* * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, * but WITHOUT ANY WARRANTY; without even the implied warranty of * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the * GNU General Public License for more details. * * You should have received a copy of the GNU General Public License * along with this program. If not, see . */ /** * \file htdocs/core/ajax/ajaxdirtree.php * \ingroup ecm * \brief This script returns content of a directory for filetree */ // This script is called with a POST method. // Directory to scan (full path) is inside POST['dir'] and encode by js escape() if ajax is used or encoded by urlencode if mode=noajax if (! defined('NOTOKENRENEWAL')) define('NOTOKENRENEWAL',1); // Disables token renewal if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU','1'); if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML','1'); if (! defined('NOREQUIREAJAX')) define('NOREQUIREAJAX','1'); if (! isset($mode) || $mode != 'noajax') // For ajax call { $res=@include '../../main.inc.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; include_once DOL_DOCUMENT_ROOT.'/core/lib/treeview.lib.php'; include_once DOL_DOCUMENT_ROOT.'/core/class/html.form.class.php'; include_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php'; $openeddir = GETPOST('openeddir'); $modulepart= GETPOST('modulepart'); $selecteddir = jsUnEscape(GETPOST('dir')); // relative path. We must decode using same encoding function used by javascript: escape() if ($selecteddir != '/') $selecteddir = preg_replace('/\/$/','',$selecteddir); // We removed last '/' except if it is '/' } else // For no ajax call { $openeddir = GETPOST('openeddir'); $modulepart= GETPOST('modulepart'); $selecteddir = GETPOST('dir'); if ($selecteddir != '/') $selecteddir = preg_replace('/\/$/','',$selecteddir); // We removed last '/' except if it is '/' if (empty($url)) $url=DOL_URL_ROOT.'/ecm/index.php'; } // Load translation files required by the page $langs->load("ecm"); // Define fullpathselecteddir. $fullpathselecteddir=''; if ($modulepart == 'ecm') $fullpathselecteddir=$conf->ecm->dir_output.'/'.($selecteddir != '/' ? $selecteddir : ''); if ($modulepart == 'medias') $fullpathselecteddir=$dolibarr_main_data_root.'/medias/'.($selecteddir != '/' ? $selecteddir : ''); // Security: // On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers. if (preg_match('/\.\./',$fullpathselecteddir) || preg_match('/[<>|]/',$fullpathselecteddir)) { dol_syslog("Refused to deliver file ".$original_file); // Do no show plain path in shown error message dol_print_error(0,$langs->trans("ErrorFileNameInvalid",GETPOST("file"))); exit; } // Check permissions if ($modulepart == 'ecm') { if (! $user->rights->ecm->read) accessforbidden(); } if ($modulepart == 'medias') { // Always allowed } /* * View */ if (! isset($mode) || $mode != 'noajax') { top_httphead(); } //print ''."\n"; $userstatic=new User($db); $form=new Form($db); $ecmdirstatic = new EcmDirectory($db); // Load full tree from database. We will use it to define nbofsubdir and nboffilesinsubdir if (empty($sqltree)) $sqltree=$ecmdirstatic->get_full_arbo(0); // Try to find key into $sqltree $current_ecmdir_id=-1; foreach($sqltree as $keycursor => $val) { //print $val['fullrelativename']." == ".$selecteddir; if ($val['fullrelativename'] == $selecteddir) { $current_ecmdir_id = $keycursor; } } if (! empty($conf->use_javascript_ajax) && empty($conf->global->MAIN_ECM_DISABLE_JS)) { if (file_exists($fullpathselecteddir)) { $files = @scandir($fullpathselecteddir); if ($files) { natcasesort($files); if (count($files) > 2) /* The 2 accounts for . and .. */ { echo '\n"; } } else print "PermissionDenied"; } // This ajax service is called only when a directory $selecteddir is opened but not when closed. //print ''; } if (empty($conf->use_javascript_ajax) || ! empty($conf->global->MAIN_ECM_DISABLE_JS)) { print ''; } // Close db if mode is not noajax if ((! isset($mode) || $mode != 'noajax') && is_object($db)) $db->close();