Search moodle.org's
Developer Documentation
Developer Documentation
- Bug fixes for general core bugs in 4.3.x will end 7 October 2024 (12 months).
- Bug fixes for security issues in 4.3.x will end 21 April 2025 (18 months).
- PHP version: minimum PHP 8.0.0 Note: minimum PHP version has increased since Moodle 4.1. PHP 8.2.x is supported too.
/lib/ -> filelib.php (source)
Differences Between: [Versions 310 and 403] [Versions 311 and 403] [Versions 39 and 403] [Versions 400 and 403] [Versions 401 and 403] [Versions 402 and 403]
1 <?php 2 // This file is part of Moodle - http://moodle.org/ 3 // 4 // Moodle is free software: you can redistribute it and/or modify 5 // it under the terms of the GNU General Public License as published by 6 // the Free Software Foundation, either version 3 of the License, or 7 // (at your option) any later version. 8 // 9 // Moodle is distributed in the hope that it will be useful, 10 // but WITHOUT ANY WARRANTY; without even the implied warranty of 11 // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 // GNU General Public License for more details. 13 // 14 // You should have received a copy of the GNU General Public License 15 // along with Moodle. If not, see <http://www.gnu.org/licenses/>. 16 17 /** 18 * Functions for file handling. 19 * 20 * @package core_files 21 * @copyright 1999 onwards Martin Dougiamas (http://dougiamas.com) 22 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later 23 */ 24 25 defined('MOODLE_INTERNAL') || die(); 26 27 /** 28 * BYTESERVING_BOUNDARY - string unique string constant. 29 */ 30 define('BYTESERVING_BOUNDARY', 's1k2o3d4a5k6s7'); 31 32 33 /** 34 * Do not process file merging when working with draft area files. 35 */ 36 define('IGNORE_FILE_MERGE', -1); 37 38 /** 39 * Unlimited area size constant 40 */ 41 define('FILE_AREA_MAX_BYTES_UNLIMITED', -1); 42 43 /** 44 * Capacity of the draft area bucket when using the leaking bucket technique to limit the draft upload rate. 45 */ 46 define('DRAFT_AREA_BUCKET_CAPACITY', 50); 47 48 /** 49 * Leaking rate of the draft area bucket when using the leaking bucket technique to limit the draft upload rate. 50 */ 51 define('DRAFT_AREA_BUCKET_LEAK', 0.2); 52 53 require_once("$CFG->libdir/filestorage/file_exceptions.php"); 54 require_once("$CFG->libdir/filestorage/file_storage.php"); 55 require_once("$CFG->libdir/filestorage/zip_packer.php"); 56 require_once("$CFG->libdir/filebrowser/file_browser.php"); 57 58 /** 59 * Encodes file serving url 60 * 61 * @deprecated use moodle_url factory methods instead 62 * 63 * @todo MDL-31071 deprecate this function 64 * @global stdClass $CFG 65 * @param string $urlbase 66 * @param string $path /filearea/itemid/dir/dir/file.exe 67 * @param bool $forcedownload 68 * @param bool $https https url required 69 * @return string encoded file url 70 */ 71 function file_encode_url($urlbase, $path, $forcedownload=false, $https=false) { 72 global $CFG; 73 74 //TODO: deprecate this 75 76 if ($CFG->slasharguments) { 77 $parts = explode('/', $path); 78 $parts = array_map('rawurlencode', $parts); 79 $path = implode('/', $parts); 80 $return = $urlbase.$path; 81 if ($forcedownload) { 82 $return .= '?forcedownload=1'; 83 } 84 } else { 85 $path = rawurlencode($path); 86 $return = $urlbase.'?file='.$path; 87 if ($forcedownload) { 88 $return .= '&forcedownload=1'; 89 } 90 } 91 92 if ($https) { 93 $return = str_replace('http://', 'https://', $return); 94 } 95 96 return $return; 97 } 98 99 /** 100 * Detects if area contains subdirs, 101 * this is intended for file areas that are attached to content 102 * migrated from 1.x where subdirs were allowed everywhere. 103 * 104 * @param context $context 105 * @param string $component 106 * @param string $filearea 107 * @param string $itemid 108 * @return bool 109 */ 110 function file_area_contains_subdirs(context $context, $component, $filearea, $itemid) { 111 global $DB; 112 113 if (!isset($itemid)) { 114 // Not initialised yet. 115 return false; 116 } 117 118 // Detect if any directories are already present, this is necessary for content upgraded from 1.x. 119 $select = "contextid = :contextid AND component = :component AND filearea = :filearea AND itemid = :itemid AND filepath <> '/' AND filename = '.'"; 120 $params = array('contextid'=>$context->id, 'component'=>$component, 'filearea'=>$filearea, 'itemid'=>$itemid); 121 return $DB->record_exists_select('files', $select, $params); 122 } 123 124 /** 125 * Prepares 'editor' formslib element from data in database 126 * 127 * The passed $data record must contain field foobar, foobarformat and optionally foobartrust. This 128 * function then copies the embedded files into draft area (assigning itemids automatically), 129 * creates the form element foobar_editor and rewrites the URLs so the embedded images can be 130 * displayed. 131 * In your mform definition, you must have an 'editor' element called foobar_editor. Then you call 132 * your mform's set_data() supplying the object returned by this function. 133 * 134 * @category files 135 * @param stdClass $data database field that holds the html text with embedded media 136 * @param string $field the name of the database field that holds the html text with embedded media 137 * @param array $options editor options (like maxifiles, maxbytes etc.) 138 * @param stdClass $context context of the editor 139 * @param string $component 140 * @param string $filearea file area name 141 * @param int $itemid item id, required if item exists 142 * @return stdClass modified data object 143 */ 144 function file_prepare_standard_editor($data, $field, array $options, $context=null, $component=null, $filearea=null, $itemid=null) { 145 $options = (array)$options; 146 if (!isset($options['trusttext'])) { 147 $options['trusttext'] = false; 148 } 149 if (!isset($options['forcehttps'])) { 150 $options['forcehttps'] = false; 151 } 152 if (!isset($options['subdirs'])) { 153 $options['subdirs'] = false; 154 } 155 if (!isset($options['maxfiles'])) { 156 $options['maxfiles'] = 0; // no files by default 157 } 158 if (!isset($options['noclean'])) { 159 $options['noclean'] = false; 160 } 161 162 //sanity check for passed context. This function doesn't expect $option['context'] to be set 163 //But this function is called before creating editor hence, this is one of the best places to check 164 //if context is used properly. This check notify developer that they missed passing context to editor. 165 if (isset($context) && !isset($options['context'])) { 166 //if $context is not null then make sure $option['context'] is also set. 167 debugging('Context for editor is not set in editoroptions. Hence editor will not respect editor filters', DEBUG_DEVELOPER); 168 } else if (isset($options['context']) && isset($context)) { 169 //If both are passed then they should be equal. 170 if ($options['context']->id != $context->id) { 171 $exceptionmsg = 'Editor context ['.$options['context']->id.'] is not equal to passed context ['.$context->id.']'; 172 throw new coding_exception($exceptionmsg); 173 } 174 } 175 176 if (is_null($itemid) or is_null($context)) { 177 $contextid = null; 178 $itemid = null; 179 if (!isset($data)) { 180 $data = new stdClass(); 181 } 182 if (!isset($data->{$field})) { 183 $data->{$field} = ''; 184 } 185 if (!isset($data->{$field.'format'})) { 186 $data->{$field.'format'} = editors_get_preferred_format(); 187 } 188 if (!$options['noclean']) { 189 if ($data->{$field.'format'} != FORMAT_MARKDOWN) { 190 $data->{$field} = clean_text($data->{$field}, $data->{$field . 'format'}); 191 } 192 } 193 194 } else { 195 if ($options['trusttext']) { 196 // noclean ignored if trusttext enabled 197 if (!isset($data->{$field.'trust'})) { 198 $data->{$field.'trust'} = 0; 199 } 200 $data = trusttext_pre_edit($data, $field, $context); 201 } else { 202 if (!$options['noclean']) { 203 // We do not have a way to sanitise Markdown texts, 204 // luckily editors for this format should not have XSS problems. 205 if ($data->{$field.'format'} != FORMAT_MARKDOWN) { 206 $data->{$field} = clean_text($data->{$field}, $data->{$field.'format'}); 207 } 208 } 209 } 210 $contextid = $context->id; 211 } 212 213 if ($options['maxfiles'] != 0) { 214 $draftid_editor = file_get_submitted_draft_itemid($field); 215 $currenttext = file_prepare_draft_area($draftid_editor, $contextid, $component, $filearea, $itemid, $options, $data->{$field}); 216 $data->{$field.'_editor'} = array('text'=>$currenttext, 'format'=>$data->{$field.'format'}, 'itemid'=>$draftid_editor); 217 } else { 218 $data->{$field.'_editor'} = array('text'=>$data->{$field}, 'format'=>$data->{$field.'format'}, 'itemid'=>0); 219 } 220 221 return $data; 222 } 223 224 /** 225 * Prepares the content of the 'editor' form element with embedded media files to be saved in database 226 * 227 * This function moves files from draft area to the destination area and 228 * encodes URLs to the draft files so they can be safely saved into DB. The 229 * form has to contain the 'editor' element named foobar_editor, where 'foobar' 230 * is the name of the database field to hold the wysiwyg editor content. The 231 * editor data comes as an array with text, format and itemid properties. This 232 * function automatically adds $data properties foobar, foobarformat and 233 * foobartrust, where foobar has URL to embedded files encoded. 234 * 235 * @category files 236 * @param stdClass $data raw data submitted by the form 237 * @param string $field name of the database field containing the html with embedded media files 238 * @param array $options editor options (trusttext, subdirs, maxfiles, maxbytes etc.) 239 * @param stdClass $context context, required for existing data 240 * @param string $component file component 241 * @param string $filearea file area name 242 * @param int $itemid item id, required if item exists 243 * @return stdClass modified data object 244 */ 245 function file_postupdate_standard_editor($data, $field, array $options, $context, $component=null, $filearea=null, $itemid=null) { 246 $options = (array)$options; 247 if (!isset($options['trusttext'])) { 248 $options['trusttext'] = false; 249 } 250 if (!isset($options['forcehttps'])) { 251 $options['forcehttps'] = false; 252 } 253 if (!isset($options['subdirs'])) { 254 $options['subdirs'] = false; 255 } 256 if (!isset($options['maxfiles'])) { 257 $options['maxfiles'] = 0; // no files by default 258 } 259 if (!isset($options['maxbytes'])) { 260 $options['maxbytes'] = 0; // unlimited 261 } 262 if (!isset($options['removeorphaneddrafts'])) { 263 $options['removeorphaneddrafts'] = false; // Don't remove orphaned draft files by default. 264 } 265 266 if ($options['trusttext']) { 267 $data->{$field.'trust'} = trusttext_trusted($context); 268 } else { 269 $data->{$field.'trust'} = 0; 270 } 271 272 $editor = $data->{$field.'_editor'}; 273 274 if ($options['maxfiles'] == 0 or is_null($filearea) or is_null($itemid) or empty($editor['itemid'])) { 275 $data->{$field} = $editor['text']; 276 } else { 277 // Clean the user drafts area of any files not referenced in the editor text. 278 if ($options['removeorphaneddrafts']) { 279 file_remove_editor_orphaned_files($editor); 280 } 281 $data->{$field} = file_save_draft_area_files($editor['itemid'], $context->id, $component, $filearea, $itemid, $options, $editor['text'], $options['forcehttps']); 282 } 283 $data->{$field.'format'} = $editor['format']; 284 285 return $data; 286 } 287 288 /** 289 * Saves text and files modified by Editor formslib element 290 * 291 * @category files 292 * @param stdClass $data $database entry field 293 * @param string $field name of data field 294 * @param array $options various options 295 * @param stdClass $context context - must already exist 296 * @param string $component 297 * @param string $filearea file area name 298 * @param int $itemid must already exist, usually means data is in db 299 * @return stdClass modified data obejct 300 */ 301 function file_prepare_standard_filemanager($data, $field, array $options, $context=null, $component=null, $filearea=null, $itemid=null) { 302 $options = (array)$options; 303 if (!isset($options['subdirs'])) { 304 $options['subdirs'] = false; 305 } 306 if (is_null($itemid) or is_null($context)) { 307 $itemid = null; 308 $contextid = null; 309 } else { 310 $contextid = $context->id; 311 } 312 313 $draftid_editor = file_get_submitted_draft_itemid($field.'_filemanager'); 314 file_prepare_draft_area($draftid_editor, $contextid, $component, $filearea, $itemid, $options); 315 $data->{$field.'_filemanager'} = $draftid_editor; 316 317 return $data; 318 } 319 320 /** 321 * Saves files modified by File manager formslib element 322 * 323 * @todo MDL-31073 review this function 324 * @category files 325 * @param stdClass $data $database entry field 326 * @param string $field name of data field 327 * @param array $options various options 328 * @param stdClass $context context - must already exist 329 * @param string $component 330 * @param string $filearea file area name 331 * @param int $itemid must already exist, usually means data is in db 332 * @return stdClass modified data obejct 333 */ 334 function file_postupdate_standard_filemanager($data, $field, array $options, $context, $component, $filearea, $itemid) { 335 $options = (array)$options; 336 if (!isset($options['subdirs'])) { 337 $options['subdirs'] = false; 338 } 339 if (!isset($options['maxfiles'])) { 340 $options['maxfiles'] = -1; // unlimited 341 } 342 if (!isset($options['maxbytes'])) { 343 $options['maxbytes'] = 0; // unlimited 344 } 345 346 if (empty($data->{$field.'_filemanager'})) { 347 $data->$field = ''; 348 349 } else { 350 file_save_draft_area_files($data->{$field.'_filemanager'}, $context->id, $component, $filearea, $itemid, $options); 351 $fs = get_file_storage(); 352 353 if ($fs->get_area_files($context->id, $component, $filearea, $itemid)) { 354 $data->$field = '1'; // TODO: this is an ugly hack (skodak) 355 } else { 356 $data->$field = ''; 357 } 358 } 359 360 return $data; 361 } 362 363 /** 364 * Generate a draft itemid 365 * 366 * @category files 367 * @global moodle_database $DB 368 * @global stdClass $USER 369 * @return int a random but available draft itemid that can be used to create a new draft 370 * file area. 371 */ 372 function file_get_unused_draft_itemid() { 373 global $DB, $USER; 374 375 if (isguestuser() or !isloggedin()) { 376 // guests and not-logged-in users can not be allowed to upload anything!!!!!! 377 throw new \moodle_exception('noguest'); 378 } 379 380 $contextid = context_user::instance($USER->id)->id; 381 382 $fs = get_file_storage(); 383 $draftitemid = rand(1, 999999999); 384 while ($files = $fs->get_area_files($contextid, 'user', 'draft', $draftitemid)) { 385 $draftitemid = rand(1, 999999999); 386 } 387 388 return $draftitemid; 389 } 390 391 /** 392 * Initialise a draft file area from a real one by copying the files. A draft 393 * area will be created if one does not already exist. Normally you should 394 * get $draftitemid by calling file_get_submitted_draft_itemid('elementname'); 395 * 396 * @category files 397 * @global stdClass $CFG 398 * @global stdClass $USER 399 * @param int $draftitemid the id of the draft area to use, or 0 to create a new one, in which case this parameter is updated. 400 * @param int $contextid This parameter and the next two identify the file area to copy files from. 401 * @param string $component 402 * @param string $filearea helps indentify the file area. 403 * @param int $itemid helps identify the file area. Can be null if there are no files yet. 404 * @param array $options text and file options ('subdirs'=>false, 'forcehttps'=>false) 405 * @param string $text some html content that needs to have embedded links rewritten to point to the draft area. 406 * @return string|null returns string if $text was passed in, the rewritten $text is returned. Otherwise NULL. 407 */ 408 function file_prepare_draft_area(&$draftitemid, $contextid, $component, $filearea, $itemid, array $options=null, $text=null) { 409 global $CFG, $USER; 410 411 $options = (array)$options; 412 if (!isset($options['subdirs'])) { 413 $options['subdirs'] = false; 414 } 415 if (!isset($options['forcehttps'])) { 416 $options['forcehttps'] = false; 417 } 418 419 $usercontext = context_user::instance($USER->id); 420 $fs = get_file_storage(); 421 422 if (empty($draftitemid)) { 423 // create a new area and copy existing files into 424 $draftitemid = file_get_unused_draft_itemid(); 425 $file_record = array('contextid'=>$usercontext->id, 'component'=>'user', 'filearea'=>'draft', 'itemid'=>$draftitemid); 426 if (!is_null($itemid) and $files = $fs->get_area_files($contextid, $component, $filearea, $itemid)) { 427 foreach ($files as $file) { 428 if ($file->is_directory() and $file->get_filepath() === '/') { 429 // we need a way to mark the age of each draft area, 430 // by not copying the root dir we force it to be created automatically with current timestamp 431 continue; 432 } 433 if (!$options['subdirs'] and ($file->is_directory() or $file->get_filepath() !== '/')) { 434 continue; 435 } 436 $draftfile = $fs->create_file_from_storedfile($file_record, $file); 437 // XXX: This is a hack for file manager (MDL-28666) 438 // File manager needs to know the original file information before copying 439 // to draft area, so we append these information in mdl_files.source field 440 // {@link file_storage::search_references()} 441 // {@link file_storage::search_references_count()} 442 $sourcefield = $file->get_source(); 443 $newsourcefield = new stdClass; 444 $newsourcefield->source = $sourcefield; 445 $original = new stdClass; 446 $original->contextid = $contextid; 447 $original->component = $component; 448 $original->filearea = $filearea; 449 $original->itemid = $itemid; 450 $original->filename = $file->get_filename(); 451 $original->filepath = $file->get_filepath(); 452 $newsourcefield->original = file_storage::pack_reference($original); 453 $draftfile->set_source(serialize($newsourcefield)); 454 // End of file manager hack 455 } 456 } 457 if (!is_null($text)) { 458 // at this point there should not be any draftfile links yet, 459 // because this is a new text from database that should still contain the @@pluginfile@@ links 460 // this happens when developers forget to post process the text 461 $text = str_replace("\"$CFG->wwwroot/draftfile.php", "\"$CFG->wwwroot/brokenfile.php#", $text); 462 } 463 } else { 464 // nothing to do 465 } 466 467 if (is_null($text)) { 468 return null; 469 } 470 471 // relink embedded files - editor can not handle @@PLUGINFILE@@ ! 472 return file_rewrite_pluginfile_urls($text, 'draftfile.php', $usercontext->id, 'user', 'draft', $draftitemid, $options); 473 } 474 475 /** 476 * Convert encoded URLs in $text from the @@PLUGINFILE@@/... form to an actual URL. 477 * Passing a new option reverse = true in the $options var will make the function to convert actual URLs in $text to encoded URLs 478 * in the @@PLUGINFILE@@ form. 479 * 480 * @param string $text The content that may contain ULRs in need of rewriting. 481 * @param string $file The script that should be used to serve these files. pluginfile.php, draftfile.php, etc. 482 * @param int $contextid This parameter and the next two identify the file area to use. 483 * @param string $component 484 * @param string $filearea helps identify the file area. 485 * @param int $itemid helps identify the file area. 486 * @param array $options 487 * bool $options.forcehttps Force the user of https 488 * bool $options.reverse Reverse the behaviour of the function 489 * mixed $options.includetoken Use a token for authentication. True for current user, int value for other user id. 490 * string The processed text. 491 */ 492 function file_rewrite_pluginfile_urls($text, $file, $contextid, $component, $filearea, $itemid, array $options=null) { 493 global $CFG, $USER; 494 495 $options = (array)$options; 496 if (!isset($options['forcehttps'])) { 497 $options['forcehttps'] = false; 498 } 499 500 $baseurl = "{$CFG->wwwroot}/{$file}"; 501 if (!empty($options['includetoken'])) { 502 $userid = $options['includetoken'] === true ? $USER->id : $options['includetoken']; 503 $token = get_user_key('core_files', $userid); 504 $finalfile = basename($file); 505 $tokenfile = "token{$finalfile}"; 506 $file = substr($file, 0, strlen($file) - strlen($finalfile)) . $tokenfile; 507 $baseurl = "{$CFG->wwwroot}/{$file}"; 508 509 if (!$CFG->slasharguments) { 510 $baseurl .= "?token={$token}&file="; 511 } else { 512 $baseurl .= "/{$token}"; 513 } 514 } 515 516 $baseurl .= "/{$contextid}/{$component}/{$filearea}/"; 517 518 if ($itemid !== null) { 519 $baseurl .= "$itemid/"; 520 } 521 522 if ($options['forcehttps']) { 523 $baseurl = str_replace('http://', 'https://', $baseurl); 524 } 525 526 if (!empty($options['reverse'])) { 527 return str_replace($baseurl, '@@PLUGINFILE@@/', $text ?? ''); 528 } else { 529 return str_replace('@@PLUGINFILE@@/', $baseurl, $text ?? ''); 530 } 531 } 532 533 /** 534 * Returns information about files in a draft area. 535 * 536 * @global stdClass $CFG 537 * @global stdClass $USER 538 * @param int $draftitemid the draft area item id. 539 * @param string $filepath path to the directory from which the information have to be retrieved. 540 * @return array with the following entries: 541 * 'filecount' => number of files in the draft area. 542 * 'filesize' => total size of the files in the draft area. 543 * 'foldercount' => number of folders in the draft area. 544 * 'filesize_without_references' => total size of the area excluding file references. 545 * (more information will be added as needed). 546 */ 547 function file_get_draft_area_info($draftitemid, $filepath = '/') { 548 global $USER; 549 550 $usercontext = context_user::instance($USER->id); 551 return file_get_file_area_info($usercontext->id, 'user', 'draft', $draftitemid, $filepath); 552 } 553 554 /** 555 * Returns information about files in an area. 556 * 557 * @param int $contextid context id 558 * @param string $component component 559 * @param string $filearea file area name 560 * @param int $itemid item id or all files if not specified 561 * @param string $filepath path to the directory from which the information have to be retrieved. 562 * @return array with the following entries: 563 * 'filecount' => number of files in the area. 564 * 'filesize' => total size of the files in the area. 565 * 'foldercount' => number of folders in the area. 566 * 'filesize_without_references' => total size of the area excluding file references. 567 * @since Moodle 3.4 568 */ 569 function file_get_file_area_info($contextid, $component, $filearea, $itemid = 0, $filepath = '/') { 570 571 $fs = get_file_storage(); 572 573 $results = array( 574 'filecount' => 0, 575 'foldercount' => 0, 576 'filesize' => 0, 577 'filesize_without_references' => 0 578 ); 579 580 $draftfiles = $fs->get_directory_files($contextid, $component, $filearea, $itemid, $filepath, true, true); 581 582 foreach ($draftfiles as $file) { 583 if ($file->is_directory()) { 584 $results['foldercount'] += 1; 585 } else { 586 $results['filecount'] += 1; 587 } 588 589 $filesize = $file->get_filesize(); 590 $results['filesize'] += $filesize; 591 if (!$file->is_external_file()) { 592 $results['filesize_without_references'] += $filesize; 593 } 594 } 595 596 return $results; 597 } 598 599 /** 600 * Returns whether a draft area has exceeded/will exceed its size limit. 601 * 602 * Please note that the unlimited value for $areamaxbytes is -1 {@link FILE_AREA_MAX_BYTES_UNLIMITED}, not 0. 603 * 604 * @param int $draftitemid the draft area item id. 605 * @param int $areamaxbytes the maximum size allowed in this draft area. 606 * @param int $newfilesize the size that would be added to the current area. 607 * @param bool $includereferences true to include the size of the references in the area size. 608 * @return bool true if the area will/has exceeded its limit. 