PHP FileManager::disable_dangerous_file方法代码示例

 /**
  * Create a new document //still needs some finetuning
  * @param array $_course
  * @return string
  */
 public function create_document($_course)
 {
     $course_id = api_get_course_int_id();
     global $charset;
     $dir = isset($_GET['dir']) ? $_GET['dir'] : $_POST['dir'];
     // Please, do not modify this dirname formatting.
     if (strstr($dir, '..')) {
         $dir = '/';
     }
     if ($dir[0] == '.') {
         $dir = substr($dir, 1);
     }
     if ($dir[0] != '/') {
         $dir = '/' . $dir;
     }
     if ($dir[strlen($dir) - 1] != '/') {
         $dir .= '/';
     }
     $filepath = api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document' . $dir;
     if (empty($_POST['dir']) && empty($_GET['dir'])) {
         //Generates folder
         $result = $this->generate_lp_folder($_course);
         $dir = $result['dir'];
         $filepath = $result['filepath'];
     }
     if (!is_dir($filepath)) {
         $filepath = api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document/';
         $dir = '/';
     }
     // stripslashes() before calling api_replace_dangerous_char() because $_POST['title']
     // is already escaped twice when it gets here.
     $title = api_replace_dangerous_char(stripslashes($_POST['title']));
     $title = FileManager::disable_dangerous_file($title);
     $filename = $title;
     $content = $_POST['content_lp'];
     $tmp_filename = $filename;
     $i = 0;
     while (file_exists($filepath . $tmp_filename . '.html')) {
         $tmp_filename = $filename . '_' . ++$i;
     }
     $filename = $tmp_filename . '.html';
     $content = stripslashes($content);
     $content = str_replace(api_get_path(WEB_COURSE_PATH), api_get_path(REL_PATH) . 'courses/', $content);
     // Change the path of mp3 to absolute.
     // The first regexp deals with ../../../ urls.
     $content = preg_replace("|(flashvars=\"file=)(\\.+/)+|", "\$1" . api_get_path(REL_COURSE_PATH) . $_course['path'] . '/document/', $content);
     // The second regexp deals with audio/ urls.
     $content = preg_replace("|(flashvars=\"file=)([^/]+)/|", "\$1" . api_get_path(REL_COURSE_PATH) . $_course['path'] . '/document/$2/', $content);
     // For flv player: To prevent edition problem with firefox, we have to use a strange tip (don't blame me please).
     $content = str_replace('</body>', '<style type="text/css">body{}</style></body>', $content);
     if (!file_exists($filepath . $filename)) {
         if ($fp = @fopen($filepath . $filename, 'w')) {
             fputs($fp, $content);
             fclose($fp);
             $file_size = filesize($filepath . $filename);
             $save_file_path = $dir . $filename;
             $document_id = FileManager::add_document($_course, $save_file_path, 'file', $file_size, $tmp_filename);
             if ($document_id) {
                 api_item_property_update($_course, TOOL_DOCUMENT, $document_id, 'DocumentAdded', api_get_user_id(), null, null, null, null, api_get_session_id());
                 $new_comment = isset($_POST['comment']) ? trim($_POST['comment']) : '';
                 $new_title = isset($_POST['title']) ? trim($_POST['title']) : '';
                 if ($new_comment || $new_title) {
                     $tbl_doc = Database::get_course_table(TABLE_DOCUMENT);
                     $ct = '';
                     if ($new_comment) {
                         $ct .= ", comment='" . Database::escape_string($new_comment) . "'";
                     }
                     if ($new_title) {
                         $ct .= ", title='" . Database::escape_string(htmlspecialchars($new_title, ENT_QUOTES, $charset)) . "' ";
                     }
                     $sql_update = "UPDATE " . $tbl_doc . " SET " . substr($ct, 1) . " WHERE c_id = " . $course_id . " AND id = " . $document_id;
                     Database::query($sql_update);
                 }
             }
             return $document_id;
         }
     }
 }

/**
 * Check if a document width the choosen filename allready exists
 */
function document_exists($filename)
{
    global $filepath;
    $filename = addslashes(trim($filename));
    $filename = Security::remove_XSS($filename);
    $filename = api_replace_dangerous_char($filename);
    $filename = FileManager::disable_dangerous_file($filename);
    return !file_exists($filepath . $filename . '.html');
}

