dolibarr  9.0.0
document.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2004-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
3  * Copyright (C) 2004-2013 Laurent Destailleur <eldy@users.sourceforge.net>
4  * Copyright (C) 2005 Simon Tosser <simon@kornog-computing.com>
5  * Copyright (C) 2005-2012 Regis Houssin <regis.houssin@inodbox.com>
6  * Copyright (C) 2010 Pierre Morin <pierre.morin@auguria.net>
7  * Copyright (C) 2010 Juanjo Menent <jmenent@2byte.es>
8  *
9  * This program is free software; you can redistribute it and/or modify
10  * it under the terms of the GNU General Public License as published by
11  * the Free Software Foundation; either version 3 of the License, or
12  * (at your option) any later version.
13  *
14  * This program is distributed in the hope that it will be useful,
15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17  * GNU General Public License for more details.
18  *
19  * You should have received a copy of the GNU General Public License
20  * along with this program. If not, see <http://www.gnu.org/licenses/>.
21  * or see http://www.gnu.org/
22  */
23 
33 //if (! defined('NOREQUIREUSER')) define('NOREQUIREUSER','1'); // Not disabled cause need to load personalized language
34 //if (! defined('NOREQUIREDB')) define('NOREQUIREDB','1'); // Not disabled cause need to load personalized language
35 if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL','1');
36 if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU','1');
37 if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML','1');
38 if (! defined('NOREQUIREAJAX')) define('NOREQUIREAJAX','1');
39 
40 // For direct external download link, we don't need to load/check we are into a login session
41 if (isset($_GET["hashp"]) && ! defined("NOLOGIN"))
42 {
43  if (! defined("NOLOGIN")) define("NOLOGIN",1);
44  if (! defined("NOCSRFCHECK")) define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
45  if (! defined("NOIPCHECK")) define("NOIPCHECK",1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
46 }
47 // Some value of modulepart can be used to get resources that are public so no login are required.
48 if ((isset($_GET["modulepart"]) && $_GET["modulepart"] == 'medias'))
49 {
50  if (! defined("NOLOGIN")) define("NOLOGIN",1);
51  if (! defined("NOCSRFCHECK")) define("NOCSRFCHECK",1); // We accept to go on this page from external web site.
52  if (! defined("NOIPCHECK")) define("NOIPCHECK",1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
53 }
54 
60 function llxHeader()
61 {
62 }
68 function llxFooter()
69 {
70 }
71 
72 require 'main.inc.php'; // Load $user and permissions
73 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
74 
75 $encoding = '';
76 $action=GETPOST('action','alpha');
77 $original_file=GETPOST('file','alphanohtml'); // Do not use urldecode here ($_GET are already decoded by PHP).
78 $hashp=GETPOST('hashp','aZ09');
79 $modulepart=GETPOST('modulepart','alpha');
80 $urlsource=GETPOST('urlsource','alpha');
81 $entity=GETPOST('entity','int')?GETPOST('entity','int'):$conf->entity;
82 
83 // Security check
84 if (empty($modulepart) && empty($hashp)) accessforbidden('Bad link. Bad value for parameter modulepart',0,0,1);
85 if (empty($original_file) && empty($hashp)) accessforbidden('Bad link. Missing identification to find file (original_file or hashp)',0,0,1);
86 if ($modulepart == 'fckeditor') $modulepart='medias'; // For backward compatibility
87 
88 $socid=0;
89 if ($user->societe_id > 0) $socid = $user->societe_id;
90 
91 // For some module part, dir may be privates
92 if (in_array($modulepart, array('facture_paiement','unpaid')))
93 {
94  if (! $user->rights->societe->client->voir || $socid) $original_file='private/'.$user->id.'/'.$original_file; // If user has no permission to see all, output dir is specific to user
95 }
96 
97 
98 /*
99  * Actions
100  */
101 
102 // None
103 
104 
105 
106 /*
107  * View
108  */
109 
110 // If we have a hash public (hashp), we guess the original_file.
111 if (! empty($hashp))
112 {
113  include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
114  $ecmfile=new EcmFiles($db);
115  $result = $ecmfile->fetch(0, '', '', '', $hashp);
116  if ($result > 0)
117  {
118  $tmp = explode('/', $ecmfile->filepath, 2); // $ecmfile->filepath is relative to document directory
119  // filepath can be 'users/X' or 'X/propale/PR11111'
120  if (is_numeric($tmp[0])) // If first tmp is numeric, it is subdir of company for multicompany, we take next part.
121  {
122  $tmp = explode('/', $tmp[1], 2);
123  }
124  $moduleparttocheck = $tmp[0]; // moduleparttocheck is first part of path
125 
126  if ($modulepart) // Not required, so often not defined, for link using public hashp parameter.