609 * @since Moodle 2.4 610 */ 611 function file_is_draft_area_limit_reached($draftitemid, $areamaxbytes, $newfilesize = 0, $includereferences = false) { 612 if ($areamaxbytes != FILE_AREA_MAX_BYTES_UNLIMITED) { 613 $draftinfo = file_get_draft_area_info($draftitemid); 614 $areasize = $draftinfo['filesize_without_references']; 615 if ($includereferences) { 616 $areasize = $draftinfo['filesize']; 617 } 618 if ($areasize + $newfilesize > $areamaxbytes) { 619 return true; 620 } 621 } 622 return false; 623 } 624 625 /** 626 * Returns whether a user has reached their draft area upload rate. 627 * 628 * @param int $userid The user id 629 * @return bool 630 */ 631 function file_is_draft_areas_limit_reached(int $userid): bool { 632 global $CFG; 633 634 $capacity = $CFG->draft_area_bucket_capacity ?? DRAFT_AREA_BUCKET_CAPACITY; 635 $leak = $CFG->draft_area_bucket_leak ?? DRAFT_AREA_BUCKET_LEAK; 636 637 $since = time() - floor($capacity / $leak); // The items that were in the bucket before this time are already leaked by now. 638 // We are going to be a bit generous to the user when using the leaky bucket 639 // algorithm below. We are going to assume that the bucket is empty at $since. 640 // We have to do an assumption here unless we really want to get ALL user's draft 641 // items without any limit and put all of them in the leaking bucket. 642 // I decided to favour performance over accuracy here. 643 644 $fs = get_file_storage(); 645 $items = $fs->get_user_draft_items($userid, $since); 646 $items = array_reverse($items); // So that the items are sorted based on time in the ascending direction. 647 648 // We only need to store the time that each element in the bucket is going to leak. So $bucket is array of leaking times. 649 $bucket = []; 650 foreach ($items as $item) { 651 $now = $item->timemodified; 652 // First let's see if items can be dropped from the bucket as a result of leakage. 653 while (!empty($bucket) && ($now >= $bucket[0])) { 654 array_shift($bucket); 655 } 656 657 // Calculate the time that the new item we put into the bucket will be leaked from it, and store it into the bucket. 658 if ($bucket) { 659 $bucket[] = max($bucket[count($bucket) - 1], $now) + (1 / $leak); 660 } else { 661 $bucket[] = $now + (1 / $leak); 662 } 663 } 664 665 // Recalculate the bucket's content based on the leakage until now. 666 $now = time(); 667 while (!empty($bucket) && ($now >= $bucket[0])) { 668 array_shift($bucket); 669 } 670 671 return count($bucket) >= $capacity; 672 } 673 674 /** 675 * Get used space of files 676 * @global moodle_database $DB 677 * @global stdClass $USER 678 * @return int total bytes 679 */ 680 function file_get_user_used_space() { 681 global $DB, $USER; 682 683 $usercontext = context_user::instance($USER->id); 684 $sql = "SELECT SUM(files1.filesize) AS totalbytes FROM {files} files1 685 JOIN (SELECT contenthash, filename, MAX(id) AS id 686 FROM {files} 687 WHERE contextid = ? AND component = ? AND filearea != ? 688 GROUP BY contenthash, filename) files2 ON files1.id = files2.id"; 689 $params = array('contextid'=>$usercontext->id, 'component'=>'user', 'filearea'=>'draft'); 690 $record = $DB->get_record_sql($sql, $params); 691 return (int)$record->totalbytes; 692 } 693 694 /** 695 * Convert any string to a valid filepath 696 * @todo review this function 697 * @param string $str 698 * @return string path 699 */ 700 function file_correct_filepath($str) { //TODO: what is this? (skodak) - No idea (Fred) 701 if ($str == '/' or empty($str)) { 702 return '/'; 703 } else { 704 return '/'.trim($str, '/').'/'; 705 } 706 } 707 708 /** 709 * Generate a folder tree of draft area of current USER recursively 710 * 711 * @todo MDL-31073 use normal return value instead, this does not fit the rest of api here (skodak) 712 * @param int $draftitemid 713 * @param string $filepath 714 * @param mixed $data 715 */ 716 function file_get_drafarea_folders($draftitemid, $filepath, &$data) { 717 global $USER, $OUTPUT, $CFG; 718 $data->children = array(); 719 $context = context_user::instance($USER->id); 720 $fs = get_file_storage(); 721 if ($files = $fs->get_directory_files($context->id, 'user', 'draft', $draftitemid, $filepath, false)) { 722 foreach ($files as $file) { 723 if ($file->is_directory()) { 724 $item = new stdClass(); 725 $item->sortorder = $file->get_sortorder(); 726 $item->filepath = $file->get_filepath(); 727 728 $foldername = explode('/', trim($item->filepath, '/')); 729 $item->fullname = trim(array_pop($foldername), '/'); 730 731 $item->id = uniqid(); 732 file_get_drafarea_folders($draftitemid, $item->filepath, $item); 733 $data->children[] = $item; 734 } else { 735 continue; 736 } 737 } 738 } 739 } 740 741 /** 742 * Listing all files (including folders) in current path (draft area) 743 * used by file manager 744 * @param int $draftitemid 745 * @param string $filepath 746 * @return stdClass 747 */ 748 function file_get_drafarea_files($draftitemid, $filepath = '/') { 749 global $USER, $OUTPUT, $CFG; 750 751 $context = context_user::instance($USER->id); 752 $fs = get_file_storage(); 753 754 $data = new stdClass(); 755 $data->path = array(); 756 $data->path[] = array('name'=>get_string('files'), 'path'=>'/'); 757 758 // will be used to build breadcrumb 759 $trail = '/'; 760 if ($filepath !== '/') { 761 $filepath = file_correct_filepath($filepath); 762 $parts = explode('/', $filepath); 763 foreach ($parts as $part) { 764 if ($part != '' && $part != null) { 765 $trail .= ($part.'/'); 766 $data->path[] = array('name'=>$part, 'path'=>$trail); 767 } 768 } 769 } 770 771 $list = array(); 772 $maxlength = 12; 773 if ($files = $fs->get_directory_files($context->id, 'user', 'draft', $draftitemid, $filepath, false)) { 774 foreach ($files as $file) { 775 $item = new stdClass(); 776 $item->filename = $file->get_filename(); 777 $item->filepath = $file->get_filepath(); 778 $item->fullname = trim($item->filename, '/'); 779 $filesize = $file->get_filesize(); 780 $item->size = $filesize ? $filesize : null; 781 $item->filesize = $filesize ? display_size($filesize) : ''; 782 783 $item->sortorder = $file->get_sortorder(); 784 $item->author = $file->get_author(); 785 $item->license = $file->get_license(); 786 $item->datemodified = $file->get_timemodified(); 787 $item->datecreated = $file->get_timecreated(); 788 $item->isref = $file->is_external_file(); 789 if ($item->isref && $file->get_status() == 666) { 790 $item->originalmissing = true; 791 } 792 // find the file this draft file was created from and count all references in local 793 // system pointing to that file 794 $source = @unserialize($file->get_source() ?? ''); 795 if (isset($source->original)) { 796 $item->refcount = $fs->search_references_count($source->original); 797 } 798 799 if ($file->is_directory()) { 800 $item->filesize = 0; 801 $item->icon = $OUTPUT->image_url(file_folder_icon())->out(false); 802 $item->type = 'folder'; 803 $foldername = explode('/', trim($item->filepath, '/')); 804 $item->fullname = trim(array_pop($foldername), '/'); 805 $item->thumbnail = $OUTPUT->image_url(file_folder_icon())->out(false); 806 } else { 807 // do NOT use file browser here! 808 $item->mimetype = get_mimetype_description($file); 809 if (file_extension_in_typegroup($file->get_filename(), 'archive')) { 810 $item->type = 'zip'; 811 } else { 812 $item->type = 'file'; 813 } 814 $itemurl = moodle_url::make_draftfile_url($draftitemid, $item->filepath, $item->filename); 815 $item->url = $itemurl->out(); 816 $item->icon = $OUTPUT->image_url(file_file_icon($file))->out(false); 817 $item->thumbnail = $OUTPUT->image_url(file_file_icon($file))->out(false); 818 819 // The call to $file->get_imageinfo() fails with an exception if the file can't be read on the file system. 820 // We still want to add such files to the list, so the owner can view and delete them if needed. So, we only call 821 // get_imageinfo() on files that can be read, and we also spoof the file status based on whether it was found. 822 // We'll use the same status types used by stored_file->get_status(), where 0 = OK. 1 = problem, as these will be 823 // used by the widget to display a warning about the problem files. 824 // The value of stored_file->get_status(), and the file record are unaffected by this. It's only superficially set. 825 $item->status = $fs->get_file_system()->is_file_readable_remotely_by_storedfile($file) ? 0 : 1; 826 if ($item->status == 0) { 827 if ($imageinfo = $file->get_imageinfo()) { 828 $item->realthumbnail = $itemurl->out(false, array('preview' => 'thumb', 829 'oid' => $file->get_timemodified())); 830 $item->realicon = $itemurl->out(false, array('preview' => 'tinyicon', 'oid' => $file->get_timemodified())); 831 $item->image_width = $imageinfo['width']; 832 $item->image_height = $imageinfo['height']; 833 } 834 } 835 } 836 $list[] = $item; 837 } 838 } 839 $data->itemid = $draftitemid; 840 $data->list = $list; 841 return $data; 842 } 843 844 /** 845 * Returns all of the files in the draftarea. 846 * 847 * @param int $draftitemid The draft item ID 848 * @param string $filepath path for the uploaded files. 849 * @return array An array of files associated with this draft item id. 850 */ 851 function file_get_all_files_in_draftarea(int $draftitemid, string $filepath = '/') : array { 852 $files = []; 853 $draftfiles = file_get_drafarea_files($draftitemid, $filepath); 854 file_get_drafarea_folders($draftitemid, $filepath, $draftfiles); 855 856 if (!empty($draftfiles)) { 857 foreach ($draftfiles->list as $draftfile) { 858 if ($draftfile->type == 'file') { 859 $files[] = $draftfile; 860 } 861 } 862 863 if (isset($draftfiles->children)) { 864 foreach ($draftfiles->children as $draftfile) { 865 $files = array_merge($files, file_get_all_files_in_draftarea($draftitemid, $draftfile->filepath)); 866 } 867 } 868 } 869 return $files; 870 } 871 872 /** 873 * Returns draft area itemid for a given element. 874 * 875 * @category files 876 * @param string $elname name of formlib editor element, or a hidden form field that stores the draft area item id, etc. 877 * @return int the itemid, or 0 if there is not one yet. 878 */ 879 function file_get_submitted_draft_itemid($elname) { 880 // this is a nasty hack, ideally all new elements should use arrays here or there should be a new parameter 881 if (!isset($_REQUEST[$elname])) { 882 return 0; 883 } 884 if (is_array($_REQUEST[$elname])) { 885 $param = optional_param_array($elname, 0, PARAM_INT); 886 if (!empty($param['itemid'])) { 887 $param = $param['itemid']; 888 } else { 889 debugging('Missing itemid, maybe caused by unset maxfiles option', DEBUG_DEVELOPER); 890 return false; 891 } 892 893 } else { 894 $param = optional_param($elname, 0, PARAM_INT); 895 } 896 897 if ($param) { 898 require_sesskey(); 899 } 900 901 return $param; 902 } 903 904 /** 905 * Restore the original source field from draft files 906 * 907 * Do not use this function because it makes field files.source inconsistent 908 * for draft area files. This function will be deprecated in 2.6 909 * 910 * @param stored_file $storedfile This only works with draft files 911 * @return stored_file 912 */ 913 function file_restore_source_field_from_draft_file($storedfile) { 914 $source = @unserialize($storedfile->get_source() ?? ''); 915 if (!empty($source)) { 916 if (is_object($source)) { 917 $restoredsource = $source->source; 918 $storedfile->set_source($restoredsource); 919 } else { 920 throw new moodle_exception('invalidsourcefield', 'error'); 921 } 922 } 923 return $storedfile; 924 } 925 926 /** 927 * Removes those files from the user drafts filearea which are not referenced in the editor text. 928 * 929 * @param stdClass $editor The online text editor element from the submitted form data. 930 */ 931 function file_remove_editor_orphaned_files($editor) { 932 global $CFG, $USER; 933 934 // Find those draft files included in the text, and generate their hashes. 935 $context = context_user::instance($USER->id); 936 $baseurl = $CFG->wwwroot . '/draftfile.php/' . $context->id . '/user/draft/' . $editor['itemid'] . '/'; 937 $pattern = "/" . preg_quote($baseurl, '/') . "(.+?)[\?\"'<>\s:\\\\]/"; 938 preg_match_all($pattern, $editor['text'], $matches); 939 $usedfilehashes = []; 940 foreach ($matches[1] as $matchedfilename) { 941 $matchedfilename = urldecode($matchedfilename); 942 $usedfilehashes[] = \file_storage::get_pathname_hash($context->id, 'user', 'draft', $editor['itemid'], '/', 943 $matchedfilename); 944 } 945 946 // Now, compare the hashes of all draft files, and remove those which don't match used files. 947 $fs = get_file_storage(); 948 $files = $fs->get_area_files($context->id, 'user', 'draft', $editor['itemid'], 'id', false); 949 foreach ($files as $file) { 950 $tmphash = $file->get_pathnamehash(); 951 if (!in_array($tmphash, $usedfilehashes)) { 952 $file->delete(); 953 } 954 } 955 } 956 957 /** 958 * Finds all draft areas used in a textarea and copies the files into the primary textarea. If a user copies and pastes 959 * content from another draft area it's possible for a single textarea to reference multiple draft areas. 960 * 961 * @category files 962 * @param int $draftitemid the id of the primary draft area. 963 * When set to -1 (probably, by a WebService) it won't process file merging, keeping the original state of the file area. 964 * @param int $usercontextid the user's context id. 965 * @param string $text some html content that needs to have files copied to the correct draft area. 966 * @param bool $forcehttps force https urls. 967 * 968 * @return string $text html content modified with new draft links 969 */ 970 function file_merge_draft_areas($draftitemid, $usercontextid, $text, $forcehttps = false) { 971 if (is_null($text)) { 972 return null; 973 } 974 975 // Do not merge files, leave it as it was. 976 if ($draftitemid === IGNORE_FILE_MERGE) { 977 return null; 978 } 979 980 $urls = extract_draft_file_urls_from_text($text, $forcehttps, $usercontextid, 'user', 'draft'); 981 982 // No draft areas to rewrite. 983 if (empty($urls)) { 984 return $text; 985 } 986 987 foreach ($urls as $url) { 988 // Do not process the "home" draft area. 989 if ($url['itemid'] == $draftitemid) { 990 continue; 991 } 992 993 // Decode the filename. 994 $filename = urldecode($url['filename']); 995 996 // Copy the file. 997 file_copy_file_to_file_area($url, $filename, $draftitemid); 998 999 // Rewrite draft area. 1000 $text = file_replace_file_area_in_text($url, $draftitemid, $text, $forcehttps); 1001 } 1002 return $text; 1003 } 1004 1005 /** 1006 * Rewrites a file area in arbitrary text. 1007 * 1008 * @param array $file General information about the file. 1009 * @param int $newid The new file area itemid. 1010 * @param string $text The text to rewrite. 1011 * @param bool $forcehttps force https urls. 1012 * @return string The rewritten text. 1013 */ 1014 function file_replace_file_area_in_text($file, $newid, $text, $forcehttps = false) { 1015 global $CFG; 1016 1017 $wwwroot = $CFG->wwwroot; 1018 if ($forcehttps) { 1019 $wwwroot = str_replace('http://', 'https://', $wwwroot); 1020 } 1021 1022 $search = [ 1023 $wwwroot, 1024 $file['urlbase'], 1025 $file['contextid'], 1026 $file['component'], 1027 $file['filearea'], 1028 $file['itemid'], 1029 $file['filename'] 1030 ]; 1031 $replace = [ 1032 $wwwroot, 1033 $file['urlbase'], 1034 $file['contextid'], 1035 $file['component'], 1036 $file['filearea'], 1037 $newid, 1038 $file['filename'] 1039 ]; 1040 1041 $text = str_ireplace( implode('/', $search), implode('/', $replace), $text); 1042 return $text; 1043 } 1044 1045 /** 1046 * Copies a file from one file area to another. 1047 * 1048 * @param array $file Information about the file to be copied. 1049 * @param string $filename The filename. 1050 * @param int $itemid The new file area. 1051 */ 1052 function file_copy_file_to_file_area($file, $filename, $itemid) { 1053 $fs = get_file_storage(); 1054 1055 // Load the current file in the old draft area. 1056 $fileinfo = array( 1057 'component' => $file['component'], 1058 'filearea' => $file['filearea'], 1059 'itemid' => $file['itemid'], 1060 'contextid' => $file['contextid'], 1061 'filepath' => '/', 1062 'filename' => $filename 1063 ); 1064 $oldfile = $fs->get_file($fileinfo['contextid'], $fileinfo['component'], $fileinfo['filearea'], 1065 $fileinfo['itemid'], $fileinfo['filepath'], $fileinfo['filename']); 1066 $newfileinfo = array( 1067 'component' => $file['component'], 1068 'filearea' => $file['filearea'], 1069 'itemid' => $itemid, 1070 'contextid' => $file['contextid'], 1071 'filepath' => '/', 1072 'filename' => $filename 1073 ); 1074 1075 $newcontextid = $newfileinfo['contextid']; 1076 $newcomponent = $newfileinfo['component']; 1077 $newfilearea = $newfileinfo['filearea']; 1078 $newitemid = $newfileinfo['itemid']; 1079 $newfilepath = $newfileinfo['filepath']; 1080 $newfilename = $newfileinfo['filename']; 1081 1082 // Check if the file exists. 1083 if (!$fs->file_exists($newcontextid, $newcomponent, $newfilearea, $newitemid, $newfilepath, $newfilename)) { 1084 $fs->create_file_from_storedfile($newfileinfo, $oldfile); 1085 } 1086 } 1087 1088 /** 1089 * Saves files from a draft file area to a real one (merging the list of files). 1090 * Can rewrite URLs in some content at the same time if desired. 1091 * 1092 * @category files 1093 * @global stdClass $USER 1094 * @param int $draftitemid the id of the draft area to use. Normally obtained 1095 * from file_get_submitted_draft_itemid('elementname') or similar. 1096 * When set to -1 (probably, by a WebService) it won't process file merging, keeping the original state of the file area. 1097 * @param int $contextid This parameter and the next two identify the file area to save to. 1098 * @param string $component 1099 * @param string $filearea indentifies the file area. 1100 * @param int $itemid helps identifies the file area. 1101 * @param array $options area options (subdirs=>false, maxfiles=-1, maxbytes=0) 1102 * @param string $text some html content that needs to have embedded links rewritten 1103 * to the @@PLUGINFILE@@ form for saving in the database. 1104 * @param bool $forcehttps force https urls. 1105 * @return string|null if $text was passed in, the rewritten $text is returned. Otherwise NULL. 1106 */ 1107 function file_save_draft_area_files($draftitemid, $contextid, $component, $filearea, $itemid, array $options=null, $text=null, $forcehttps=false) { 1108 global $USER; 1109 1110 // Do not merge files, leave it as it was. 1111 if ($draftitemid === IGNORE_FILE_MERGE) { 1112 // Safely return $text, no need to rewrite pluginfile because this is mostly comming from an external client like the app. 1113 return $text; 1114 } 1115 1116 if ($itemid === false) { 1117 // Catch a potentially dangerous coding error. 1118 throw new coding_exception('file_save_draft_area_files was called with $itemid false. ' . 1119 "This suggests a bug, because it would wipe all ($contextid, $component, $filearea) files."); 1120 } 1121 1122 $usercontext = context_user::instance($USER->id); 1123 $fs = get_file_storage(); 1124 1125 $options = (array)$options; 1126 if (!isset($options['subdirs'])) { 1127 $options['subdirs'] = false; 1128 } 1129 if (!isset($options['maxfiles'])) { 1130 $options['maxfiles'] = -1; // unlimited 1131 } 1132 if (!isset($options['maxbytes']) || $options['maxbytes'] == USER_CAN_IGNORE_FILE_SIZE_LIMITS) { 1133 $options['maxbytes'] = 0; // unlimited 1134 } 1135 if (!isset($options['areamaxbytes'])) { 1136 $options['areamaxbytes'] = FILE_AREA_MAX_BYTES_UNLIMITED; // Unlimited. 1137 } 1138 $allowreferences = true; 1139 if (isset($options['return_types']) && !($options['return_types'] & (FILE_REFERENCE | FILE_CONTROLLED_LINK))) { 1140 // we assume that if $options['return_types'] is NOT specified, we DO allow references. 1141 // this is not exactly right. BUT there are many places in code where filemanager options 1142 // are not passed to file_save_draft_area_files() 1143 $allowreferences = false; 1144 } 1145 1146 // Check if the user has copy-pasted from other draft areas. Those files will be located in different draft 1147 // areas and need to be copied into the current draft area. 1148 $text = file_merge_draft_areas($draftitemid, $usercontext->id, $text, $forcehttps); 1149 1150 // Check if the draft area has exceeded the authorised limit. This should never happen as validation 1151 // should have taken place before, unless the user is doing something nauthly. If so, let's just not save 1152 // anything at all in the next area. 1153 if (file_is_draft_area_limit_reached($draftitemid, $options['areamaxbytes'])) { 1154 return null; 1155 } 1156 1157 $draftfiles = $fs->get_area_files($usercontext->id, 'user', 'draft', $draftitemid, 'id'); 1158 $oldfiles = $fs->get_area_files($contextid, $component, $filearea, $itemid, 'id'); 1159 1160 // One file in filearea means it is empty (it has only top-level directory '.'). 1161 if (count($draftfiles) > 1 || count($oldfiles) > 1) { 1162 // we have to merge old and new files - we want to keep file ids for files that were not changed 1163 // we change time modified for all new and changed files, we keep time created as is 1164 1165 $newhashes = array(); 1166 $filecount = 0; 1167 $context = context::instance_by_id($contextid, MUST_EXIST); 1168 foreach ($draftfiles as $file) { 1169 if (!$options['subdirs'] && $file->get_filepath() !== '/') { 1170 continue; 1171 } 1172 if (!$allowreferences && $file->is_external_file()) { 1173 continue; 1174 } 1175 if (!$file->is_directory()) { 1176 // Check to see if this file was uploaded by someone who can ignore the file size limits. 1177 $fileusermaxbytes = get_user_max_upload_file_size($context, $options['maxbytes'], 0, 0, $file->get_userid()); 1178 if ($fileusermaxbytes != USER_CAN_IGNORE_FILE_SIZE_LIMITS 1179 && ($options['maxbytes'] and $options['maxbytes'] < $file->get_filesize())) { 1180 // Oversized file. 1181 continue; 1182 } 1183 if ($options['maxfiles'] != -1 and $options['maxfiles'] <= $filecount) { 1184 // more files - should not get here at all 1185 continue; 1186 } 1187 $filecount++; 1188 } 1189 $newhash = $fs->get_pathname_hash($contextid, $component, $filearea, $itemid, $file->get_filepath(), $file->get_filename()); 1190 $newhashes[$newhash] = $file; 1191 } 1192 1193 // Loop through oldfiles and decide which we need to delete and which to update. 1194 // After this cycle the array $newhashes will only contain the files that need to be added. 1195 foreach ($oldfiles as $oldfile) { 1196 $oldhash = $oldfile->get_pathnamehash(); 1197 if (!isset($newhashes[$oldhash])) { 1198 // delete files not needed any more - deleted by user 1199 $oldfile->delete(); 1200 continue; 1201 } 1202 1203 $newfile = $newhashes[$oldhash]; 1204 // Now we know that we have $oldfile and $newfile for the same path. 1205 // Let's check if we can update this file or we need to delete and create. 1206 if ($newfile->is_directory()) { 1207 // Directories are always ok to just update. 1208 } else if (($source = @unserialize($newfile->get_source() ?? '')) && isset($source->original)) { 1209 // File has the 'original' - we need to update the file (it may even have not been changed at all). 1210 $original = file_storage::unpack_reference($source->original); 1211 if ($original['filename'] !== $oldfile->get_filename() || $original['filepath'] !== $oldfile->get_filepath()) { 1212 // Very odd, original points to another file. Delete and create file. 1213 $oldfile->delete(); 1214 continue; 1215 } 1216 } else { 1217 // The same file name but absence of 'original' means that file was deteled and uploaded again. 1218 // By deleting and creating new file we properly manage all existing references. 1219 $oldfile->delete(); 1220 continue; 1221 } 1222 1223 // status changed, we delete old file, and create a new one 1224 if ($oldfile->get_status() != $newfile->get_status()) { 1225 // file was changed, use updated with new timemodified data 1226 $oldfile->delete(); 1227 // This file will be added later 1228 continue; 1229 } 1230 1231 // Updated author 1232 if ($oldfile->get_author() != $newfile->get_author()) { 1233 $oldfile->set_author($newfile->get_author()); 1234 } 1235 // Updated license 1236 if ($oldfile->get_license() != $newfile->get_license()) { 1237 $oldfile->set_license($newfile->get_license()); 1238 } 1239 1240 // Updated file source 1241 // Field files.source for draftarea files contains serialised object with source and original information. 1242 // We only store the source part of it for non-draft file area. 1243 $newsource = $newfile->get_source(); 1244 if ($source = @unserialize($newfile->get_source() ?? '')) { 1245 $newsource = $source->source; 1246 } 1247 if ($oldfile->get_source() !== $newsource) { 1248 $oldfile->set_source($newsource); 1249 } 1250 1251 // Updated sort order 1252 if ($oldfile->get_sortorder() != $newfile->get_sortorder()) { 1253 $oldfile->set_sortorder($newfile->get_sortorder()); 1254 } 1255 1256 // Update file timemodified 1257 if ($oldfile->get_timemodified() != $newfile->get_timemodified()) { 1258 $oldfile->set_timemodified($newfile->get_timemodified()); 1259 } 1260 1261 // Replaced file content 1262 if (!