| 4 |
david |
1 |
<?php
|
|
|
2 |
|
|
|
3 |
/***************************************************************************\
|
|
|
4 |
* SPIP, Systeme de publication pour l'internet *
|
|
|
5 |
* *
|
|
|
6 |
* Copyright (c) 2001-2005 *
|
|
|
7 |
* Arnaud Martin, Antoine Pitrou, Philippe Riviere, Emmanuel Saint-James *
|
|
|
8 |
* *
|
|
|
9 |
* Ce programme est un logiciel libre distribue sous licence GNU/GPL. *
|
|
|
10 |
* Pour plus de details voir le fichier COPYING.txt ou l'aide en ligne. *
|
|
|
11 |
\***************************************************************************/
|
|
|
12 |
|
|
|
13 |
# script d'acces aux documents joints
|
|
|
14 |
# doit etre appele avec un de ces 2 parametres de GET:
|
|
|
15 |
# - id_document
|
|
|
16 |
# - file
|
|
|
17 |
# il verifie soit que le demandeur est authentifie
|
|
|
18 |
# soit que le fichier est joint à au moins 1 article, breve ou rubrique
|
|
|
19 |
|
|
|
20 |
$id_document = ($_GET['id_document']);
|
|
|
21 |
$file = urldecode($_GET['file']);
|
|
|
22 |
if (strpos($file,'../') !== false)
|
|
|
23 |
$refus = 1;
|
|
|
24 |
else
|
|
|
25 |
{
|
|
|
26 |
$refus = false;
|
|
|
27 |
include ("ecrire/inc_version.php3");
|
|
|
28 |
include_local(_FILE_CONNECT);
|
|
|
29 |
include_ecrire("inc_meta.php3");
|
|
|
30 |
include_ecrire("inc_session.php3");
|
|
|
31 |
|
|
|
32 |
global $auteur_session;
|
|
|
33 |
if ($cookie_session = $_COOKIE['spip_session'])
|
|
|
34 |
{
|
|
|
35 |
if (verifier_session($cookie_session))
|
|
|
36 |
{
|
|
|
37 |
if ($auteur_session['statut'] == '0minirezo'
|
|
|
38 |
OR $auteur_session['statut'] == '1comite')
|
|
|
39 |
$auth_login = $auteur_session['login'];
|
|
|
40 |
}
|
|
|
41 |
}
|
|
|
42 |
|
|
|
43 |
if (!$id_document) {
|
|
|
44 |
$id_document = @spip_fetch_array(spip_query("select id_document from spip_documents as documents where documents.fichier='".$file."'"));
|
|
|
45 |
if (!$id_document) $refus = 2;
|
|
|
46 |
$id_document = $id_document['id_document'];
|
|
|
47 |
} else {
|
|
|
48 |
$file = @spip_fetch_array(spip_query("select fichier from spip_documents as documents where id_document='". $id_document ."'"));
|
|
|
49 |
if (!$file) $refus = 3;
|
|
|
50 |
$file = $file['fichier'];
|
|
|
51 |
}
|
|
|
52 |
}
|
|
|
53 |
|
|
|
54 |
if (!$auth_login && !$refus) {
|
|
|
55 |
if (!spip_num_rows(spip_query("select articles.id_article
|
|
|
56 |
from spip_documents_articles as rel_articles, spip_articles as articles
|
|
|
57 |
where rel_articles.id_article = articles.id_article AND
|
|
|
58 |
articles.statut = 'publie' AND rel_articles.id_document ='".
|
|
|
59 |
$id_document .
|
|
|
60 |
"' LIMIT 1"))) {
|
|
|
61 |
if (!spip_num_rows(spip_query("select rubriques.id_rubrique
|
|
|
62 |
from spip_documents_rubriques as rel_rubriques, spip_rubriques as rubriques
|
|
|
63 |
where rel_rubriques.id_rubrique = rubriques.id_rubrique AND
|
|
|
64 |
rubriques.statut = 'publie' AND rel_rubriques.id_document ='".
|
|
|
65 |
$id_document .
|
|
|
66 |
"' LIMIT 1"))) {
|
|
|
67 |
if (!spip_num_rows(spip_query("select breves.id_breve
|
|
|
68 |
from spip_documents_breves as rel_breves, spip_breves as breves
|
|
|
69 |
where rel_breves.id_breve = breves.id_breve AND
|
|
|
70 |
breves.statut = 'publie' AND rel_breves.id_document ='".
|
|
|
71 |
$id_document .
|
|
|
72 |
"' LIMIT 1")))
|
|
|
73 |
$refus = 4; } } }
|
|
|
74 |
|
|
|
75 |
if (!$refus)
|
|
|
76 |
{
|
|
|
77 |
header("Content-Type: ". mime_content_type($file));
|
|
|
78 |
header("Content-Length: ". filesize($file));
|
|
|
79 |
header("Content-Disposition: attachment; filename=\"". basename($file) ."\";");
|
|
|
80 |
header("Content-Transfer-Encoding: binary");
|
|
|
81 |
readfile($file);
|
|
|
82 |
}
|
|
|
83 |
else
|
|
|
84 |
spip_log("Acces refuse ($refus) au document " . ($_GET['id_document']) . ': ' .($_GET['file']));
|
|
|
85 |
|
|
|
86 |
?>
|