dolibarr 20.0.0
viewimage.php
Go to the documentation of this file.
1<?php
2/* Copyright (C) 2004-2005 Rodolphe Quiedeville <rodolphe@quiedeville.org>
3 * Copyright (C) 2005-2016 Laurent Destailleur <eldy@users.sourceforge.net>
4 * Copyright (C) 2005-2016 Regis Houssin <regis.houssin@inodbox.com>
5 * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program. If not, see <https://www.gnu.org/licenses/>.
19 * or see https://www.gnu.org/
20 */
21
30define('MAIN_SECURITY_FORCECSP', "default-src: 'none'");
31
32//if (! defined('NOREQUIREUSER')) define('NOREQUIREUSER','1'); // Not disabled cause need to load personalized language
33//if (! defined('NOREQUIREDB')) define('NOREQUIREDB','1'); // Not disabled cause need to load personalized language
34if (!defined('NOREQUIRESOC')) {
35 define('NOREQUIRESOC', '1');
36}
37if (!defined('NOREQUIRETRAN')) {
38 define('NOREQUIRETRAN', '1');
39}
40if (!defined('NOCSRFCHECK')) {
41 define('NOCSRFCHECK', '1');
42}
43if (!defined('NOTOKENRENEWAL')) {
44 define('NOTOKENRENEWAL', '1');
45}
46if (!defined('NOREQUIREMENU')) {
47 define('NOREQUIREMENU', '1');
48}
49if (!defined('NOREQUIREHTML')) {
50 define('NOREQUIREHTML', '1');
51}
52if (!defined('NOREQUIREAJAX')) {
53 define('NOREQUIREAJAX', '1');
54}
55
56// Some value of modulepart can be used to get resources that are public so no login are required.
57// Note that only directory logo is free to access without login.
58$needlogin = 1;
59// Keep $_GET here, GETPOST is not available yet
60if (isset($_GET["modulepart"])) {
61 // Some value of modulepart can be used to get resources that are public so no login are required.
62
63 // For logo of company
64 if ($_GET["modulepart"] == 'mycompany' && preg_match('/^\/?logos\//', $_GET['file'])) {
65 $needlogin = 0;
66 }
67 // For barcode live generation
68 if ($_GET["modulepart"] == 'barcode') {
69 $needlogin = 0;
70 }
71 // Medias files
72 if ($_GET["modulepart"] == 'medias') {
73 $needlogin = 0;
74 }
75 // Common files (files into /public/theme/common)
76 if ($_GET["modulepart"] == 'common') {
77 $needlogin = 0;
78 }
79 // User photo when user has made its profile public (for virtual credi card)
80 if ($_GET["modulepart"] == 'userphotopublic') {
81 $needlogin = 0;
82 }
83 // Used by TakePOS Auto Order
84 if ($_GET["modulepart"] == 'product' && isset($_GET["publictakepos"])) {
85 $needlogin = 0;
86 }
87}
88// For direct external download link, we don't need to load/check we are into a login session
89if (isset($_GET["hashp"])) {
90 $needlogin = 0;
91}
92// If nologin required
93if (!$needlogin) {
94 if (!defined("NOLOGIN")) {
95 define("NOLOGIN", 1);
96 }
97 if (!defined("NOCSRFCHECK")) {
98 define("NOCSRFCHECK", 1); // We accept to go on this page from external web site.
99 }
100 if (!defined("NOIPCHECK")) {
101 define("NOIPCHECK", 1); // Do not check IP defined into conf $dolibarr_main_restrict_ip
102 }
103}
104
105// For MultiCompany module.
106// Do not use GETPOST here, function is not defined and define must be done before including main.inc.php
107// Because 2 entities can have the same ref.
