dolibarr  16.0.5
viewimage.php
Go to the documentation of this file.
1 <?php
2 /* Copyright (C) 2004-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org>
3  * Copyright (C) 2005-2016 Laurent Destailleur <eldy@users.sourceforge.net>
4  * Copyright (C) 2005-2016 Regis Houssin <regis.houssin@inodbox.com>
5  *
6  * This program is free software; you can redistribute it and/or modify
7  * it under the terms of the GNU General Public License as published by
8  * the Free Software Foundation; either version 3 of the License, or
9  * (at your option) any later version.
10  *
11  * This program is distributed in the hope that it will be useful,
12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14  * GNU General Public License for more details.
15  *
16  * You should have received a copy of the GNU General Public License
17  * along with this program. If not, see <https://www.gnu.org/licenses/>.
18  * or see https://www.gnu.org/
19  */
20 
29 //if (! defined('NOREQUIREUSER')) define('NOREQUIREUSER','1'); // Not disabled cause need to load personalized language
30 //if (! defined('NOREQUIREDB')) define('NOREQUIREDB','1'); // Not disabled cause need to load personalized language
31 if (!defined('NOREQUIRESOC')) {
32  define('NOREQUIRESOC', '1');
33 }
34 if (!defined('NOREQUIRETRAN')) {
35  define('NOREQUIRETRAN', '1');
36 }
37 if (!defined('NOCSRFCHECK')) {
38  define('NOCSRFCHECK', '1');
39 }
40 if (!defined('NOTOKENRENEWAL')) {
41  define('NOTOKENRENEWAL', '1');
42 }
43 if (!defined('NOREQUIREMENU')) {
44  define('NOREQUIREMENU', '1');
45 }
46 if (!defined('NOREQUIREHTML')) {
47  define('NOREQUIREHTML', '1');
48 }
49 if (!defined('NOREQUIREAJAX')) {
50  define('NOREQUIREAJAX', '1');
51 }
52 
53 // Some value of modulepart can be used to get resources that are public so no login are required.
54 // Note that only directory logo is free to access without login.
55 if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'mycompany' && preg_match('/^\/?logos\//', $_GET['file'])) {
56  if (!defined("NOLOGIN")) {
57  define("NOLOGIN", 1);
58  }
59  if (!defined("NOCSRFCHECK")) {
60  define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
61  }
62  if (!defined("NOIPCHECK")) {
63  define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
64  }
65 }
66 // For direct external download link, we don't need to load/check we are into a login session
67 if (isset($_GET["hashp"]) && !defined("NOLOGIN")) {
68  if (!defined("NOLOGIN")) {
69  define("NOLOGIN", 1);
70  }
71  if (!defined("NOCSRFCHECK")) {
72  define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
73  }
74  if (!defined("NOIPCHECK")) {
75  define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
76  }
77 }
78 // Some value of modulepart can be used to get resources that are public so no login are required.
79 if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'medias') {
80  if (!defined("NOLOGIN")) {
81  define("NOLOGIN", 1);
82  }
83  if (!defined("NOCSRFCHECK")) {
84  define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
85  }
86  if (!defined("NOIPCHECK")) {
87  define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
88  }
89 }
90 
91 // Used by TakePOS Auto Order
92 if (isset($_GET["modulepart"]) && $_GET["modulepart"] == 'product' && isset($_GET["publictakepos"])) {
93  if (!defined("NOLOGIN")) {
94  define("NOLOGIN", 1);
95  }
96  if (!defined("NOCSRFCHECK")) {
97  define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
98  }
99  if (!defined("NOIPCHECK")) {
100  define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
101  }
102 }
103 
104 // For multicompany
105 $entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
106 if (is_numeric($entity)) {
107  define("DOLENTITY", $entity);
108 }
109 
116 function llxHeader()
117 {
118 }
125 function llxFooter()
126 {
127 }
128 
129 require 'main.inc.php'; // Load $user and permissions
130 require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
131 
132 $action = GETPOST('action', 'aZ09');
133 $original_file = GETPOST('file', 'alphanohtml'); // Do not use urldecode here ($_GET are already decoded by PHP).
134 $hashp = GETPOST('hashp', 'aZ09');
135 $modulepart = GETPOST('modulepart', 'alpha');
136 $urlsource = GETPOST('urlsource', 'alpha');
137 $entity = GETPOST('entity', 'int') ?GETPOST('entity', 'int') : $conf->entity;
138 
139 // Security check
140 if (empty($modulepart) && empty($hashp)) {
141  accessforbidden('Bad link. Bad value for parameter modulepart', 0, 0, 1);
142 }
143 if (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {
144  accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 0, 0, 1);
145 }
146 if ($modulepart == 'fckeditor') {
147  $modulepart = 'medias'; // For backward compatibility
148 }
149 
150 
151 
152 /*
153  * Actions
154  */
155 
156 // None
157 
158 
159 
160 /*
161  * View
162  */
163 
164 if (GETPOST("cache", 'alpha')) {
165  // Important: Following code is to avoid page request by browser and PHP CPU at
166  // each Dolibarr page access.