127  {
128  if ($moduleparttocheck == $modulepart)
129  {
130  // We remove first level of directory
131  $original_file = (($tmp[1]?$tmp[1].'/':'').$ecmfile->filename); // this is relative to module dir
132  //var_dump($original_file); exit;
133  }
134  else
135  {
136  accessforbidden('Bad link. File is from another module part.',0,0,1);
137  }
138  }
139  else
140  {
141  $modulepart = $moduleparttocheck;
142  $original_file = (($tmp[1]?$tmp[1].'/':'').$ecmfile->filename); // this is relative to module dir
143  }
144  }
145  else
146  {
147  $langs->load("errors");
148  accessforbidden($langs->trans("ErrorFileNotFoundWithSharedLink"),0,0,1);
149  }
150 }
151 
152 // Define attachment (attachment=true to force choice popup 'open'/'save as')
153 $attachment = true;
154 if (preg_match('/\.(html|htm)$/i',$original_file)) $attachment = false;
155 if (isset($_GET["attachment"])) $attachment = GETPOST("attachment",'alpha')?true:false;
156 if (! empty($conf->global->MAIN_DISABLE_FORCE_SAVEAS)) $attachment=false;
157 
158 // Define mime type
159 $type = 'application/octet-stream';
160 if (GETPOST('type','alpha')) $type=GETPOST('type','alpha');
161 else $type=dol_mimetype($original_file);
162 
163 // Security: Delete string ../ into $original_file
164 $original_file = str_replace("../","/", $original_file);
165 
166 // Find the subdirectory name as the reference
167 $refname=basename(dirname($original_file)."/");
168 
169 // Security check
170 if (empty($modulepart)) accessforbidden('Bad value for parameter modulepart');
171 
172 $check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $refname);
173 $accessallowed = $check_access['accessallowed'];
174 $sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals'];
175 $fullpath_original_file = $check_access['original_file']; // $fullpath_original_file is now a full path name
176 
177 if (! empty($hashp))
178 {
179  $accessallowed = 1; // When using hashp, link is public so we force $accessallowed
180  $sqlprotectagainstexternals = '';
181 }
182 else
183 {
184  // Basic protection (against external users only)
185  if ($user->societe_id > 0)
186  {
187  if ($sqlprotectagainstexternals)
188  {
189  $resql = $db->query($sqlprotectagainstexternals);
190  if ($resql)
191  {
192  $num=$db->num_rows($resql);
193  $i=0;
194  while ($i < $num)
195  {
196  $obj = $db->fetch_object($resql);
197  if ($user->societe_id != $obj->fk_soc)
198  {
199  $accessallowed=0;
200  break;
201  }
202  $i++;
203  }
204  }
205  }
206  }
207 }
208 
209 // Security:
210 // Limit access if permissions are wrong
211 if (! $accessallowed)
212 {
213  accessforbidden();
214 }
215 
216 // Security:
217 // On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
218 if (preg_match('/\.\./',$fullpath_original_file) || preg_match('/[<>|]/',$fullpath_original_file))
219 {
220  dol_syslog("Refused to deliver file ".$fullpath_original_file);
221  print "ErrorFileNameInvalid: ".$original_file;
222  exit;
223 }
224 
225 
226 clearstatcache();
227 
228 $filename = basename($fullpath_original_file);
229 
230 // Output file on browser
231 dol_syslog("document.php download $fullpath_original_file filename=$filename content-type=$type");
232 $fullpath_original_file_osencoded=dol_osencode($fullpath_original_file); // New file name encoded in OS encoding charset
233 
234 // This test if file exists should be useless. We keep it to find bug more easily
235 if (! file_exists($fullpath_original_file_osencoded))
236 {
237  dol_syslog("ErrorFileDoesNotExists: ".$fullpath_original_file);
238  print "ErrorFileDoesNotExists: ".$original_file;
239  exit;
240 }
241 
242 // Permissions are ok and file found, so we return it
243 top_httphead($type);
244 header('Content-Description: File Transfer');
245 if ($encoding) header('Content-Encoding: '.$encoding);
246 // Add MIME Content-Disposition from RFC 2183 (inline=automatically displayed, attachment=need user action to open)
247 if ($attachment) header('Content-Disposition: attachment; filename="'.$filename.'"');
248 else header('Content-Disposition: inline; filename="'.$filename.'"');
249 header('Content-Length: ' . dol_filesize($fullpath_original_file));
250 // Ajout directives pour resoudre bug IE
251 header('Cache-Control: Public, must-revalidate');
252 header('Pragma: public');
253 
254 readfile($fullpath_original_file_osencoded);
255 
256 if (is_object($db)) $db->close();
dol_osencode($str)
Return a string encoded into OS filesystem encoding.
GETPOST($paramname, $check='none', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
print
Draft customers invoices.
Definition: index.php:91
if(! empty($conf->facture->enabled) && $user->rights->facture->lire) if(! empty($conf->fournisseur->enabled) && $user->rights->fournisseur->facture->lire) if(! empty($conf->don->enabled) && $user->rights->societe->lire) if(! empty($conf->tax->enabled) && $user->rights->tax->charges->lire) if(! empty($conf->facture->enabled) &&! empty($conf->commande->enabled) && $user->rights->commande->lire &&empty($conf->global->WORKFLOW_DISABLE_CREATE_INVOICE_FROM_ORDER)) if(! empty($conf->facture->enabled) && $user->rights->facture->lire) if(! empty($conf->fournisseur->enabled) && $user->rights->fournisseur->facture->lire) $resql
Social contributions to pay.
Definition: index.php:1053
if(! defined('NOREQUIREMENU')) if(! function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
Definition: main.inc.php:1107
dol_mimetype($file, $default='application/octet-stream', $mode=0)
Return mime type of a file.
dol_filesize($pathoffile)
Return size of a file.
Definition: files.lib.php:552
dol_check_secure_access_document($modulepart, $original_file, $entity, $fuser='', $refname='', $mode='read')
Security check when accessing to a document (used by document.php, viewimage.php and webservices) ...
Definition: files.lib.php:2109
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0)
Show a message to say access is forbidden and stop program Calling this function terminate execution ...
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='')
Write log message into outputs.
llxFooter()
Footer empty.
Definition: document.php:68
Class to manage ECM files.
if(isset($_GET["hashp"]) &&! defined("NOLOGIN")) if((isset($_GET["modulepart"]) && $_GET["modulepart"]=='medias')) llxHeader()
Header empty.
Definition: document.php:60