2 // This script fetches files from the dataroot directory
3 // Syntax: file.php/courseid/dir/dir/dir/filename.ext
4 // file.php/courseid/dir/dir/dir/filename.ext?forcedownload=1 (download instead of inline)
5 // file.php/courseid/dir (returns index.html from dir)
6 // Workaround: file.php?file=/courseid/dir/dir/dir/filename.ext
7 // Test: file.php/testslasharguments
10 //TODO: Blog attachments do not have access control implemented - anybody can read them!
11 // It might be better to move the code to separate file because the access
12 // control is quite complex - see bolg/index.php
14 require_once('config.php');
15 require_once('lib/filelib.php');
17 if (empty($CFG->filelifetime
)) {
18 $lifetime = 86400; // Seconds for files to remain in caches
20 $lifetime = $CFG->filelifetime
;
23 // disable moodle specific debug messages
26 $relativepath = get_file_argument('file.php');
27 $forcedownload = optional_param('forcedownload', 0, PARAM_BOOL
);
29 // relative path must start with '/', because of backup/restore!!!
31 error('No valid arguments supplied or incorrect server configuration');
32 } else if ($relativepath{0} != '/') {
33 error('No valid arguments supplied, path does not start with slash!');
36 $pathname = $CFG->dataroot
.$relativepath;
38 // extract relative path components
39 $args = explode('/', trim($relativepath, '/'));
40 if (count($args) == 0) { // always at least courseid, may search for index.html in course root
41 error('No valid arguments supplied');
44 // security: limit access to existing course subdirectories
45 if (($args[0]!='blog') and (!$course = get_record_sql("SELECT * FROM {$CFG->prefix}course WHERE id='".(int)$args[0]."'"))) {
46 error('Invalid course ID');
49 // security: prevent access to "000" or "1 something" directories
50 // hack for blogs, needs proper security check too
51 if (($args[0] != 'blog') and ($args[0] != $course->id
)) {
52 error('Invalid course ID');
55 // security: login to course if necessary
56 if ($args[0] == 'blog') {
57 if (empty($CFG->bloglevel
)) {
58 error('Blogging is disabled!');
59 } else if ($CFG->bloglevel
< BLOG_GLOBAL_LEVEL
) {
61 } else if ($CFG->forcelogin
) {
64 } else if ($course->id
!= SITEID
) {
65 require_login($course->id
);
66 } else if ($CFG->forcelogin
) {
70 // security: only editing teachers can access backups
71 if ((count($args) >= 2) and (strtolower($args[1]) == 'backupdata')) {
72 if (!has_capability('moodle/site:backup', get_context_instance(CONTEXT_COURSE
, $course->id
))) {
73 error('Access not allowed');
75 $lifetime = 0; //disable browser caching for backups
79 if (is_dir($pathname)) {
80 if (file_exists($pathname.'/index.html')) {
81 $pathname = rtrim($pathname, '/').'/index.html';
82 $args[] = 'index.html';
83 } else if (file_exists($pathname.'/index.htm')) {
84 $pathname = rtrim($pathname, '/').'/index.htm';
85 $args[] = 'index.htm';
86 } else if (file_exists($pathname.'/Default.htm')) {
87 $pathname = rtrim($pathname, '/').'/Default.htm';
88 $args[] = 'Default.htm';
90 // security: do not return directory node!
91 not_found($course->id
);
95 // security: teachers can view all assignments, students only their own
96 if ((count($args) >= 3)
97 and (strtolower($args[1]) == 'moddata')
98 and (strtolower($args[2]) == 'assignment')) {
100 $lifetime = 0; // do not cache assignments, students may reupload them
101 if (!has_capability('mod/assignment:grade', get_context_instance(CONTEXT_COURSE
, $course->id
))
102 and $args[4] != $USER->id
) {
103 error('Access not allowed');
107 // security: force download of all attachments submitted by students
108 if ((count($args) >= 3)
109 and (strtolower($args[1]) == 'moddata')
110 and ((strtolower($args[2]) == 'forum')
111 or (strtolower($args[2]) == 'assignment')
112 or (strtolower($args[2]) == 'data')
113 or (strtolower($args[2]) == 'glossary')
114 or (strtolower($args[2]) == 'wiki')
115 or (strtolower($args[2]) == 'exercise')
116 or (strtolower($args[2]) == 'workshop')
118 $forcedownload = 1; // force download of all attachments
120 if ($args[0] == 'blog') {
121 $forcedownload = 1; // force download of all attachments
124 // security: some protection of hidden resource files
125 // warning: it may break backwards compatibility
126 if ((!empty($CFG->preventaccesstohiddenfiles
))
127 and (count($args) >= 2)
128 and (!(strtolower($args[1]) == 'moddata' and strtolower($args[2]) != 'resource')) // do not block files from other modules!
129 and (!has_capability('moodle/course:viewhiddenactivities', get_context_instance(CONTEXT_COURSE
, $course->id
)))) {
133 $reference = implode('/', $rargs);
135 $sql = "SELECT COUNT(r.id) " .
136 "FROM {$CFG->prefix}resource r, " .
137 "{$CFG->prefix}course_modules cm, " .
138 "{$CFG->prefix}modules m " .
139 "WHERE r.course = '{$course->id}' " .
140 "AND m.name = 'resource' " .
141 "AND cm.module = m.id " .
142 "AND cm.instance = r.id " .
143 "AND cm.visible = 0 " .
144 "AND r.type = 'file' " .
145 "AND r.reference = '{$reference}'";
146 if (count_records_sql($sql)) {
147 error('Access not allowed');
151 // check that file exists
152 if (!file_exists($pathname)) {
153 not_found($course->id
);
156 // ========================================
157 // finally send the file
158 // ========================================
159 session_write_close(); // unlock session during fileserving
160 $filename = $args[count($args)-1];
161 send_file($pathname, $filename, $lifetime, $CFG->filteruploadedfiles
, false, $forcedownload);
163 function not_found($courseid) {
165 header('HTTP/1.0 404 not found');
166 error(get_string('filenotfound', 'error'), $CFG->wwwroot
.'/course/view.php?id='.$courseid); //this is not displayed on IIS??