30define(
'MAIN_SECURITY_FORCECSP',
"default-src: 'none'");
34if (!defined(
'NOREQUIRESOC')) {
35 define(
'NOREQUIRESOC',
'1');
37if (!defined(
'NOREQUIRETRAN')) {
38 define(
'NOREQUIRETRAN',
'1');
40if (!defined(
'NOCSRFCHECK')) {
41 define(
'NOCSRFCHECK',
'1');
43if (!defined(
'NOTOKENRENEWAL')) {
44 define(
'NOTOKENRENEWAL',
'1');
46if (!defined(
'NOREQUIREMENU')) {
47 define(
'NOREQUIREMENU',
'1');
49if (!defined(
'NOREQUIREHTML')) {
50 define(
'NOREQUIREHTML',
'1');
52if (!defined(
'NOREQUIREAJAX')) {
53 define(
'NOREQUIREAJAX',
'1');
60if (isset($_GET[
"modulepart"])) {
64 if ($_GET[
"modulepart"] ==
'mycompany' && preg_match(
'/^\/?logos\//', $_GET[
'file'])) {
68 if ($_GET[
"modulepart"] ==
'barcode') {
72 if ($_GET[
"modulepart"] ==
'medias') {
76 if ($_GET[
"modulepart"] ==
'common') {
80 if ($_GET[
"modulepart"] ==
'userphotopublic') {
84 if ($_GET[
"modulepart"] ==
'product' && isset($_GET[
"publictakepos"])) {
89if (isset($_GET[
"hashp"])) {
94 if (!defined(
"NOLOGIN")) {
97 if (!defined(
"NOCSRFCHECK")) {
98 define(
"NOCSRFCHECK", 1);
100 if (!defined(
"NOIPCHECK")) {
101 define(
"NOIPCHECK", 1);
108$entity = (!empty($_GET[
'entity']) ? (int) $_GET[
'entity'] : (!empty($_POST[
'entity']) ? (int) $_POST[
'entity'] : 1));
109if (is_numeric($entity)) {
110 define(
"DOLENTITY", $entity);
132require
'main.inc.php';
133require_once DOL_DOCUMENT_ROOT.
'/core/lib/files.lib.php';
135$action =
GETPOST(
'action',
'aZ09');
136$original_file =
GETPOST(
'file',
'alphanohtml');
137$hashp =
GETPOST(
'hashp',
'aZ09', 1);
138$modulepart =
GETPOST(
'modulepart',
'alpha', 1);
139$urlsource =
GETPOST(
'urlsource',
'alpha');
143if (empty($modulepart) && empty($hashp)) {
146if (empty($original_file) && empty($hashp) && $modulepart !=
'barcode') {
149if ($modulepart ==
'fckeditor') {
150 $modulepart =
'medias';
166if (
GETPOST(
"cache",
'alpha')) {
171 if (empty($dolibarr_nocache)) {
172 if (
GETPOST(
'cache',
'alpha') !=
'1') {
173 $delaycache = 3600 * 24 * 7;
177 header(
'Cache-Control: max-age='.$delaycache.
', public, must-revalidate');
178 header(
'Pragma: cache');
179 header(
'Expires: '.gmdate(
'D, d M Y H:i:s', time() + $delaycache).
' GMT');
182 header(
'Cache-Control: no-cache');
189 include_once DOL_DOCUMENT_ROOT.
'/ecm/class/ecmfiles.class.php';
191 $result = $ecmfile->fetch(0,
'',
'',
'', $hashp);
193 $tmp = explode(
'/', $ecmfile->filepath, 2);
195 if (is_numeric($tmp[0])) {
196 $tmp = explode(
'/', $tmp[1], 2);
198 $moduleparttocheck = $tmp[0];
201 if ($moduleparttocheck == $modulepart) {
203 $original_file = (($tmp[1] ? $tmp[1].
'/' :
'').$ecmfile->filename);
209 $modulepart = $moduleparttocheck;
210 $original_file = (($tmp[1] ? $tmp[1].
'/' :
'').$ecmfile->filename);
218$type =
'application/octet-stream';
220 $type =
GETPOST(
'type',
'alpha');
226if (preg_match(
'/html/i', $type)) {
230if (preg_match(
'/\.noexe$/i', $original_file)) {
235$original_file = preg_replace(
'/\.\.+/',
'..', $original_file);
236$original_file = str_replace(
'../',
'/', $original_file);
237$original_file = str_replace(
'..\\',
'/', $original_file);
240$refname = basename(dirname($original_file).
"/");
241if ($refname ==
'thumbs') {
243 $refname = basename(dirname(dirname($original_file)).
