From 1fb8932e70e51c02374b10f25b50d0096fc9d1fa Mon Sep 17 00:00:00 2001
From: "Committo,Ergo:sum" <esj@rezo.net>
Date: Fri, 8 Oct 2004 13:22:01 +0000
Subject: [PATCH] =?UTF-8?q?s=C3=A9curisation=20des=20sous-r=C3=A9pertoires?=
=?UTF-8?q?=20pour=20documents=20joints?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
---
donne_l_ode.php3 | 75 ++++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 75 insertions(+)
create mode 100644 donne_l_ode.php3
diff --git a/donne_l_ode.php3 b/donne_l_ode.php3
new file mode 100644
index 0000000000..90e80700c1
--- /dev/null
+++ b/donne_l_ode.php3
@@ -0,0 +1,75 @@
+<?
+# script d'acces aux documents joints
+# doit etre appele avec un de ces 2 parametres de GET:
+# - id_document
+# - file
+# il verifie soit que le demandeur est authentifie
+# soit que le fichier est joint à au moins 1 article, breve ou rubrique
+
+$id_document = ($_GET['id_document']);
+$file = urldecode($_GET['file']);
+if (strpos($file,'../') !== false)
+ $refus = 1;
+else
+ {
+ $refus = false;
+ include ("ecrire/inc_version.php3");
+ include ("ecrire/inc_connect.php3");
+ include ("ecrire/inc_meta.php3");
+ include ("ecrire/inc_session.php3");
+
+ global $auteur_session;
+ if ($cookie_session = $HTTP_COOKIE_VARS['spip_session'])
+ {
+ if (verifier_session($cookie_session))
+ {
+ if ($auteur_session['statut'] == '0minirezo'
+ OR $auteur_session['statut'] == '1comite')
+ $auth_login = $auteur_session['login'];
+ }
+ }
+
+ if (!$id_document) {
+ $id_document = @spip_fetch_array(spip_query("select id_document from spip_documents as documents where documents.fichier='".$file."'"));
+ if (!$id_document) $refus = 2;
+ $id_document = $id_document['id_document'];
+ } else {
+ $file = @spip_fetch_array(spip_query("select fichier from spip_documents as documents where id_document='". $id_document ."'"));
+ if (!$file) $refus = 3;
+ $file = $file['fichier'];
+ }
+ }
+
+if (!$auth_login && !$refus) {
+ if (!spip_num_rows(spip_query("select articles.id_article
+from spip_documents_articles as rel_articles, spip_articles as articles
+where rel_articles.id_article = articles.id_article AND
+articles.statut = 'publie' AND rel_articles.id_document ='".
+ $id_document .
+ "' LIMIT 1"))) {
+ if (!spip_num_rows(spip_query("select rubriques.id_rubrique
+from spip_documents_rubriques as rel_rubriques, spip_rubriques as rubriques
+where rel_rubriques.id_rubrique = rubriques.id_rubrique AND
+rubriques.statut = 'publie' AND rel_rubriques.id_document ='".
+ $id_document .
+ "' LIMIT 1"))) {
+ if (!spip_num_rows(spip_query("select breves.id_breve
+from spip_documents_breves as rel_breves, spip_breves as breves
+where rel_breves.id_breve = breves.id_breve AND
+breves.statut = 'publie' AND rel_breves.id_document ='".
+ $id_document .
+ "' LIMIT 1")))
+ $refus = 4; } } }
+
+if (!$refus)
+ {
+ header("Content-Type: ". mime_content_type($file));
+ header("Content-Length: ". filesize($file));
+ header("Content-Disposition: attachment; filename=\"". basename($file) ."\";");
+ header("Content-Transfer-Encoding: binary");
+ readfile($file);
+ }
+ else
+ spip_log("Acces refuse ($refus) au document " . ($_GET['id_document']) . ': ' .($_GET['file']));
+
+?>
\ No newline at end of file
--
GitLab