dolibarr 21.0.0-beta
actions_linkedfiles.inc.php
1<?php
2/* Copyright (C) 2013 Cédric Salvador <csalvador@gpcsolutions.fr>
3 * Copyright (C) 2015 Marcos García <marcosgdf@gmail.com>
4 * Copyright (C) 2015 Ferran Marcet <fmarcet@2byte.es>
5 * Copyright (C) 2024 Frédéric France <frederic.france@free.fr>
6 * Copyright (C) 2024 MDW <mdeweerd@users.noreply.github.com>
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program. If not, see <https://www.gnu.org/licenses/>.
20 * or see https://www.gnu.org/
21 */
22
23// Variable $upload_dir must be defined when entering here.
24// Variable $upload_dirold may also exists.
25// Variable $confirm must be defined.
26// If variable $permissiontoadd is defined, we check it is true. Note: A test on permission should already have been done into the restrictedArea() method called by parent page.
27
41'
42@phan-var-force string $upload_dir
43@phan-var-force string $forceFullTextIndexation
44';
45
46// Protection to understand what happen when submitting files larger than post_max_size
47if (GETPOSTINT('uploadform') && empty($_POST) && empty($_FILES)) {
48 dol_syslog("The PHP parameter 'post_max_size' is too low. All POST parameters and FILES were set to empty.");
49 $langs->loadLangs(array("errors", "install"));
50 print $langs->trans("ErrorFileSizeTooLarge").' ';
51 print $langs->trans("ErrorGoBackAndCorrectParameters");
52 die;
53}
54
55if ((GETPOST('sendit', 'alpha')
56 || GETPOST('linkit', 'restricthtml')
57 || ($action == 'confirm_deletefile' && $confirm == 'yes')
58 || ($action == 'confirm_updateline' && GETPOST('save', 'alpha') && GETPOST('link', 'alpha'))
59 || ($action == 'renamefile' && GETPOST('renamefilesave', 'alpha'))) && empty($permissiontoadd)) {
60 dol_syslog('The file actions_linkedfiles.inc.php was included but parameter $permissiontoadd was not set before.');
61 print 'The file actions_linkedfiles.inc.php was included but parameter $permissiontoadd was not set before.';
62 die;
63}
64
65$error = 0;
66
67// Submit file/link
68if (GETPOST('sendit', 'alpha') && getDolGlobalString('MAIN_UPLOAD_DOC') && !empty($permissiontoadd)) {
69 if (!empty($_FILES) && is_array($_FILES['userfile'])) {
70 include_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
71
72 if (is_array($_FILES['userfile']['tmp_name'])) {
73 $userfiles = $_FILES['userfile']['tmp_name'];
74 } else {
75 $userfiles = array($_FILES['userfile']['tmp_name']);
76 }
77
78 foreach ($userfiles as $key => $userfile) {
79 if (empty($_FILES['userfile']['tmp_name'][$key])) {
80 $error++;
81 if ($_FILES['userfile']['error'][$key] == 1 || $_FILES['userfile']['error'][$key] == 2) {
82 setEventMessages($langs->trans('ErrorFileSizeTooLarge'), null, 'errors');
83 } else {
84 setEventMessages($langs->trans("ErrorFieldRequired", $langs->transnoentitiesnoconv("File")), null, 'errors');
85 }
86 }
87 if (preg_match('/__.*__/', $_FILES['userfile']['name'][$key])) {
88 $error++;
89 setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
90 }
91 }
92
93 if (!$error) {
94 // Define if we have to generate thumbs or not
95 $generatethumbs = 1;
96 if (GETPOST('section_dir', 'alpha')) {
97 $generatethumbs = 0;
98 }
99 $allowoverwrite = (GETPOSTINT('overwritefile') ? 1 : 0);
100
101 if (!empty($upload_dirold) && getDolGlobalInt('PRODUCT_USE_OLD_PATH_FOR_PHOTO')) {
102 $result = dol_add_file_process($upload_dirold, $allowoverwrite, 1, 'userfile', GETPOST('savingdocmask', 'alpha'), null, '', $generatethumbs, $object, $forceFullTextIndexation);
103 } elseif (!empty($upload_dir)) {
104 $result = dol_add_file_process($upload_dir, $allowoverwrite, 1, 'userfile', GETPOST('savingdocmask', 'alpha'), null, '', $generatethumbs, $object, $forceFullTextIndexation);
105 }
106 }
107 }
108} elseif (GETPOST('linkit', 'restricthtml') && getDolGlobalString('MAIN_UPLOAD_DOC') && !empty($permissiontoadd)) {
109 $link = GETPOST('link', 'alpha');
110 if ($link) {
111 if (substr($link, 0, 7) != 'http://' && substr($link, 0, 8) != 'https://' && substr($link, 0, 7) != 'file://' && substr($link, 0, 7) != 'davs://') {
112 $link = 'http://'.$link;
113 }
114
115 // Parse $newUrl
116 $newUrlArray = parse_url($link);
117
118 // Allow external links to svg ?
