get.php

   1 <?php
   2 /************************************************************************/
   3 /* ATutor                                                                                                                               */
   4 /************************************************************************/
   5 /* Copyright (c) 2002-2010                                              */
   6 /* Inclusive Design Institute                                           */
   7 /* http://atutor.ca                                                     */
   8 /* This program is free software. You can redistribute it and/or        */
   9 /* modify it under the terms of the GNU General Public License          */
  10 /* as published by the Free Software Foundation.                        */
  11 /************************************************************************/
  12 // $Id$
  13 define('AT_INCLUDE_PATH', 'include/');
  14 @ob_end_clean();
  15 header("Content-Encoding: none");
  16 if (isset($_GET['test'])) {
  17         header('HTTP/1.1 200 OK', TRUE);
  18         header('ATutor-Get: OK');
  19         exit;
  20 }
  21 $in_get = TRUE;
  22
  23 require(AT_INCLUDE_PATH . 'vitals.inc.php');
  24 require(AT_INCLUDE_PATH . 'lib/mime.inc.php');
  25
  26 $force_download = false;
  27
  28 //get path to file
  29 if (defined('AT_FORCE_GET_FILE') && AT_FORCE_GET_FILE) {
  30         if ((version_compare(phpversion(), '5.2.0', '<') > 0) && !empty($_SERVER['ORIG_PATH_INFO'])){
  31                 //http://www.atutor.ca/atutor/mantis/view.php?id=3436
  32                 $current_file = $_SERVER['ORIG_PATH_INFO'];
  33         } else if (!empty($_SERVER['PATH_INFO'])) {
  34         $current_file = $_SERVER['PATH_INFO'];
  35         } else if (!empty($_SERVER['REQUEST_URI'])) {
  36                 $current_file = $_SERVER['REQUEST_URI'];
  37     } else if (!empty($_SERVER['PHP_SELF'])) {
  38                 if (!empty($_SERVER['QUERY_STRING'])) {
  39             $current_file = $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
  40         } else {
  41                 $current_file = $_SERVER['PHP_SELF'];
  42                 }
  43     } else if (!empty($_SERVER['SCRIPT_NAME'])) {
  44                 if (!empty($_SERVER['QUERY_STRING'])) {
  45             $current_file = $_SERVER['SCRIPT_NAME'] . '?' . $_SERVER['QUERY_STRING'];
  46         } else {
  47                 $current_file = $_SERVER['SCRIPT_NAME'];
  48                 }
  49     } else if (!empty($_SERVER['URL'])) {
  50         if (!empty($_SERVER['QUERY_STRING'])) {
  51             $current_file = $_SERVER['URL'] . '?' . $_SERVER['QUERY_STRING'];
  52         }
  53         $current_file = $_SERVER['URL'];
  54         }
  55
  56         if (($pos = strpos($current_file, '/get.php')) !== FALSE) {
  57                 $current_file = substr($current_file, $pos + strlen('/get.php'));
  58         }
  59         if (substr($current_file, 0, 2) == '/@') {
  60                 $force_download = true;
  61                 $current_file = substr($current_file, 2);
  62         }
  63
  64 } else {
  65         $current_file = $_GET['f'];
  66
  67         if (substr($current_file, 0, 2) == '/@') {
  68                 $force_download = true;
  69                 $current_file = substr($current_file, 2);
  70         }
  71 }
  72
  73 $file_name = pathinfo($current_file);
  74 $file_name = $file_name['basename'];
  75
  76 if (substr($file_name, 0, 4) == 'b64:') {
  77         $base64_file_name = substr($file_name, 4);
  78         $file_name = base64_decode($base64_file_name);
  79         $current_file = '/'.$file_name;
  80 }
  81
  82
  83 $file = AT_CONTENT_DIR . $_SESSION['course_id'] . $current_file;
  84
  85 //send header mime type
  86 $pathinfo = pathinfo($file);
  87
  88 $ext = $pathinfo['extension'];
  89 if ($ext == '') {
  90         $ext = 'application/octet-stream';
  91 } else {
  92         $ext = $mime[$ext][0];
  93 }
  94
  95 //check that this file is within the content directory & exists
  96
  97 // NOTE!! for some reason realpath() is not returning FALSE when the file doesn't exist!
  98 $real = realpath($file);
  99 if (file_exists($real) && (substr($real, 0, strlen(AT_CONTENT_DIR)) == AT_CONTENT_DIR)) {
 100         if ($force_download) {
 101                 header('Content-Type: application/force-download');
 102                 header('Content-transfer-encoding: binary');
 103                 header('Content-Disposition: attachment; filename="'.$pathinfo['basename'].'"');
 104         } else {
 105                 header('Content-Disposition: filename="'.$pathinfo['basename'].'"');
 106         }
 107
 108         /**
 109          * although we can check if mod_xsendfile is installed in apache2
 110          * we can't actually check if it's enabled. also, we can't check if
 111          * it's enabled and installed in lighty, so instead we send the
 112          * header anyway, if it works then the line after it will not
 113          * execute. if it doesn't work, then the line after it will replace
 114          * it so that the full server path is not exposed.
 115          *
 116          * x-sendfile is supported in apache2 and lighttpd 1.5+ (previously
 117          * named x-send-file in lighttpd 1.4)
 118          */
 119         header('x-Sendfile: '.$real);
 120         header('x-Sendfile: ', TRUE); // if we get here then it didn't work
 121
 122         header('Content-Type: '.$ext);
 123         //a hack for http://atutor.ca/atutor/mantis/view.php?id=4531
 124         //@harris
 125         if ($pathinfo['extension']=='mp3' || $pathinfo['extension']=='mp4') {
 126                 header('Content-length: '.filesize($real));
 127         }
 128
 129         @readfile($real);
 130         exit;
 131 } else {
 132         header('HTTP/1.1 404 Not Found', TRUE);
 133         exit;
 134 }
 135
 136 ?>