$oldfile->is_directory() && 1263 ($oldfile->get_contenthash() != $newfile->get_contenthash() || 1264 $oldfile->get_filesize() != $newfile->get_filesize() || 1265 $oldfile->get_referencefileid() != $newfile->get_referencefileid() || 1266 $oldfile->get_userid() != $newfile->get_userid())) { 1267 $oldfile->replace_file_with($newfile); 1268 } 1269 1270 // unchanged file or directory - we keep it as is 1271 unset($newhashes[$oldhash]); 1272 } 1273 1274 // Add fresh file or the file which has changed status 1275 // the size and subdirectory tests are extra safety only, the UI should prevent it 1276 foreach ($newhashes as $file) { 1277 $file_record = array('contextid'=>$contextid, 'component'=>$component, 'filearea'=>$filearea, 'itemid'=>$itemid, 'timemodified'=>time()); 1278 if ($source = @unserialize($file->get_source() ?? '')) { 1279 // Field files.source for draftarea files contains serialised object with source and original information. 1280 // We only store the source part of it for non-draft file area. 1281 $file_record['source'] = $source->source; 1282 } 1283 1284 if ($file->is_external_file()) { 1285 $repoid = $file->get_repository_id(); 1286 if (!empty($repoid)) { 1287 $context = context::instance_by_id($contextid, MUST_EXIST); 1288 $repo = repository::get_repository_by_id($repoid, $context); 1289 if (!empty($options)) { 1290 $repo->options = $options; 1291 } 1292 $file_record['repositoryid'] = $repoid; 1293 // This hook gives the repo a place to do some house cleaning, and update the $reference before it's saved 1294 // to the file store. E.g. transfer ownership of the file to a system account etc. 1295 $reference = $repo->reference_file_selected($file->get_reference(), $context, $component, $filearea, $itemid); 1296 1297 $file_record['reference'] = $reference; 1298 } 1299 } 1300 1301 $fs->create_file_from_storedfile($file_record, $file); 1302 } 1303 } 1304 1305 // note: do not purge the draft area - we clean up areas later in cron, 1306 // the reason is that user might press submit twice and they would loose the files, 1307 // also sometimes we might want to use hacks that save files into two different areas 1308 1309 if (is_null($text)) { 1310 return null; 1311 } else { 1312 return file_rewrite_urls_to_pluginfile($text, $draftitemid, $forcehttps); 1313 } 1314 } 1315 1316 /** 1317 * Convert the draft file area URLs in some content to @@PLUGINFILE@@ tokens 1318 * ready to be saved in the database. Normally, this is done automatically by 1319 * {@link file_save_draft_area_files()}. 1320 * 1321 * @category files 1322 * @param string $text the content to process. 1323 * @param int $draftitemid the draft file area the content was using. 1324 * @param bool $forcehttps whether the content contains https URLs. Default false. 1325 * @return string the processed content. 1326 */ 1327 function file_rewrite_urls_to_pluginfile($text, $draftitemid, $forcehttps = false) { 1328 global $CFG, $USER; 1329 1330 $usercontext = context_user::instance($USER->id); 1331 1332 $wwwroot = $CFG->wwwroot; 1333 if ($forcehttps) { 1334 $wwwroot = str_replace('http://', 'https://', $wwwroot); 1335 } 1336 1337 // relink embedded files if text submitted - no absolute links allowed in database! 1338 $text = str_ireplace("$wwwroot/draftfile.php/$usercontext->id/user/draft/$draftitemid/", '@@PLUGINFILE@@/', $text); 1339 1340 if (strpos($text, 'draftfile.php?file=') !== false) { 1341 $matches = array(); 1342 preg_match_all("!$wwwroot/draftfile.php\?file=%2F{$usercontext->id}%2Fuser%2Fdraft%2F{$draftitemid}%2F[^'\",&<>|`\s:\\\\]+!iu", $text, $matches); 1343 if ($matches) { 1344 foreach ($matches[0] as $match) { 1345 $replace = str_ireplace('%2F', '/', $match); 1346 $text = str_replace($match, $replace, $text); 1347 } 1348 } 1349 $text = str_ireplace("$wwwroot/draftfile.php?file=/$usercontext->id/user/draft/$draftitemid/", '@@PLUGINFILE@@/', $text); 1350 } 1351 1352 return $text; 1353 } 1354 1355 /** 1356 * Set file sort order 1357 * 1358 * @global moodle_database $DB 1359 * @param int $contextid the context id 1360 * @param string $component file component 1361 * @param string $filearea file area. 1362 * @param int $itemid itemid. 1363 * @param string $filepath file path. 1364 * @param string $filename file name. 1365 * @param int $sortorder the sort order of file. 1366 * @return bool 1367 */ 1368 function file_set_sortorder($contextid, $component, $filearea, $itemid, $filepath, $filename, $sortorder) { 1369 global $DB; 1370 $conditions = array('contextid'=>$contextid, 'component'=>$component, 'filearea'=>$filearea, 'itemid'=>$itemid, 'filepath'=>$filepath, 'filename'=>$filename); 1371 if ($file_record = $DB->get_record('files', $conditions)) { 1372 $sortorder = (int)$sortorder; 1373 $file_record->sortorder = $sortorder; 1374 $DB->update_record('files', $file_record); 1375 return true; 1376 } 1377 return false; 1378 } 1379 1380 /** 1381 * reset file sort order number to 0 1382 * @global moodle_database $DB 1383 * @param int $contextid the context id 1384 * @param string $component 1385 * @param string $filearea file area. 1386 * @param int|bool $itemid itemid. 1387 * @return bool 1388 */ 1389 function file_reset_sortorder($contextid, $component, $filearea, $itemid=false) { 1390 global $DB; 1391 1392 $conditions = array('contextid'=>$contextid, 'component'=>$component, 'filearea'=>$filearea); 1393 if ($itemid !== false) { 1394 $conditions['itemid'] = $itemid; 1395 } 1396 1397 $file_records = $DB->get_records('files', $conditions); 1398 foreach ($file_records as $file_record) { 1399 $file_record->sortorder = 0; 1400 $DB->update_record('files', $file_record); 1401 } 1402 return true; 1403 } 1404 1405 /** 1406 * Returns description of upload error 1407 * 1408 * @param int $errorcode found in $_FILES['filename.ext']['error'] 1409 * @return string error description string, '' if ok 1410 */ 1411 function file_get_upload_error($errorcode) { 1412 1413 switch ($errorcode) { 1414 case 0: // UPLOAD_ERR_OK - no error 1415 $errmessage = ''; 1416 break; 1417 1418 case 1: // UPLOAD_ERR_INI_SIZE 1419 $errmessage = get_string('uploadserverlimit'); 1420 break; 1421 1422 case 2: // UPLOAD_ERR_FORM_SIZE 1423 $errmessage = get_string('uploadformlimit'); 1424 break; 1425 1426 case 3: // UPLOAD_ERR_PARTIAL 1427 $errmessage = get_string('uploadpartialfile'); 1428 break; 1429 1430 case 4: // UPLOAD_ERR_NO_FILE 1431 $errmessage = get_string('uploadnofilefound'); 1432 break; 1433 1434 // Note: there is no error with a value of 5 1435 1436 case 6: // UPLOAD_ERR_NO_TMP_DIR 1437 $errmessage = get_string('uploadnotempdir'); 1438 break; 1439 1440 case 7: // UPLOAD_ERR_CANT_WRITE 1441 $errmessage = get_string('uploadcantwrite'); 1442 break; 1443 1444 case 8: // UPLOAD_ERR_EXTENSION 1445 $errmessage = get_string('uploadextension'); 1446 break; 1447 1448 default: 1449 $errmessage = get_string('uploadproblem'); 1450 } 1451 1452 return $errmessage; 1453 } 1454 1455 /** 1456 * Recursive function formating an array in POST parameter 1457 * @param array $arraydata - the array that we are going to format and add into &$data array 1458 * @param string $currentdata - a row of the final postdata array at instant T 1459 * when finish, it's assign to $data under this format: name[keyname][][]...[]='value' 1460 * @param array $data - the final data array containing all POST parameters : 1 row = 1 parameter 1461 */ 1462 function format_array_postdata_for_curlcall($arraydata, $currentdata, &$data) { 1463 foreach ($arraydata as $k=>$v) { 1464 $newcurrentdata = $currentdata; 1465 if (is_array($v)) { //the value is an array, call the function recursively 1466 $newcurrentdata = $newcurrentdata.'['.urlencode($k).']'; 1467 format_array_postdata_for_curlcall($v, $newcurrentdata, $data); 1468 } else { //add the POST parameter to the $data array 1469 $data[] = $newcurrentdata.'['.urlencode($k).']='.urlencode($v); 1470 } 1471 } 1472 } 1473 1474 /** 1475 * Transform a PHP array into POST parameter 1476 * (see the recursive function format_array_postdata_for_curlcall) 1477 * @param array $postdata 1478 * @return array containing all POST parameters (1 row = 1 POST parameter) 1479 */ 1480 function format_postdata_for_curlcall($postdata) { 1481 $data = array(); 1482 foreach ($postdata as $k=>$v) { 1483 if (is_array($v)) { 1484 $currentdata = urlencode($k); 1485 format_array_postdata_for_curlcall($v, $currentdata, $data); 1486 } else { 1487 $data[] = urlencode($k).'='.urlencode($v ?? ''); 1488 } 1489 } 1490 $convertedpostdata = implode('&', $data); 1491 return $convertedpostdata; 1492 } 1493 1494 /** 1495 * Fetches content of file from Internet (using proxy if defined). Uses cURL extension if present. 1496 * Due to security concerns only downloads from http(s) sources are supported. 1497 * 1498 * @category files 1499 * @param string $url file url starting with http(s):// 1500 * @param array $headers http headers, null if none. If set, should be an 1501 * associative array of header name => value pairs. 1502 * @param array $postdata array means use POST request with given parameters 1503 * @param bool $fullresponse return headers, responses, etc in a similar way snoopy does 1504 * (if false, just returns content) 1505 * @param int $timeout timeout for complete download process including all file transfer 1506 * (default 5 minutes) 1507 * @param int $connecttimeout timeout for connection to server; this is the timeout that 1508 * usually happens if the remote server is completely down (default 20 seconds); 1509 * may not work when using proxy 1510 * @param bool $skipcertverify If true, the peer's SSL certificate will not be checked. 1511 * Only use this when already in a trusted location. 1512 * @param string $tofile store the downloaded content to file instead of returning it. 1513 * @param bool $calctimeout false by default, true enables an extra head request to try and determine 1514 * filesize and appropriately larger timeout based on $CFG->curltimeoutkbitrate 1515 * @return stdClass|string|bool stdClass object if $fullresponse is true, false if request failed, true 1516 * if file downloaded into $tofile successfully or the file content as a string. 1517 */ 1518 function download_file_content($url, $headers=null, $postdata=null, $fullresponse=false, $timeout=300, $connecttimeout=20, $skipcertverify=false, $tofile=NULL, $calctimeout=false) { 1519 global $CFG; 1520 1521 // Only http and https links supported. 1522 if (!preg_match('|^https?://|i', $url)) { 1523 if ($fullresponse) { 1524 $response = new stdClass(); 1525 $response->status = 0; 1526 $response->headers = array(); 1527 $response->response_code = 'Invalid protocol specified in url'; 1528 $response->results = ''; 1529 $response->error = 'Invalid protocol specified in url'; 1530 return $response; 1531 } else { 1532 return false; 1533 } 1534 } 1535 1536 $options = array(); 1537 1538 $headers2 = array(); 1539 if (is_array($headers)) { 1540 foreach ($headers as $key => $value) { 1541 if (is_numeric($key)) { 1542 $headers2[] = $value; 1543 } else { 1544 $headers2[] = "$key: $value"; 1545 } 1546 } 1547 } 1548 1549 if ($skipcertverify) { 1550 $options['CURLOPT_SSL_VERIFYPEER'] = false; 1551 } else { 1552 $options['CURLOPT_SSL_VERIFYPEER'] = true; 1553 } 1554 1555 $options['CURLOPT_CONNECTTIMEOUT'] = $connecttimeout; 1556 1557 $options['CURLOPT_FOLLOWLOCATION'] = 1; 1558 $options['CURLOPT_MAXREDIRS'] = 5; 1559 1560 // Use POST if requested. 1561 if (is_array($postdata)) { 1562 $postdata = format_postdata_for_curlcall($postdata); 1563 } else if (empty($postdata)) { 1564 $postdata = null; 1565 } 1566 1567 // Optionally attempt to get more correct timeout by fetching the file size. 1568 if (!isset($CFG->curltimeoutkbitrate)) { 1569 // Use very slow rate of 56kbps as a timeout speed when not set. 1570 $bitrate = 56; 1571 } else { 1572 $bitrate = $CFG->curltimeoutkbitrate; 1573 } 1574 if ($calctimeout and !isset($postdata)) { 1575 $curl = new curl(); 1576 $curl->setHeader($headers2); 1577 1578 $curl->head($url, $postdata, $options); 1579 1580 $info = $curl->get_info(); 1581 $error_no = $curl->get_errno(); 1582 if (!$error_no && $info['download_content_length'] > 0) { 1583 // No curl errors - adjust for large files only - take max timeout. 1584 $timeout = max($timeout, ceil($info['download_content_length'] * 8 / ($bitrate * 1024))); 1585 } 1586 } 1587 1588 $curl = new curl(); 1589 $curl->setHeader($headers2); 1590 1591 $options['CURLOPT_RETURNTRANSFER'] = true; 1592 $options['CURLOPT_NOBODY'] = false; 1593 $options['CURLOPT_TIMEOUT'] = $timeout; 1594 1595 if ($tofile) { 1596 $fh = fopen($tofile, 'w'); 1597 if (!$fh) { 1598 if ($fullresponse) { 1599 $response = new stdClass(); 1600 $response->status = 0; 1601 $response->headers = array(); 1602 $response->response_code = 'Can not write to file'; 1603 $response->results = false; 1604 $response->error = 'Can not write to file'; 1605 return $response; 1606 } else { 1607 return false; 1608 } 1609 } 1610 $options['CURLOPT_FILE'] = $fh; 1611 } 1612 1613 if (isset($postdata)) { 1614 $content = $curl->post($url, $postdata, $options); 1615 } else { 1616 $content = $curl->get($url, null, $options); 1617 } 1618 1619 if ($tofile) { 1620 fclose($fh); 1621 @chmod($tofile, $CFG->filepermissions); 1622 } 1623 1624 /* 1625 // Try to detect encoding problems. 1626 if ((curl_errno($ch) == 23 or curl_errno($ch) == 61) and defined('CURLOPT_ENCODING')) { 1627 curl_setopt($ch, CURLOPT_ENCODING, 'none'); 1628 $result = curl_exec($ch); 1629 } 1630 */ 1631 1632 $info = $curl->get_info(); 1633 $error_no = $curl->get_errno(); 1634 $rawheaders = $curl->get_raw_response(); 1635 1636 if ($error_no) { 1637 $error = $content; 1638 if (!$fullresponse) { 1639 debugging("cURL request for \"$url\" failed with: $error ($error_no)", DEBUG_ALL); 1640 return false; 1641 } 1642 1643 $response = new stdClass(); 1644 if ($error_no == 28) { 1645 $response->status = '-100'; // Mimic snoopy. 1646 } else { 1647 $response->status = '0'; 1648 } 1649 $response->headers = array(); 1650 $response->response_code = $error; 1651 $response->results = false; 1652 $response->error = $error; 1653 return $response; 1654 } 1655 1656 if ($tofile) { 1657 $content = true; 1658 } 1659 1660 if (empty($info['http_code'])) { 1661 // For security reasons we support only true http connections (Location: file:// exploit prevention). 1662 $response = new stdClass(); 1663 $response->status = '0'; 1664 $response->headers = array(); 1665 $response->response_code = 'Unknown cURL error'; 1666 $response->results = false; // do NOT change this, we really want to ignore the result! 1667 $response->error = 'Unknown cURL error'; 1668 1669 } else { 1670 $response = new stdClass(); 1671 $response->status = (string)$info['http_code']; 1672 $response->headers = $rawheaders; 1673 $response->results = $content; 1674 $response->error = ''; 1675 1676 // There might be multiple headers on redirect, find the status of the last one. 1677 $firstline = true; 1678 foreach ($rawheaders as $line) { 1679 if ($firstline) { 1680 $response->response_code = $line; 1681 $firstline = false; 1682 } 1683 if (trim($line, "\r\n") === '') { 1684 $firstline = true; 1685 } 1686 } 1687 } 1688 1689 if ($fullresponse) { 1690 return $response; 1691 } 1692 1693 if ($info['http_code'] != 200) { 1694 debugging("cURL request for \"$url\" failed, HTTP response code: ".$response->response_code, DEBUG_ALL); 1695 return false; 1696 } 1697 return $response->results; 1698 } 1699 1700 /** 1701 * Returns a list of information about file types based on extensions. 1702 * 1703 * The following elements expected in value array for each extension: 1704 * 'type' - mimetype 1705 * 'icon' - location of the icon file. If value is FILENAME, then either pix/f/FILENAME.gif 1706 * or pix/f/FILENAME.png must be present in moodle and contain 16x16 filetype icon; 1707 * also files with bigger sizes under names 1708 * FILENAME-24, FILENAME-32, FILENAME-64, FILENAME-128, FILENAME-256 are recommended. 1709 * 'groups' (optional) - array of filetype groups this filetype extension is part of; 1710 * commonly used in moodle the following groups: 1711 * - web_image - image that can be included as <img> in HTML 1712 * - image - image that we can parse using GD to find it's dimensions, also used for portfolio format 1713 * - optimised_image - image that will be processed and optimised 1714 * - video - file that can be imported as video in text editor 1715 * - audio - file that can be imported as audio in text editor 1716 * - archive - we can extract files from this archive 1717 * - spreadsheet - used for portfolio format 1718 * - document - used for portfolio format 1719 * - presentation - used for portfolio format 1720 * 'string' (optional) - the name of the string from lang/en/mimetypes.php that displays 1721 * human-readable description for this filetype; 1722 * Function {@link get_mimetype_description()} first looks at the presence of string for 1723 * particular mimetype (value of 'type'), if not found looks for string specified in 'string' 1724 * attribute, if not found returns the value of 'type'; 1725 * 'defaulticon' (boolean, optional) - used by function {@link file_mimetype_icon()} to find 1726 * an icon for mimetype. If an entry with 'defaulticon' is not found for a particular mimetype, 1727 * this function will return first found icon; Especially usefull for types such as 'text/plain' 1728 * 1729 * @category files 1730 * @return array List of information about file types based on extensions. 1731 * Associative array of extension (lower-case) to associative array 1732 * from 'element name' to data. Current element names are 'type' and 'icon'. 1733 * Unknown types should use the 'xxx' entry which includes defaults. 1734 */ 1735 function &get_mimetypes_array() { 1736 // Get types from the core_filetypes function, which includes caching. 1737 return core_filetypes::get_types(); 1738 } 1739 1740 /** 1741 * Determine a file's MIME type based on the given filename using the function mimeinfo. 1742 * 1743 * This function retrieves a file's MIME type for a file that will be sent to the user. 1744 * This should only be used for file-sending purposes just like in send_stored_file, send_file, and send_temp_file. 1745 * Should the file's MIME type cannot be determined by mimeinfo, it will return 'application/octet-stream' as a default 1746 * MIME type which should tell the browser "I don't know what type of file this is, so just download it.". 1747 * 1748 * @param string $filename The file's filename. 1749 * @return string The file's MIME type or 'application/octet-stream' if it cannot be determined. 1750 */ 1751 function get_mimetype_for_sending($filename = '') { 1752 // Guess the file's MIME type using mimeinfo. 1753 $mimetype = mimeinfo('type', $filename); 1754 1755 // Use octet-stream as fallback if MIME type cannot be determined by mimeinfo. 1756 if (!$mimetype || $mimetype === 'document/unknown') { 1757 $mimetype = 'application/octet-stream'; 1758 } 1759 1760 return $mimetype; 1761 } 1762 1763 /** 1764 * Obtains information about a filetype based on its extension. Will 1765 * use a default if no information is present about that particular 1766 * extension. 1767 * 1768 * @category files 1769 * @param string $element Desired information (usually 'icon' 1770 * for icon filename or 'type' for MIME type. Can also be 1771 * 'icon24', ...32, 48, 64, 72, 80, 96, 128, 256) 1772 * @param string $filename Filename we're looking up 1773 * @return string Requested piece of information from array 1774 */ 1775 function mimeinfo($element, $filename) { 1776 global $CFG; 1777 $mimeinfo = & get_mimetypes_array(); 1778 static $iconpostfixes = array(256=>'-256', 128=>'-128', 96=>'-96', 80=>'-80', 72=>'-72', 64=>'-64', 48=>'-48', 32=>'-32', 24=>'-24', 16=>''); 1779 1780 $filetype = strtolower(pathinfo($filename ?? '', PATHINFO_EXTENSION)); 1781 if (empty($filetype)) { 1782 $filetype = 'xxx'; // file without extension 1783 } 1784 if (preg_match('/^icon(\d*)$/', $element, $iconsizematch)) { 1785 $iconsize = max(array(16, (int)$iconsizematch[1])); 1786 $filenames = array($mimeinfo['xxx']['icon']); 1787 if ($filetype != 'xxx' && isset($mimeinfo[$filetype]['icon'])) { 1788 array_unshift($filenames, $mimeinfo[$filetype]['icon']); 1789 } 1790 // find the file with the closest size, first search for specific icon then for default icon 1791 foreach ($filenames as $filename) { 1792 foreach ($iconpostfixes as $size => $postfix) { 1793 $fullname = $CFG->dirroot.'/pix/f/'.$filename.$postfix; 1794 if ($iconsize >= $size && 1795 (file_exists($fullname.'.svg') || file_exists($fullname.'.png') || file_exists($fullname.'.gif'))) { 1796 return $filename.$postfix; 1797 } 1798 } 1799 } 1800 } else if (isset($mimeinfo[$filetype][$element])) { 1801 return $mimeinfo[$filetype][$element]; 1802 } else if (isset($mimeinfo['xxx'][$element])) { 1803 return $mimeinfo['xxx'][$element]; // By default 1804 } else { 1805 return null; 1806 } 1807 } 1808 1809 /** 1810 * Obtains information about a filetype based on the MIME type rather than 1811 * the other way around. 1812 * 1813 * @category files 1814 * @param string $element Desired information ('extension', 'icon', etc.) 1815 * @param string $mimetype MIME type we're looking up 1816 * @return string Requested piece of information from array 1817 */ 1818 function mimeinfo_from_type($element, $mimetype) { 1819 /* array of cached mimetype->extension associations */ 1820 static $cached = array(); 1821 $mimeinfo = & get_mimetypes_array(); 1822 1823 if (!array_key_exists($mimetype, $cached)) { 1824 $cached[$mimetype] = null; 1825 foreach($mimeinfo as $filetype => $values) { 1826 if ($values['type'] == $mimetype) { 1827 if ($cached[$mimetype] === null) { 1828 $cached[$mimetype] = '.'.$filetype; 1829 } 1830 if (!empty($values['defaulticon'])) { 1831 $cached[$mimetype] = '.'.$filetype; 1832 break; 1833 } 1834 } 1835 } 1836 if (empty($cached[$mimetype])) { 1837 $cached[$mimetype] = '.xxx'; 1838 } 1839 } 1840 if ($element === 'extension') { 1841 return $cached[$mimetype]; 1842 } else { 1843 return mimeinfo($element, $cached[$mimetype]); 1844 } 1845 } 1846 1847 /** 1848 * Return the relative icon path for a given file 1849 * 1850 * Usage: 1851 * <code> 1852 * // $file - instance of stored_file or file_info 1853 * $icon = $OUTPUT->image_url(file_file_icon($file))->out(); 1854 * echo html_writer::empty_tag('img', array('src' => $icon, 'alt' => get_mimetype_description($file))); 1855 * </code> 1856 * or 1857 * <code> 1858 * echo $OUTPUT->pix_icon(file_file_icon($file), get_mimetype_description($file)); 1859 * </code> 1860 * 1861 * @param stored_file|file_info|stdClass|array $file (in case of object attributes $file->filename 1862 * and $file->mimetype are expected) 1863 * @param null $unused This parameter has been deprecated since 4.3 and should not be used anymore. 1864 * @return string 1865 */ 1866 function file_file_icon($file, $unused = null) { 1867 if ($unused !== null) { 1868 debugging('Deprecated argument passed to ' . __FUNCTION__, DEBUG_DEVELOPER); 1869 } 1870 1871 if (!is_object($file)) { 1872 $file = (object)$file; 1873 } 1874 if (isset($file->filename)) { 1875 $filename = $file->filename; 1876 } else if (method_exists($file, 'get_filename')) { 1877 $filename = $file->get_filename(); 1878 } else if (method_exists($file, 'get_visible_name')) { 1879 $filename = $file->get_visible_name(); 1880 } else { 1881 $filename = ''; 1882 } 1883 if (isset($file->mimetype)) { 1884 $mimetype = $file->mimetype; 1885 } else if (method_exists($file, 'get_mimetype')) { 1886 $mimetype = $file->get_mimetype(); 1887 } else { 1888 $mimetype = ''; 1889 } 1890 $mimetypes = &get_mimetypes_array(); 1891 if ($filename) { 1892 $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); 1893 if ($extension && !empty($mimetypes[$extension])) { 1894 // if file name has known extension, return icon for this extension 1895 return file_extension_icon($filename); 1896 } 1897 } 1898 return file_mimetype_icon($mimetype); 1899 } 1900 1901 /** 1902 * Return the relative icon path for a folder image. 