    $webcamdir = $params['webcamdir'];
    $webcamuserid = $params['webcamuserid'];
} else {
    api_not_allowed();
    die;
}
if ($webcamuserid != api_get_user_id() || api_get_user_id() == 0 || $webcamuserid == 0) {
    api_not_allowed();
    die;
}
//clean
$webcamname = Security::remove_XSS($webcamname);
$webcamname = Database::escape_string($webcamname);
$webcamname = addslashes(trim($webcamname));
$webcamname = api_replace_dangerous_char($webcamname, 'strict');
$webcamname = FileManager::disable_dangerous_file($webcamname);
$webcamdir = Security::remove_XSS($webcamdir);
//security extension
$ext = explode('.', $webcamname);
$ext = strtolower($ext[sizeof($ext) - 1]);
if ($ext != 'jpg') {
    die;
}
//Do not use here check Fileinfo method because return: text/plain                //CHECK THIS BEFORE COMMIT
$dirBaseDocuments = api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document';
$saveDir = $dirBaseDocuments . $webcamdir;
$current_session_id = api_get_session_id();
$groupId = $_SESSION['_gid'];
//avoid duplicates
$webcamname_to_save = $webcamname;
$title_to_save = str_replace('_', ' ', $webcamname);

/**
This function changes the name of a certain file.
It needs no global variables, it takes all info from parameters.
It returns nothing.
@todo check if this function is used
*/
function change_name($base_work_dir, $source_file, $rename_to, $dir, $doc)
{
    $file_name_for_change = $base_work_dir . $dir . $source_file;
    //api_display_debug_info("call FileManager::my_rename: params $file_name_for_change, $rename_to");
    $rename_to = FileManager::disable_dangerous_file($rename_to);
    // Avoid renaming to .htaccess file
    $rename_to = FileManager::my_rename($file_name_for_change, stripslashes($rename_to));
    // fileManage API
    if ($rename_to) {
        if (isset($dir) && $dir != '') {
            $source_file = $dir . $source_file;
            $new_full_file_name = dirname($source_file) . '/' . $rename_to;
        } else {
            $source_file = '/' . $source_file;
            $new_full_file_name = '/' . $rename_to;
        }
        FileManager::update_db_info('update', $source_file, $new_full_file_name);
        // fileManage API
        $name_changed = get_lang('ElRen');
        $info_message = get_lang('fileModified');
        $GLOBALS['file_name'] = $rename_to;
        $GLOBALS['doc'] = $rename_to;
        return $info_message;
    } else {
        $dialogBox = get_lang('FileExists');
        // TODO: This variable is not used.
        /* Return to step 1 */
        $rename = $source_file;
        unset($source_file);
    }
}

//Only teacher and all users into their group and any user into his/her shared folder
if ($is_allowed_to_edit || $group_member_with_upload_rights || is_my_shared_folder(api_get_user_id(), $curdirpath, $session_id)) {
    // Create directory with $_POST data
    if (isset($_POST['create_dir']) && $_POST['dirname'] != '') {
        // Needed for directory creation
        $post_dir_name = $_POST['dirname'];
        if ($post_dir_name == '../' || $post_dir_name == '.' || $post_dir_name == '..') {
            Display::display_error_message(get_lang('CannotCreateDir'));
        } else {
            if (!empty($_POST['dir_id'])) {
                $document_data = DocumentManager::get_document_data_by_id($_POST['dir_id'], api_get_course_id());
                $curdirpath = $document_data['path'];
            }
            $added_slash = $curdirpath == '/' ? '' : '/';
            $dir_name = $curdirpath . $added_slash . api_replace_dangerous_char($post_dir_name);
            $dir_name = FileManager::disable_dangerous_file($dir_name);
            $dir_check = $base_work_dir . $dir_name;
            if (!is_dir($dir_check)) {
                $created_dir = FileManager::create_unexisting_directory($_course, api_get_user_id(), api_get_session_id(), $to_group_id, $to_user_id, $base_work_dir, $dir_name, $post_dir_name);
                if ($created_dir) {
                    Display::display_confirmation_message('<span title="' . $created_dir . '">' . get_lang('DirCr') . '</span>', false);
                    // Uncomment if you want to enter the created dir
                    //$curdirpath = $created_dir;
                    //$curdirpathurl = urlencode($curdirpath);
                } else {
                    Display::display_error_message(get_lang('CannotCreateDir'));
                }
            } else {
                Display::display_error_message(get_lang('CannotCreateDir'));
            }
        }

