Subversion Repositories oidplus

Rev

Rev 1005 | Rev 1200 | Go to most recent revision | Details | Compare with Previous | Last modification | View Log | RSS feed

Rev Author Line No. Line
635 daniel-mar 1 
<?php
2 
 
3 
/*
4 
 * OIDplus 2.0
5 
 * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
6 
 *
7 
 * Licensed under the Apache License, Version 2.0 (the "License");
8 
 * you may not use this file except in compliance with the License.
9 
 * You may obtain a copy of the License at
10 
 *
11 
 *     http://www.apache.org/licenses/LICENSE-2.0
12 
 *
13 
 * Unless required by applicable law or agreed to in writing, software
14 
 * distributed under the License is distributed on an "AS IS" BASIS,
15 
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 
 * See the License for the specific language governing permissions and
17 
 * limitations under the License.
18 
 */
19 
 
1050 daniel-mar 20 
use ViaThinkSoft\OIDplus\OIDplus;
21 
use ViaThinkSoft\OIDplus\OIDplusException;
22 
use ViaThinkSoft\OIDplus\OIDplusPagePublicAttachments;
23 
 
635 daniel-mar 24 
require_once __DIR__ . '/../../../../includes/oidplus.inc.php';
25 
 
26 
try {
27 
        OIDplus::init(true);
28 
 
1050 daniel-mar 29 
        if (OIDplus::baseConfig()->getValue('DISABLE_PLUGIN_ViaThinkSoft\OIDplus\OIDplusPagePublicAttachments', false)) {
635 daniel-mar 30 
                throw new OIDplusException(_L('This plugin was disabled by the system administrator!'));
31 
        }
32 
 
33 
        originHeaders();
34 
 
35 
        if (!isset($_REQUEST['filename'])) {
36 
                http_response_code(400);
37 
                throw new OIDplusException(_L('Argument "%1" is missing','filename'));
38 
        }
39 
        $filename = $_REQUEST['filename'];
40 
        if (strpos($filename, '/') !== false) throw new OIDplusException(_L('Illegal file name'));
41 
        if (strpos($filename, '\\') !== false) throw new OIDplusException(_L('Illegal file name'));
42 
        if (strpos($filename, '..') !== false) throw new OIDplusException(_L('Illegal file name'));
43 
        if (strpos($filename, chr(0)) !== false) throw new OIDplusException(_L('Illegal file name'));
44 
 
45 
        if (!isset($_REQUEST['id'])) {
46 
                http_response_code(400);
47 
                throw new OIDplusException(_L('Argument "%1" is missing','id'));
48 
        }
49 
        $id = $_REQUEST['id'];
50 
 
51 
        $uploaddir = OIDplusPagePublicAttachments::getUploadDir($id);
52 
        $local_file = $uploaddir.'/'.$filename;
53 
 
54 
        if (!file_exists($local_file)) {
55 
                http_response_code(404);
56 
                throw new OIDplusException(_L('The file does not exist'));
57 
        }
58 
 
1005 daniel-mar 59 
        OIDplus::invoke_shutdown();
60 
 
635 daniel-mar 61 
        VtsBrowserDownload::output_file($local_file);
1050 daniel-mar 62 
} catch (\Exception $e) {
635 daniel-mar 63 
        echo '<h1>'._L('Error').'</h1><p>'.htmlentities($e->getMessage()).'<p>';
64 
}