diff --git a/htdocs/core/ajax/ajaxdirpreview.php b/htdocs/core/ajax/ajaxdirpreview.php
index 74d9db0ec6d..203bd71e645 100644
--- a/htdocs/core/ajax/ajaxdirpreview.php
+++ b/htdocs/core/ajax/ajaxdirpreview.php
@@ -39,11 +39,11 @@ if (! isset($mode) || $mode != 'noajax') // For ajax call
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
- $action=GETPOST('action','aZ09');
- $file=urldecode(GETPOST('file'));
- $section=GETPOST("section");
- $module=GETPOST("module");
- $urlsource=GETPOST("urlsource");
+ $action=GETPOST('action','aZ09');
+ $file=urldecode(GETPOST('file','alpha'));
+ $section=GETPOST("section",'alpha');
+ $module=GETPOST("module",'alpha');
+ $urlsource=GETPOST("urlsource",'alpha');
$search_doc_ref=GETPOST('search_doc_ref','alpha');
$sortfield = GETPOST("sortfield",'alpha');
@@ -56,7 +56,9 @@ if (! isset($mode) || $mode != 'noajax') // For ajax call
if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="name";
- $upload_dir = dirname(str_replace("../","/", $conf->ecm->dir_output.'/'.$file));
+ $rootdirfordoc = $conf->ecm->dir_output;
+
+ $upload_dir = dirname(str_replace("../", "/", $rootdirfordoc.'/'.$file));
$ecmdir = new EcmDirectory($db);
$result=$ecmdir->fetch($section);
@@ -68,7 +70,9 @@ if (! isset($mode) || $mode != 'noajax') // For ajax call
}
else // For no ajax call
{
- $ecmdir = new EcmDirectory($db);
+ $rootdirfordoc = $conf->ecm->dir_output;
+
+ $ecmdir = new EcmDirectory($db);
$relativepath='';
if ($section > 0)
{
@@ -80,7 +84,7 @@ else // For no ajax call
}
}
$relativepath=$ecmdir->getRelativePath();
- $upload_dir = $conf->ecm->dir_output.'/'.$relativepath;
+ $upload_dir = $rootdirfordoc.'/'.$relativepath;
}
if (empty($url)) $url=DOL_URL_ROOT.'/ecm/index.php';
@@ -95,8 +99,7 @@ if ($user->societe_id > 0) $socid = $user->societe_id;
//print 'xxx'.$upload_dir;
// Security:
-// On interdit les remontees de repertoire ainsi que les pipe dans
-// les noms de fichiers.
+// On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
if (preg_match('/\.\./',$upload_dir) || preg_match('/[<>|]/',$upload_dir))
{
dol_syslog("Refused to deliver file ".$upload_dir);
@@ -105,6 +108,16 @@ if (preg_match('/\.\./',$upload_dir) || preg_match('/[<>|]/',$upload_dir))
exit;
}
+// Check permissions
+if ($modulepart == 'ecm')
+{
+ if (! $user->rights->ecm->read) accessforbidden();
+}
+if ($modulepart == 'medias')
+{
+ // Always allowed
+}
+
/*
* Action
@@ -153,7 +166,7 @@ if ($type == 'directory')
$excludefiles = array('^SPECIMEN\.pdf$','^\.','(\.meta|_preview.*\.png)$','^temp$','^payments$','^CVS$','^thumbs$');
$sorting = (strtolower($sortorder)=='desc'?SORT_DESC:SORT_ASC);
- // Right area. If module is defined, we are in automatic ecm.
+ // Right area. If module is defined here, we are in automatic ecm.
$automodules = array('company', 'invoice', 'invoice_supplier', 'propal', 'order', 'order_supplier', 'contract', 'product', 'tax', 'project', 'fichinter', 'user', 'expensereport');
// TODO change for multicompany sharing
@@ -197,20 +210,33 @@ if ($type == 'directory')
$filter=preg_quote($search_doc_ref, '/');
$filearray=dol_dir_list($upload_dir, "files", 1, $filter, $excludefiles, $sortfield, $sorting,1);
- $formfile->list_of_autoecmfiles($upload_dir,$filearray,$module,$param,1,'',$user->rights->ecm->upload,1,$textifempty,$maxlengthname,$url,1);
+ $perm=$user->rights->ecm->upload;
+
+ $formfile->list_of_autoecmfiles($upload_dir,$filearray,$module,$param,1,'',$perm,1,$textifempty,$maxlengthname,$url,1);
}
// Manual list
else
{
- $relativepath=$ecmdir->getRelativePath();
- $upload_dir = $conf->ecm->dir_output.'/'.$relativepath;
+ if ($module == 'medias')
+ {
+ $relativepath=GETPOST('file','alpha');
+ $upload_dir = $dolibarr_main_data_root.'/medias/'.$relativepath;
+ }
+ else
+ {
+ $relativepath=$ecmdir->getRelativePath();
+ $upload_dir = $conf->ecm->dir_output.'/'.$relativepath;
+ }
// If $section defined with value 0
- if ($section === '0' || empty($section))
+ if (($section === '0' || empty($section)) && ($module != 'medias'))
{
$filearray=array();
}
- else $filearray=dol_dir_list($upload_dir,"files",0,'',array('^\.','(\.meta|_preview.*\.png)$','^temp$','^CVS$'),$sortfield, $sorting,1);
+ else
+ {
+ $filearray=dol_dir_list($upload_dir,"files",0,'',array('^\.','(\.meta|_preview.*\.png)$','^temp$','^CVS$'),$sortfield, $sorting,1);
+ }
if ($section)
{
@@ -222,7 +248,18 @@ if ($type == 'directory')
else if ($section === '0') $textifempty='
'.$langs->trans("DirNotSynchronizedSyncFirst").'