108$entity = (!empty($_GET['entity']) ? (int) $_GET['entity'] : (!empty($_POST['entity']) ? (int) $_POST['entity'] : 1));
109if (is_numeric($entity)) {
110 define("DOLENTITY", $entity);
111}
112
119function llxHeader()
120{
121}
128function llxFooter()
129{
130}
131
132require 'main.inc.php'; // Load $user and permissions
133require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
134
135$action = GETPOST('action', 'aZ09');
136$original_file = GETPOST('file', 'alphanohtml');
137$hashp = GETPOST('hashp', 'aZ09', 1);
138$modulepart = GETPOST('modulepart', 'alpha', 1);
139$urlsource = GETPOST('urlsource', 'alpha');
140$entity = (GETPOSTINT('entity') ? GETPOSTINT('entity') : $conf->entity);
141
142// Security check
143if (empty($modulepart) && empty($hashp)) {
144 httponly_accessforbidden('Bad link. Bad value for parameter modulepart', 400);
145}
146if (empty($original_file) && empty($hashp) && $modulepart != 'barcode') {
147 httponly_accessforbidden('Bad link. Missing identification to find file (param file or hashp)', 400);
148}
149if ($modulepart == 'fckeditor') {
150 $modulepart = 'medias'; // For backward compatibility
151}
152
153
154/*
155 * Actions
156 */
157
158// None
159
160
161
162/*
163 * View
164 */
165
166if (GETPOST("cache", 'alpha')) {
167 // Important: The following code is to avoid a page request by the browser and PHP CPU at each Dolibarr page access.
168 // We are here when param cache=xxx to force a cache policy:
169 // xxx=1 means cache of 3600s
170 // xxx=abcdef or 123456789 means a cache of 1 week (the key will be modified to get break cache use)
171 if (empty($dolibarr_nocache)) {
172 if (GETPOST('cache', 'alpha') != '1') {
173 $delaycache = 3600 * 24 * 7;
174 } else {
175 $delaycache = 3600;
176 }
177 header('Cache-Control: max-age='.$delaycache.', public, must-revalidate');
178 header('Pragma: cache'); // This is to avoid to have Pragma: no-cache set by proxy or web server
179 header('Expires: '.gmdate('D, d M Y H:i:s', time() + $delaycache).' GMT'); // This is to avoid to have Expires set by proxy or web server
180 } else {
181 // If any cache on files were disable by config file (for test purpose)
182 header('Cache-Control: no-cache');
183 }
184 //print $dolibarr_nocache; exit;
185}
186
187// If we have a hash public (hashp), we guess the original_file.
188if (!empty($hashp)) {
189 include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
190 $ecmfile = new EcmFiles($db);
191 $result = $ecmfile->fetch(0, '', '', '', $hashp);
192 if ($result > 0) {
193 $tmp = explode('/', $ecmfile->filepath, 2); // $ecmfile->filepath is relative to document directory
194 // filepath can be 'users/X' or 'X/propale/PR11111'
195 if (is_numeric($tmp[0])) { // If first tmp is numeric, it is subdir of company for multicompany, we take next part.
196 $tmp = explode('/', $tmp[1], 2);
197 }
198 $moduleparttocheck = $tmp[0]; // moduleparttocheck is first part of path
199
200 if ($modulepart) { // Not required, so often not defined, for link using public hashp parameter.
201 if ($moduleparttocheck == $modulepart) {
202 // We remove first level of directory
203 $original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir
204 //var_dump($original_file); exit;
205 } else {
206 httponly_accessforbidden('Bad link. File is from another module part.', 403);
207 }
208 } else {
209 $modulepart = $moduleparttocheck;
210 $original_file = (($tmp[1] ? $tmp[1].'/' : '').$ecmfile->filename); // this is relative to module dir
211 }
212 } else {
213 httponly_accessforbidden("ErrorFileNotFoundWithSharedLink", 403, 1);
214 }
215}
216
217// Define mime type
218$type = 'application/octet-stream';
219if (GETPOST('type', 'alpha')) {
220 $type = GETPOST('type', 'alpha');
221} else {
222 $type = dol_mimetype($original_file);
223}
224
225// Security: This wrapper is for images. We do not allow type/html
226if (preg_match('/html/i', $type)) {
227 httponly_accessforbidden('Error: Using the image wrapper to output a file with a mime type HTML is not possible.');
228}
229// Security: This wrapper is for images. We do not allow files ending with .noexe
230if (preg_match('/\.noexe$/i', $original_file)) {
231 httponly_accessforbidden('Error: Using the image wrapper to output a file ending with .noexe is not allowed.');
232}
233
234// Security: Delete string ../ or ..\ into $original_file
235$original_file = preg_replace('/\.\.+/', '..', $original_file); // Replace '... or more' with '..'