1903 * 1904 * Usage: 1905 * <code> 1906 * $icon = $OUTPUT->image_url(file_folder_icon())->out(); 1907 * echo html_writer::empty_tag('img', array('src' => $icon)); 1908 * </code> 1909 * or 1910 * <code> 1911 * echo $OUTPUT->pix_icon(file_folder_icon(), ''); 1912 * </code> 1913 * 1914 * @param null $unused This parameter has been deprecated since 4.3 and should not be used anymore. 1915 * @return string 1916 */ 1917 function file_folder_icon($unused = null) { 1918 global $CFG; 1919 1920 if ($unused !== null) { 1921 debugging('Deprecated argument passed to ' . __FUNCTION__, DEBUG_DEVELOPER); 1922 } 1923 1924 return 'f/folder'; 1925 } 1926 1927 /** 1928 * Returns the relative icon path for a given mime type 1929 * 1930 * This function should be used in conjunction with $OUTPUT->image_url to produce 1931 * a return the full path to an icon. 1932 * 1933 * <code> 1934 * $mimetype = 'image/jpg'; 1935 * $icon = $OUTPUT->image_url(file_mimetype_icon($mimetype))->out(); 1936 * echo html_writer::empty_tag('img', array('src' => $icon, 'alt' => get_mimetype_description($mimetype))); 1937 * </code> 1938 * 1939 * @category files 1940 * @todo MDL-31074 When an $OUTPUT->icon method is available this function should be altered 1941 * to conform with that. 1942 * @param string $mimetype The mimetype to fetch an icon for 1943 * @param null $unused This parameter has been deprecated since 4.3 and should not be used anymore. 1944 * @return string The relative path to the icon 1945 */ 1946 function file_mimetype_icon($mimetype, $unused = null) { 1947 return 'f/'.mimeinfo_from_type('icon', $mimetype); 1948 } 1949 1950 /** 1951 * Returns the relative icon path for a given file name 1952 * 1953 * This function should be used in conjunction with $OUTPUT->image_url to produce 1954 * a return the full path to an icon. 1955 * 1956 * <code> 1957 * $filename = '.jpg'; 1958 * $icon = $OUTPUT->image_url(file_extension_icon($filename))->out(); 1959 * echo html_writer::empty_tag('img', array('src' => $icon, 'alt' => '...')); 1960 * </code> 1961 * 1962 * @todo MDL-31074 When an $OUTPUT->icon method is available this function should be altered 1963 * to conform with that. 1964 * @todo MDL-31074 Implement $size 1965 * @category files 1966 * @param string $filename The filename to get the icon for 1967 * @param null $unused This parameter has been deprecated since 4.3 and should not be used anymore. 1968 * @return string 1969 */ 1970 function file_extension_icon($filename, $unused = null) { 1971 if ($unused !== null) { 1972 debugging('Deprecated argument passed to ' . __FUNCTION__, DEBUG_DEVELOPER); 1973 } 1974 return 'f/'.mimeinfo('icon', $filename); 1975 } 1976 1977 /** 1978 * Obtains descriptions for file types (e.g. 'Microsoft Word document') from the 1979 * mimetypes.php language file. 1980 * 1981 * @param mixed $obj - instance of stored_file or file_info or array/stdClass with field 1982 * 'filename' and 'mimetype', or just a string with mimetype (though it is recommended to 1983 * have filename); In case of array/stdClass the field 'mimetype' is optional. 1984 * @param bool $capitalise If true, capitalises first character of result 1985 * @return string Text description 1986 */ 1987 function get_mimetype_description($obj, $capitalise=false) { 1988 $filename = $mimetype = ''; 1989 if (is_object($obj) && method_exists($obj, 'get_filename') && method_exists($obj, 'get_mimetype')) { 1990 // this is an instance of stored_file 1991 $mimetype = $obj->get_mimetype(); 1992 $filename = $obj->get_filename(); 1993 } else if (is_object($obj) && method_exists($obj, 'get_visible_name') && method_exists($obj, 'get_mimetype')) { 1994 // this is an instance of file_info 1995 $mimetype = $obj->get_mimetype(); 1996 $filename = $obj->get_visible_name(); 1997 } else if (is_array($obj) || is_object ($obj)) { 1998 $obj = (array)$obj; 1999 if (!empty($obj['filename'])) { 2000 $filename = $obj['filename']; 2001 } 2002 if (!empty($obj['mimetype'])) { 2003 $mimetype = $obj['mimetype']; 2004 } 2005 } else { 2006 $mimetype = $obj; 2007 } 2008 $mimetypefromext = mimeinfo('type', $filename); 2009 if (empty($mimetype) || $mimetypefromext !== 'document/unknown') { 2010 // if file has a known extension, overwrite the specified mimetype 2011 $mimetype = $mimetypefromext; 2012 } 2013 $extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION)); 2014 if (empty($extension)) { 2015 $mimetypestr = mimeinfo_from_type('string', $mimetype); 2016 $extension = str_replace('.', '', mimeinfo_from_type('extension', $mimetype)); 2017 } else { 2018 $mimetypestr = mimeinfo('string', $filename); 2019 } 2020 $chunks = explode('/', $mimetype, 2); 2021 $chunks[] = ''; 2022 $attr = array( 2023 'mimetype' => $mimetype, 2024 'ext' => $extension, 2025 'mimetype1' => $chunks[0], 2026 'mimetype2' => $chunks[1], 2027 ); 2028 $a = array(); 2029 foreach ($attr as $key => $value) { 2030 $a[$key] = $value; 2031 $a[strtoupper($key)] = strtoupper($value); 2032 $a[ucfirst($key)] = ucfirst($value); 2033 } 2034 2035 // MIME types may include + symbol but this is not permitted in string ids. 2036 $safemimetype = str_replace('+', '_', $mimetype ?? ''); 2037 $safemimetypestr = str_replace('+', '_', $mimetypestr ?? ''); 2038 $customdescription = mimeinfo('customdescription', $filename); 2039 if ($customdescription) { 2040 // Call format_string on the custom description so that multilang 2041 // filter can be used (if enabled on system context). We use system 2042 // context because it is possible that the page context might not have 2043 // been defined yet. 2044 $result = format_string($customdescription, true, 2045 array('context' => context_system::instance())); 2046 } else if (get_string_manager()->string_exists($safemimetype, 'mimetypes')) { 2047 $result = get_string($safemimetype, 'mimetypes', (object)$a); 2048 } else if (get_string_manager()->string_exists($safemimetypestr, 'mimetypes')) { 2049 $result = get_string($safemimetypestr, 'mimetypes', (object)$a); 2050 } else if (get_string_manager()->string_exists('default', 'mimetypes')) { 2051 $result = get_string('default', 'mimetypes', (object)$a); 2052 } else { 2053 $result = $mimetype; 2054 } 2055 if ($capitalise) { 2056 $result=ucfirst($result); 2057 } 2058 return $result; 2059 } 2060 2061 /** 2062 * Returns array of elements of type $element in type group(s) 2063 * 2064 * @param string $element name of the element we are interested in, usually 'type' or 'extension' 2065 * @param string|array $groups one group or array of groups/extensions/mimetypes 2066 * @return array 2067 */ 2068 function file_get_typegroup($element, $groups) { 2069 static $cached = array(); 2070 2071 // Turn groups into a list. 2072 if (!is_array($groups)) { 2073 $groups = preg_split('/[\s,;:"\']+/', $groups, -1, PREG_SPLIT_NO_EMPTY); 2074 } 2075 2076 if (!array_key_exists($element, $cached)) { 2077 $cached[$element] = array(); 2078 } 2079 $result = array(); 2080 foreach ($groups as $group) { 2081 if (!array_key_exists($group, $cached[$element])) { 2082 // retrieive and cache all elements of type $element for group $group 2083 $mimeinfo = & get_mimetypes_array(); 2084 $cached[$element][$group] = array(); 2085 foreach ($mimeinfo as $extension => $value) { 2086 $value['extension'] = '.'.$extension; 2087 if (empty($value[$element])) { 2088 continue; 2089 } 2090 if (($group === '.'.$extension || $group === $value['type'] || 2091 (!empty($value['groups']) && in_array($group, $value['groups']))) && 2092 !in_array($value[$element], $cached[$element][$group])) { 2093 $cached[$element][$group][] = $value[$element]; 2094 } 2095 } 2096 } 2097 $result = array_merge($result, $cached[$element][$group]); 2098 } 2099 return array_values(array_unique($result)); 2100 } 2101 2102 /** 2103 * Checks if file with name $filename has one of the extensions in groups $groups 2104 * 2105 * @see get_mimetypes_array() 2106 * @param string $filename name of the file to check 2107 * @param string|array $groups one group or array of groups to check 2108 * @param bool $checktype if true and extension check fails, find the mimetype and check if 2109 * file mimetype is in mimetypes in groups $groups 2110 * @return bool 2111 */ 2112 function file_extension_in_typegroup($filename, $groups, $checktype = false) { 2113 $extension = pathinfo($filename, PATHINFO_EXTENSION); 2114 if (!empty($extension) && in_array('.'.strtolower($extension), file_get_typegroup('extension', $groups))) { 2115 return true; 2116 } 2117 return $checktype && file_mimetype_in_typegroup(mimeinfo('type', $filename), $groups); 2118 } 2119 2120 /** 2121 * Checks if mimetype $mimetype belongs to one of the groups $groups 2122 * 2123 * @see get_mimetypes_array() 2124 * @param string $mimetype 2125 * @param string|array $groups one group or array of groups to check 2126 * @return bool 2127 */ 2128 function file_mimetype_in_typegroup($mimetype, $groups) { 2129 return !empty($mimetype) && in_array($mimetype, file_get_typegroup('type', $groups)); 2130 } 2131 2132 /** 2133 * Requested file is not found or not accessible, does not return, terminates script 2134 * 2135 * @global stdClass $CFG 2136 * @global stdClass $COURSE 2137 */ 2138 function send_file_not_found() { 2139 global $CFG, $COURSE; 2140 2141 // Allow cross-origin requests only for Web Services. 2142 // This allow to receive requests done by Web Workers or webapps in different domains. 2143 if (WS_SERVER) { 2144 header('Access-Control-Allow-Origin: *'); 2145 } 2146 2147 send_header_404(); 2148 throw new \moodle_exception('filenotfound', 'error', 2149 $CFG->wwwroot.'/course/view.php?id='.$COURSE->id); // This is not displayed on IIS? 2150 } 2151 /** 2152 * Helper function to send correct 404 for server. 2153 */ 2154 function send_header_404() { 2155 if (substr(php_sapi_name(), 0, 3) == 'cgi') { 2156 header("Status: 404 Not Found"); 2157 } else { 2158 header('HTTP/1.0 404 not found'); 2159 } 2160 } 2161 2162 /** 2163 * The readfile function can fail when files are larger than 2GB (even on 64-bit 2164 * platforms). This wrapper uses readfile for small files and custom code for 2165 * large ones. 2166 * 2167 * @param string $path Path to file 2168 * @param int $filesize Size of file (if left out, will get it automatically) 2169 * @return int|bool Size read (will always be $filesize) or false if failed 2170 */ 2171 function readfile_allow_large($path, $filesize = -1) { 2172 // Automatically get size if not specified. 2173 if ($filesize === -1) { 2174 $filesize = filesize($path); 2175 } 2176 if ($filesize <= 2147483647) { 2177 // If the file is up to 2^31 - 1, send it normally using readfile. 2178 return readfile($path); 2179 } else { 2180 // For large files, read and output in 64KB chunks. 2181 $handle = fopen($path, 'r'); 2182 if ($handle === false) { 2183 return false; 2184 } 2185 $left = $filesize; 2186 while ($left > 0) { 2187 $size = min($left, 65536); 2188 $buffer = fread($handle, $size); 2189 if ($buffer === false) { 2190 return false; 2191 } 2192 echo $buffer; 2193 $left -= $size; 2194 } 2195 return $filesize; 2196 } 2197 } 2198 2199 /** 2200 * Enhanced readfile() with optional acceleration. 2201 * @param string|stored_file $file 2202 * @param string $mimetype 2203 * @param bool $accelerate 2204 * @return void 2205 */ 2206 function readfile_accel($file, $mimetype, $accelerate) { 2207 global $CFG; 2208 2209 if ($mimetype === 'text/plain') { 2210 // there is no encoding specified in text files, we need something consistent 2211 header('Content-Type: text/plain; charset=utf-8'); 2212 } else { 2213 header('Content-Type: '.$mimetype); 2214 } 2215 2216 $lastmodified = is_object($file) ? $file->get_timemodified() : filemtime($file); 2217 header('Last-Modified: '. gmdate('D, d M Y H:i:s', $lastmodified) .' GMT'); 2218 2219 if (is_object($file)) { 2220 header('Etag: "' . $file->get_contenthash() . '"'); 2221 if (isset($_SERVER['HTTP_IF_NONE_MATCH']) and trim($_SERVER['HTTP_IF_NONE_MATCH'], '"') === $file->get_contenthash()) { 2222 header('HTTP/1.1 304 Not Modified'); 2223 return; 2224 } 2225 } 2226 2227 // if etag present for stored file rely on it exclusively 2228 if (!empty($_SERVER['HTTP_IF_MODIFIED_SINCE']) and (empty($_SERVER['HTTP_IF_NONE_MATCH']) or !is_object($file))) { 2229 // get unixtime of request header; clip extra junk off first 2230 $since = strtotime(preg_replace('/;.*$/', '', $_SERVER["HTTP_IF_MODIFIED_SINCE"])); 2231 if ($since && $since >= $lastmodified) { 2232 header('HTTP/1.1 304 Not Modified'); 2233 return; 2234 } 2235 } 2236 2237 if ($accelerate and empty($CFG->disablebyteserving) and $mimetype !== 'text/plain') { 2238 header('Accept-Ranges: bytes'); 2239 } else { 2240 header('Accept-Ranges: none'); 2241 } 2242 2243 if ($accelerate) { 2244 if (is_object($file)) { 2245 $fs = get_file_storage(); 2246 if ($fs->supports_xsendfile()) { 2247 if ($fs->xsendfile_file($file)) { 2248 return; 2249 } 2250 } 2251 } else { 2252 if (!empty($CFG->xsendfile)) { 2253 require_once("$CFG->libdir/xsendfilelib.php"); 2254 if (xsendfile($file)) { 2255 return; 2256 } 2257 } 2258 } 2259 } 2260 2261 $filesize = is_object($file) ? $file->get_filesize() : filesize($file); 2262 2263 header('Last-Modified: '. gmdate('D, d M Y H:i:s', $lastmodified) .' GMT'); 2264 2265 if ($accelerate and empty($CFG->disablebyteserving) and $mimetype !== 'text/plain') { 2266 2267 if (!empty($_SERVER['HTTP_RANGE']) and strpos($_SERVER['HTTP_RANGE'],'bytes=') !== FALSE) { 2268 // byteserving stuff - for acrobat reader and download accelerators 2269 // see: http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.35 2270 // inspired by: http://www.coneural.org/florian/papers/04_byteserving.php 2271 $ranges = false; 2272 if (preg_match_all('/(\d*)-(\d*)/', $_SERVER['HTTP_RANGE'], $ranges, PREG_SET_ORDER)) { 2273 foreach ($ranges as $key=>$value) { 2274 if ($ranges[$key][1] == '') { 2275 //suffix case 2276 $ranges[$key][1] = $filesize - $ranges[$key][2]; 2277 $ranges[$key][2] = $filesize - 1; 2278 } else if ($ranges[$key][2] == '' || $ranges[$key][2] > $filesize - 1) { 2279 //fix range length 2280 $ranges[$key][2] = $filesize - 1; 2281 } 2282 if ($ranges[$key][2] != '' && $ranges[$key][2] < $ranges[$key][1]) { 2283 //invalid byte-range ==> ignore header 2284 $ranges = false; 2285 break; 2286 } 2287 //prepare multipart header 2288 $ranges[$key][0] = "\r\n--".BYTESERVING_BOUNDARY."\r\nContent-Type: $mimetype\r\n"; 2289 $ranges[$key][0] .= "Content-Range: bytes {$ranges[$key][1]}-{$ranges[$key][2]}/$filesize\r\n\r\n"; 2290 } 2291 } else { 2292 $ranges = false; 2293 } 2294 if ($ranges) { 2295 if (is_object($file)) { 2296 $handle = $file->get_content_file_handle(); 2297 if ($handle === false) { 2298 throw new file_exception('storedfilecannotreadfile', $file->get_filename()); 2299 } 2300 } else { 2301 $handle = fopen($file, 'rb'); 2302 if ($handle === false) { 2303 throw new file_exception('cannotopenfile', $file); 2304 } 2305 } 2306 byteserving_send_file($handle, $mimetype, $ranges, $filesize); 2307 } 2308 } 2309 } 2310 2311 header('Content-Length: ' . $filesize); 2312 2313 if (!empty($_SERVER['REQUEST_METHOD']) and $_SERVER['REQUEST_METHOD'] === 'HEAD') { 2314 exit; 2315 } 2316 2317 while (ob_get_level()) { 2318 $handlerstack = ob_list_handlers(); 2319 $activehandler = array_pop($handlerstack); 2320 if ($activehandler === 'default output handler') { 2321 // We do not expect any content in the buffer when we are serving files. 2322 $buffercontents = ob_get_clean(); 2323 if ($buffercontents !== '') { 2324 error_log('Non-empty default output handler buffer detected while serving the file ' . $file); 2325 } 2326 } else { 2327 // Some handlers such as zlib output compression may have file signature buffered - flush it. 2328 ob_end_flush(); 2329 } 2330 } 2331 2332 // send the whole file content 2333 if (is_object($file)) { 2334 $file->readfile(); 2335 } else { 2336 if (readfile_allow_large($file, $filesize) === false) { 2337 throw new file_exception('cannotopenfile', $file); 2338 } 2339 } 2340 } 2341 2342 /** 2343 * Similar to readfile_accel() but designed for strings. 2344 * @param string $string 2345 * @param string $mimetype 2346 * @param bool $accelerate Ignored 2347 * @return void 2348 */ 2349 function readstring_accel($string, $mimetype, $accelerate = false) { 2350 global $CFG; 2351 2352 if ($mimetype === 'text/plain') { 2353 // there is no encoding specified in text files, we need something consistent 2354 header('Content-Type: text/plain; charset=utf-8'); 2355 } else { 2356 header('Content-Type: '.$mimetype); 2357 } 2358 header('Last-Modified: '. gmdate('D, d M Y H:i:s', time()) .' GMT'); 2359 header('Accept-Ranges: none'); 2360 header('Content-Length: '.strlen($string)); 2361 echo $string; 2362 } 2363 2364 /** 2365 * Handles the sending of temporary file to user, download is forced. 2366 * File is deleted after abort or successful sending, does not return, script terminated 2367 * 2368 * @param string $path path to file, preferably from moodledata/temp/something; or content of file itself 2369 * @param string $filename proposed file name when saving file 2370 * @param bool $pathisstring If the path is string 2371 */ 2372 function send_temp_file($path, $filename, $pathisstring=false) { 2373 global $CFG; 2374 2375 // Guess the file's MIME type. 2376 $mimetype = get_mimetype_for_sending($filename); 2377 2378 // close session - not needed anymore 2379 \core\session\manager::write_close(); 2380 2381 if (!$pathisstring) { 2382 if (!file_exists($path)) { 2383 send_header_404(); 2384 throw new \moodle_exception('filenotfound', 'error', $CFG->wwwroot.'/'); 2385 } 2386 // executed after normal finish or abort 2387 core_shutdown_manager::register_function('send_temp_file_finished', array($path)); 2388 } 2389 2390 // if user is using IE, urlencode the filename so that multibyte file name will show up correctly on popup 2391 if (core_useragent::is_ie() || core_useragent::is_edge()) { 2392 $filename = urlencode($filename); 2393 } 2394 2395 // If this file was requested from a form, then mark download as complete. 2396 \core_form\util::form_download_complete(); 2397 2398 header('Content-Disposition: attachment; filename="'.$filename.'"'); 2399 if (is_https()) { // HTTPS sites - watch out for IE! KB812935 and KB316431. 2400 header('Cache-Control: private, max-age=10, no-transform'); 2401 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2402 header('Pragma: '); 2403 } else { //normal http - prevent caching at all cost 2404 header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); 2405 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2406 header('Pragma: no-cache'); 2407 } 2408 2409 // send the contents - we can not accelerate this because the file will be deleted asap 2410 if ($pathisstring) { 2411 readstring_accel($path, $mimetype); 2412 } else { 2413 readfile_accel($path, $mimetype, false); 2414 @unlink($path); 2415 } 2416 2417 die; //no more chars to output 2418 } 2419 2420 /** 2421 * Internal callback function used by send_temp_file() 2422 * 2423 * @param string $path 2424 */ 2425 function send_temp_file_finished($path) { 2426 if (file_exists($path)) { 2427 @unlink($path); 2428 } 2429 } 2430 2431 /** 2432 * Serve content which is not meant to be cached. 2433 * 2434 * This is only intended to be used for volatile public files, for instance 2435 * when development is enabled, or when caching is not required on a public resource. 2436 * 2437 * @param string $content Raw content. 2438 * @param string $filename The file name. 2439 * @return void 2440 */ 2441 function send_content_uncached($content, $filename) { 2442 $mimetype = mimeinfo('type', $filename); 2443 $charset = strpos($mimetype, 'text/') === 0 ? '; charset=utf-8' : ''; 2444 2445 header('Content-Disposition: inline; filename="' . $filename . '"'); 2446 header('Last-Modified: ' . gmdate('D, d M Y H:i:s', time()) . ' GMT'); 2447 header('Expires: ' . gmdate('D, d M Y H:i:s', time() + 2) . ' GMT'); 2448 header('Pragma: '); 2449 header('Accept-Ranges: none'); 2450 header('Content-Type: ' . $mimetype . $charset); 2451 header('Content-Length: ' . strlen($content)); 2452 2453 echo $content; 2454 die(); 2455 } 2456 2457 /** 2458 * Safely save content to a certain path. 2459 * 2460 * This function tries hard to be atomic by first copying the content 2461 * to a separate file, and then moving the file across. It also prevents 2462 * the user to abort a request to prevent half-safed files. 2463 * 2464 * This function is intended to be used when saving some content to cache like 2465 * $CFG->localcachedir. If you're not caching a file you should use the File API. 2466 * 2467 * @param string $content The file content. 2468 * @param string $destination The absolute path of the final file. 2469 * @return void 2470 */ 2471 function file_safe_save_content($content, $destination) { 2472 global $CFG; 2473 2474 clearstatcache(); 2475 if (!file_exists(dirname($destination))) { 2476 @mkdir(dirname($destination), $CFG->directorypermissions, true); 2477 } 2478 2479 // Prevent serving of incomplete file from concurrent request, 2480 // the rename() should be more atomic than fwrite(). 2481 ignore_user_abort(true); 2482 if ($fp = fopen($destination . '.tmp', 'xb')) { 2483 fwrite($fp, $content); 2484 fclose($fp); 2485 rename($destination . '.tmp', $destination); 2486 @chmod($destination, $CFG->filepermissions); 2487 @unlink($destination . '.tmp'); // Just in case anything fails. 2488 } 2489 ignore_user_abort(false); 2490 if (connection_aborted()) { 2491 die(); 2492 } 2493 } 2494 2495 /** 2496 * Handles the sending of file data to the user's browser, including support for 2497 * byteranges etc. 2498 * 2499 * @category files 2500 * @param string|stored_file $path Path of file on disk (including real filename), 2501 * or actual content of file as string, 2502 * or stored_file object 2503 * @param string $filename Filename to send 2504 * @param int $lifetime Number of seconds before the file should expire from caches (null means $CFG->filelifetime) 2505 * @param int $filter 0 (default)=no filtering, 1=all files, 2=html files only 2506 * @param bool $pathisstring If true (default false), $path is the content to send and not the pathname. 2507 * Forced to false when $path is a stored_file object. 2508 * @param bool $forcedownload If true (default false), forces download of file rather than view in browser/plugin 2509 * @param string $mimetype Include to specify the MIME type; leave blank to have it guess the type from $filename 2510 * @param bool $dontdie - return control to caller afterwards. this is not recommended and only used for cleanup tasks. 2511 * if this is passed as true, ignore_user_abort is called. if you don't want your processing to continue on cancel, 2512 * you must detect this case when control is returned using connection_aborted. Please not that session is closed 2513 * and should not be reopened. 2514 * @param array $options An array of options, currently accepts: 2515 * - (string) cacheability: public, or private. 2516 * - (string|null) immutable 2517 * - (bool) dontforcesvgdownload: true if force download should be disabled on SVGs. 2518 * Note: This overrides a security feature, so should only be applied to "trusted" content 2519 * (eg module content that is created using an XSS risk flagged capability, such as SCORM). 2520 * @return null script execution stopped unless $dontdie is true 2521 */ 2522 function send_file($path, $filename, $lifetime = null , $filter=0, $pathisstring=false, $forcedownload=false, $mimetype='', 2523 $dontdie=false, array $options = array()) { 2524 global $CFG, $COURSE; 2525 2526 if ($dontdie) { 2527 ignore_user_abort(true); 2528 } 2529 2530 if ($lifetime === 'default' or is_null($lifetime)) { 2531 $lifetime = $CFG->filelifetime; 2532 } 2533 2534 if (is_object($path)) { 2535 $pathisstring = false; 2536 } 2537 2538 \core\session\manager::write_close(); // Unlock session during file serving. 2539 2540 // Use given MIME type if specified, otherwise guess it. 2541 if (!$mimetype || $mimetype === 'document/unknown') { 2542 $mimetype = get_mimetype_for_sending($filename); 2543 } 2544 2545 // if user is using IE, urlencode the filename so that multibyte file name will show up correctly on popup 2546 if (core_useragent::is_ie() || core_useragent::is_edge()) { 2547 $filename = rawurlencode($filename); 2548 } 2549 2550 // Make sure we force download of SVG files, unless the module explicitly allows them (eg within SCORM content). 2551 // This is for security reasons (https://digi.ninja/blog/svg_xss.php). 