167  if (empty($dolibarr_nocache)) {
168  header('Cache-Control: max-age=3600, public, must-revalidate');
169  header('Pragma: cache'); // This is to avoid having Pragma: no-cache
170  } else {
171  header('Cache-Control: no-cache');
172  }
173  //print $dolibarr_nocache; exit;
174 }
175 
176 // If we have a hash public (hashp), we guess the original_file.
177 if (!empty($hashp)) {
178  include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
179  $ecmfile = new EcmFiles($db);
180  $result = $ecmfile->fetch(0, '', '', '', $hashp);
181  if ($result > 0) {
182  $tmp = explode('/', $ecmfile->filepath, 2); // $ecmfile->filepath is relative to document directory
183  // filepath can be 'users/X' or 'X/propale/PR11111'
184  if (is_numeric($tmp[0])) { // If first tmp is numeric, it is subdir of company for multicompany, we take next part.
185  $tmp = explode('/', $tmp[1], 2);
186  }
187  $moduleparttocheck = $tmp[0]; // moduleparttocheck is first part of path
188 
189  if ($modulepart) { // Not required, so often not defined, for link using public hashp parameter.
190  if ($moduleparttocheck == $modulepart) {
191  // We remove first level of directory
192  $original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir
193  //var_dump($original_file); exit;
194  } else {
195  accessforbidden('Bad link. File is from another module part.', 0, 0, 1);
196  }
197  } else {
198  $modulepart = $moduleparttocheck;
199  $original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir
200  }
201  } else {
202  $langs->load("errors");
203  accessforbidden($langs->trans("ErrorFileNotFoundWithSharedLink"), 0, 0, 1);
204  }
205 }
206 
207 // Define mime type
208 $type = 'application/octet-stream';
209 if (GETPOST('type', 'alpha')) {
210  $type = GETPOST('type', 'alpha');
211 } else {
212  $type = dol_mimetype($original_file);
213 }
214 
215 // Security: This wrapper is for images. We do not allow type/html
216 if (preg_match('/html/i', $type)) {
217  accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.', 0, 0, 1);
218 }
219 // Security: This wrapper is for images. We do not allow files ending with .noexe
220 if (preg_match('/\.noexe$/i', $original_file)) {
221  accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.', 0, 0, 1);
222 }
223 
224 // Security: Delete string ../ or ..\ into $original_file
225 $original_file = preg_replace('/\.\.+/', '..', $original_file); // Replace '... or more' with '..'
226 $original_file = str_replace('../', '/', $original_file);
227 $original_file = str_replace('..\\', '/', $original_file);
228 
229 // Find the subdirectory name as the reference
230 $refname = basename(dirname($original_file)."/");
231 if ($refname == 'thumbs') {
232  // If we get the thumbs directory, we must go one step higher. For example original_file='10/thumbs/myfile_small.jpg' -> refname='10'
233  $refname = basename(dirname(dirname($original_file))."/");
234 }
235 
236 // Check that file is allowed for view with viewimage.php
237 if (!empty($original_file) && !dolIsAllowedForPreview($original_file)) {
238  accessforbidden('This file is not qualified for preview', 0, 0, 1);
239 }
240 
241 // Security check
242 if (empty($modulepart)) {
243  accessforbidden('Bad value for parameter modulepart', 0, 0, 1);
244 }
245 
246 // When logged in a different entity, medias cannot be accessed because $conf->$module->multidir_output
247 // is not set on the requested entity, but they are public documents, so reset entity
248 if ($modulepart === 'medias' && $entity != $conf->entity) {
249  $conf->entity = $entity;
250  $conf->setValues($db);
251 }
252 
253 $check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $user, $refname);
254 $accessallowed = $check_access['accessallowed'];
255 $sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals'];
256 $fullpath_original_file = $check_access['original_file']; // $fullpath_original_file is now a full path name
257 
258 if (!empty($hashp)) {
259  $accessallowed = 1; // When using hashp, link is public so we force $accessallowed
260  $sqlprotectagainstexternals = '';
261 } elseif (isset($_GET["publictakepos"])) {
262  if (!empty($conf->global->TAKEPOS_AUTO_ORDER)) {
263  $accessallowed = 1; // Only if TakePOS Public Auto Order is enabled and received publictakepos variable
264  }
265 } else {
266  // Basic protection (against external users only)
267  if ($user->socid > 0) {
268  if ($sqlprotectagainstexternals) {
269  $resql = $db->query($sqlprotectagainstexternals);
270  if ($resql) {
271  $num = $db->num_rows($resql);
272  $i = 0;
273  while ($i < $num) {
274  $obj = $db->fetch_object($resql);
275  if ($user->socid != $obj->fk_soc) {
276  $accessallowed = 0;
277  break;
278  }
279  $i++;
280  }
281  }
282  }
283  }
284 }
285 
286 // Security:
287 // Limit access if permissions are wrong
288 if (!$accessallowed) {
289  accessforbidden();
290 }
291 
292 // Security:
293 // On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
294 if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file)) {
295  dol_syslog("Refused to deliver file ".$fullpath_original_file);
296  print "ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
297  exit;
298 }
299 
300 
301 
302 if ($modulepart == 'barcode') {
303  $generator = GETPOST("generator", "aZ09");
304  $encoding = GETPOST("encoding", "aZ09");
305  $readable = GETPOST("readable", 'aZ09') ? GETPOST("readable", "aZ09") : "Y";
306  if (in_array($encoding, array('EAN8', 'EAN13'))) {
307  $code = GETPOST("code", 'alphanohtml');
308  } else {
309  $code = GETPOST("code", 'restricthtml'); // This can be rich content (qrcode, datamatrix, ...)