236$original_file = str_replace('../', '/', $original_file);
237$original_file = str_replace('..\\', '/', $original_file);
238
239// Find the subdirectory name as the reference
240$refname = basename(dirname($original_file)."/");
241if ($refname == 'thumbs') {
242 // If we get the thumbs directory, we must go one step higher. For example original_file='10/thumbs/myfile_small.jpg' -> refname='10'
243 $refname = basename(dirname(dirname($original_file))."/");
244}
245
246// Check that file is allowed for view with viewimage.php
247if (!empty($original_file) && !dolIsAllowedForPreview($original_file)) {
248 httponly_accessforbidden('This file extension is not qualified for preview', 403);
249}
250
251// Security check
252if (empty($modulepart)) {
253 httponly_accessforbidden('Bad value for parameter modulepart', 400);
254}
255
256// When logged in a different entity, medias cannot be accessed because $conf->$module->multidir_output
257// is not set on the requested entity, but they are public documents, so reset entity
258if ($modulepart === 'medias' && $entity != $conf->entity) {
259 $conf->entity = $entity;
260 $conf->setValues($db);
261}
262
263$check_access = dol_check_secure_access_document($modulepart, $original_file, $entity, $user, $refname);
264$accessallowed = $check_access['accessallowed'];
265$sqlprotectagainstexternals = $check_access['sqlprotectagainstexternals'];
266$fullpath_original_file = $check_access['original_file']; // $fullpath_original_file is now a full path name
267
268if (!empty($hashp)) {
269 $accessallowed = 1; // When using hashp, link is public so we force $accessallowed
270 $sqlprotectagainstexternals = '';
271} elseif (GETPOSTINT("publictakepos")) {
272 if (getDolGlobalString('TAKEPOS_AUTO_ORDER') && in_array($modulepart, array('product', 'category'))) {
273 $accessallowed = 1; // When TakePOS Public Auto Order is enabled, we accept to see all images of product and categories with no login
274 // TODO Replace this with a call of getPublicImageOfObject like used by website so
275 // only shared images are visible
276 }
277} else {
278 // Basic protection (against external users only)
279 if ($user->socid > 0) {
280 if ($sqlprotectagainstexternals) {
281 $resql = $db->query($sqlprotectagainstexternals);
282 if ($resql) {
283 $num = $db->num_rows($resql);
284 $i = 0;
285 while ($i < $num) {
286 $obj = $db->fetch_object($resql);
287 if ($user->socid != $obj->fk_soc) {
288 $accessallowed = 0;
289 break;
290 }
291 $i++;
292 }
293 }
294 }
295 }
296}
297
298// Security:
299// Limit access if permissions are wrong
300if (!$accessallowed) {
302}
303
304// Security:
305// On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
306if (preg_match('/\.\./', $fullpath_original_file) || preg_match('/[<>|]/', $fullpath_original_file)) {
307 dol_syslog("Refused to deliver file ".$fullpath_original_file);
308 print "ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
309 exit;
310}
311
312
313
314if ($modulepart == 'barcode') {
315 $generator = GETPOST("generator", "aZ09");
316 $encoding = GETPOST("encoding", "aZ09");
317 $readable = GETPOST("readable", 'aZ09') ? GETPOST("readable", "aZ09") : "Y";
318 if (in_array($encoding, array('EAN8', 'EAN13'))) {
319 $code = GETPOST("code", 'alphanohtml');
320 } else {
321 $code = GETPOST("code", 'restricthtml'); // This can be rich content (qrcode, datamatrix, ...)