2552 if (file_is_svg_image_from_mimetype($mimetype) && empty($options['dontforcesvgdownload'])) { 2553 $forcedownload = true; 2554 } 2555 2556 if ($forcedownload) { 2557 header('Content-Disposition: attachment; filename="'.$filename.'"'); 2558 2559 // If this file was requested from a form, then mark download as complete. 2560 \core_form\util::form_download_complete(); 2561 } else if ($mimetype !== 'application/x-shockwave-flash') { 2562 // If this is an swf don't pass content-disposition with filename as this makes the flash player treat the file 2563 // as an upload and enforces security that may prevent the file from being loaded. 2564 2565 header('Content-Disposition: inline; filename="'.$filename.'"'); 2566 } 2567 2568 if ($lifetime > 0) { 2569 $immutable = ''; 2570 if (!empty($options['immutable'])) { 2571 $immutable = ', immutable'; 2572 // Overwrite lifetime accordingly: 2573 // 90 days only - based on Moodle point release cadence being every 3 months. 2574 $lifetimemin = 60 * 60 * 24 * 90; 2575 $lifetime = max($lifetime, $lifetimemin); 2576 } 2577 $cacheability = ' public,'; 2578 if (!empty($options['cacheability']) && ($options['cacheability'] === 'public')) { 2579 // This file must be cache-able by both browsers and proxies. 2580 $cacheability = ' public,'; 2581 } else if (!empty($options['cacheability']) && ($options['cacheability'] === 'private')) { 2582 // This file must be cache-able only by browsers. 2583 $cacheability = ' private,'; 2584 } else if (isloggedin() and !isguestuser()) { 2585 // By default, under the conditions above, this file must be cache-able only by browsers. 2586 $cacheability = ' private,'; 2587 } 2588 $nobyteserving = false; 2589 header('Cache-Control:'.$cacheability.' max-age='.$lifetime.', no-transform'.$immutable); 2590 header('Expires: '. gmdate('D, d M Y H:i:s', time() + $lifetime) .' GMT'); 2591 header('Pragma: '); 2592 2593 } else { // Do not cache files in proxies and browsers 2594 $nobyteserving = true; 2595 if (is_https()) { // HTTPS sites - watch out for IE! KB812935 and KB316431. 2596 header('Cache-Control: private, max-age=10, no-transform'); 2597 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2598 header('Pragma: '); 2599 } else { //normal http - prevent caching at all cost 2600 header('Cache-Control: private, must-revalidate, pre-check=0, post-check=0, max-age=0, no-transform'); 2601 header('Expires: '. gmdate('D, d M Y H:i:s', 0) .' GMT'); 2602 header('Pragma: no-cache'); 2603 } 2604 } 2605 2606 if (empty($filter)) { 2607 // send the contents 2608 if ($pathisstring) { 2609 readstring_accel($path, $mimetype); 2610 } else { 2611 readfile_accel($path, $mimetype, !$dontdie); 2612 } 2613 2614 } else { 2615 // Try to put the file through filters 2616 if ($mimetype == 'text/html' || $mimetype == 'application/xhtml+xml' || file_is_svg_image_from_mimetype($mimetype)) { 2617 $options = new stdClass(); 2618 $options->noclean = true; 2619 $options->nocache = true; // temporary workaround for MDL-5136 2620 if (is_object($path)) { 2621 $text = $path->get_content(); 2622 } else if ($pathisstring) { 2623 $text = $path; 2624 } else { 2625 $text = implode('', file($path)); 2626 } 2627 $output = format_text($text, FORMAT_HTML, $options, $COURSE->id); 2628 2629 readstring_accel($output, $mimetype); 2630 2631 } else if (($mimetype == 'text/plain') and ($filter == 1)) { 2632 // only filter text if filter all files is selected 2633 $options = new stdClass(); 2634 $options->newlines = false; 2635 $options->noclean = true; 2636 if (is_object($path)) { 2637 $text = htmlentities($path->get_content(), ENT_QUOTES, 'UTF-8'); 2638 } else if ($pathisstring) { 2639 $text = htmlentities($path, ENT_QUOTES, 'UTF-8'); 2640 } else { 2641 $text = htmlentities(implode('', file($path)), ENT_QUOTES, 'UTF-8'); 2642 } 2643 $output = '<pre>'. format_text($text, FORMAT_MOODLE, $options, $COURSE->id) .'</pre>'; 2644 2645 readstring_accel($output, $mimetype); 2646 2647 } else { 2648 // send the contents 2649 if ($pathisstring) { 2650 readstring_accel($path, $mimetype); 2651 } else { 2652 readfile_accel($path, $mimetype, !$dontdie); 2653 } 2654 } 2655 } 2656 if ($dontdie) { 2657 return; 2658 } 2659 die; //no more chars to output!!! 2660 } 2661 2662 /** 2663 * Handles the sending of file data to the user's browser, including support for 2664 * byteranges etc. 2665 * 2666 * The $options parameter supports the following keys: 2667 * (string|null) preview - send the preview of the file (e.g. "thumb" for a thumbnail) 2668 * (string|null) filename - overrides the implicit filename 2669 * (bool) dontdie - return control to caller afterwards. this is not recommended and only used for cleanup tasks. 2670 * if this is passed as true, ignore_user_abort is called. if you don't want your processing to continue on cancel, 2671 * you must detect this case when control is returned using connection_aborted. Please not that session is closed 2672 * and should not be reopened 2673 * (string|null) cacheability - force the cacheability setting of the HTTP response, "private" or "public", 2674 * when $lifetime is greater than 0. Cacheability defaults to "private" when logged in as other than guest; otherwise, 2675 * defaults to "public". 2676 * (string|null) immutable - set the immutable cache setting in the HTTP response, when served under HTTPS. 2677 * Note: it's up to the consumer to set it properly i.e. when serving a "versioned" URL. 2678 * 2679 * @category files 2680 * @param stored_file $storedfile local file object 2681 * @param int $lifetime Number of seconds before the file should expire from caches (null means $CFG->filelifetime) 2682 * @param int $filter 0 (default)=no filtering, 1=all files, 2=html files only 2683 * @param bool $forcedownload If true (default false), forces download of file rather than view in browser/plugin 2684 * @param array $options additional options affecting the file serving 2685 * @return null script execution stopped unless $options['dontdie'] is true 2686 */ 2687 function send_stored_file($storedfile, $lifetime=null, $filter=0, $forcedownload=false, array $options=array()) { 2688 global $CFG, $COURSE; 2689 2690 static $recursion = 0; 2691 2692 if (empty($options['filename'])) { 2693 $filename = null; 2694 } else { 2695 $filename = $options['filename']; 2696 } 2697 2698 if (empty($options['dontdie'])) { 2699 $dontdie = false; 2700 } else { 2701 $dontdie = true; 2702 } 2703 2704 if ($lifetime === 'default' or is_null($lifetime)) { 2705 $lifetime = $CFG->filelifetime; 2706 } 2707 2708 if (!empty($options['preview'])) { 2709 // replace the file with its preview 2710 $fs = get_file_storage(); 2711 $previewfile = $fs->get_file_preview($storedfile, $options['preview']); 2712 if (!$previewfile) { 2713 // Unable to create a preview of the file, send its default mime icon instead. 2714 $fileicon = file_file_icon($storedfile); 2715 send_file($CFG->dirroot.'/pix/'.$fileicon.'.svg', basename($fileicon).'.svg'); 2716 } else { 2717 // preview images have fixed cache lifetime and they ignore forced download 2718 // (they are generated by GD and therefore they are considered reasonably safe). 2719 $storedfile = $previewfile; 2720 $lifetime = DAYSECS; 2721 $filter = 0; 2722 $forcedownload = false; 2723 } 2724 } 2725 2726 // handle external resource 2727 if ($storedfile && $storedfile->is_external_file() && !isset($options['sendcachedexternalfile'])) { 2728 2729 // Have we been here before? 2730 $recursion++; 2731 if ($recursion > 10) { 2732 throw new coding_exception('Recursive file serving detected'); 2733 } 2734 2735 $storedfile->send_file($lifetime, $filter, $forcedownload, $options); 2736 die; 2737 } 2738 2739 if (!$storedfile || $storedfile->is_directory()) { 2740 // Nothing to serve. 2741 if ($dontdie) { 2742 return; 2743 } 2744 die; 2745 } 2746 2747 $filename = is_null($filename) ? $storedfile->get_filename() : $filename; 2748 2749 // Use given MIME type if specified. 2750 $mimetype = $storedfile->get_mimetype(); 2751 2752 // Allow cross-origin requests only for Web Services. 2753 // This allow to receive requests done by Web Workers or webapps in different domains. 2754 if (WS_SERVER) { 2755 header('Access-Control-Allow-Origin: *'); 2756 } 2757 2758 send_file($storedfile, $filename, $lifetime, $filter, false, $forcedownload, $mimetype, $dontdie, $options); 2759 } 2760 2761 /** 2762 * Recursively delete the file or folder with path $location. That is, 2763 * if it is a file delete it. If it is a folder, delete all its content 2764 * then delete it. If $location does not exist to start, that is not 2765 * considered an error. 2766 * 2767 * @param string $location the path to remove. 2768 * @return bool 2769 */ 2770 function fulldelete($location) { 2771 if (empty($location)) { 2772 // extra safety against wrong param 2773 return false; 2774 } 2775 if (is_dir($location)) { 2776 if (!$currdir = opendir($location)) { 2777 return false; 2778 } 2779 while (false !== ($file = readdir($currdir))) { 2780 if ($file <> ".." && $file <> ".") { 2781 $fullfile = $location."/".$file; 2782 if (is_dir($fullfile)) { 2783 if (!fulldelete($fullfile)) { 2784 return false; 2785 } 2786 } else { 2787 if (!unlink($fullfile)) { 2788 return false; 2789 } 2790 } 2791 } 2792 } 2793 closedir($currdir); 2794 if (! rmdir($location)) { 2795 return false; 2796 } 2797 2798 } else if (file_exists($location)) { 2799 if (!unlink($location)) { 2800 return false; 2801 } 2802 } 2803 return true; 2804 } 2805 2806 /** 2807 * Send requested byterange of file. 2808 * 2809 * @param resource $handle A file handle 2810 * @param string $mimetype The mimetype for the output 2811 * @param array $ranges An array of ranges to send 2812 * @param string $filesize The size of the content if only one range is used 2813 */ 2814 function byteserving_send_file($handle, $mimetype, $ranges, $filesize) { 2815 // better turn off any kind of compression and buffering 2816 ini_set('zlib.output_compression', 'Off'); 2817 2818 $chunksize = 1*(1024*1024); // 1MB chunks - must be less than 2MB! 2819 if ($handle === false) { 2820 die; 2821 } 2822 if (count($ranges) == 1) { //only one range requested 2823 $length = $ranges[0][2] - $ranges[0][1] + 1; 2824 header('HTTP/1.1 206 Partial content'); 2825 header('Content-Length: '.$length); 2826 header('Content-Range: bytes '.$ranges[0][1].'-'.$ranges[0][2].'/'.$filesize); 2827 header('Content-Type: '.$mimetype); 2828 2829 while(@ob_get_level()) { 2830 if (!@ob_end_flush()) { 2831 break; 2832 } 2833 } 2834 2835 fseek($handle, $ranges[0][1]); 2836 while (!feof($handle) && $length > 0) { 2837 core_php_time_limit::raise(60*60); //reset time limit to 60 min - should be enough for 1 MB chunk 2838 $buffer = fread($handle, ($chunksize < $length ? $chunksize : $length)); 2839 echo $buffer; 2840 flush(); 2841 $length -= strlen($buffer); 2842 } 2843 fclose($handle); 2844 die; 2845 } else { // multiple ranges requested - not tested much 2846 $totallength = 0; 2847 foreach($ranges as $range) { 2848 $totallength += strlen($range[0]) + $range[2] - $range[1] + 1; 2849 } 2850 $totallength += strlen("\r\n--".BYTESERVING_BOUNDARY."--\r\n"); 2851 header('HTTP/1.1 206 Partial content'); 2852 header('Content-Length: '.$totallength); 2853 header('Content-Type: multipart/byteranges; boundary='.BYTESERVING_BOUNDARY); 2854 2855 while(@ob_get_level()) { 2856 if (!@ob_end_flush()) { 2857 break; 2858 } 2859 } 2860 2861 foreach($ranges as $range) { 2862 $length = $range[2] - $range[1] + 1; 2863 echo $range[0]; 2864 fseek($handle, $range[1]); 2865 while (!feof($handle) && $length > 0) { 2866 core_php_time_limit::raise(60*60); //reset time limit to 60 min - should be enough for 1 MB chunk 2867 $buffer = fread($handle, ($chunksize < $length ? $chunksize : $length)); 2868 echo $buffer; 2869 flush(); 2870 $length -= strlen($buffer); 2871 } 2872 } 2873 echo "\r\n--".BYTESERVING_BOUNDARY."--\r\n"; 2874 fclose($handle); 2875 die; 2876 } 2877 } 2878 2879 /** 2880 * Tells whether the filename is executable. 2881 * 2882 * @link http://php.net/manual/en/function.is-executable.php 2883 * @link https://bugs.php.net/bug.php?id=41062 2884 * @param string $filename Path to the file. 2885 * @return bool True if the filename exists and is executable; otherwise, false. 2886 */ 2887 function file_is_executable($filename) { 2888 if (strtoupper(substr(PHP_OS, 0, 3)) === 'WIN') { 2889 if (is_executable($filename)) { 2890 return true; 2891 } else { 2892 $fileext = strrchr($filename, '.'); 2893 // If we have an extension we can check if it is listed as executable. 2894 if ($fileext && file_exists($filename) && !is_dir($filename)) { 2895 $winpathext = strtolower(getenv('PATHEXT')); 2896 $winpathexts = explode(';', $winpathext); 2897 2898 return in_array(strtolower($fileext), $winpathexts); 2899 } 2900 2901 return false; 2902 } 2903 } else { 2904 return is_executable($filename); 2905 } 2906 } 2907 2908 /** 2909 * Overwrite an existing file in a draft area. 2910 * 2911 * @param stored_file $newfile the new file with the new content and meta-data 2912 * @param stored_file $existingfile the file that will be overwritten 2913 * @throws moodle_exception 2914 * @since Moodle 3.2 2915 */ 2916 function file_overwrite_existing_draftfile(stored_file $newfile, stored_file $existingfile) { 2917 if ($existingfile->get_component() != 'user' or $existingfile->get_filearea() != 'draft') { 2918 throw new coding_exception('The file to overwrite is not in a draft area.'); 2919 } 2920 2921 $fs = get_file_storage(); 2922 // Remember original file source field. 2923 $source = @unserialize($existingfile->get_source() ?? ''); 2924 // Remember the original sortorder. 2925 $sortorder = $existingfile->get_sortorder(); 2926 if ($newfile->is_external_file()) { 2927 // New file is a reference. Check that existing file does not have any other files referencing to it 2928 if (isset($source->original) && $fs->search_references_count($source->original)) { 2929 throw new moodle_exception('errordoublereference', 'repository'); 2930 } 2931 } 2932 2933 // Delete existing file to release filename. 2934 $newfilerecord = array( 2935 'contextid' => $existingfile->get_contextid(), 2936 'component' => 'user', 2937 'filearea' => 'draft', 2938 'itemid' => $existingfile->get_itemid(), 2939 'timemodified' => time() 2940 ); 2941 $existingfile->delete(); 2942 2943 // Create new file. 2944 $newfile = $fs->create_file_from_storedfile($newfilerecord, $newfile); 2945 // Preserve original file location (stored in source field) for handling references. 2946 if (isset($source->original)) { 2947 if (!($newfilesource = @unserialize($newfile->get_source() ?? ''))) { 2948 $newfilesource = new stdClass(); 2949 } 2950 $newfilesource->original = $source->original; 2951 $newfile->set_source(serialize($newfilesource)); 2952 } 2953 $newfile->set_sortorder($sortorder); 2954 } 2955 2956 /** 2957 * Add files from a draft area into a final area. 2958 * 2959 * Most of the time you do not want to use this. It is intended to be used 2960 * by asynchronous services which cannot direcly manipulate a final 2961 * area through a draft area. Instead they add files to a new draft 2962 * area and merge that new draft into the final area when ready. 2963 * 2964 * @param int $draftitemid the id of the draft area to use. 2965 * @param int $contextid this parameter and the next two identify the file area to save to. 2966 * @param string $component component name 2967 * @param string $filearea indentifies the file area 2968 * @param int $itemid identifies the item id or false for all items in the file area 2969 * @param array $options area options (subdirs=false, maxfiles=-1, maxbytes=0, areamaxbytes=FILE_AREA_MAX_BYTES_UNLIMITED) 2970 * @see file_save_draft_area_files 2971 * @since Moodle 3.2 2972 */ 2973 function file_merge_files_from_draft_area_into_filearea($draftitemid, $contextid, $component, $filearea, $itemid, 2974 array $options = null) { 2975 // We use 0 here so file_prepare_draft_area creates a new one, finaldraftid will be updated with the new draft id. 2976 $finaldraftid = 0; 2977 file_prepare_draft_area($finaldraftid, $contextid, $component, $filearea, $itemid, $options); 2978 file_merge_draft_area_into_draft_area($draftitemid, $finaldraftid); 2979 file_save_draft_area_files($finaldraftid, $contextid, $component, $filearea, $itemid, $options); 2980 } 2981 2982 /** 2983 * Merge files from two draftarea areas. 2984 * 2985 * This does not handle conflict resolution, files in the destination area which appear 2986 * to be more recent will be kept disregarding the intended ones. 2987 * 2988 * @param int $getfromdraftid the id of the draft area where are the files to merge. 2989 * @param int $mergeintodraftid the id of the draft area where new files will be merged. 2990 * @throws coding_exception 2991 * @since Moodle 3.2 2992 */ 2993 function file_merge_draft_area_into_draft_area($getfromdraftid, $mergeintodraftid) { 2994 global $USER; 2995 2996 $fs = get_file_storage(); 2997 $contextid = context_user::instance($USER->id)->id; 2998 2999 if (!$filestomerge = $fs->get_area_files($contextid, 'user', 'draft', $getfromdraftid)) { 3000 throw new coding_exception('Nothing to merge or area does not belong to current user'); 3001 } 3002 3003 $currentfiles = $fs->get_area_files($contextid, 'user', 'draft', $mergeintodraftid); 3004 3005 // Get hashes of the files to merge. 3006 $newhashes = array(); 3007 foreach ($filestomerge as $filetomerge) { 3008 $filepath = $filetomerge->get_filepath(); 3009 $filename = $filetomerge->get_filename(); 3010 3011 $newhash = $fs->get_pathname_hash($contextid, 'user', 'draft', $mergeintodraftid, $filepath, $filename); 3012 $newhashes[$newhash] = $filetomerge; 3013 } 3014 3015 // Calculate wich files must be added. 3016 foreach ($currentfiles as $file) { 3017 $filehash = $file->get_pathnamehash(); 3018 // One file to be merged already exists. 3019 if (isset($newhashes[$filehash])) { 3020 $updatedfile = $newhashes[$filehash]; 3021 3022 // Avoid race conditions. 3023 if ($file->get_timemodified() > $updatedfile->get_timemodified()) { 3024 // The existing file is more recent, do not copy the suposedly "new" one. 3025 unset($newhashes[$filehash]); 3026 continue; 3027 } 3028 // Update existing file (not only content, meta-data too). 3029 file_overwrite_existing_draftfile($updatedfile, $file); 3030 unset($newhashes[$filehash]); 3031 } 3032 } 3033 3034 foreach ($newhashes as $newfile) { 3035 $newfilerecord = array( 3036 'contextid' => $contextid, 3037 'component' => 'user', 3038 'filearea' => 'draft', 3039 'itemid' => $mergeintodraftid, 3040 'timemodified' => time() 3041 ); 3042 3043 $fs->create_file_from_storedfile($newfilerecord, $newfile); 3044 } 3045 } 3046 3047 /** 3048 * Attempt to determine whether the specified mime-type is an SVG image or not. 3049 * 3050 * @param string $mimetype Mime-type 3051 * @return bool True if it is an SVG file 3052 */ 3053 function file_is_svg_image_from_mimetype(string $mimetype): bool { 3054 return preg_match('|^image/svg|', $mimetype); 3055 } 3056 3057 /** 3058 * Returns the moodle proxy configuration as a formatted url 3059 * 3060 * @return string the string to use for proxy settings. 3061 */ 3062 function get_moodle_proxy_url() { 3063 global $CFG; 3064 $proxy = ''; 3065 if (empty($CFG->proxytype)) { 3066 return $proxy; 3067 } 3068 if (empty($CFG->proxyhost)) { 3069 return $proxy; 3070 } 3071 if ($CFG->proxytype === 'SOCKS5') { 3072 // If it is a SOCKS proxy, append the protocol info. 3073 $protocol = 'socks5://'; 3074 } else { 3075 $protocol = ''; 3076 } 3077 $proxy = $CFG->proxyhost; 3078 if (!empty($CFG->proxyport)) { 3079 $proxy .= ':'. $CFG->proxyport; 3080 } 3081 if (!empty($CFG->proxyuser) && !empty($CFG->proxypassword)) { 3082 $proxy = $protocol . $CFG->proxyuser . ':' . $CFG->proxypassword . '@' . $proxy; 3083 } 3084 return $proxy; 3085 } 3086 3087 3088 3089 /** 3090 * RESTful cURL class 3091 * 3092 * This is a wrapper class for curl, it is quite easy to use: 3093 * <code> 3094 * $c = new curl; 3095 * // enable cache 3096 * $c = new curl(array('cache'=>true)); 3097 * // enable cookie 3098 * $c = new curl(array('cookie'=>true)); 3099 * // enable proxy 3100 * $c = new curl(array('proxy'=>true)); 3101 * 3102 * // HTTP GET Method 3103 * $html = $c->get('http://example.com'); 3104 * // HTTP POST Method 3105 * $html = $c->post('http://example.com/', array('q'=>'words', 'name'=>'moodle')); 3106 * // HTTP PUT Method 3107 * $html = $c->put('http://example.com/', array('file'=>'/var/www/test.txt'); 3108 * </code> 3109 * 3110 * @package core_files 3111 * @category files 3112 * @copyright Dongsheng Cai <dongsheng@moodle.com> 3113 * @license http://www.gnu.org/copyleft/gpl.html GNU Public License 3114 */ 3115 class curl { 3116 /** @var curl_cache|false Caches http request contents */ 3117 public $cache = false; 3118 /** @var bool Uses proxy, null means automatic based on URL */ 3119 public $proxy = null; 3120 /** @var string library version */ 3121 public $version = '0.4 dev'; 3122 /** @var array http's response */ 3123 public $response = array(); 3124 /** @var array Raw response headers, needed for BC in download_file_content(). */ 3125 public $rawresponse = array(); 3126 /** @var array http header */ 3127 public $header = array(); 3128 /** @var array cURL information */ 3129 public $info; 3130 /** @var string error */ 3131 public $error; 3132 /** @var int error code */ 3133 public $errno; 3134 /** @var bool Perform redirects at PHP level instead of relying on native cURL functionality. Always true now. */ 3135 public $emulateredirects = null; 3136 3137 /** @var array cURL options */ 3138 private $options; 3139 3140 /** @var string Proxy host */ 3141 private $proxy_host = ''; 3142 /** @var string Proxy auth */ 3143 private $proxy_auth = ''; 3144 /** @var string Proxy type */ 3145 private $proxy_type = ''; 3146 /** @var bool Debug mode on */ 3147 private $debug = false; 3148 /** @var bool|string Path to cookie file */ 3149 private $cookie = false; 3150 /** @var bool tracks multiple headers in response - redirect detection */ 3151 private $responsefinished = false; 3152 /** @var security helper class, responsible for checking host/ports against allowed/blocked entries.*/ 3153 private $securityhelper; 3154 /** @var bool ignoresecurity a flag which can be supplied to the constructor, allowing security to be bypassed. */ 3155 private $ignoresecurity; 3156 /** @var array $mockresponses For unit testing only - return the head of this list instead of making the next request. */ 3157 private static $mockresponses = []; 3158 /** @var array temporary params value if the value is not belongs to class stored_file. */ 3159 public $_tmp_file_post_params = []; 3160 3161 /** 3162 * Curl constructor. 3163 * 3164 * Allowed settings are: 3165 * proxy: (bool) use proxy server, null means autodetect non-local from url 3166 * debug: (bool) use debug output 3167 * cookie: (string) path to cookie file, false if none 3168 * cache: (bool) use cache 3169 * module_cache: (string) type of cache 3170 * securityhelper: (\core\files\curl_security_helper_base) helper object providing URL checking for requests. 3171 * ignoresecurity: (bool) set true to override and ignore the security helper when making requests. 3172 * 3173 * @param array $settings 3174 */ 3175 public function __construct($settings = array()) { 3176 global $CFG; 3177 if (!function_exists('curl_init')) { 3178 $this->error = 'cURL module must be enabled!'; 3179 trigger_error($this->error, E_USER_ERROR); 3180 return false; 3181 } 3182 3183 // All settings of this class should be init here. 3184 $this->resetopt(); 3185 if (!empty($settings['debug'])) { 3186 $this->debug = true; 3187 } 3188 if (!empty($settings['cookie'])) { 3189 if($settings['cookie'] === true) { 3190 $this->cookie = $CFG->dataroot.'/curl_cookie.txt'; 3191 } else { 3192 $this->cookie = $settings['cookie']; 3193 } 3194 } 3195 if (!empty($settings['cache'])) { 3196 if (class_exists('curl_cache')) { 3197 if (!empty($settings['module_cache'])) { 3198 $this->cache = new curl_cache($settings['module_cache']); 3199 } else { 3200 $this->cache = new curl_cache('misc'); 3201 } 3202 } 3203 } 3204 if (!empty($CFG->proxyhost)) { 3205 if (empty($CFG->proxyport)) { 3206 $this->proxy_host = $CFG->proxyhost; 3207 } else { 3208 $this->proxy_host = $CFG->proxyhost.':'.$CFG->proxyport; 3209 } 3210 if (!empty($CFG->proxyuser) and !empty($CFG->proxypassword)) { 3211 $this->proxy_auth = $CFG->proxyuser.':'.