310  }
311 
312  if (empty($generator) || empty($encoding)) {
313  print 'Error: Parameter "generator" or "encoding" not defined';
314  exit;
315  }
316 
317  $dirbarcode = array_merge(array("/core/modules/barcode/doc/"), $conf->modules_parts['barcode']);
318 
319  $result = 0;
320 
321  foreach ($dirbarcode as $reldir) {
322  $dir = dol_buildpath($reldir, 0);
323  $newdir = dol_osencode($dir);
324 
325  // Check if directory exists (we do not use dol_is_dir to avoid loading files.lib.php)
326  if (!is_dir($newdir)) {
327  continue;
328  }
329 
330  $result = @include_once $newdir.$generator.'.modules.php';
331  if ($result) {
332  break;
333  }
334  }
335 
336  // Load barcode class
337  $classname = "mod".ucfirst($generator);
338  $module = new $classname($db);
339  if ($module->encodingIsSupported($encoding)) {
340  $result = $module->buildBarCode($code, $encoding, $readable);
341  }
342 } else {
343  // Open and return file
344  clearstatcache();
345 
346  $filename = basename($fullpath_original_file);
347 
348  // Output files on browser
349  dol_syslog("viewimage.php return file $fullpath_original_file filename=$filename content-type=$type");
350 
351  // This test is to avoid error images when image is not available (for example thumbs).
352  if (!dol_is_file($fullpath_original_file) && empty($_GET["noalt"])) {
353  $fullpath_original_file = DOL_DOCUMENT_ROOT.'/public/theme/common/nophoto.png';
354  /*$error='Error: File '.$_GET["file"].' does not exists or filesystems permissions are not allowed';
355  print $error;
356  exit;*/
357  }
358 
359  // Permissions are ok and file found, so we return it
360  if ($type) {
361  top_httphead($type);
362  header('Content-Disposition: inline; filename="'.basename($fullpath_original_file).'"');
363  } else {
364  top_httphead('image/png');
365  header('Content-Disposition: inline; filename="'.basename($fullpath_original_file).'"');
366  }
367 
368  $fullpath_original_file_osencoded = dol_osencode($fullpath_original_file);
369 
370  readfile($fullpath_original_file_osencoded);
371 }
372 
373 
374 if (is_object($db)) {
375  $db->close();
376 }
dol_osencode
dol_osencode($str)
Return a string encoded into OS filesystem encoding.
Definition: functions.lib.php:8499
GETPOST
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
Definition: functions.lib.php:484
dol_buildpath
dol_buildpath($path, $type=0, $returnemptyifnotfound=0)
Return path of url or filesystem.
Definition: functions.lib.php:1062
dol_mimetype
dol_mimetype($file, $default='application/octet-stream', $mode=0)
Return MIME type of a file from its name with extension.
Definition: functions.lib.php:9741
top_httphead
if(!defined('NOREQUIREMENU')) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
Definition: main.inc.php:1407
llxFooter
llxFooter()
Footer empty.
Definition: viewimage.php:125
dol_is_file
dol_is_file($pathoffile)
Return if path is a file.
Definition: files.lib.php:477
dol_syslog
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
Definition: functions.lib.php:1603
EcmFiles
Class to manage ECM files.
Definition: ecmfiles.class.php:35
dol_check_secure_access_document
dol_check_secure_access_document($modulepart, $original_file, $entity, $fuser='', $refname='', $mode='read')
Security check when accessing to a document (used by document.php, viewimage.php and webservices to g...
Definition: files.lib.php:2405
$resql
if(isModEnabled('facture') &&!empty($user->rights->facture->lire)) if((isModEnabled('fournisseur') &&empty($conf->global->MAIN_USE_NEW_SUPPLIERMOD) && $user->rights->fournisseur->facture->lire)||(isModEnabled('supplier_invoice') && $user->rights->supplier_invoice->lire)) if(isModEnabled('don') &&!empty($user->rights->don->lire)) if(isModEnabled('tax') &&!empty($user->rights->tax->charges->lire)) if(isModEnabled('facture') &&isModEnabled('commande') && $user->rights->commande->lire &&empty($conf->global->WORKFLOW_DISABLE_CREATE_INVOICE_FROM_ORDER)) $resql
Social contributions to pay.
Definition: index.php:742
dolIsAllowedForPreview
dolIsAllowedForPreview($file)
Return if a file is qualified for preview.
Definition: functions.lib.php:9706
accessforbidden
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program Calling this function terminate execution ...
Definition: security.lib.php:933
llxHeader
if(is_numeric($entity)) llxHeader()
Header empty.
Definition: viewimage.php:116