get_noid.php

   1 <?php
   2 /************************************************************************/
   3 /* ATutor                                                                                                                               */
   4 /************************************************************************/
   5 /* Copyright (c) 2002-2010                                              */
   6 /* Inclusive Design Institute                                           */
   7 /* http://atutor.ca                                                     */
   8 /* This program is free software. You can redistribute it and/or        */
   9 /* modify it under the terms of the GNU General Public License          */
  10 /* as published by the Free Software Foundation.                        */
  11 /************************************************************************/
  12 // $Id: get.php 6974 2007-06-15 18:44:37Z joel $
  13 define('AT_INCLUDE_PATH', 'include/');
  14 @ob_end_clean();
  15 header("Content-Encoding: none");
  16 if (isset($_GET['test'])) {
  17         header('HTTP/1.1 200 OK', TRUE);
  18         header('ATutor-Get: OK');
  19         exit;
  20 }
  21 $in_get = TRUE;
  22
  23 require(AT_INCLUDE_PATH . 'vitals.inc.php');
  24 require(AT_INCLUDE_PATH . 'lib/mime.inc.php');
  25
  26 $force_download = false;
  27
  28 //get path to file
  29 if (defined('AT_FORCE_GET_FILE') && AT_FORCE_GET_FILE) {
  30         if (!empty($_SERVER['PATH_INFO'])) {
  31         $current_file = $_SERVER['PATH_INFO'];
  32         } else if (!empty($_SERVER['REQUEST_URI'])) {
  33                 $current_file = $_SERVER['REQUEST_URI'];
  34     } else if (!empty($_SERVER['PHP_SELF'])) {
  35                 if (!empty($_SERVER['QUERY_STRING'])) {
  36             $current_file = $_SERVER['PHP_SELF'] . '?' . $_SERVER['QUERY_STRING'];
  37         } else {
  38                 $current_file = $_SERVER['PHP_SELF'];
  39                 }
  40     } else if (!empty($_SERVER['SCRIPT_NAME'])) {
  41                 if (!empty($_SERVER['QUERY_STRING'])) {
  42             $current_file = $_SERVER['SCRIPT_NAME'] . '?' . $_SERVER['QUERY_STRING'];
  43         } else {
  44                 $current_file = $_SERVER['SCRIPT_NAME'];
  45                 }
  46     } else if (!empty($_SERVER['URL'])) {
  47         if (!empty($_SERVER['QUERY_STRING'])) {
  48             $current_file = $_SERVER['URL'] . '?' . $_SERVER['QUERY_STRING'];
  49         }
  50         $current_file = $_SERVER['URL'];
  51         }
  52
  53         if ($pos = strpos($current_file, '/get.php/') !== FALSE) {
  54                 $current_file = substr($current_file, $pos + strlen('/get.php/'));
  55         }
  56
  57         if (substr($current_file, 0, 2) == '/@') {
  58                 $force_download = true;
  59                 $current_file = substr($current_file, 2);
  60         }
  61 } else {
  62         $current_file = $_GET['f'];
  63
  64         if (substr($current_file, 0, 2) == '/@') {
  65                 $force_download = true;
  66                 $current_file = substr($current_file, 2);
  67         }
  68 }
  69
  70 $file_name = pathinfo($current_file);
  71 $file_name = $file_name['basename'];
  72
  73 if (substr($file_name, 0, 4) == 'b64:') {
  74         $base64_file_name = substr($file_name, 4);
  75         $file_name = base64_decode($base64_file_name);
  76         $current_file = '/'.$file_name;
  77 }
  78
  79 if (is_numeric(substr($current_file, 1, 1)) == true) {
  80     $course_num = substr($current_file, 1, 1);
  81     $current_file = substr($current_file, 2);
  82     $file = AT_CONTENT_DIR . $course_num . $current_file;
  83 } else {
  84     $file = AT_CONTENT_DIR . $_SESSION['course_id'] . $current_file;
  85 }
  86
  87 //send header mime type
  88 $pathinfo = pathinfo($file);
  89 $ext = $pathinfo['extension'];
  90 if ($ext == '') {
  91         $ext = 'application/octet-stream';
  92 } else {
  93         $ext = $mime[$ext][0];
  94 }
  95
  96 //check that this file is within the content directory & exists
  97
  98 // NOTE!! for some reason realpath() is not returning FALSE when the file doesn't exist!
  99 $real = realpath($file);
 100
 101 if (file_exists($real) && (substr($real, 0, strlen(AT_CONTENT_DIR)) == AT_CONTENT_DIR)) {
 102         if ($force_download) {
 103                 header('Content-Type: application/force-download');
 104                 header('Content-transfer-encoding: binary');
 105                 header('Content-Disposition: attachment; filename="'.$pathinfo['basename'].'"');
 106         } else {
 107                 header('Content-Disposition: filename="'.$pathinfo['basename'].'"');
 108         }
 109
 110         /**
 111          * although we can check if mod_xsendfile is installed in apache2
 112          * we can't actually check if it's enabled. also, we can't check if
 113          * it's enabled and installed in lighty, so instead we send the
 114          * header anyway, if it works then the line after it will not
 115          * execute. if it doesn't work, then the line after it will replace
 116          * it so that the full server path is not exposed.
 117          *
 118          * x-sendfile is supported in apache2 and lighttpd 1.5+ (previously
 119          * named x-send-file in lighttpd 1.4)
 120          */
 121         header('x-Sendfile: '.$real);
 122         header('x-Sendfile: ', TRUE); // if we get here then it didn't work
 123
 124         header('Content-Type: '.$ext);
 125
 126         @readfile($real);
 127         exit;
 128 } else {
 129         header('HTTP/1.1 404 Not Found', TRUE);
 130         exit;
 131 }
 132
 133 ?>