$CFG->proxypassword; 3212 $this->setopt(array( 3213 'proxyauth'=> CURLAUTH_BASIC | CURLAUTH_NTLM, 3214 'proxyuserpwd'=>$this->proxy_auth)); 3215 } 3216 if (!empty($CFG->proxytype)) { 3217 if ($CFG->proxytype == 'SOCKS5') { 3218 $this->proxy_type = CURLPROXY_SOCKS5; 3219 } else { 3220 $this->proxy_type = CURLPROXY_HTTP; 3221 $this->setopt([ 3222 'httpproxytunnel' => false, 3223 ]); 3224 if (defined('CURLOPT_SUPPRESS_CONNECT_HEADERS')) { 3225 $this->setopt([ 3226 'suppress_connect_headers' => true, 3227 ]); 3228 } 3229 } 3230 $this->setopt(array('proxytype'=>$this->proxy_type)); 3231 } 3232 3233 if (isset($settings['proxy'])) { 3234 $this->proxy = $settings['proxy']; 3235 } 3236 } else { 3237 $this->proxy = false; 3238 } 3239 3240 // All redirects are performed at PHP level now and each one is checked against blocked URLs rules. We do not 3241 // want to let cURL naively follow the redirect chain and visit every URL for security reasons. Even when the 3242 // caller explicitly wants to ignore the security checks, we would need to fall back to the original 3243 // implementation and use emulated redirects if open_basedir is in effect to avoid the PHP warning 3244 // "CURLOPT_FOLLOWLOCATION cannot be activated when in safe_mode or an open_basedir". So it is better to simply 3245 // ignore this property and always handle redirects at this PHP wrapper level and not inside the native cURL. 3246 $this->emulateredirects = true; 3247 3248 // Curl security setup. Allow injection of a security helper, but if not found, default to the core helper. 3249 if (isset($settings['securityhelper']) && $settings['securityhelper'] instanceof \core\files\curl_security_helper_base) { 3250 $this->set_security($settings['securityhelper']); 3251 } else { 3252 $this->set_security(new \core\files\curl_security_helper()); 3253 } 3254 $this->ignoresecurity = isset($settings['ignoresecurity']) ? $settings['ignoresecurity'] : false; 3255 } 3256 3257 /** 3258 * Resets the CURL options that have already been set 3259 */ 3260 public function resetopt() { 3261 $this->options = array(); 3262 $this->options['CURLOPT_USERAGENT'] = \core_useragent::get_moodlebot_useragent(); 3263 // True to include the header in the output 3264 $this->options['CURLOPT_HEADER'] = 0; 3265 // True to Exclude the body from the output 3266 $this->options['CURLOPT_NOBODY'] = 0; 3267 // Redirect ny default. 3268 $this->options['CURLOPT_FOLLOWLOCATION'] = 1; 3269 $this->options['CURLOPT_MAXREDIRS'] = 10; 3270 $this->options['CURLOPT_ENCODING'] = ''; 3271 // TRUE to return the transfer as a string of the return 3272 // value of curl_exec() instead of outputting it out directly. 3273 $this->options['CURLOPT_RETURNTRANSFER'] = 1; 3274 $this->options['CURLOPT_SSL_VERIFYPEER'] = 0; 3275 $this->options['CURLOPT_SSL_VERIFYHOST'] = 2; 3276 $this->options['CURLOPT_CONNECTTIMEOUT'] = 30; 3277 3278 if ($cacert = self::get_cacert()) { 3279 $this->options['CURLOPT_CAINFO'] = $cacert; 3280 } 3281 } 3282 3283 /** 3284 * Get the location of ca certificates. 3285 * @return string absolute file path or empty if default used 3286 */ 3287 public static function get_cacert() { 3288 global $CFG; 3289 3290 // Bundle in dataroot always wins. 3291 if (is_readable("$CFG->dataroot/moodleorgca.crt")) { 3292 return realpath("$CFG->dataroot/moodleorgca.crt"); 3293 } 3294 3295 // Next comes the default from php.ini 3296 $cacert = ini_get('curl.cainfo'); 3297 if (!empty($cacert) and is_readable($cacert)) { 3298 return realpath($cacert); 3299 } 3300 3301 // Windows PHP does not have any certs, we need to use something. 3302 if ($CFG->ostype === 'WINDOWS') { 3303 if (is_readable("$CFG->libdir/cacert.pem")) { 3304 return realpath("$CFG->libdir/cacert.pem"); 3305 } 3306 } 3307 3308 // Use default, this should work fine on all properly configured *nix systems. 3309 return null; 3310 } 3311 3312 /** 3313 * Reset Cookie 3314 */ 3315 public function resetcookie() { 3316 if (!empty($this->cookie)) { 3317 if (is_file($this->cookie)) { 3318 $fp = fopen($this->cookie, 'w'); 3319 if (!empty($fp)) { 3320 fwrite($fp, ''); 3321 fclose($fp); 3322 } 3323 } 3324 } 3325 } 3326 3327 /** 3328 * Set curl options. 3329 * 3330 * Do not use the curl constants to define the options, pass a string 3331 * corresponding to that constant. Ie. to set CURLOPT_MAXREDIRS, pass 3332 * array('CURLOPT_MAXREDIRS' => 10) or array('maxredirs' => 10) to this method. 3333 * 3334 * @param array $options If array is null, this function will reset the options to default value. 3335 * @return void 3336 * @throws coding_exception If an option uses constant value instead of option name. 3337 */ 3338 public function setopt($options = array()) { 3339 if (is_array($options)) { 3340 foreach ($options as $name => $val) { 3341 if (!is_string($name)) { 3342 throw new coding_exception('Curl options should be defined using strings, not constant values.'); 3343 } 3344 if (stripos($name, 'CURLOPT_') === false) { 3345 // Only prefix with CURLOPT_ if the option doesn't contain CURLINFO_, 3346 // which is a valid prefix for at least one option CURLINFO_HEADER_OUT. 3347 if (stripos($name, 'CURLINFO_') === false) { 3348 $name = strtoupper('CURLOPT_'.$name); 3349 } 3350 } else { 3351 $name = strtoupper($name); 3352 } 3353 $this->options[$name] = $val; 3354 } 3355 } 3356 } 3357 3358 /** 3359 * Reset http method 3360 */ 3361 public function cleanopt() { 3362 unset($this->options['CURLOPT_HTTPGET']); 3363 unset($this->options['CURLOPT_POST']); 3364 unset($this->options['CURLOPT_POSTFIELDS']); 3365 unset($this->options['CURLOPT_PUT']); 3366 unset($this->options['CURLOPT_INFILE']); 3367 unset($this->options['CURLOPT_INFILESIZE']); 3368 unset($this->options['CURLOPT_CUSTOMREQUEST']); 3369 unset($this->options['CURLOPT_FILE']); 3370 } 3371 3372 /** 3373 * Resets the HTTP Request headers (to prepare for the new request) 3374 */ 3375 public function resetHeader() { 3376 $this->header = array(); 3377 } 3378 3379 /** 3380 * Set HTTP Request Header 3381 * 3382 * @param array $header 3383 */ 3384 public function setHeader($header) { 3385 if (is_array($header)) { 3386 foreach ($header as $v) { 3387 $this->setHeader($v); 3388 } 3389 } else { 3390 // Remove newlines, they are not allowed in headers. 3391 $newvalue = preg_replace('/[\r\n]/', '', $header); 3392 if (!in_array($newvalue, $this->header)) { 3393 $this->header[] = $newvalue; 3394 } 3395 } 3396 } 3397 3398 /** 3399 * Get HTTP Response Headers 3400 * @return array of arrays 3401 */ 3402 public function getResponse() { 3403 return $this->response; 3404 } 3405 3406 /** 3407 * Get raw HTTP Response Headers 3408 * @return array of strings 3409 */ 3410 public function get_raw_response() { 3411 return $this->rawresponse; 3412 } 3413 3414 /** 3415 * private callback function 3416 * Formatting HTTP Response Header 3417 * 3418 * We only keep the last headers returned. For example during a redirect the 3419 * redirect headers will not appear in {@link self::getResponse()}, if you need 3420 * to use those headers, refer to {@link self::get_raw_response()}. 3421 * 3422 * @param resource $ch Apparently not used 3423 * @param string $header 3424 * @return int The strlen of the header 3425 */ 3426 private function formatHeader($ch, $header) { 3427 $this->rawresponse[] = $header; 3428 3429 if (trim($header, "\r\n") === '') { 3430 // This must be the last header. 3431 $this->responsefinished = true; 3432 } 3433 3434 if (strlen($header) > 2) { 3435 if ($this->responsefinished) { 3436 // We still have headers after the supposedly last header, we must be 3437 // in a redirect so let's empty the response to keep the last headers. 3438 $this->responsefinished = false; 3439 $this->response = array(); 3440 } 3441 $parts = explode(" ", rtrim($header, "\r\n"), 2); 3442 $key = rtrim($parts[0], ':'); 3443 $value = isset($parts[1]) ? $parts[1] : null; 3444 if (!empty($this->response[$key])) { 3445 if (is_array($this->response[$key])) { 3446 $this->response[$key][] = $value; 3447 } else { 3448 $tmp = $this->response[$key]; 3449 $this->response[$key] = array(); 3450 $this->response[$key][] = $tmp; 3451 $this->response[$key][] = $value; 3452 3453 } 3454 } else { 3455 $this->response[$key] = $value; 3456 } 3457 } 3458 return strlen($header); 3459 } 3460 3461 /** 3462 * Set options for individual curl instance 3463 * 3464 * @param resource|CurlHandle $curl A curl handle 3465 * @param array $options 3466 * @return resource The curl handle 3467 */ 3468 private function apply_opt($curl, $options) { 3469 // Clean up 3470 $this->cleanopt(); 3471 // set cookie 3472 if (!empty($this->cookie) || !empty($options['cookie'])) { 3473 $this->setopt(array('cookiejar'=>$this->cookie, 3474 'cookiefile'=>$this->cookie 3475 )); 3476 } 3477 3478 // Bypass proxy if required. 3479 if ($this->proxy === null) { 3480 if (!empty($this->options['CURLOPT_URL']) and is_proxybypass($this->options['CURLOPT_URL'])) { 3481 $proxy = false; 3482 } else { 3483 $proxy = true; 3484 } 3485 } else { 3486 $proxy = (bool)$this->proxy; 3487 } 3488 3489 // Set proxy. 3490 if ($proxy) { 3491 $options['CURLOPT_PROXY'] = $this->proxy_host; 3492 } else { 3493 unset($this->options['CURLOPT_PROXY']); 3494 } 3495 3496 $this->setopt($options); 3497 3498 // Reset before set options. 3499 curl_setopt($curl, CURLOPT_HEADERFUNCTION, array(&$this,'formatHeader')); 3500 3501 // Setting the User-Agent based on options provided. 3502 $useragent = ''; 3503 3504 if (!empty($options['CURLOPT_USERAGENT'])) { 3505 $useragent = $options['CURLOPT_USERAGENT']; 3506 } else if (!empty($this->options['CURLOPT_USERAGENT'])) { 3507 $useragent = $this->options['CURLOPT_USERAGENT']; 3508 } else { 3509 $useragent = \core_useragent::get_moodlebot_useragent(); 3510 } 3511 3512 // Set headers. 3513 if (empty($this->header)) { 3514 $this->setHeader(array( 3515 'User-Agent: ' . $useragent, 3516 'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7', 3517 'Connection: keep-alive' 3518 )); 3519 } else if (!in_array('User-Agent: ' . $useragent, $this->header)) { 3520 // Remove old User-Agent if one existed. 3521 // We have to partial search since we don't know what the original User-Agent is. 3522 if ($match = preg_grep('/User-Agent.*/', $this->header)) { 3523 $key = array_keys($match)[0]; 3524 unset($this->header[$key]); 3525 } 3526 $this->setHeader(array('User-Agent: ' . $useragent)); 3527 } 3528 curl_setopt($curl, CURLOPT_HTTPHEADER, $this->header); 3529 3530 if ($this->debug) { 3531 echo '<h1>Options</h1>'; 3532 var_dump($this->options); 3533 echo '<h1>Header</h1>'; 3534 var_dump($this->header); 3535 } 3536 3537 // Do not allow infinite redirects. 3538 if (!isset($this->options['CURLOPT_MAXREDIRS'])) { 3539 $this->options['CURLOPT_MAXREDIRS'] = 0; 3540 } else if ($this->options['CURLOPT_MAXREDIRS'] > 100) { 3541 $this->options['CURLOPT_MAXREDIRS'] = 100; 3542 } else { 3543 $this->options['CURLOPT_MAXREDIRS'] = (int)$this->options['CURLOPT_MAXREDIRS']; 3544 } 3545 3546 // Make sure we always know if redirects expected. 3547 if (!isset($this->options['CURLOPT_FOLLOWLOCATION'])) { 3548 $this->options['CURLOPT_FOLLOWLOCATION'] = 0; 3549 } 3550 3551 // Limit the protocols to HTTP and HTTPS. 3552 if (defined('CURLOPT_PROTOCOLS')) { 3553 $this->options['CURLOPT_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS); 3554 $this->options['CURLOPT_REDIR_PROTOCOLS'] = (CURLPROTO_HTTP | CURLPROTO_HTTPS); 3555 } 3556 3557 // Set options. 3558 foreach($this->options as $name => $val) { 3559 if ($name === 'CURLOPT_FOLLOWLOCATION') { 3560 // All the redirects are emulated at PHP level. 3561 curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 0); 3562 continue; 3563 } 3564 $name = constant($name); 3565 curl_setopt($curl, $name, $val); 3566 } 3567 3568 return $curl; 3569 } 3570 3571 /** 3572 * Download multiple files in parallel 3573 * 3574 * Calls {@link multi()} with specific download headers 3575 * 3576 * <code> 3577 * $c = new curl(); 3578 * $file1 = fopen('a', 'wb'); 3579 * $file2 = fopen('b', 'wb'); 3580 * $c->download(array( 3581 * array('url'=>'http://localhost/', 'file'=>$file1), 3582 * array('url'=>'http://localhost/20/', 'file'=>$file2) 3583 * )); 3584 * fclose($file1); 3585 * fclose($file2); 3586 * </code> 3587 * 3588 * or 3589 * 3590 * <code> 3591 * $c = new curl(); 3592 * $c->download(array( 3593 * array('url'=>'http://localhost/', 'filepath'=>'/tmp/file1.tmp'), 3594 * array('url'=>'http://localhost/20/', 'filepath'=>'/tmp/file2.tmp') 3595 * )); 3596 * </code> 3597 * 3598 * @param array $requests An array of files to request { 3599 * url => url to download the file [required] 3600 * file => file handler, or 3601 * filepath => file path 3602 * } 3603 * If 'file' and 'filepath' parameters are both specified in one request, the 3604 * open file handle in the 'file' parameter will take precedence and 'filepath' 3605 * will be ignored. 3606 * 3607 * @param array $options An array of options to set 3608 * @return array An array of results 3609 */ 3610 public function download($requests, $options = array()) { 3611 $options['RETURNTRANSFER'] = false; 3612 return $this->multi($requests, $options); 3613 } 3614 3615 /** 3616 * Returns the current curl security helper. 3617 * 3618 * @return \core\files\curl_security_helper instance. 3619 */ 3620 public function get_security() { 3621 return $this->securityhelper; 3622 } 3623 3624 /** 3625 * Sets the curl security helper. 3626 * 3627 * @param \core\files\curl_security_helper $securityobject instance/subclass of the base curl_security_helper class. 3628 * @return bool true if the security helper could be set, false otherwise. 3629 */ 3630 public function set_security($securityobject) { 3631 if ($securityobject instanceof \core\files\curl_security_helper) { 3632 $this->securityhelper = $securityobject; 3633 return true; 3634 } 3635 return false; 3636 } 3637 3638 /** 3639 * Multi HTTP Requests 3640 * This function could run multi-requests in parallel. 3641 * 3642 * @param array $requests An array of files to request 3643 * @param array $options An array of options to set 3644 * @return array An array of results 3645 */ 3646 protected function multi($requests, $options = array()) { 3647 $count = count($requests); 3648 $handles = array(); 3649 $results = array(); 3650 $main = curl_multi_init(); 3651 for ($i = 0; $i < $count; $i++) { 3652 if (!empty($requests[$i]['filepath']) and empty($requests[$i]['file'])) { 3653 // open file 3654 $requests[$i]['file'] = fopen($requests[$i]['filepath'], 'w'); 3655 $requests[$i]['auto-handle'] = true; 3656 } 3657 foreach($requests[$i] as $n=>$v) { 3658 $options[$n] = $v; 3659 } 3660 $handles[$i] = curl_init($requests[$i]['url']); 3661 $this->apply_opt($handles[$i], $options); 3662 curl_multi_add_handle($main, $handles[$i]); 3663 } 3664 $running = 0; 3665 do { 3666 curl_multi_exec($main, $running); 3667 } while($running > 0); 3668 for ($i = 0; $i < $count; $i++) { 3669 if (!empty($options['CURLOPT_RETURNTRANSFER'])) { 3670 $results[] = true; 3671 } else { 3672 $results[] = curl_multi_getcontent($handles[$i]); 3673 } 3674 curl_multi_remove_handle($main, $handles[$i]); 3675 } 3676 curl_multi_close($main); 3677 3678 for ($i = 0; $i < $count; $i++) { 3679 if (!empty($requests[$i]['filepath']) and !empty($requests[$i]['auto-handle'])) { 3680 // close file handler if file is opened in this function 3681 fclose($requests[$i]['file']); 3682 } 3683 } 3684 return $results; 3685 } 3686 3687 /** 3688 * Helper function to reset the request state vars. 3689 * 3690 * @return void. 3691 */ 3692 protected function reset_request_state_vars() { 3693 $this->info = array(); 3694 $this->error = ''; 3695 $this->errno = 0; 3696 $this->response = array(); 3697 $this->rawresponse = array(); 3698 $this->responsefinished = false; 3699 } 3700 3701 /** 3702 * For use only in unit tests - we can pre-set the next curl response. 3703 * This is useful for unit testing APIs that call external systems. 3704 * @param string $response 3705 */ 3706 public static function mock_response($response) { 3707 if ((defined('PHPUNIT_TEST') && PHPUNIT_TEST)) { 3708 array_push(self::$mockresponses, $response); 3709 } else { 3710 throw new coding_exception('mock_response function is only available for unit tests.'); 3711 } 3712 } 3713 3714 /** 3715 * check_securityhelper_blocklist. 3716 * Checks whether the given URL is blocked by checking both plugin's security helpers 3717 * and core curl security helper or any curl security helper that passed to curl class constructor. 3718 * If ignoresecurity is set to true, skip checking and consider the url is not blocked. 3719 * This augments all installed plugin's security helpers if there is any. 3720 * 3721 * @param string $url the url to check. 3722 * @return string - an error message if URL is blocked or null if URL is not blocked. 3723 */ 3724 protected function check_securityhelper_blocklist(string $url): ?string { 3725 3726 // If curl security is not enabled, do not proceed. 3727 if ($this->ignoresecurity) { 3728 return null; 3729 } 3730 3731 // Augment all installed plugin's security helpers if there is any. 3732 // The plugin's function has to be defined as plugintype_pluginname_curl_security_helper in pluginname/lib.php. 3733 $plugintypes = get_plugins_with_function('curl_security_helper'); 3734 3735 // If any of the security helper's function returns true, treat as URL is blocked. 3736 foreach ($plugintypes as $plugins) { 3737 foreach ($plugins as $pluginfunction) { 3738 // Get curl security helper object from plugin lib.php. 3739 $pluginsecurityhelper = $pluginfunction(); 3740 if ($pluginsecurityhelper instanceof \core\files\curl_security_helper_base) { 3741 if ($pluginsecurityhelper->url_is_blocked($url)) { 3742 $this->error = $pluginsecurityhelper->get_blocked_url_string(); 3743 return $this->error; 3744 } 3745 } 3746 } 3747 } 3748 3749 // Check if the URL is blocked in core curl_security_helper or 3750 // curl security helper that passed to curl class constructor. 3751 if ($this->securityhelper->url_is_blocked($url)) { 3752 $this->error = $this->securityhelper->get_blocked_url_string(); 3753 return $this->error; 3754 } 3755 3756 return null; 3757 } 3758 3759 /** 3760 * Single HTTP Request 3761 * 3762 * @param string $url The URL to request 3763 * @param array $options 3764 * @return bool 3765 */ 3766 protected function request($url, $options = array()) { 3767 // Reset here so that the data is valid when result returned from cache, or if we return due to a blocked URL hit. 3768 $this->reset_request_state_vars(); 3769 3770 if ((defined('PHPUNIT_TEST') && PHPUNIT_TEST)) { 3771 $mockresponse = array_pop(self::$mockresponses); 3772 if ($mockresponse !== null) { 3773 $this->info = [ 'http_code' => 200 ]; 3774 return $mockresponse; 3775 } 3776 } 3777 3778 if (empty($this->emulateredirects)) { 3779 // Just in case someone had tried to explicitly disable emulated redirects in legacy code. 3780 debugging('Attempting to disable emulated redirects has no effect any more!', DEBUG_DEVELOPER); 3781 } 3782 3783 $urlisblocked = $this->check_securityhelper_blocklist($url); 3784 if (!is_null($urlisblocked)) { 3785 $this->trigger_url_blocked_event($url, $urlisblocked); 3786 return $urlisblocked; 3787 } 3788 3789 // Set the URL as a curl option. 3790 $this->setopt(array('CURLOPT_URL' => $url)); 3791 3792 // Create curl instance. 3793 $curl = curl_init(); 3794 3795 $this->apply_opt($curl, $options); 3796 if ($this->cache && $ret = $this->cache->get($this->options)) { 3797 return $ret; 3798 } 3799 3800 $ret = curl_exec($curl); 3801 $this->info = curl_getinfo($curl); 3802 $this->error = curl_error($curl); 3803 $this->errno = curl_errno($curl); 3804 // Note: $this->response and $this->rawresponse are filled by $hits->formatHeader callback. 3805 3806 if (intval($this->info['redirect_count']) > 0) { 3807 // For security reasons we do not allow the cURL handle to follow redirects on its own. 3808 // See setting CURLOPT_FOLLOWLOCATION in {@see self::apply_opt()} method. 3809 throw new coding_exception('Internal cURL handle should never follow redirects on its own!', 3810 'Reported number of redirects: ' . $this->info['redirect_count']); 3811 } 3812 3813 if ($this->options['CURLOPT_FOLLOWLOCATION'] && $this->info['http_code'] != 200) { 3814 $redirects = 0; 3815 3816 while($redirects <= $this->options['CURLOPT_MAXREDIRS']) { 3817 3818 if ($this->info['http_code'] == 301) { 3819 // Moved Permanently - repeat the same request on new URL. 3820 3821 } else if ($this->info['http_code'] == 302) { 3822 // Found - the standard redirect - repeat the same request on new URL. 3823 3824 } else if ($this->info['http_code'] == 303) { 3825 // 303 See Other - repeat only if GET, do not bother with POSTs. 3826 if (empty($this->options['CURLOPT_HTTPGET'])) { 3827 break; 3828 } 3829 3830 } else if ($this->info['http_code'] == 307) { 3831 // Temporary Redirect - must repeat using the same request type. 3832 3833 } else if ($this->info['http_code'] == 308) { 3834 // Permanent Redirect - must repeat using the same request type. 3835 3836 } else { 3837 // Some other http code means do not retry! 3838 break; 3839 } 3840 3841 $redirects++; 3842 3843 $redirecturl = null; 3844 if (isset($this->info['redirect_url'])) { 3845 if (preg_match('|^https?://|i', $this->info['redirect_url'])) { 3846 $redirecturl = $this->info['redirect_url']; 3847 } else { 3848 // Emulate CURLOPT_REDIR_PROTOCOLS behaviour which we have set to (CURLPROTO_HTTP | CURLPROTO_HTTPS) only. 3849 $this->errno = CURLE_UNSUPPORTED_PROTOCOL; 3850 $this->error = 'Redirect to a URL with unsuported protocol: ' . $this->info['redirect_url']; 3851 curl_close($curl); 3852 return $this->error; 3853 } 3854 } 3855 if (!$redirecturl) { 3856 foreach ($this->response as $k => $v) { 3857 if (strtolower($k) === 'location') { 3858 $redirecturl = $v; 3859 break; 3860 } 3861 } 3862 if (preg_match('|^https?://|i', $redirecturl)) { 3863 // Great, this is the correct location format! 3864 3865 } else if ($redirecturl) { 3866 $current = curl_getinfo($curl, CURLINFO_EFFECTIVE_URL); 3867 if (strpos($redirecturl, '/') === 0) { 3868 // Relative to server root - just guess. 3869 $pos = strpos('/', $current, 8); 3870 if ($pos === false) { 3871 $redirecturl = $current.$redirecturl; 3872 } else { 3873 $redirecturl = substr($current, 0, $pos).$redirecturl; 3874 } 3875 } else { 3876 // Relative to current script. 3877 $redirecturl = dirname($current).'/'.$redirecturl; 3878 } 3879 } 3880 } 3881 3882 $urlisblocked = $this->check_securityhelper_blocklist($redirecturl); 3883 if (!is_null($urlisblocked)) { 3884 $this->reset_request_state_vars(); 3885 curl_close($curl); 3886 $this->trigger_url_blocked_event($redirecturl, $urlisblocked, true); 3887 return $urlisblocked; 3888 } 3889 3890 // If the response body is written to a seekable stream resource, reset the stream pointer to avoid 3891 // appending multiple response bodies to the same resource. 3892 if (!empty($this->options['CURLOPT_FILE'])) { 3893 $streammetadata = stream_get_meta_data($this->options['CURLOPT_FILE']); 3894 if ($streammetadata['seekable']) { 3895 ftruncate($this->options['CURLOPT_FILE'], 0); 3896 rewind($this->options['CURLOPT_FILE']); 3897 } 3898 } 3899 3900 curl_setopt($curl, CURLOPT_URL, $redirecturl); 3901 $ret = curl_exec($curl); 3902 3903 $this->info = curl_getinfo($curl); 3904 $this->error = curl_error($curl); 3905 $this->errno = curl_errno($curl); 3906 3907 $this->info['redirect_count'] = $redirects; 3908 3909 if ($this->info['http_code'] === 200) { 3910 // Finally this is what we wanted. 3911 break; 3912 } 3913 if ($this->errno != CURLE_OK) { 3914 // Something wrong is going on. 3915 break; 3916 } 3917 } 3918 if ($redirects > $this->options['CURLOPT_MAXREDIRS']) { 3919 $this->errno = CURLE_TOO_MANY_REDIRECTS; 3920 $this->error = 'Maximum ('.