Changeset 962

Timestamp:

03/04/2008 12:40:40 AM (3 years ago)

Author:

DotMG

Message:

This ticket can be seen as a COORDINATION ticket for #692 to trunk. But since {{files}} action in 1.1.7 is a somewhat enhanced version, the issue is taken differently.

• actions/files/files.php : porting #692 to trunk
• handlers/files.xml/files.xml.php : porting #692 to trunk and adding error messages.
• lang/en/en.inc.php : More error messages.

refs #696

Location:

trunk

Files:

• actions/files/files.php (modified) (1 diff)
• handlers/files.xml/files.xml.php (modified) (3 diffs)
• lang/en/en.inc.php (modified) (2 diffs)

trunk/actions/files/files.php

@@ -27 +27 @@
  * @uses        Wakka::HasAccess()
  * @uses        Wakka::IsAdmin()
- * @uses        Wakka::MiniHref()
  * @uses        Wakka::htmlspecialchars_ent()
+ * @uses        Wakka::FormOpen()
+ * @uses        Wakka::FormClose()
+ * @uses        Wakka::SetConfigValue()
+ * @uses        Wakka::ReturnSafeHTML()
+ * @uses        Config::$upload_path
  *
  * @todo security: check file type, not only extension

trunk/handlers/files.xml/files.xml.php

@@ -17 +17 @@
  * @filesource
  *
- * @uses        Wakka::GetConfigValue()
+ * @uses        mkdir_r()
+ * @uses        Wakka::SetConfigValue()
  * @uses        Wakka::GetPageTag()
  * @uses        Wakka::HasAccess()
  * @uses        Wakka::Href()
  * @uses        Wakka::IsAdmin()
- * @uses        Wakka::redirect()
+ * @uses        Wakka::SetRedirectMessage()
+ * @uses        Wakka::Redirect()
  * @uses        Config::$upload_path
+ * @uses        Config::$root_page
+ * @uses        WIKKA_ERROR_ACL_READ_INFO
+ *
  * @todo        make shared download code for this and grab code handler
  */
@@ -38 +43 @@
 }
 
+if (!isset($_GET['file']) || !isset($_GET['action']) || !is_string($_GET['file']))
+{
+        // invocation of files.xml must provide $_GET['file'] and $_GET['action'].
+        // todo: add an error message here: probably, ERROR_BAD_PARAMETERS should be splitted.
+        $this->Redirect('');
+}
+if ('.' == $_GET['file']{0})
+{
+        $this->Redirect($this->Href(), ERROR_FILETYPE_NOT_ALLOWED);
+}
 // do the action
 switch ($_GET['action'])        # #312
@@ -49 +64 @@
                 header("Content-Type: application/x-download");
                 header("Content-Disposition: attachment; filename=\"".urldecode($filename)."\"");
-                if ($this->HasAccess('read'))
+                if (!file_exists($path))
                 {
-                        if (isset($_SERVER['HTTP_RANGE']) &&
-                                (preg_match('/^.*bytes[= ]+(\d+)-(\d+)\s*$/', $_SERVER['HTTP_RANGE'], $range)) &&
-                                ((int) $range[2] >= (int) $range[1])
-                           )
-                        {
-                                $rstart = $range[1];
-                                $rend = $range[2];
-                                $fp = fopen($path, 'rb');
-                                fseek($fp, $rstart+SEEK_SET);
-                                $data = fread($fp, $rend - $rstart + 1);
-                                fclose($fp);
-                                header('Content-Range: bytes '.$rstart.'-'.$rend.'/'.filesize($path));
-                                header('HTTP/1.1 206 Partial content');
-                                echo $data;
-                                exit();
-                        }
-                        //Header("Content-Length: ".filesize($path));
-                        //Header("Connection: close");
-                        @ob_end_clean();
-                        @ob_end_clean();
+                        $this->Redirect($this->Href(), sprintf(ERROR_NONEXISTENT_FILE, $_GET['file']));
+                }
+                if (!$this->HasAccess('read'))
+                {
+                        // The user may have followed a link from email or external site, but he has no access to the page.
+                        // We redirect this user to the HomePage.
+                        $this->Redirect($this->Href('', $this->GetConfigValue('root_page')), WIKKA_ERROR_ACL_READ_INFO);
+                }
+                if (isset($_SERVER['HTTP_RANGE']) &&
+                        (preg_match('/^.*bytes[= ]+(\d+)-(\d+)\s*$/', $_SERVER['HTTP_RANGE'], $range)) &&
+                        ((int) $range[2] >= (int) $range[1])
+                   )
+                {
+                        $rstart = $range[1];
+                        $rend = $range[2];
                         $fp = fopen($path, 'rb');
-                        while (!feof($fp))
-                        {
-                                $data = fread($fp, 4096);
-                                echo $data;
-                        }
+                        fseek($fp, $rstart+SEEK_SET);
+                        $data = fread($fp, $rend - $rstart + 1);
                         fclose($fp);
+                        header('Content-Range: bytes '.$rstart.'-'.$rend.'/'.filesize($path));
+                        header('HTTP/1.1 206 Partial content');
+                        echo $data;
                         exit();
                 }
+                //Header("Content-Length: ".filesize($path));
+                //Header("Connection: close");
+                @ob_end_clean();
+                @ob_end_clean();
+                $fp = fopen($path, 'rb');
+                while (!feof($fp))
+                {
+                        $data = fread($fp, 4096);
+                        echo $data;
+                }
+                fclose($fp);
+                exit();
         case 'delete':
                 if ($this->IsAdmin())
                 {
-                        @unlink($upload_path.DIRECTORY_SEPARATOR.$_GET['file']); # #89, #312 // TODO if this is admin-only, why hide any errors?
+                        $delete_success = @unlink($upload_path.DIRECTORY_SEPARATOR.$_GET['file']); # #89, #312 
+                        if (!$delete_success)
+                        {
+                                $this->SetRedirectMessage(ERROR_FILE_NOT_DELETED);
+                        }
                 }
-                print $this->redirect($this->Href());
 }
+print $this->Redirect($this->Href());
 ?>

trunk/lang/en/en.inc.php

@@ -234 +234 @@
 
 /**#@+
- * Language constant used by the {@link files.php files} action
+ * Language constant used by the {@link files.php files action} and {@link handlers/files.xml/files.xml.php files.xml handler}
  */
 // files
@@ -244 +244 @@
 define('ERROR_FILE_ALREADY_EXISTS', 'Sorry, a file named %s already exists.'); // %s - file name ref
 define('ERROR_EXTENSION_NOT_ALLOWED', 'Sorry, files with this extension are not allowed.');
+define('ERROR_FILETYPE_NOT_ALLOWED', 'Sorry, files of this type are not allowed.');
+define('ERROR_FILE_NOT_DELETED', 'Sorry, the file could not be deleted!');
 define('ERROR_FILE_TOO_BIG', 'Attempted file upload was too big. Maximum allowed size is %s.'); // %s - allowed filesize
 define('ERROR_NO_FILE_SELECTED', 'No file selected.');