322 }
323
324 // If $code is virtualcard_xxx_999.vcf, it is a file to read to get code
325 $reg = array();
326 if (preg_match('/^virtualcard_([^_]+)_(\d+)\.vcf$/', $code, $reg)) {
327 $vcffile = '';
328 if ($reg[1] == 'user') {
329 $vcffile = $conf->user->dir_temp.'/'.$code;
330 } elseif ($reg[1] == 'contact') {
331 $vcffile = $conf->contact->dir_temp.'/'.$code;
332 }
333
334 if ($vcffile) {
335 $code = file_get_contents($vcffile);
336 }
337 }
338
339
340 if (empty($generator) || empty($encoding)) {
341 print 'Error: Parameter "generator" or "encoding" not defined';
342 exit;
343 }
344
345 $dirbarcode = array_merge(array("/core/modules/barcode/doc/"), $conf->modules_parts['barcode']);
346
347 $result = 0;
348
349 foreach ($dirbarcode as $reldir) {
350 $dir = dol_buildpath($reldir, 0);
351 $newdir = dol_osencode($dir);
352
353 // Check if directory exists (we do not use dol_is_dir to avoid loading files.lib.php)
354 if (!is_dir($newdir)) {
355 continue;
356 }
357
358 $result = @include_once $newdir.$generator.'.modules.php';
359 if ($result) {
360 break;
361 }
362 }
363
364 // Load barcode class
365 $classname = "mod".ucfirst($generator);
366
367 $module = new $classname($db);
368 if ($module->encodingIsSupported($encoding)) {
369 $result = $module->buildBarCode($code, $encoding, $readable);
370 }
371} else {
372 // Open and return file
373 clearstatcache();
374
375 $filename = basename($fullpath_original_file);
376
377 // Output files on browser
378 dol_syslog("viewimage.php return file $fullpath_original_file filename=$filename content-type=$type");
379
380 if (!dol_is_file($fullpath_original_file) && !GETPOSTINT("noalt", 1)) {
381 // This test is to replace error images with a nice "notfound image" when image is not available (for example when thumbs not yet generated).
382 $fullpath_original_file = DOL_DOCUMENT_ROOT.'/public/theme/common/nophoto.png';
383 /*$error='Error: File '.$_GET["file"].' does not exists or filesystems permissions are not allowed';
384 print $error;
385 exit;*/
386 }
387
388 // Permissions are ok and file found, so we return it
389 if ($type) {
390 top_httphead($type);
391 header('Content-Disposition: inline; filename="'.basename($fullpath_original_file).'"');
392 } else {
393 top_httphead('image/png');
394 header('Content-Disposition: inline; filename="'.basename($fullpath_original_file).'"');
395 }
396
397 $fullpath_original_file_osencoded = dol_osencode($fullpath_original_file);
398
399 readfile($fullpath_original_file_osencoded);
400}
401
402
403if (is_object($db)) {
404 $db->close();
405}
Class to manage ECM files.
dol_check_secure_access_document($modulepart, $original_file, $entity, $fuser=null, $refname='', $mode='read')
Security check when accessing to a document (used by document.php, viewimage.php and webservices to g...
dol_is_file($pathoffile)
Return if path is a file.
dol_mimetype($file, $default='application/octet-stream', $mode=0)
Return MIME type of a file from its name with extension.
GETPOSTINT($paramname, $method=0)
Return the value of a $_GET or $_POST supervariable, converted into integer.
dol_osencode($str)
Return a string encoded into OS filesystem encoding.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dolIsAllowedForPreview($file)
Return if a file is qualified for preview.
dol_buildpath($path, $type=0, $returnemptyifnotfound=0)
Return path of url or filesystem.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
if(!defined( 'NOREQUIREMENU')) if(!empty(GETPOST('seteventmessages', 'alpha'))) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
httponly_accessforbidden($message='1', $http_response_code=403, $stringalreadysanitized=0)
Show a message to say access is forbidden and stop program.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.
if(is_numeric( $entity)) llxHeader()
Header empty.
llxFooter()
Footer empty.