$this->options['CURLOPT_MAXREDIRS'].') redirects followed'; 3921 } 3922 } 3923 3924 if ($this->cache) { 3925 $this->cache->set($this->options, $ret); 3926 } 3927 3928 if ($this->debug) { 3929 echo '<h1>Return Data</h1>'; 3930 var_dump($ret); 3931 echo '<h1>Info</h1>'; 3932 var_dump($this->info); 3933 echo '<h1>Error</h1>'; 3934 var_dump($this->error); 3935 } 3936 3937 curl_close($curl); 3938 3939 if (empty($this->error)) { 3940 return $ret; 3941 } else { 3942 return $this->error; 3943 // exception is not ajax friendly 3944 //throw new moodle_exception($this->error, 'curl'); 3945 } 3946 } 3947 3948 /** 3949 * Trigger url_blocked event 3950 * 3951 * @param string $url The URL to request 3952 * @param string $reason Reason for blocking 3953 * @param bool $redirect true if it was a redirect 3954 */ 3955 private function trigger_url_blocked_event($url, $reason, $redirect = false): void { 3956 $params = [ 3957 'url' => $url, 3958 'reason' => $reason, 3959 'redirect' => $redirect, 3960 ]; 3961 $event = core\event\url_blocked::create(['other' => $params]); 3962 $event->trigger(); 3963 } 3964 3965 /** 3966 * HTTP HEAD method 3967 * 3968 * @see request() 3969 * 3970 * @param string $url 3971 * @param array $options 3972 * @return bool 3973 */ 3974 public function head($url, $options = array()) { 3975 $options['CURLOPT_HTTPGET'] = 0; 3976 $options['CURLOPT_HEADER'] = 1; 3977 $options['CURLOPT_NOBODY'] = 1; 3978 return $this->request($url, $options); 3979 } 3980 3981 /** 3982 * HTTP PATCH method 3983 * 3984 * @param string $url 3985 * @param array|string $params 3986 * @param array $options 3987 * @return bool 3988 */ 3989 public function patch($url, $params = '', $options = array()) { 3990 $options['CURLOPT_CUSTOMREQUEST'] = 'PATCH'; 3991 if (is_array($params)) { 3992 $this->_tmp_file_post_params = array(); 3993 foreach ($params as $key => $value) { 3994 if ($value instanceof stored_file) { 3995 $value->add_to_curl_request($this, $key); 3996 } else { 3997 $this->_tmp_file_post_params[$key] = $value; 3998 } 3999 } 4000 $options['CURLOPT_POSTFIELDS'] = $this->_tmp_file_post_params; 4001 unset($this->_tmp_file_post_params); 4002 } else { 4003 // The variable $params is the raw post data. 4004 $options['CURLOPT_POSTFIELDS'] = $params; 4005 } 4006 return $this->request($url, $options); 4007 } 4008 4009 /** 4010 * HTTP POST method 4011 * 4012 * @param string $url 4013 * @param array|string $params 4014 * @param array $options 4015 * @return bool 4016 */ 4017 public function post($url, $params = '', $options = array()) { 4018 $options['CURLOPT_POST'] = 1; 4019 if (is_array($params)) { 4020 $this->_tmp_file_post_params = array(); 4021 foreach ($params as $key => $value) { 4022 if ($value instanceof stored_file) { 4023 $value->add_to_curl_request($this, $key); 4024 } else { 4025 $this->_tmp_file_post_params[$key] = $value; 4026 } 4027 } 4028 $options['CURLOPT_POSTFIELDS'] = $this->_tmp_file_post_params; 4029 unset($this->_tmp_file_post_params); 4030 } else { 4031 // $params is the raw post data 4032 $options['CURLOPT_POSTFIELDS'] = $params; 4033 } 4034 return $this->request($url, $options); 4035 } 4036 4037 /** 4038 * HTTP GET method 4039 * 4040 * @param string $url 4041 * @param array $params 4042 * @param array $options 4043 * @return bool 4044 */ 4045 public function get($url, $params = array(), $options = array()) { 4046 $options['CURLOPT_HTTPGET'] = 1; 4047 4048 if (!empty($params)) { 4049 $url .= (stripos($url, '?') !== false) ? '&' : '?'; 4050 $url .= http_build_query($params, '', '&'); 4051 } 4052 return $this->request($url, $options); 4053 } 4054 4055 /** 4056 * Downloads one file and writes it to the specified file handler 4057 * 4058 * <code> 4059 * $c = new curl(); 4060 * $file = fopen('savepath', 'w'); 4061 * $result = $c->download_one('http://localhost/', null, 4062 * array('file' => $file, 'timeout' => 5, 'followlocation' => true, 'maxredirs' => 3)); 4063 * fclose($file); 4064 * $download_info = $c->get_info(); 4065 * if ($result === true) { 4066 * // file downloaded successfully 4067 * } else { 4068 * $error_text = $result; 4069 * $error_code = $c->get_errno(); 4070 * } 4071 * </code> 4072 * 4073 * <code> 4074 * $c = new curl(); 4075 * $result = $c->download_one('http://localhost/', null, 4076 * array('filepath' => 'savepath', 'timeout' => 5, 'followlocation' => true, 'maxredirs' => 3)); 4077 * // ... see above, no need to close handle and remove file if unsuccessful 4078 * </code> 4079 * 4080 * @param string $url 4081 * @param array|null $params key-value pairs to be added to $url as query string 4082 * @param array $options request options. Must include either 'file' or 'filepath' 4083 * @return bool|string true on success or error string on failure 4084 */ 4085 public function download_one($url, $params, $options = array()) { 4086 $options['CURLOPT_HTTPGET'] = 1; 4087 if (!empty($params)) { 4088 $url .= (stripos($url, '?') !== false) ? '&' : '?'; 4089 $url .= http_build_query($params, '', '&'); 4090 } 4091 if (!empty($options['filepath']) && empty($options['file'])) { 4092 // open file 4093 if (!($options['file'] = fopen($options['filepath'], 'w'))) { 4094 $this->errno = 100; 4095 return get_string('cannotwritefile', 'error', $options['filepath']); 4096 } 4097 $filepath = $options['filepath']; 4098 } 4099 unset($options['filepath']); 4100 $result = $this->request($url, $options); 4101 if (isset($filepath)) { 4102 fclose($options['file']); 4103 if ($result !== true) { 4104 unlink($filepath); 4105 } 4106 } 4107 return $result; 4108 } 4109 4110 /** 4111 * HTTP PUT method 4112 * 4113 * @param string $url 4114 * @param array $params 4115 * @param array $options 4116 * @return bool 4117 */ 4118 public function put($url, $params = array(), $options = array()) { 4119 $file = ''; 4120 $fp = false; 4121 if (isset($params['file'])) { 4122 $file = $params['file']; 4123 if (is_file($file)) { 4124 $fp = fopen($file, 'r'); 4125 $size = filesize($file); 4126 $options['CURLOPT_PUT'] = 1; 4127 $options['CURLOPT_INFILESIZE'] = $size; 4128 $options['CURLOPT_INFILE'] = $fp; 4129 } else { 4130 return null; 4131 } 4132 if (!isset($this->options['CURLOPT_USERPWD'])) { 4133 $this->setopt(array('CURLOPT_USERPWD' => 'anonymous: noreply@moodle.org')); 4134 } 4135 } else { 4136 $options['CURLOPT_CUSTOMREQUEST'] = 'PUT'; 4137 $options['CURLOPT_POSTFIELDS'] = $params; 4138 } 4139 4140 $ret = $this->request($url, $options); 4141 if ($fp !== false) { 4142 fclose($fp); 4143 } 4144 return $ret; 4145 } 4146 4147 /** 4148 * HTTP DELETE method 4149 * 4150 * @param string $url 4151 * @param array $param 4152 * @param array $options 4153 * @return bool 4154 */ 4155 public function delete($url, $param = array(), $options = array()) { 4156 $options['CURLOPT_CUSTOMREQUEST'] = 'DELETE'; 4157 if (!isset($options['CURLOPT_USERPWD'])) { 4158 $options['CURLOPT_USERPWD'] = 'anonymous: noreply@moodle.org'; 4159 } 4160 $ret = $this->request($url, $options); 4161 return $ret; 4162 } 4163 4164 /** 4165 * HTTP TRACE method 4166 * 4167 * @param string $url 4168 * @param array $options 4169 * @return bool 4170 */ 4171 public function trace($url, $options = array()) { 4172 $options['CURLOPT_CUSTOMREQUEST'] = 'TRACE'; 4173 $ret = $this->request($url, $options); 4174 return $ret; 4175 } 4176 4177 /** 4178 * HTTP OPTIONS method 4179 * 4180 * @param string $url 4181 * @param array $options 4182 * @return bool 4183 */ 4184 public function options($url, $options = array()) { 4185 $options['CURLOPT_CUSTOMREQUEST'] = 'OPTIONS'; 4186 $ret = $this->request($url, $options); 4187 return $ret; 4188 } 4189 4190 /** 4191 * Get curl information 4192 * 4193 * @return array 4194 */ 4195 public function get_info() { 4196 return $this->info; 4197 } 4198 4199 /** 4200 * Get curl error code 4201 * 4202 * @return int 4203 */ 4204 public function get_errno() { 4205 return $this->errno; 4206 } 4207 4208 /** 4209 * When using a proxy, an additional HTTP response code may appear at 4210 * the start of the header. For example, when using https over a proxy 4211 * there may be 'HTTP/1.0 200 Connection Established'. Other codes are 4212 * also possible and some may come with their own headers. 4213 * 4214 * If using the return value containing all headers, this function can be 4215 * called to remove unwanted doubles. 4216 * 4217 * Note that it is not possible to distinguish this situation from valid 4218 * data unless you know the actual response part (below the headers) 4219 * will not be included in this string, or else will not 'look like' HTTP 4220 * headers. As a result it is not safe to call this function for general 4221 * data. 4222 * 4223 * @param string $input Input HTTP response 4224 * @return string HTTP response with additional headers stripped if any 4225 */ 4226 public static function strip_double_headers($input) { 4227 // I have tried to make this regular expression as specific as possible 4228 // to avoid any case where it does weird stuff if you happen to put 4229 // HTTP/1.1 200 at the start of any line in your RSS file. This should 4230 // also make it faster because it can abandon regex processing as soon 4231 // as it hits something that doesn't look like an http header. The 4232 // header definition is taken from RFC 822, except I didn't support 4233 // folding which is never used in practice. 4234 $crlf = "\r\n"; 4235 return preg_replace( 4236 // HTTP version and status code (ignore value of code). 4237 '~^HTTP/[1-9](\.[0-9])?.*' . $crlf . 4238 // Header name: character between 33 and 126 decimal, except colon. 4239 // Colon. Header value: any character except \r and \n. CRLF. 4240 '(?:[\x21-\x39\x3b-\x7e]+:[^' . $crlf . ']+' . $crlf . ')*' . 4241 // Headers are terminated by another CRLF (blank line). 4242 $crlf . 4243 // Second HTTP status code, this time must be 200. 4244 '(HTTP/[1-9](\.[0-9])? 200)~', '$2', $input); 4245 } 4246 } 4247 4248 /** 4249 * This class is used by cURL class, use case: 4250 * 4251 * <code> 4252 * $CFG->repositorycacheexpire = 120; 4253 * $CFG->curlcache = 120; 4254 * 4255 * $c = new curl(array('cache'=>true), 'module_cache'=>'repository'); 4256 * $ret = $c->get('http://www.google.com'); 4257 * </code> 4258 * 4259 * @package core_files 4260 * @copyright Dongsheng Cai <dongsheng@moodle.com> 4261 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later 4262 */ 4263 class curl_cache { 4264 /** @var string Path to cache directory */ 4265 public $dir = ''; 4266 4267 /** @var int the repositorycacheexpire config value. */ 4268 private $ttl; 4269 4270 /** 4271 * Constructor 4272 * 4273 * @global stdClass $CFG 4274 * @param string $module which module is using curl_cache 4275 */ 4276 public function __construct($module = 'repository') { 4277 global $CFG; 4278 if (!empty($module)) { 4279 $this->dir = $CFG->cachedir.'/'.$module.'/'; 4280 } else { 4281 $this->dir = $CFG->cachedir.'/misc/'; 4282 } 4283 if (!file_exists($this->dir)) { 4284 mkdir($this->dir, $CFG->directorypermissions, true); 4285 } 4286 if ($module == 'repository') { 4287 if (empty($CFG->repositorycacheexpire)) { 4288 $CFG->repositorycacheexpire = 120; 4289 } 4290 $this->ttl = $CFG->repositorycacheexpire; 4291 } else { 4292 if (empty($CFG->curlcache)) { 4293 $CFG->curlcache = 120; 4294 } 4295 $this->ttl = $CFG->curlcache; 4296 } 4297 } 4298 4299 /** 4300 * Get cached value 4301 * 4302 * @global stdClass $CFG 4303 * @global stdClass $USER 4304 * @param mixed $param 4305 * @return bool|string 4306 */ 4307 public function get($param) { 4308 global $CFG, $USER; 4309 $this->cleanup($this->ttl); 4310 $filename = 'u'.$USER->id.'_'.md5(serialize($param)); 4311 if(file_exists($this->dir.$filename)) { 4312 $lasttime = filemtime($this->dir.$filename); 4313 if (time()-$lasttime > $this->ttl) { 4314 return false; 4315 } else { 4316 $fp = fopen($this->dir.$filename, 'r'); 4317 $size = filesize($this->dir.$filename); 4318 $content = fread($fp, $size); 4319 return unserialize($content); 4320 } 4321 } 4322 return false; 4323 } 4324 4325 /** 4326 * Set cache value 4327 * 4328 * @global object $CFG 4329 * @global object $USER 4330 * @param mixed $param 4331 * @param mixed $val 4332 */ 4333 public function set($param, $val) { 4334 global $CFG, $USER; 4335 $filename = 'u'.$USER->id.'_'.md5(serialize($param)); 4336 $fp = fopen($this->dir.$filename, 'w'); 4337 fwrite($fp, serialize($val)); 4338 fclose($fp); 4339 @chmod($this->dir.$filename, $CFG->filepermissions); 4340 } 4341 4342 /** 4343 * Remove cache files 4344 * 4345 * @param int $expire The number of seconds before expiry 4346 */ 4347 public function cleanup($expire) { 4348 if ($dir = opendir($this->dir)) { 4349 while (false !== ($file = readdir($dir))) { 4350 if(!is_dir($file) && $file != '.' && $file != '..') { 4351 $lasttime = @filemtime($this->dir.$file); 4352 if (time() - $lasttime > $expire) { 4353 @unlink($this->dir.$file); 4354 } 4355 } 4356 } 4357 closedir($dir); 4358 } 4359 } 4360 /** 4361 * delete current user's cache file 4362 * 4363 * @global object $CFG 4364 * @global object $USER 4365 */ 4366 public function refresh() { 4367 global $CFG, $USER; 4368 if ($dir = opendir($this->dir)) { 4369 while (false !== ($file = readdir($dir))) { 4370 if (!is_dir($file) && $file != '.' && $file != '..') { 4371 if (strpos($file, 'u'.$USER->id.'_') !== false) { 4372 @unlink($this->dir.$file); 4373 } 4374 } 4375 } 4376 } 4377 } 4378 } 4379 4380 /** 4381 * This function delegates file serving to individual plugins 4382 * 4383 * @param string $relativepath 4384 * @param bool $forcedownload 4385 * @param null|string $preview the preview mode, defaults to serving the original file 4386 * @param boolean $offline If offline is requested - don't serve a redirect to an external file, return a file suitable for viewing 4387 * offline (e.g. mobile app). 4388 * @param bool $embed Whether this file will be served embed into an iframe. 4389 * @todo MDL-31088 file serving improments 4390 */ 4391 function file_pluginfile($relativepath, $forcedownload, $preview = null, $offline = false, $embed = false) { 4392 global $DB, $CFG, $USER, $OUTPUT; 4393 // relative path must start with '/' 4394 if (!$relativepath) { 4395 throw new \moodle_exception('invalidargorconf'); 4396 } else if ($relativepath[0] != '/') { 4397 throw new \moodle_exception('pathdoesnotstartslash'); 4398 } 4399 4400 // extract relative path components 4401 $args = explode('/', ltrim($relativepath, '/')); 4402 4403 if (count($args) < 3) { // always at least context, component and filearea 4404 throw new \moodle_exception('invalidarguments'); 4405 } 4406 4407 $contextid = (int)array_shift($args); 4408 $component = clean_param(array_shift($args), PARAM_COMPONENT); 4409 $filearea = clean_param(array_shift($args), PARAM_AREA); 4410 4411 list($context, $course, $cm) = get_context_info_array($contextid); 4412 4413 $fs = get_file_storage(); 4414 4415 $sendfileoptions = ['preview' => $preview, 'offline' => $offline, 'embed' => $embed]; 4416 4417 // ======================================================================================================================== 4418 if ($component === 'blog') { 4419 // Blog file serving 4420 if ($context->contextlevel != CONTEXT_SYSTEM) { 4421 send_file_not_found(); 4422 } 4423 if ($filearea !== 'attachment' and $filearea !== 'post') { 4424 send_file_not_found(); 4425 } 4426 4427 if (empty($CFG->enableblogs)) { 4428 throw new \moodle_exception('siteblogdisable', 'blog'); 4429 } 4430 4431 $entryid = (int)array_shift($args); 4432 if (!$entry = $DB->get_record('post', array('module'=>'blog', 'id'=>$entryid))) { 4433 send_file_not_found(); 4434 } 4435 if ($CFG->bloglevel < BLOG_GLOBAL_LEVEL) { 4436 require_login(); 4437 if (isguestuser()) { 4438 throw new \moodle_exception('noguest'); 4439 } 4440 if ($CFG->bloglevel == BLOG_USER_LEVEL) { 4441 if ($USER->id != $entry->userid) { 4442 send_file_not_found(); 4443 } 4444 } 4445 } 4446 4447 if ($entry->publishstate === 'public') { 4448 if ($CFG->forcelogin) { 4449 require_login(); 4450 } 4451 4452 } else if ($entry->publishstate === 'site') { 4453 require_login(); 4454 //ok 4455 } else if ($entry->publishstate === 'draft') { 4456 require_login(); 4457 if ($USER->id != $entry->userid) { 4458 send_file_not_found(); 4459 } 4460 } 4461 4462 $filename = array_pop($args); 4463 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4464 4465 if (!$file = $fs->get_file($context->id, $component, $filearea, $entryid, $filepath, $filename) or $file->is_directory()) { 4466 send_file_not_found(); 4467 } 4468 4469 send_stored_file($file, 10*60, 0, true, $sendfileoptions); // download MUST be forced - security! 4470 4471 // ======================================================================================================================== 4472 } else if ($component === 'grade') { 4473 4474 require_once($CFG->libdir . '/grade/constants.php'); 4475 4476 if (($filearea === 'outcome' or $filearea === 'scale') and $context->contextlevel == CONTEXT_SYSTEM) { 4477 // Global gradebook files 4478 if ($CFG->forcelogin) { 4479 require_login(); 4480 } 4481 4482 $fullpath = "/$context->id/$component/$filearea/".implode('/', $args); 4483 4484 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 4485 send_file_not_found(); 4486 } 4487 4488 \core\session\manager::write_close(); // Unlock session during file serving. 4489 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4490 4491 } else if ($filearea == GRADE_FEEDBACK_FILEAREA || $filearea == GRADE_HISTORY_FEEDBACK_FILEAREA) { 4492 if ($context->contextlevel != CONTEXT_MODULE) { 4493 send_file_not_found(); 4494 } 4495 4496 require_login($course, false); 4497 4498 $gradeid = (int) array_shift($args); 4499 $filename = array_pop($args); 4500 if ($filearea == GRADE_HISTORY_FEEDBACK_FILEAREA) { 4501 $grade = $DB->get_record('grade_grades_history', ['id' => $gradeid]); 4502 } else { 4503 $grade = $DB->get_record('grade_grades', ['id' => $gradeid]); 4504 } 4505 4506 if (!$grade) { 4507 send_file_not_found(); 4508 } 4509 4510 $iscurrentuser = $USER->id == $grade->userid; 4511 4512 if (!$iscurrentuser) { 4513 $coursecontext = context_course::instance($course->id); 4514 if (!has_capability('moodle/grade:viewall', $coursecontext)) { 4515 send_file_not_found(); 4516 } 4517 } 4518 4519 $fullpath = "/$context->id/$component/$filearea/$gradeid/$filename"; 4520 4521 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 4522 send_file_not_found(); 4523 } 4524 4525 \core\session\manager::write_close(); // Unlock session during file serving. 4526 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4527 } else { 4528 send_file_not_found(); 4529 } 4530 4531 // ======================================================================================================================== 4532 } else if ($component === 'tag') { 4533 if ($filearea === 'description' and $context->contextlevel == CONTEXT_SYSTEM) { 4534 4535 // All tag descriptions are going to be public but we still need to respect forcelogin 4536 if ($CFG->forcelogin) { 4537 require_login(); 4538 } 4539 4540 $fullpath = "/$context->id/tag/description/".implode('/', $args); 4541 4542 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 4543 send_file_not_found(); 4544 } 4545 4546 \core\session\manager::write_close(); // Unlock session during file serving. 4547 send_stored_file($file, 60*60, 0, true, $sendfileoptions); 4548 4549 } else { 4550 send_file_not_found(); 4551 } 4552 // ======================================================================================================================== 4553 } else if ($component === 'badges') { 4554 require_once($CFG->libdir . '/badgeslib.php'); 4555 4556 $badgeid = (int)array_shift($args); 4557 $badge = new badge($badgeid); 4558 $filename = array_pop($args); 4559 4560 if ($filearea === 'badgeimage') { 4561 if ($filename !== 'f1' && $filename !== 'f2' && $filename !== 'f3') { 4562 send_file_not_found(); 4563 } 4564 if (!$file = $fs->get_file($context->id, 'badges', 'badgeimage', $badge->id, '/', $filename.'.png')) { 4565 send_file_not_found(); 4566 } 4567 4568 \core\session\manager::write_close(); 4569 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4570 } else if ($filearea === 'userbadge' and $context->contextlevel == CONTEXT_USER) { 4571 if (!$file = $fs->get_file($context->id, 'badges', 'userbadge', $badge->id, '/', $filename.'.png')) { 4572 send_file_not_found(); 4573 } 4574 4575 \core\session\manager::write_close(); 4576 send_stored_file($file, 60*60, 0, true, $sendfileoptions); 4577 } 4578 // ======================================================================================================================== 4579 } else if ($component === 'calendar') { 4580 if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_SYSTEM) { 4581 4582 // All events here are public the one requirement is that we respect forcelogin 4583 if ($CFG->forcelogin) { 4584 require_login(); 4585 } 4586 4587 // Get the event if from the args array 4588 $eventid = array_shift($args); 4589 4590 // Load the event from the database 4591 if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'eventtype'=>'site'))) { 4592 send_file_not_found(); 4593 } 4594 4595 // Get the file and serve if successful 4596 $filename = array_pop($args); 4597 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4598 if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) { 4599 send_file_not_found(); 4600 } 4601 4602 \core\session\manager::write_close(); // Unlock session during file serving. 4603 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4604 4605 } else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_USER) { 4606 4607 // Must be logged in, if they are not then they obviously can't be this user 4608 require_login(); 4609 4610 // Don't want guests here, potentially saves a DB call 4611 if (isguestuser()) { 4612 send_file_not_found(); 4613 } 4614 4615 // Get the event if from the args array 4616 $eventid = array_shift($args); 4617 4618 // Load the event from the database - user id must match 4619 if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'userid'=>$USER->id, 'eventtype'=>'user'))) { 4620 send_file_not_found(); 4621 } 4622 4623 // Get the file and serve if successful 4624 $filename = array_pop($args); 4625 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4626 if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) { 4627 send_file_not_found(); 4628 } 4629 4630 \core\session\manager::write_close(); // Unlock session during file serving. 4631 send_stored_file($file, 0, 0, true, $sendfileoptions); 4632 4633 } else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_COURSECAT) { 4634 if ($CFG->forcelogin) { 4635 require_login(); 4636 } 4637 4638 // Get category, this will also validate access. 4639 $category = core_course_category::get($context->instanceid); 4640 4641 // Get the event ID from the args array, load event. 4642 $eventid = array_shift($args); 4643 $event = $DB->get_record('event', [ 4644 'id' => (int) $eventid, 4645 'eventtype' => 'category', 4646 'categoryid' => $category->id, 4647 ]); 4648 4649 if (!$event) { 4650 send_file_not_found(); 4651 } 4652 4653 // Retrieve file from storage, and serve. 4654 $filename = array_pop($args); 4655 $filepath = $args ? '/' . implode('/', $args) .'/' : '/'; 4656 $file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename); 4657 if (!$file || $file->is_directory()) { 4658 send_file_not_found(); 4659 } 4660 4661 // Unlock session during file serving. 4662 \core\session\manager::write_close(); 4663 send_stored_file($file, HOURSECS, 0, $forcedownload, $sendfileoptions); 4664 } else if ($filearea === 'event_description' and $context->contextlevel == CONTEXT_COURSE) { 4665 4666 // Respect forcelogin and require login unless this is the site.... it probably 4667 // should NEVER be the site 4668 if ($CFG->forcelogin || $course->id != SITEID) { 4669 require_login($course); 4670 } 4671 4672 // Must be able to at least view the course. This does not apply to the front page. 4673 if ($course->id != SITEID && (!is_enrolled($context)) && (!is_viewing($context))) { 4674 //TODO: hmm, do we really want to block guests here? 4675 send_file_not_found(); 4676 } 4677 4678 // Get the event id 4679 $eventid = array_shift($args); 4680 4681 // Load the event from the database we need to check whether it is 4682 // a) valid course event 4683 // b) a group event 4684 // Group events use the course context (there is no group context) 4685 if (!$event = $DB->get_record('event', array('id'=>(int)$eventid, 'courseid'=>$course->id))) { 4686 send_file_not_found(); 4687 } 4688 4689 // If its a group event require either membership of view all groups capability 4690 if ($event->eventtype === 'group') { 4691 if (!has_capability('moodle/site:accessallgroups', $context) && !groups_is_member($event->groupid, $USER->id)) { 4692 send_file_not_found(); 4693 } 4694 } else if ($event->eventtype === 'course' || $event->eventtype === 'site') { 4695 // Ok. Please note that the event type 'site' still uses a course context. 4696 } else { 4697 // Some other type. 4698 send_file_not_found(); 4699 } 4700 4701 // If we get this far we can serve the file 4702 $filename = array_pop($args); 4703 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4704 if (!