"/");
252if (empty($modulepart)) {
258if ($modulepart ===
'medias' && $entity != $conf->entity) {
259 $conf->entity = $entity;
260 $conf->setValues($db);
264$accessallowed = $check_access[
'accessallowed'];
265$sqlprotectagainstexternals = $check_access[
'sqlprotectagainstexternals'];
266$fullpath_original_file = $check_access[
'original_file'];
270 $sqlprotectagainstexternals =
'';
272 if (
getDolGlobalString(
'TAKEPOS_AUTO_ORDER') && in_array($modulepart, array(
'product',
'category'))) {
279 if ($user->socid > 0) {
280 if ($sqlprotectagainstexternals) {
281 $resql = $db->query($sqlprotectagainstexternals);
283 $num = $db->num_rows($resql);
286 $obj = $db->fetch_object($resql);
287 if ($user->socid != $obj->fk_soc) {
300if (!$accessallowed) {
306if (preg_match(
'/\.\./', $fullpath_original_file) || preg_match(
'/[<>|]/', $fullpath_original_file)) {
307 dol_syslog(
"Refused to deliver file ".$fullpath_original_file);
308 print
"ErrorFileNameInvalid: ".dol_escape_htmltag($original_file);
314if ($modulepart ==
'barcode') {
315 $generator =
GETPOST(
"generator",
"aZ09");
316 $encoding =
GETPOST(
"encoding",
"aZ09");
317 $readable =
GETPOST(
"readable",
'aZ09') ?
GETPOST(
"readable",
"aZ09") :
"Y";
318 if (in_array($encoding, array(
'EAN8',
'EAN13'))) {
319 $code =
GETPOST(
"code",
'alphanohtml');
321 $code =
GETPOST(
"code",
'restricthtml');
326 if (preg_match(
'/^virtualcard_([^_]+)_(\d+)\.vcf$/', $code, $reg)) {
328 if ($reg[1] ==
'user') {
329 $vcffile = $conf->user->dir_temp.
'/'.$code;
330 } elseif ($reg[1] ==
'contact') {
331 $vcffile = $conf->contact->dir_temp.
'/'.$code;
335 $code = file_get_contents($vcffile);
340 if (empty($generator) || empty($encoding)) {
341 print
'Error: Parameter "generator" or "encoding" not defined';
345 $dirbarcode = array_merge(array(
"/core/modules/barcode/doc/"), $conf->modules_parts[
'barcode']);
349 foreach ($dirbarcode as $reldir) {
354 if (!is_dir($newdir)) {
358 $result = @include_once $newdir.$generator.
'.modules.php';
365 $classname =
"mod".ucfirst($generator);
367 $module =
new $classname($db);
368 if ($module->encodingIsSupported($encoding)) {
369 $result = $module->buildBarCode($code, $encoding, $readable);
375 $filename = basename($fullpath_original_file);
378 dol_syslog(
"viewimage.php return file $fullpath_original_file filename=$filename content-type=$type");
382 $fullpath_original_file = DOL_DOCUMENT_ROOT.
'/public/theme/common/nophoto.png';
391 header(
'Content-Disposition: inline; filename="'.basename($fullpath_original_file).
'"');
394 header(
'Content-Disposition: inline; filename="'.basename($fullpath_original_file).
'"');
397 $fullpath_original_file_osencoded =
dol_osencode($fullpath_original_file);
399 readfile($fullpath_original_file_osencoded);
Class to manage ECM files.
dol_check_secure_access_document($modulepart, $original_file, $entity, $fuser=null, $refname='', $mode='read')
Security check when accessing to a document (used by document.php, viewimage.php and webservices to g...
dol_is_file($pathoffile)
Return if path is a file.
dol_mimetype($file, $default='application/octet-stream', $mode=0)
Return MIME type of a file from its name with extension.
GETPOSTINT($paramname, $method=0)
Return the value of a $_GET or $_POST supervariable, converted into integer.
dol_osencode($str)
Return a string encoded into OS filesystem encoding.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dolIsAllowedForPreview($file)
Return if a file is qualified for preview.
dol_buildpath($path, $type=0, $returnemptyifnotfound=0)
Return path of url or filesystem.
getDolGlobalString($key, $default='')
Return dolibarr global constant string value.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
if(!defined( 'NOREQUIREMENU')) if(!empty(GETPOST('seteventmessages', 'alpha'))) if(!function_exists("llxHeader")) top_httphead($contenttype='text/html', $forcenocache=0)
Show HTTP header.
httponly_accessforbidden($message='1', $http_response_code=403, $stringalreadysanitized=0)
Show a message to say access is forbidden and stop program.
accessforbidden($message='', $printheader=1, $printfooter=1, $showonlymessage=0, $params=null)
Show a message to say access is forbidden and stop program.
if(is_numeric( $entity)) llxHeader()
Header empty.