Subversion Repositories oidplus

Rev

Rev 360 | Go to most recent revision | Blame | Last modification | View Log | RSS feed

  1. <?php
  2.  
  3. /*
  4.  * OIDplus 2.0
  5.  * Copyright 2019 - 2021 Daniel Marschall, ViaThinkSoft
  6.  *
  7.  * Licensed under the Apache License, Version 2.0 (the "License");
  8.  * you may not use this file except in compliance with the License.
  9.  * You may obtain a copy of the License at
  10.  *
  11.  *     http://www.apache.org/licenses/LICENSE-2.0
  12.  *
  13.  * Unless required by applicable law or agreed to in writing, software
  14.  * distributed under the License is distributed on an "AS IS" BASIS,
  15.  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  16.  * See the License for the specific language governing permissions and
  17.  * limitations under the License.
  18.  */
  19.  
  20. require_once __DIR__ . '/../../../includes/oidplus.inc.php';
  21.  
  22. try {
  23.         OIDplus::init(true);
  24.  
  25.         originHeaders();
  26.  
  27.         if (!isset($_REQUEST['filename'])) {
  28.                 http_response_code(400);
  29.                 throw new Exception(_L('Argument "%1" is missing','filename'));
  30.         }
  31.         $filename = $_REQUEST['filename'];
  32.         if (strpos($filename, '/') !== false) throw new OIDplusException(_L('Illegal file name'));
  33.         if (strpos($filename, '\\') !== false) throw new OIDplusException(_L('Illegal file name'));
  34.         if (strpos($filename, '..') !== false) throw new OIDplusException(_L('Illegal file name'));
  35.         if (strpos($filename, chr(0)) !== false) throw new OIDplusException(_L('Illegal file name'));
  36.  
  37.         if (!isset($_REQUEST['id'])) {
  38.                 http_response_code(400);
  39.                 throw new Exception(_L('Argument "%1" is missing','id'));
  40.         }
  41.         $id = $_REQUEST['id'];
  42.  
  43.         $uploaddir = OIDplusPagePublicAttachments::getUploadDir($id);
  44.         $local_file = $uploaddir.'/'.$filename;
  45.  
  46.         if (!file_exists($local_file)) {
  47.                 http_response_code(404);
  48.                 throw new Exception(_L('The file does not exist'));
  49.         }
  50.  
  51.         VtsBrowserDownload::output_file($local_file);
  52. } catch (Exception $e) {
  53.         echo '<h1>'._L('Error').'</h1><p>'.htmlentities($e->getMessage()).'<p>';
  54. }