119 if (!getDolGlobalString('MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS')) {
120 if (!empty($newUrlArray['path']) && preg_match('/\.svg$/i', $newUrlArray['path'])) {
121 $error++;
122 $langs->load("errors");
123 setEventMessages($langs->trans('ErrorSVGFilesNotAllowedAsLinksWithout', 'MAIN_ALLOW_SVG_FILES_AS_EXTERNAL_LINKS'), null, 'errors');
124 }
125 }
126 // Check URL is external (must refuse local link by default)
127 if (!getDolGlobalString('MAIN_ALLOW_LOCAL_LINKS_AS_EXTERNAL_LINKS')) {
128 // Test $newUrlAray['host'] to check link is external using isIPAllowed() and if not refuse the local link
129 // TODO
130 }
131
132 if (!$error) {
133 dol_add_file_process($upload_dir, 0, 1, 'userfile', '', $link, '', 0);
134 }
135 }
136}
137
138// Delete file/link
139if ($action == 'confirm_deletefile' && $confirm == 'yes' && !empty($permissiontoadd)) {
140 $urlfile = GETPOST('urlfile', 'alpha', 0, null, null, 1);
141 if (GETPOST('section', 'alpha')) {
142 // For a delete from the ECM module, upload_dir is ECM root dir and urlfile contains relative path from upload_dir
143 $file = $upload_dir.(preg_match('/\/$/', $upload_dir) ? '' : '/').$urlfile;
144 } else { // For a delete from the file manager into another module, or from documents pages, upload_dir contains already path to file from module dir, so we clean path into urlfile.
145 $urlfile = basename($urlfile);
146 $file = $upload_dir.(preg_match('/\/$/', $upload_dir) ? '' : '/').$urlfile;
147 if (!empty($upload_dirold)) {
148 $fileold = $upload_dirold."/".$urlfile;
149 }
150 }
151 $linkid = GETPOSTINT('linkid');
152
153 if ($urlfile) {
154 // delete of a file
155 $dir = dirname($file).'/'; // Chemin du dossier contenant l'image d'origine
156 $dirthumb = $dir.'/thumbs/'; // Chemin du dossier contenant la vignette (if file is an image)
157
158 $ret = dol_delete_file($file, 0, 0, 0, (is_object($object) ? $object : null));
159 if (!empty($fileold)) {
160 dol_delete_file($fileold, 0, 0, 0, (is_object($object) ? $object : null)); // Delete file using old path
161 }
162
163 if ($ret) {
164 // If it exists, remove thumb.
165 $regs = array();
166 if (preg_match('/(\.jpg|\.jpeg|\.bmp|\.gif|\.png|\.tiff)$/i', $file, $regs)) {
167 $photo_vignette = basename(preg_replace('/'.$regs[0].'/i', '', $file).'_small'.$regs[0]);
168 if (file_exists(dol_osencode($dirthumb.$photo_vignette))) {
169 dol_delete_file($dirthumb.$photo_vignette);
170 }
171
172 $photo_vignette = basename(preg_replace('/'.$regs[0].'/i', '', $file).'_mini'.$regs[0]);
173 if (file_exists(dol_osencode($dirthumb.$photo_vignette))) {
174 dol_delete_file($dirthumb.$photo_vignette);
175 }
176 }
177 setEventMessages($langs->trans("FileWasRemoved", $urlfile), null, 'mesgs');
178 } else {
179 setEventMessages($langs->trans("ErrorFailToDeleteFile", $urlfile), null, 'errors');
180 }
181 } elseif ($linkid) { // delete of external link
182 require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
183 $link = new Link($db);
184 $link->fetch($linkid);
185 $res = $link->delete($user);
186
187 $langs->load('link');
188 if ($res > 0) {
189 setEventMessages($langs->trans("LinkRemoved", $link->label), null, 'mesgs');
190 } else {
191 if (count($link->errors)) {
192 setEventMessages('', $link->errors, 'errors');
193 } else {
194 setEventMessages($langs->trans("ErrorFailedToDeleteLink", $link->label), null, 'errors');
195 }
196 }
197 }
198
199 if (is_object($object) && $object->id > 0) {
200 if (!empty($backtopage)) {
201 header('Location: '.$backtopage);
202 exit;
203 } else {
204 $tmpurl = $_SERVER["PHP_SELF"].'?id='.$object->id.(GETPOST('section_dir', 'alpha') ? '&section_dir='.urlencode(GETPOST('section_dir', 'alpha')) : '').(!empty($withproject) ? '&withproject=1' : '');
205 header('Location: '.$tmpurl);
206 exit;
207 }
208 }
209} elseif ($action == 'confirm_updateline' && GETPOST('save', 'alpha') && GETPOST('link', 'alpha') && !empty($permissiontoadd)) {
210 require_once DOL_DOCUMENT_ROOT.'/core/class/link.class.php';
211
