96require
'main.inc.php';
97require_once DOL_DOCUMENT_ROOT.
'/core/lib/files.lib.php';
98require_once DOL_DOCUMENT_ROOT.
'/core/lib/images.lib.php';
101$action =
GETPOST(
'action',
'aZ09');
102$original_file =
GETPOST(
'file',
'alphanohtml');
103$hashp =
GETPOST(
'hashp',
'aZ09');
104$modulepart =
GETPOST(
'modulepart',
'alpha');
105$urlsource =
GETPOST(
'urlsource',
'alpha');
109if (empty($modulepart) && empty($hashp)) {
112if (empty($original_file) && empty($hashp)) {
115if ($modulepart ==
'fckeditor') {
116 $modulepart =
'medias';
120if ($user->socid > 0) {
121 $socid = $user->socid;
125if (in_array($modulepart, array(
'facture_paiement',
'unpaid'))) {
126 if (!$user->hasRight(
'societe',
'client',
'voir')) {
127 $original_file =
'private/'.$user->id.
'/'.$original_file;
147 include_once DOL_DOCUMENT_ROOT.
'/ecm/class/ecmfiles.class.php';
149 $result = $ecmfile->fetch(0,
'',
'',
'', $hashp);
151 $tmp = explode(
'/', $ecmfile->filepath, 2);
153 if (is_numeric($tmp[0])) {
154 $tmp = explode(
'/', $tmp[1], 2);
156 $moduleparttocheck = $tmp[0];
159 if ($moduleparttocheck == $modulepart) {
161 $original_file = (($tmp[1] ? $tmp[1].
'/' :
'').$ecmfile->filename);
167 $modulepart = $moduleparttocheck;
168 $original_file = (($tmp[1] ? $tmp[1].
'/' :
'').$ecmfile->filename);
170 $entity = $ecmfile->entity;
171 if ($entity != $conf->entity) {
172 $conf->entity = $entity;
173 $conf->setValues($db);
176 $langs->load(
"errors");
183if (preg_match(
'/\.(html|htm)$/i', $original_file)) {
186if (isset($_GET[
"attachment"])) {
187 $attachment =
GETPOST(
"attachment",
'alpha') ?
true:
false;
194$type =
'application/octet-stream';
196 $type =
GETPOST(
'type',
'alpha');
204 $type =
'application/octet-stream';
208$original_file = preg_replace(
'/\.\.+/',
'..', $original_file);
209$original_file = str_replace(
'../',
'/', $original_file);
210$original_file = str_replace(
'..\\',
'/', $original_file);
214if (empty($modulepart)) {
220$accessallowed = $check_access[
'accessallowed'];
221$sqlprotectagainstexternals = $check_access[
'sqlprotectagainstexternals'];
222$fullpath_original_file = $check_access[
'original_file'];
227 $sqlprotectagainstexternals =
'';
230 if ($user->socid > 0) {
231 if ($sqlprotectagainstexternals) {
232 $resql = $db->query($sqlprotectagainstexternals);
234 $num = $db->num_rows($resql);
237 $obj = $db->fetch_object($resql);
238 if ($user->socid != $obj->fk_soc) {
251if (!$accessallowed) {
257if (preg_match(
'/\.\./', $fullpath_original_file) || preg_match(
'/[<>|]/', $fullpath_original_file)) {
258 dol_syslog(
"Refused to deliver file ".$fullpath_original_file);
259 print
"ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
266$filename = basename($fullpath_original_file);
267$filename = preg_replace(
'/\.noexe$/i',
'', $filename);
270dol_syslog(
"document.php download $fullpath_original_file filename=$filename content-type=$type");
271$fullpath_original_file_osencoded =
dol_osencode($fullpath_original_file);
274if (!file_exists($fullpath_original_file_osencoded)) {
275 dol_syslog(
"ErrorFileDoesNotExists: ".$fullpath_original_file);
276 print
"ErrorFileDoesNotExists: ".dol_escape_htmltag($original_file);
281$hookmanager->initHooks(array(
'document'));
282$parameters = array(
'ecmfile' => $ecmfile,
'modulepart' => $modulepart,
'original_file' => $original_file,
283 'entity' => $entity,
'fullpath_original_file' => $fullpath_original_file,
284 'filename' => $filename,
'fullpath_original_file_osencoded' => $fullpath_original_file_osencoded);
286$reshook = $hookmanager->executeHooks(
'downloadDocument', $parameters, $object, $action);
288 $errors = $hookmanager->error.(is_array($hookmanager->errors) ? (!empty($hookmanager->error) ?
', ' :
'').implode(
', ', $hookmanager->errors) :
'');
289 dol_syslog(
"document.php - Errors when executing the hook 'downloadDocument' : ".$errors);
290 print
"ErrorDownloadDocumentHooks: ".$errors;
298header(
'Content-Description: File Transfer');
300 header(
'Content-Encoding: '.$encoding);
305 header(
'Content-Disposition: attachment; filename="'.$filename.
'"');
307 header(
'Content-Disposition: inline; filename="'.$filename.
'"');
310header(
'Cache-Control: Public, must-revalidate');
311header(
'Pragma: public');
318 $readfile = !$imgres;
327 header(
'Content-Length: '.
dol_filesize($fullpath_original_file));
dol_check_secure_access_document($modulepart, $original_file, $entity, $fuser=null, $refname='', $mode='read')
Security check when accessing to a document (used by document.php, viewimage.php and webservices to g...
if(!defined( 'NOREQUIREMENU')) if(!empty(GETPOST('seteventmessages', 'alpha'))) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.