else if ($context->contextlevel >= CONTEXT_COURSE) { 5070 require_login($course, false, $cm); 5071 5072 } else { 5073 send_file_not_found(); 5074 } 5075 5076 $formid = (int)array_shift($args); 5077 5078 $sql = "SELECT ga.id 5079 FROM {grading_areas} ga 5080 JOIN {grading_definitions} gd ON (gd.areaid = ga.id) 5081 WHERE gd.id = ? AND ga.contextid = ?"; 5082 $areaid = $DB->get_field_sql($sql, array($formid, $context->id), IGNORE_MISSING); 5083 5084 if (!$areaid) { 5085 send_file_not_found(); 5086 } 5087 5088 $fullpath = "/$context->id/$component/$filearea/$formid/".implode('/', $args); 5089 5090 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 5091 send_file_not_found(); 5092 } 5093 5094 \core\session\manager::write_close(); // Unlock session during file serving. 5095 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5096 } 5097 } else if ($component === 'contentbank') { 5098 if ($filearea != 'public' || isguestuser()) { 5099 send_file_not_found(); 5100 } 5101 5102 if ($context->contextlevel == CONTEXT_SYSTEM || $context->contextlevel == CONTEXT_COURSECAT) { 5103 require_login(); 5104 } else if ($context->contextlevel == CONTEXT_COURSE) { 5105 require_login($course); 5106 } else { 5107 send_file_not_found(); 5108 } 5109 5110 $itemid = (int)array_shift($args); 5111 $filename = array_pop($args); 5112 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5113 if (!$file = $fs->get_file($context->id, $component, $filearea, $itemid, $filepath, $filename) or 5114 $file->is_directory()) { 5115 send_file_not_found(); 5116 } 5117 5118 \core\session\manager::write_close(); // Unlock session during file serving. 5119 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 5120 } else if (strpos($component, 'mod_') === 0) { 5121 $modname = substr($component, 4); 5122 if (!file_exists("$CFG->dirroot/mod/$modname/lib.php")) { 5123 send_file_not_found(); 5124 } 5125 require_once("$CFG->dirroot/mod/$modname/lib.php"); 5126 5127 if ($context->contextlevel == CONTEXT_MODULE) { 5128 if ($cm->modname !== $modname) { 5129 // somebody tries to gain illegal access, cm type must match the component! 5130 send_file_not_found(); 5131 } 5132 } 5133 5134 if ($filearea === 'intro') { 5135 if (!plugin_supports('mod', $modname, FEATURE_MOD_INTRO, true)) { 5136 send_file_not_found(); 5137 } 5138 5139 // Require login to the course first (without login to the module). 5140 require_course_login($course, true); 5141 5142 // Now check if module is available OR it is restricted but the intro is shown on the course page. 5143 $cminfo = cm_info::create($cm); 5144 if (!$cminfo->uservisible) { 5145 if (!$cm->showdescription || !$cminfo->is_visible_on_course_page()) { 5146 // Module intro is not visible on the course page and module is not available, show access error. 5147 require_course_login($course, true, $cminfo); 5148 } 5149 } 5150 5151 // all users may access it 5152 $filename = array_pop($args); 5153 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5154 if (!$file = $fs->get_file($context->id, 'mod_'.$modname, 'intro', 0, $filepath, $filename) or $file->is_directory()) { 5155 send_file_not_found(); 5156 } 5157 5158 // finally send the file 5159 send_stored_file($file, null, 0, false, $sendfileoptions); 5160 } 5161 5162 $filefunction = $component.'_pluginfile'; 5163 $filefunctionold = $modname.'_pluginfile'; 5164 if (function_exists($filefunction)) { 5165 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5166 $filefunction($course, $cm, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5167 } else if (function_exists($filefunctionold)) { 5168 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5169 $filefunctionold($course, $cm, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5170 } 5171 5172 send_file_not_found(); 5173 5174 // ======================================================================================================================== 5175 } else if (strpos($component, 'block_') === 0) { 5176 $blockname = substr($component, 6); 5177 // note: no more class methods in blocks please, that is .... 5178 if (!file_exists("$CFG->dirroot/blocks/$blockname/lib.php")) { 5179 send_file_not_found(); 5180 } 5181 require_once("$CFG->dirroot/blocks/$blockname/lib.php"); 5182 5183 if ($context->contextlevel == CONTEXT_BLOCK) { 5184 $birecord = $DB->get_record('block_instances', array('id'=>$context->instanceid), '*',MUST_EXIST); 5185 if ($birecord->blockname !== $blockname) { 5186 // somebody tries to gain illegal access, cm type must match the component! 5187 send_file_not_found(); 5188 } 5189 5190 if ($context->get_course_context(false)) { 5191 // If block is in course context, then check if user has capability to access course. 5192 require_course_login($course); 5193 } else if ($CFG->forcelogin) { 5194 // If user is logged out, bp record will not be visible, even if the user would have access if logged in. 5195 require_login(); 5196 } 5197 5198 $bprecord = $DB->get_record('block_positions', array('contextid' => $context->id, 'blockinstanceid' => $context->instanceid)); 5199 // User can't access file, if block is hidden or doesn't have block:view capability 5200 if (($bprecord && !$bprecord->visible) || !has_capability('moodle/block:view', $context)) { 5201 send_file_not_found(); 5202 } 5203 } else { 5204 $birecord = null; 5205 } 5206 5207 $filefunction = $component.'_pluginfile'; 5208 if (function_exists($filefunction)) { 5209 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5210 $filefunction($course, $birecord, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5211 } 5212 5213 send_file_not_found(); 5214 5215 // ======================================================================================================================== 5216 } else if (strpos($component, '_') === false) { 5217 // all core subsystems have to be specified above, no more guessing here! 5218 send_file_not_found(); 5219 5220 } else { 5221 // try to serve general plugin file in arbitrary context 5222 $dir = core_component::get_component_directory($component); 5223 if (!file_exists("$dir/lib.php")) { 5224 send_file_not_found(); 5225 } 5226 include_once("$dir/lib.php"); 5227 5228 $filefunction = $component.'_pluginfile'; 5229 if (function_exists($filefunction)) { 5230 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5231 $filefunction($course, $cm, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5232 } 5233 5234 send_file_not_found(); 5235 } 5236 5237 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