212 $link = new Link($db);
213 $f = $link->fetch(GETPOSTINT('linkid'));
214 if ($f) {
215 $link->url = GETPOST('link', 'alpha');
216 if (substr($link->url, 0, 7) != 'http://' && substr($link->url, 0, 8) != 'https://' && substr($link->url, 0, 7) != 'file://') {
217 $link->url = 'http://'.$link->url;
218 }
219 $link->label = GETPOST('label', 'alphanohtml');
220 $res = $link->update($user);
221 if (!$res) {
222 setEventMessages($langs->trans("ErrorFailedToUpdateLink", $link->label), null, 'mesgs');
223 }
224 } else {
225 //error fetching
226 }
227} elseif ($action == 'renamefile' && GETPOST('renamefilesave', 'alpha') && !empty($permissiontoadd)) {
228 // For documents pages, upload_dir contains already the path to the file from module dir
229 if (!empty($upload_dir)) {
230 $filenamefrom = dol_sanitizeFileName(GETPOST('renamefilefrom', 'alpha'), '_', 0); // Do not remove accents
231 $filenameto = dol_sanitizeFileName(GETPOST('renamefileto', 'alpha'), '_', 0); // Do not remove accents
232
233 // We apply dol_string_nohtmltag also to clean file names (this remove duplicate spaces) because
234 // this function is also applied when we upload and when we make try to download file (by the GETPOST(filename, 'alphanohtml') call).
235 $filenameto = dol_string_nohtmltag($filenameto);
236 if (preg_match('/__.*__/', $filenameto)) {
237 $error++;
238 setEventMessages($langs->trans('ErrorWrongFileName'), null, 'errors');
239 }
240
241 // Check that filename is not the one of a reserved allowed CLI command
242 if (empty($error)) {
243 global $dolibarr_main_restrict_os_commands;
244 if (!empty($dolibarr_main_restrict_os_commands)) {
245 $arrayofallowedcommand = explode(',', $dolibarr_main_restrict_os_commands);
246 $arrayofallowedcommand = array_map('trim', $arrayofallowedcommand);
247 if (in_array(basename($filenameto), $arrayofallowedcommand)) {
248 $error++;
249 $langs->load("errors"); // key must be loaded because we can't rely on loading during output, we need var substitution to be done now.
250 setEventMessages($langs->trans("ErrorFilenameReserved", basename($filenameto)), null, 'errors');
251 }
252 }
253 }
254
255 if (empty($error) && $filenamefrom != $filenameto) {
256 // Security:
257 // Disallow file with some extensions. We rename them.
258 // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.
259 if (isAFileWithExecutableContent($filenameto) && !getDolGlobalString('MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED')) {
260 // $upload_dir ends with a slash, so be must be sure the medias dir to compare to ends with slash too.
261 $publicmediasdirwithslash = $conf->medias->multidir_output[$conf->entity];
262 if (!preg_match('/\/$/', $publicmediasdirwithslash)) {
263 $publicmediasdirwithslash .= '/';
264 }
265
266 if (strpos($upload_dir, $publicmediasdirwithslash) !== 0) { // We never add .noexe on files into media directory
267 $filenameto .= '.noexe';
268 }
269 }
270
271 if ($filenamefrom && $filenameto) {
272 $srcpath = $upload_dir.'/'.$filenamefrom;
273 $destpath = $upload_dir.'/'.$filenameto;
274 /* disabled. Too many bugs. All files of an object must remain into directory of object. link with event should be done in llx_ecm_files with column agenda_id.
275 if ($modulepart == "ticket" && !dol_is_file($srcpath)) {
276 $srcbis = $conf->agenda->dir_output.'/'.GETPOST('section_dir').$filenamefrom;
277 if (dol_is_file($srcbis)) {
278 $srcpath = $srcbis;
279 $destpath = $conf->agenda->dir_output.'/'.GETPOST('section_dir').$filenameto;
280 }
281 }*/
282
283 $reshook = $hookmanager->initHooks(array('actionlinkedfiles'));
284 $parameters = array('filenamefrom' => $filenamefrom, 'filenameto' => $filenameto, 'upload_dir' => $upload_dir);
285 $reshook = $hookmanager->executeHooks('renameUploadedFile', $parameters, $object);
286
287 if (empty($reshook)) {
288 if (preg_match('/^\./', $filenameto)) {
289 $langs->load("errors"); // lang must be loaded because we can't rely on loading during output, we need var substitution to be done now.
