1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859606162636465 |
- <?php
- session_cache_limiter('public');
- require_once '../inc/global.inc.php';
- $this_section=SECTION_COURSES;
- header('Expires: Wed, 01 Jan 1990 00:00:00 GMT');
- header('Cache-Control: public');
- header('Pragma: no-cache');
- api_protect_course_script(true);
- $doc_url = $_GET['file'];
- $doc_url = str_replace('///', '&', $doc_url);
- $doc_url = str_replace(' ', '+', $doc_url);
- $doc_url = str_replace('/..', '', $doc_url);
- if (! isset($_course)) {
- api_not_allowed(true);
- }
- $full_file_name = api_get_path(SYS_COURSE_PATH).api_get_course_path().'/upload/blog/'.$doc_url;
- if (is_dir($full_file_name)) {
-
- while ($doc_url{$dul = strlen($doc_url)-1}=='/') $doc_url = substr($doc_url,0,$dul);
-
- $document_explorer = api_get_path(WEB_COURSE_PATH).api_get_course_path();
-
- header('Location: '.$document_explorer);
- }
- $tbl_blogs_attachment = Database::get_course_table(TABLE_BLOGS_ATTACHMENT);
- $course_id = api_get_course_int_id();
- Event::event_download($doc_url);
- $sql = 'SELECT filename FROM '.$tbl_blogs_attachment.'
- WHERE c_id = '.$course_id.' AND path LIKE BINARY "'.Database::escape_string($doc_url).'"';
- $result = Database::query($sql);
- if (Database::num_rows($result) > 0) {
- $row = Database::fetch_array($result);
- if (Security::check_abs_path($full_file_name, api_get_path(SYS_COURSE_PATH).api_get_course_path().'/upload/blog/')) {
- DocumentManager::file_send_for_download($full_file_name, TRUE, $row['filename']);
- }
- }
- exit;
|