    $wamidir = $params['wamidir'];
    $wamiuserid = $params['wamiuserid'];
} else {
    api_not_allowed();
    die;
}
if ($wamiuserid != api_get_user_id() || api_get_user_id() == 0 || $wamiuserid == 0) {
    api_not_allowed();
    die;
}
//clean
$waminame = Security::remove_XSS($waminame);
$waminame = Database::escape_string($waminame);
$waminame = addslashes(trim($waminame));
$waminame = api_replace_dangerous_char($waminame, 'strict');
$waminame = FileManager::disable_dangerous_file($waminame);
$wamidir = Security::remove_XSS($wamidir);
$content = file_get_contents('php://input');
//security extension
$ext = explode('.', $waminame);
$ext = strtolower($ext[sizeof($ext) - 1]);
if ($ext != 'wav') {
    die;
}
//Do not use here check Fileinfo method because return: text/plain
$dirBaseDocuments = api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document';
$saveDir = $dirBaseDocuments . $wamidir;
$current_session_id = api_get_session_id();
$groupId = $_SESSION['_gid'];
//avoid duplicates
$waminame_to_save = $waminame;

 // Create the audio folder if it does not exist yet.
 $_course = api_get_course_info();
 $filepath = api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document/';
 if (!is_dir($filepath . 'audio')) {
     mkdir($filepath . 'audio', api_get_permissions_for_new_directories());
     $audio_id = FileManager::add_document($_course, '/audio', 'folder', 0, 'audio');
     api_item_property_update($_course, TOOL_DOCUMENT, $audio_id, 'FolderCreated', api_get_user_id(), null, null, null, null, api_get_session_id());
 }
 // Check if file already exits into document/audio/
 $file_name = $_FILES[$key]['name'];
 $file_name = stripslashes($file_name);
 // Add extension to files without one (if possible).
 $file_name = FileManager::add_ext_on_mime($file_name, $_FILES[$key]['type']);
 $clean_name = api_replace_dangerous_char($file_name);
 // No "dangerous" files.
 $clean_name = FileManager::disable_dangerous_file($clean_name);
 $check_file_path = api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document/audio/' . $clean_name;
 // If the file exists we generate a new name.
 if (file_exists($check_file_path)) {
     $filename_components = explode('.', $clean_name);
     // Gettting the extension of the file.
     $file_extension = $filename_components[count($filename_components) - 1];
     // Adding something random to prevent overwriting.
     $filename_components[count($filename_components) - 1] = time();
     // Reconstructing the new filename.
     $clean_name = implode($filename_components) . '.' . $file_extension;
     // Using the new name in the $_FILES superglobal.
     $_FILES[$key]['name'] = $clean_name;
 }
 // Upload the file in the documents tool
 $file_path = FileManager::handle_uploaded_document($_course, $_FILES[$key], api_get_path(SYS_COURSE_PATH) . $_course['path'] . '/document', '/audio', api_get_user_id(), '', '', '', '', false);

 /**
  * Filters dangerous filenames (*.php[.]?* and .htaccess) and returns it in
  * a non-executable form (for PHP and htaccess, this is still vulnerable to
  * other languages' files extensions)
  * @param   string  Unfiltered filename
  * @param   string  Filtered filename
  */
 public static function filter_filename($filename)
 {
     return FileManager::disable_dangerous_file($filename);
 }

/**
 * Upload a submitted user production.
 *
 * @param    $user_id    User id
 * @return    The filename of the new production or FALSE if the upload has failed
 */
function upload_user_production($user_id)
{
    $image_path = UserManager::get_user_picture_path_by_id($user_id, 'system', true);
    $production_repository = $image_path['dir'] . $user_id . '/';
    if (!file_exists($production_repository)) {
        @mkdir($production_repository, api_get_permissions_for_new_directories(), true);
    }
    $filename = api_replace_dangerous_char($_FILES['production']['name']);
    $filename = FileManager::disable_dangerous_file($filename);
    if (FileManager::filter_extension($filename)) {
        if (@move_uploaded_file($_FILES['production']['tmp_name'], $production_repository . $filename)) {
            return $filename;
        }
    }
    return false;
    // this should be returned if anything went wrong with the upload
}