';
else $textifempty=($showonrightsize=='featurenotyetavailable'?$langs->trans("FeatureNotYetAvailable"):$langs->trans("ECMSelectASection"));
- $formfile->list_of_documents($filearray,'','ecm',$param,1,$relativepath,$user->rights->ecm->upload,1,$textifempty,$maxlengthname,'',$url);
+ if ($module == 'medias')
+ {
+ $modulepart='medias';
+ $perm=($user->rights->websites->creer || $user->rights->emailing->creer);
+ }
+ else
+ {
+ $modulepart='ecm';
+ $perm=$user->rights->ecm->upload;
+ }
+
+ $formfile->list_of_documents($filearray,'',$modulepart,$param,1,$relativepath,$perm,1,$textifempty,$maxlengthname,'',$url);
}
}
diff --git a/htdocs/core/ajax/ajaxdirtree.php b/htdocs/core/ajax/ajaxdirtree.php
index 14b05c75905..c376bee9da3 100644
--- a/htdocs/core/ajax/ajaxdirtree.php
+++ b/htdocs/core/ajax/ajaxdirtree.php
@@ -45,13 +45,14 @@ if ($selecteddir != '/') $selecteddir = preg_replace('/\/$/','',$selecteddir);
$langs->load("ecm");
-// Define selecteddir (fullpath).
+// Define fullpathselecteddir.
+$fullpathselecteddir='';
if ($modulepart == 'ecm') $fullpathselecteddir=$conf->ecm->dir_output.'/'.($selecteddir != '/' ? $selecteddir : '');
+if ($modulepart == 'medias') $fullpathselecteddir=$dolibarr_main_data_root.'/medias/'.($selecteddir != '/' ? $selecteddir : '');
// Security:
-// On interdit les remontees de repertoire ainsi que les pipe dans
-// les noms de fichiers.
+// On interdit les remontees de repertoire ainsi que les pipe dans les noms de fichiers.
if (preg_match('/\.\./',$fullpathselecteddir) || preg_match('/[<>|]/',$fullpathselecteddir))
{
dol_syslog("Refused to deliver file ".$original_file);
@@ -63,9 +64,12 @@ if (preg_match('/\.\./',$fullpathselecteddir) || preg_match('/[<>|]/',$fullpaths
// Check permissions
if ($modulepart == 'ecm')
{
- if (! $user->rights->ecm->read) accessforbidden();
+ if (! $user->rights->ecm->read) accessforbidden();
+}
+if ($modulepart == 'medias')
+{
+ // Always allowed
}
-
/*
@@ -97,7 +101,8 @@ foreach($sqltree as $keycursor => $val)
if (file_exists($fullpathselecteddir))
{
$files = @scandir($fullpathselecteddir);
- if ($files)
+
+ if ($files)
{
natcasesort($files);
if ( count($files) > 2 ) /* The 2 accounts for . and .. */
diff --git a/htdocs/ecm/index.php b/htdocs/ecm/index.php
index a7113a1895a..94b1781ab81 100644
--- a/htdocs/ecm/index.php
+++ b/htdocs/ecm/index.php
@@ -1,5 +1,5 @@
+/* Copyright (C) 2008-2017 Laurent Destailleur
* Copyright (C) 2008-2010 Regis Houssin
*
* This program is free software; you can redistribute it and/or modify
@@ -61,7 +61,6 @@ $pageprev = $page - 1;
$pagenext = $page + 1;
if (! $sortorder) $sortorder="ASC";
if (! $sortfield) $sortfield="fullname";
-if ($module == 'invoice_supplier' && $sortfield == "fullname") $sortfield="level1name";
$ecmdir = new EcmDirectory($db);
if ($section)
@@ -346,16 +345,11 @@ if ($action == 'delete' && empty($conf->use_javascript_ajax))
}
-//if (! empty($conf->use_javascript_ajax)) $classviewhide='hidden';
-//else $classviewhide='visible';
-$classviewhide='inline-block';
-
-
-
-
-$head = ecm_prepare_dasboard_head('');
-dol_fiche_head($head, 'index', $langs->trans("ECMArea").' - '.$langs->trans("ECMFileManager"), 1, '');
-
+if ($module != 'medias')
+{
+ $head = ecm_prepare_dasboard_head('');
+ dol_fiche_head($head, 'index', $langs->trans("ECMArea").' - '.$langs->trans("ECMFileManager"), -1, '');
+}
// Start container of all panels
?>
@@ -394,7 +388,7 @@ print '';
// To attach new file
if ((! empty($conf->use_javascript_ajax) && empty($conf->global->MAIN_ECM_DISABLE_JS)) || ! empty($section))
{
- if (empty($section) || $section == -1)
+ if ((empty($section) || $section == -1) && ($module != 'medias'))
{
?>