get.php

   1 <?php
   2 /************************************************************************/
   3 /* ATutor                                                                                                                               */
   4 /************************************************************************/
   5 /* Copyright (c) 2002-2008 by Greg Gay, Joel Kronenberg & Heidi Hazelton*/
   6 /* Adaptive Technology Resource Centre / University of Toronto                  */
   7 /* http://atutor.ca                                                                                                             */
   8 /*                                                                                                                                              */
   9 /* This program is free software. You can redistribute it and/or                */
  10 /* modify it under the terms of the GNU General Public License                  */
  11 /* as published by the Free Software Foundation.                                                */
  12 /************************************************************************/
  13 // $Id$
  14 define('AT_INCLUDE_PATH', 'include/');
  15 @ob_end_clean();
  16 header("Content-Encoding: none");
  17 if (isset($_GET['test'])) {
  18         header('HTTP/1.1 200 OK', TRUE);
  19         header('ATutor-Get: OK');
  20         exit;
  21 }
  22 $in_get = TRUE;
  23
  24 require(AT_INCLUDE_PATH . 'vitals.inc.php');
  25 require(AT_INCLUDE_PATH . 'lib/mime.inc.php');
  26
  27 $force_download = false;
  28
  29 //get path to file
  30 if (defined('AT_FORCE_GET_FILE') && AT_FORCE_GET_FILE) {
  31         if ((version_compare(phpversion(), '5.2.0', '<') > 0) && !empty($_SERVER['ORIG_PATH_INFO'])){
  32                 //http://www.atutor.ca/atutor/mantis/view.php?id=3436
  33                 $current_file = $_SERVER['ORIG_PATH_INFO'];
  34         } else if (!empty($_SERVER['PATH_INFO'])) {
  35         $current_file = $_SERVER['PATH_INFO'];
  36         } else if (!empty($_SERVER['REQUEST_URI'])) {
  37                 $current_file = $_SERVER['REQUEST_URI'];
  38     } else if (!empty($_SERVER['PHP_SELF'])) {
  39                 if (!empty($_SERVER['QUERY_STRING'])) {
  40             $current_file = $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
  41         } else {
  42                 $current_file = $_SERVER['PHP_SELF'];
  43                 }
  44     } else if (!empty($_SERVER['SCRIPT_NAME'])) {
  45                 if (!empty($_SERVER['QUERY_STRING'])) {
  46             $current_file = $_SERVER['SCRIPT_NAME'] . '?' . $_SERVER['QUERY_STRING'];
  47         } else {
  48                 $current_file = $_SERVER['SCRIPT_NAME'];
  49                 }
  50     } else if (!empty($_SERVER['URL'])) {
  51         if (!empty($_SERVER['QUERY_STRING'])) {
  52             $current_file = $_SERVER['URL'] . '?' . $_SERVER['QUERY_STRING'];
  53         }
  54         $current_file = $_SERVER['URL'];
  55         }
  56
  57         if (($pos = strpos($current_file, '/get.php')) !== FALSE) {
  58                 $current_file = substr($current_file, $pos + strlen('/get.php'));
  59         }
  60         if (substr($current_file, 0, 2) == '/@') {
  61                 $force_download = true;
  62                 $current_file = substr($current_file, 2);
  63         }
  64
  65 } else {
  66         $current_file = $_GET['f'];
  67
  68         if (substr($current_file, 0, 2) == '/@') {
  69                 $force_download = true;
  70                 $current_file = substr($current_file, 2);
  71         }
  72 }
  73
  74 $file_name = pathinfo($current_file);
  75 $file_name = $file_name['basename'];
  76
  77 if (substr($file_name, 0, 4) == 'b64:') {
  78         $base64_file_name = substr($file_name, 4);
  79         $file_name = base64_decode($base64_file_name);
  80         $current_file = '/'.$file_name;
  81 }
  82
  83
  84 $file = AT_CONTENT_DIR . $_SESSION['course_id'] . $current_file;
  85
  86 //send header mime type
  87 $pathinfo = pathinfo($file);
  88 $ext = $pathinfo['extension'];
  89 if ($ext == '') {
  90         $ext = 'application/octet-stream';
  91 } else {
  92         $ext = $mime[$ext][0];
  93 }
  94
  95 //check that this file is within the content directory & exists
  96
  97 // NOTE!! for some reason realpath() is not returning FALSE when the file doesn't exist!
  98 $real = realpath($file);
  99
 100 if (file_exists($real) && (substr($real, 0, strlen(AT_CONTENT_DIR)) == AT_CONTENT_DIR)) {
 101         if ($force_download) {
 102                 header('Content-Type: application/force-download');
 103                 header('Content-transfer-encoding: binary');
 104                 header('Content-Disposition: attachment; filename="'.$pathinfo['basename'].'"');
 105         } else {
 106                 header('Content-Disposition: filename="'.$pathinfo['basename'].'"');
 107         }
 108
 109         /**
 110          * although we can check if mod_xsendfile is installed in apache2
 111          * we can't actually check if it's enabled. also, we can't check if
 112          * it's enabled and installed in lighty, so instead we send the
 113          * header anyway, if it works then the line after it will not
 114          * execute. if it doesn't work, then the line after it will replace
 115          * it so that the full server path is not exposed.
 116          *
 117          * x-sendfile is supported in apache2 and lighttpd 1.5+ (previously
 118          * named x-send-file in lighttpd 1.4)
 119          */
 120         header('x-Sendfile: '.$real);
 121         header('x-Sendfile: ', TRUE); // if we get here then it didn't work
 122
 123         header('Content-Type: '.$ext);
 124
 125         @readfile($real);
 126         exit;
 127 } else {
 128         header('HTTP/1.1 404 Not Found', TRUE);
 129         exit;
 130 }
 131
 132 ?>