$file = $fs->get_file($context->id, $component, $filearea, $eventid, $filepath, $filename) or $file->is_directory()) { 4705 send_file_not_found(); 4706 } 4707 4708 \core\session\manager::write_close(); // Unlock session during file serving. 4709 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4710 4711 } else { 4712 send_file_not_found(); 4713 } 4714 4715 // ======================================================================================================================== 4716 } else if ($component === 'user') { 4717 if ($filearea === 'icon' and $context->contextlevel == CONTEXT_USER) { 4718 if (count($args) == 1) { 4719 $themename = theme_config::DEFAULT_THEME; 4720 $filename = array_shift($args); 4721 } else { 4722 $themename = array_shift($args); 4723 $filename = array_shift($args); 4724 } 4725 4726 // fix file name automatically 4727 if ($filename !== 'f1' and $filename !== 'f2' and $filename !== 'f3') { 4728 $filename = 'f1'; 4729 } 4730 4731 if ((!empty($CFG->forcelogin) and !isloggedin()) || 4732 (!empty($CFG->forceloginforprofileimage) && (!isloggedin() || isguestuser()))) { 4733 // protect images if login required and not logged in; 4734 // also if login is required for profile images and is not logged in or guest 4735 // do not use require_login() because it is expensive and not suitable here anyway 4736 $theme = theme_config::load($themename); 4737 redirect($theme->image_url('u/'.$filename, 'moodle')); // intentionally not cached 4738 } 4739 4740 if (!$file = $fs->get_file($context->id, 'user', 'icon', 0, '/', $filename.'.png')) { 4741 if (!$file = $fs->get_file($context->id, 'user', 'icon', 0, '/', $filename.'.jpg')) { 4742 if ($filename === 'f3') { 4743 // f3 512x512px was introduced in 2.3, there might be only the smaller version. 4744 if (!$file = $fs->get_file($context->id, 'user', 'icon', 0, '/', 'f1.png')) { 4745 $file = $fs->get_file($context->id, 'user', 'icon', 0, '/', 'f1.jpg'); 4746 } 4747 } 4748 } 4749 } 4750 if (!$file) { 4751 // bad reference - try to prevent future retries as hard as possible! 4752 if ($user = $DB->get_record('user', array('id'=>$context->instanceid), 'id, picture')) { 4753 if ($user->picture > 0) { 4754 $DB->set_field('user', 'picture', 0, array('id'=>$user->id)); 4755 } 4756 } 4757 // no redirect here because it is not cached 4758 $theme = theme_config::load($themename); 4759 $imagefile = $theme->resolve_image_location('u/'.$filename, 'moodle', null); 4760 send_file($imagefile, basename($imagefile), 60*60*24*14); 4761 } 4762 4763 $options = $sendfileoptions; 4764 if (empty($CFG->forcelogin) && empty($CFG->forceloginforprofileimage)) { 4765 // Profile images should be cache-able by both browsers and proxies according 4766 // to $CFG->forcelogin and $CFG->forceloginforprofileimage. 4767 $options['cacheability'] = 'public'; 4768 } 4769 send_stored_file($file, 60*60*24*365, 0, false, $options); // enable long caching, there are many images on each page 4770 4771 } else if ($filearea === 'private' and $context->contextlevel == CONTEXT_USER) { 4772 require_login(); 4773 4774 if (isguestuser()) { 4775 send_file_not_found(); 4776 } 4777 4778 if ($USER->id !== $context->instanceid) { 4779 send_file_not_found(); 4780 } 4781 4782 $filename = array_pop($args); 4783 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4784 if (!$file = $fs->get_file($context->id, $component, $filearea, 0, $filepath, $filename) or $file->is_directory()) { 4785 send_file_not_found(); 4786 } 4787 4788 \core\session\manager::write_close(); // Unlock session during file serving. 4789 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4790 4791 } else if ($filearea === 'profile' and $context->contextlevel == CONTEXT_USER) { 4792 4793 if ($CFG->forcelogin) { 4794 require_login(); 4795 } 4796 4797 $userid = $context->instanceid; 4798 4799 if (!empty($CFG->forceloginforprofiles)) { 4800 require_once("{$CFG->dirroot}/user/lib.php"); 4801 4802 require_login(); 4803 4804 // Verify the current user is able to view the profile of the supplied user anywhere. 4805 $user = core_user::get_user($userid); 4806 if (!user_can_view_profile($user, null, $context)) { 4807 send_file_not_found(); 4808 } 4809 } 4810 4811 $filename = array_pop($args); 4812 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4813 if (!$file = $fs->get_file($context->id, $component, $filearea, 0, $filepath, $filename) or $file->is_directory()) { 4814 send_file_not_found(); 4815 } 4816 4817 \core\session\manager::write_close(); // Unlock session during file serving. 4818 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4819 4820 } else if ($filearea === 'profile' and $context->contextlevel == CONTEXT_COURSE) { 4821 $userid = (int)array_shift($args); 4822 $usercontext = context_user::instance($userid); 4823 4824 if ($CFG->forcelogin) { 4825 require_login(); 4826 } 4827 4828 if (!empty($CFG->forceloginforprofiles)) { 4829 require_once("{$CFG->dirroot}/user/lib.php"); 4830 4831 require_login(); 4832 4833 // Verify the current user is able to view the profile of the supplied user in current course. 4834 $user = core_user::get_user($userid); 4835 if (!user_can_view_profile($user, $course, $usercontext)) { 4836 send_file_not_found(); 4837 } 4838 } 4839 4840 $filename = array_pop($args); 4841 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4842 if (!$file = $fs->get_file($usercontext->id, 'user', 'profile', 0, $filepath, $filename) or $file->is_directory()) { 4843 send_file_not_found(); 4844 } 4845 4846 \core\session\manager::write_close(); // Unlock session during file serving. 4847 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4848 4849 } else if ($filearea === 'backup' and $context->contextlevel == CONTEXT_USER) { 4850 require_login(); 4851 4852 if (isguestuser()) { 4853 send_file_not_found(); 4854 } 4855 $userid = $context->instanceid; 4856 4857 if ($USER->id != $userid) { 4858 send_file_not_found(); 4859 } 4860 4861 $filename = array_pop($args); 4862 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4863 if (!$file = $fs->get_file($context->id, 'user', 'backup', 0, $filepath, $filename) or $file->is_directory()) { 4864 send_file_not_found(); 4865 } 4866 4867 \core\session\manager::write_close(); // Unlock session during file serving. 4868 send_stored_file($file, 0, 0, true, $sendfileoptions); // must force download - security! 4869 4870 } else { 4871 send_file_not_found(); 4872 } 4873 4874 // ======================================================================================================================== 4875 } else if ($component === 'coursecat') { 4876 if ($context->contextlevel != CONTEXT_COURSECAT) { 4877 send_file_not_found(); 4878 } 4879 4880 if ($filearea === 'description') { 4881 if ($CFG->forcelogin) { 4882 // no login necessary - unless login forced everywhere 4883 require_login(); 4884 } 4885 4886 // Check if user can view this category. 4887 if (!core_course_category::get($context->instanceid, IGNORE_MISSING)) { 4888 send_file_not_found(); 4889 } 4890 4891 $filename = array_pop($args); 4892 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4893 if (!$file = $fs->get_file($context->id, 'coursecat', 'description', 0, $filepath, $filename) or $file->is_directory()) { 4894 send_file_not_found(); 4895 } 4896 4897 \core\session\manager::write_close(); // Unlock session during file serving. 4898 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4899 } else { 4900 send_file_not_found(); 4901 } 4902 4903 // ======================================================================================================================== 4904 } else if ($component === 'course') { 4905 if ($context->contextlevel != CONTEXT_COURSE) { 4906 send_file_not_found(); 4907 } 4908 4909 if ($filearea === 'summary' || $filearea === 'overviewfiles') { 4910 if ($CFG->forcelogin) { 4911 require_login(); 4912 } 4913 4914 $filename = array_pop($args); 4915 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4916 if (!$file = $fs->get_file($context->id, 'course', $filearea, 0, $filepath, $filename) or $file->is_directory()) { 4917 send_file_not_found(); 4918 } 4919 4920 \core\session\manager::write_close(); // Unlock session during file serving. 4921 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4922 4923 } else if ($filearea === 'section') { 4924 if ($CFG->forcelogin) { 4925 require_login($course); 4926 } else if ($course->id != SITEID) { 4927 require_login($course); 4928 } 4929 4930 $sectionid = (int)array_shift($args); 4931 4932 if (!$section = $DB->get_record('course_sections', array('id'=>$sectionid, 'course'=>$course->id))) { 4933 send_file_not_found(); 4934 } 4935 4936 $filename = array_pop($args); 4937 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4938 if (!$file = $fs->get_file($context->id, 'course', 'section', $sectionid, $filepath, $filename) or $file->is_directory()) { 4939 send_file_not_found(); 4940 } 4941 4942 \core\session\manager::write_close(); // Unlock session during file serving. 4943 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 4944 4945 } else if ($filearea === 'generated') { 4946 if ($CFG->forcelogin) { 4947 require_login($course); 4948 } else if ($course->id != SITEID) { 4949 require_login($course); 4950 } 4951 4952 $svg = $OUTPUT->get_generated_svg_for_id($course->id); 4953 4954 \core\session\manager::write_close(); // Unlock session during file serving. 4955 send_file($svg, 'course.svg', 60 * 60, 0, true, $forcedownload); 4956 4957 } else { 4958 send_file_not_found(); 4959 } 4960 4961 } else if ($component === 'cohort') { 4962 4963 $cohortid = (int)array_shift($args); 4964 $cohort = $DB->get_record('cohort', array('id' => $cohortid), '*', MUST_EXIST); 4965 $cohortcontext = context::instance_by_id($cohort->contextid); 4966 4967 // The context in the file URL must be either cohort context or context of the course underneath the cohort's context. 4968 if ($context->id != $cohort->contextid && 4969 ($context->contextlevel != CONTEXT_COURSE || !in_array($cohort->contextid, $context->get_parent_context_ids()))) { 4970 send_file_not_found(); 4971 } 4972 4973 // User is able to access cohort if they have view cap on cohort level or 4974 // the cohort is visible and they have view cap on course level. 4975 $canview = has_capability('moodle/cohort:view', $cohortcontext) || 4976 ($cohort->visible && has_capability('moodle/cohort:view', $context)); 4977 4978 if ($filearea === 'description' && $canview) { 4979 $filename = array_pop($args); 4980 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 4981 if (($file = $fs->get_file($cohortcontext->id, 'cohort', 'description', $cohort->id, $filepath, $filename)) 4982 && !$file->is_directory()) { 4983 \core\session\manager::write_close(); // Unlock session during file serving. 4984 send_stored_file($file, 60 * 60, 0, $forcedownload, $sendfileoptions); 4985 } 4986 } 4987 4988 send_file_not_found(); 4989 4990 } else if ($component === 'group') { 4991 if ($context->contextlevel != CONTEXT_COURSE) { 4992 send_file_not_found(); 4993 } 4994 4995 require_course_login($course, true, null, false); 4996 4997 $groupid = (int)array_shift($args); 4998 4999 $group = $DB->get_record('groups', array('id'=>$groupid, 'courseid'=>$course->id), '*', MUST_EXIST); 5000 if (($course->groupmodeforce and $course->groupmode == SEPARATEGROUPS) and !has_capability('moodle/site:accessallgroups', $context) and !groups_is_member($group->id, $USER->id)) { 5001 // do not allow access to separate group info if not member or teacher 5002 send_file_not_found(); 5003 } 5004 5005 if ($filearea === 'description') { 5006 5007 require_login($course); 5008 5009 $filename = array_pop($args); 5010 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5011 if (!$file = $fs->get_file($context->id, 'group', 'description', $group->id, $filepath, $filename) or $file->is_directory()) { 5012 send_file_not_found(); 5013 } 5014 5015 \core\session\manager::write_close(); // Unlock session during file serving. 5016 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5017 5018 } else if ($filearea === 'icon') { 5019 $filename = array_pop($args); 5020 5021 if ($filename !== 'f1' and $filename !== 'f2') { 5022 send_file_not_found(); 5023 } 5024 if (!$file = $fs->get_file($context->id, 'group', 'icon', $group->id, '/', $filename.'.png')) { 5025 if (!$file = $fs->get_file($context->id, 'group', 'icon', $group->id, '/', $filename.'.jpg')) { 5026 send_file_not_found(); 5027 } 5028 } 5029 5030 \core\session\manager::write_close(); // Unlock session during file serving. 5031 send_stored_file($file, 60*60, 0, false, $sendfileoptions); 5032 5033 } else if ($filearea === 'generated') { 5034 if ($CFG->forcelogin) { 5035 require_login($course); 5036 } else if ($course->id != SITEID) { 5037 require_login($course); 5038 } 5039 5040 $svg = $OUTPUT->get_generated_svg_for_id($group->id); 5041 5042 \core\session\manager::write_close(); // Unlock session during file serving. 5043 send_file($svg, 'group.svg', 60 * 60, 0, true, $forcedownload); 5044 5045 } else { 5046 send_file_not_found(); 5047 } 5048 5049 } else if ($component === 'grouping') { 5050 if ($context->contextlevel != CONTEXT_COURSE) { 5051 send_file_not_found(); 5052 } 5053 5054 require_login($course); 5055 5056 $groupingid = (int)array_shift($args); 5057 5058 // note: everybody has access to grouping desc images for now 5059 if ($filearea === 'description') { 5060 5061 $filename = array_pop($args); 5062 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5063 if (!$file = $fs->get_file($context->id, 'grouping', 'description', $groupingid, $filepath, $filename) or $file->is_directory()) { 5064 send_file_not_found(); 5065 } 5066 5067 \core\session\manager::write_close(); // Unlock session during file serving. 5068 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5069 5070 } else { 5071 send_file_not_found(); 5072 } 5073 5074 // ======================================================================================================================== 5075 } else if ($component === 'backup') { 5076 if ($filearea === 'course' and $context->contextlevel == CONTEXT_COURSE) { 5077 require_login($course); 5078 require_capability('moodle/backup:downloadfile', $context); 5079 5080 $filename = array_pop($args); 5081 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5082 if (!$file = $fs->get_file($context->id, 'backup', 'course', 0, $filepath, $filename) or $file->is_directory()) { 5083 send_file_not_found(); 5084 } 5085 5086 \core\session\manager::write_close(); // Unlock session during file serving. 5087 send_stored_file($file, 0, 0, $forcedownload, $sendfileoptions); 5088 5089 } else if ($filearea === 'section' and $context->contextlevel == CONTEXT_COURSE) { 5090 require_login($course); 5091 require_capability('moodle/backup:downloadfile', $context); 5092 5093 $sectionid = (int)array_shift($args); 5094 5095 $filename = array_pop($args); 5096 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5097 if (!$file = $fs->get_file($context->id, 'backup', 'section', $sectionid, $filepath, $filename) or $file->is_directory()) { 5098 send_file_not_found(); 5099 } 5100 5101 \core\session\manager::write_close(); 5102 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5103 5104 } else if ($filearea === 'activity' and $context->contextlevel == CONTEXT_MODULE) { 5105 require_login($course, false, $cm); 5106 require_capability('moodle/backup:downloadfile', $context); 5107 5108 $filename = array_pop($args); 5109 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5110 if (!$file = $fs->get_file($context->id, 'backup', 'activity', 0, $filepath, $filename) or $file->is_directory()) { 5111 send_file_not_found(); 5112 } 5113 5114 \core\session\manager::write_close(); 5115 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5116 5117 } else if ($filearea === 'automated' and $context->contextlevel == CONTEXT_COURSE) { 5118 // Backup files that were generated by the automated backup systems. 5119 5120 require_login($course); 5121 require_capability('moodle/backup:downloadfile', $context); 5122 require_capability('moodle/restore:userinfo', $context); 5123 5124 $filename = array_pop($args); 5125 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5126 if (!$file = $fs->get_file($context->id, 'backup', 'automated', 0, $filepath, $filename) or $file->is_directory()) { 5127 send_file_not_found(); 5128 } 5129 5130 \core\session\manager::write_close(); // Unlock session during file serving. 5131 send_stored_file($file, 0, 0, $forcedownload, $sendfileoptions); 5132 5133 } else { 5134 send_file_not_found(); 5135 } 5136 5137 // ======================================================================================================================== 5138 } else if ($component === 'question') { 5139 require_once($CFG->libdir . '/questionlib.php'); 5140 question_pluginfile($course, $context, 'question', $filearea, $args, $forcedownload, $sendfileoptions); 5141 send_file_not_found(); 5142 5143 // ======================================================================================================================== 5144 } else if ($component === 'grading') { 5145 if ($filearea === 'description') { 5146 // files embedded into the form definition description 5147 5148 if ($context->contextlevel == CONTEXT_SYSTEM) { 5149 require_login(); 5150 5151 } else if ($context->contextlevel >= CONTEXT_COURSE) { 5152 require_login($course, false, $cm); 5153 5154 } else { 5155 send_file_not_found(); 5156 } 5157 5158 $formid = (int)array_shift($args); 5159 5160 $sql = "SELECT ga.id 5161 FROM {grading_areas} ga 5162 JOIN {grading_definitions} gd ON (gd.areaid = ga.id) 5163 WHERE gd.id = ? AND ga.contextid = ?"; 5164 $areaid = $DB->get_field_sql($sql, array($formid, $context->id), IGNORE_MISSING); 5165 5166 if (!$areaid) { 5167 send_file_not_found(); 5168 } 5169 5170 $fullpath = "/$context->id/$component/$filearea/$formid/".implode('/', $args); 5171 5172 if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->is_directory()) { 5173 send_file_not_found(); 5174 } 5175 5176 \core\session\manager::write_close(); // Unlock session during file serving. 5177 send_stored_file($file, 60*60, 0, $forcedownload, $sendfileoptions); 5178 } 5179 } else if ($component === 'contentbank') { 5180 if ($filearea != 'public' || isguestuser()) { 5181 send_file_not_found(); 5182 } 5183 5184 if ($context->contextlevel == CONTEXT_SYSTEM || $context->contextlevel == CONTEXT_COURSECAT) { 5185 require_login(); 5186 } else if ($context->contextlevel == CONTEXT_COURSE) { 5187 require_login($course); 5188 } else { 5189 send_file_not_found(); 5190 } 5191 5192 $componentargs = fullclone($args); 5193 $itemid = (int)array_shift($args); 5194 $filename = array_pop($args); 5195 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5196 5197 \core\session\manager::write_close(); // Unlock session during file serving. 5198 5199 $contenttype = $DB->get_field('contentbank_content', 'contenttype', ['id' => $itemid]); 5200 if (component_class_callback("\\{$contenttype}\\contenttype", 'pluginfile', 5201 [$course, null, $context, $filearea, $componentargs, $forcedownload, $sendfileoptions], false) === false) { 5202 5203 if (!$file = $fs->get_file($context->id, $component, $filearea, $itemid, $filepath, $filename) or 5204 5205 $file->is_directory()) { 5206 send_file_not_found(); 5207 5208 } else { 5209 send_stored_file($file, 0, 0, true, $sendfileoptions); // Must force download - security! 5210 } 5211 } 5212 } else if (strpos($component, 'mod_') === 0) { 5213 $modname = substr($component, 4); 5214 if (!file_exists("$CFG->dirroot/mod/$modname/lib.php")) { 5215 send_file_not_found(); 5216 } 5217 require_once("$CFG->dirroot/mod/$modname/lib.php"); 5218 5219 if ($context->contextlevel == CONTEXT_MODULE) { 5220 if ($cm->modname !== $modname) { 5221 // somebody tries to gain illegal access, cm type must match the component! 5222 send_file_not_found(); 5223 } 5224 } 5225 5226 if ($filearea === 'intro') { 5227 if (!plugin_supports('mod', $modname, FEATURE_MOD_INTRO, true)) { 5228 send_file_not_found(); 5229 } 5230 5231 // Require login to the course first (without login to the module). 5232 require_course_login($course, true); 5233 5234 // Now check if module is available OR it is restricted but the intro is shown on the course page. 5235 $cminfo = cm_info::create($cm); 5236 if (!$cminfo->uservisible) { 5237 if (!$cm->showdescription || !$cminfo->is_visible_on_course_page()) { 5238 // Module intro is not visible on the course page and module is not available, show access error. 5239 require_course_login($course, true, $cminfo); 5240 } 5241 } 5242 5243 // all users may access it 5244 $filename = array_pop($args); 5245 $filepath = $args ? '/'.implode('/', $args).'/' : '/'; 5246 if (!$file = $fs->get_file($context->id, 'mod_'.$modname, 'intro', 0, $filepath, $filename) or $file->is_directory()) { 5247 send_file_not_found(); 5248 } 5249 5250 // finally send the file 5251 send_stored_file($file, null, 0, false, $sendfileoptions); 5252 } 5253 5254 $filefunction = $component.'_pluginfile'; 5255 $filefunctionold = $modname.'_pluginfile'; 5256 if (function_exists($filefunction)) { 5257 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5258 $filefunction($course, $cm, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5259 } else if (function_exists($filefunctionold)) { 5260 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5261 $filefunctionold($course, $cm, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5262 } 5263 5264 send_file_not_found(); 5265 5266 // ======================================================================================================================== 5267 } else if (strpos($component, 'block_') === 0) { 5268 $blockname = substr($component, 6); 5269 // note: no more class methods in blocks please, that is .... 5270 if (!file_exists("$CFG->dirroot/blocks/$blockname/lib.php")) { 5271 send_file_not_found(); 5272 } 5273 require_once("$CFG->dirroot/blocks/$blockname/lib.php"); 5274 5275 if ($context->contextlevel == CONTEXT_BLOCK) { 5276 $birecord = $DB->get_record('block_instances', array('id'=>$context->instanceid), '*',MUST_EXIST); 5277 if ($birecord->blockname !== $blockname) { 5278 // somebody tries to gain illegal access, cm type must match the component! 5279 send_file_not_found(); 5280 } 5281 5282 if ($context->get_course_context(false)) { 5283 // If block is in course context, then check if user has capability to access course. 5284 require_course_login($course); 5285 } else if ($CFG->forcelogin) { 5286 // If user is logged out, bp record will not be visible, even if the user would have access if logged in. 5287 require_login(); 5288 } 5289 5290 $bprecord = $DB->get_record('block_positions', array('contextid' => $context->id, 'blockinstanceid' => $context->instanceid)); 5291 // User can't access file, if block is hidden or doesn't have block:view capability 5292 if (($bprecord && !$bprecord->visible) || !has_capability('moodle/block:view', $context)) { 5293 send_file_not_found(); 5294 } 5295 } else { 5296 $birecord = null; 5297 } 5298 5299 $filefunction = $component.'_pluginfile'; 5300 if (function_exists($filefunction)) { 5301 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5302 $filefunction($course, $birecord, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5303 } 5304 5305 send_file_not_found(); 5306 5307 // ======================================================================================================================== 5308 } else if (strpos($component, '_') === false) { 5309 // all core subsystems have to be specified above, no more guessing here! 5310 send_file_not_found(); 5311 5312 } else { 5313 // try to serve general plugin file in arbitrary context 5314 $dir = core_component::get_component_directory($component); 5315 if (!file_exists("$dir/lib.php")) { 5316 send_file_not_found(); 5317 } 5318 include_once("$dir/lib.php"); 5319 5320 $filefunction = $component.'_pluginfile'; 5321 if (function_exists($filefunction)) { 5322 // if the function exists, it must send the file and terminate. Whatever it returns leads to "not found" 5323 $filefunction($course, $cm, $context, $filearea, $args, $forcedownload, $sendfileoptions); 5324 } 5325 5326 send_file_not_found(); 5327 } 5328 5329 }
title
Description
Body
title
Description
Body
title
Description
Body
title
Body