290 setEventMessages($langs->trans("ErrorFilenameCantStartWithDot", $filenameto), null, 'errors');
291 } elseif (!file_exists($destpath)) {
292 $result = dol_move($srcpath, $destpath);
293 if ($result) {
294 // Define if we have to generate thumbs or not
295 $generatethumbs = 1;
296 // When we rename a file from the file manager in ecm, we must not regenerate thumbs (not a problem, we do pass here)
297 // When we rename a file from the website module, we must not regenerate thumbs (module = medias in such a case)
298 // but when we rename from a tab "Documents", we must regenerate thumbs
299 if (GETPOST('modulepart', 'aZ09') == 'medias') {
300 $generatethumbs = 0;
301 }
302
303 if ($generatethumbs) {
304 if ($object->id > 0) {
305 // Create thumbs for the new file
306 $object->addThumbs($destpath);
307
308 // Delete thumb files with old name
309 $object->delThumbs($srcpath);
310 }
311 }
312
313 setEventMessages($langs->trans("FileRenamed"), null);
314 } else {
315 $langs->load("errors"); // lang must be loaded because we can't rely on loading during output, we need var substitution to be done now.
316 setEventMessages($langs->trans("ErrorFailToRenameFile", $filenamefrom, $filenameto), null, 'errors');
317 }
318 } else {
319 $langs->load("errors"); // lang must be loaded because we can't rely on loading during output, we need var substitution to be done now.
320 setEventMessages($langs->trans("ErrorDestinationAlreadyExists", $filenameto), null, 'errors');
321 }
322 }
323 }
324 }
325 }
326
327 // Update properties in ECM table
328 if (GETPOSTINT('ecmfileid') > 0) {
329 $shareenabled = GETPOST('shareenabled', 'alpha');
330
331 include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmfiles.class.php';
332 $ecmfile = new EcmFiles($db);
333 $result = $ecmfile->fetch(GETPOSTINT('ecmfileid'));
334 if ($result > 0) {
335 if ($shareenabled) {
336 if (empty($ecmfile->share)) {
337 require_once DOL_DOCUMENT_ROOT.'/core/lib/security2.lib.php';
338 $ecmfile->share = getRandomPassword(true);
339 }
340 } else {
341 $ecmfile->share = '';
342 }
343 $result = $ecmfile->update($user);
344 if ($result < 0) {
345 setEventMessages($ecmfile->error, $ecmfile->errors, 'warnings');
346 }
347 }
348 }
349}
if( $user->socid > 0) if(! $user->hasRight('accounting', 'chartofaccount')) $object
Definition card.php:66
Class to manage ECM files.
dol_delete_file($file, $disableglob=0, $nophperrors=0, $nohook=0, $object=null, $allowdotdot=false, $indexdatabase=1, $nolog=0)
Remove a file or several files with a mask.
dol_move($srcfile, $destfile, $newmask='0', $overwriteifexists=1, $testvirus=0, $indexdatabase=1, $moreinfo=array())
Move a file into another name.
dol_add_file_process($upload_dir, $allowoverwrite=0, $updatesessionordb=0, $varfiles='addedfile', $savingdocmask='', $link=null, $trackid='', $generatethumbs=1, $object=null, $forceFullTestIndexation='')
Get and save an upload file (for example after submitting a new file a mail form).
setEventMessages($mesg, $mesgs, $style='mesgs', $messagekey='', $noduplicate=0, $attop=0)
Set event messages in dol_events session object.
GETPOSTINT($paramname, $method=0)
Return the value of a $_GET or $_POST supervariable, converted into integer.
dol_osencode($str)
Return a string encoded into OS filesystem encoding.
dol_string_nohtmltag($stringtoclean, $removelinefeed=1, $pagecodeto='UTF-8', $strip_tags=0, $removedoublespaces=1)
Clean a string from all HTML tags and entities.
getDolGlobalInt($key, $default=0)
Return a Dolibarr global constant int value.
GETPOST($paramname, $check='alphanohtml', $method=0, $filter=null, $options=null, $noreplace=0)
Return value of a param into GET or POST supervariable.
dol_sanitizeFileName($str, $newstr='_', $unaccent=1)
Clean a string to use it as a file name.
isAFileWithExecutableContent($filename)
Return if a file can contains executable content.
getDolGlobalString($key, $default='')
Return a Dolibarr global constant string value.
dol_syslog($message, $level=LOG_INFO, $ident=0, $suffixinfilename='', $restricttologhandler='', $logcontext=null)
Write log message into outputs.
global $conf
The following vars must be defined: $type2label $form $conf, $lang, The following vars may also be de...
Definition member.php:79
getRandomPassword($generic=false, $replaceambiguouschars=null, $length=32)
Return a generated password using default module.