lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Filename is ok even with option MAIN_DISABLE_FORCE_SAVEAS

Browse Source
This commit is contained in:
Laurent Destailleur 2009-02-18 17:04:00 +00:00
parent b6a5487c16
commit ce9fb9cd61
1 changed files with 26 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

51
htdocs/document.php
View File

@ -1,6 +1,6 @@
<?php <?php
/* Copyright (C) 2004-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org> /* Copyright (C) 2004-2007 Rodolphe Quiedeville <rodolphe@quiedeville.org>
* Copyright (C) 2004-2008 Laurent Destailleur <eldy@users.sourceforge.net> * Copyright (C) 2004-2009 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2005 Simon Tosser <simon@kornog-computing.com> * Copyright (C) 2005 Simon Tosser <simon@kornog-computing.com>
* *
* This program is free software; you can redistribute it and/or modify * This program is free software; you can redistribute it and/or modify
@ -49,7 +49,7 @@ else
if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU','1'); if (! defined('NOREQUIREMENU')) define('NOREQUIREMENU','1');
if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML','1'); if (! defined('NOREQUIREHTML')) define('NOREQUIREHTML','1');
if (! defined('NOREQUIREAJAX')) define('NOREQUIREAJAX','1'); if (! defined('NOREQUIREAJAX')) define('NOREQUIREAJAX','1');
// Pour autre que companylogo, on charge environnement + info issus de logon comme le user // Pour autre que companylogo, on charge environnement + info issus de logon comme le user
require("./main.inc.php"); require("./main.inc.php");
// master.inc.php is included in main.inc.php // master.inc.php is included in main.inc.php
@ -60,7 +60,7 @@ require_once(DOL_DOCUMENT_ROOT.'/lib/files.lib.php');
// C'est un wrapper, donc header vierge // C'est un wrapper, donc header vierge
function llxHeader() { } function llxHeader() { }
// Default encoding for HTTP output if no encoding can be found for file to download // Default encoding for HTTP output if no encoding can be found for file to download
//$encoding='ISO-8859-1'; //$encoding='ISO-8859-1';
$action = $_GET["action"]; $action = $_GET["action"];
@ -111,7 +111,7 @@ if ($modulepart)
$original_file=$conf->facture->dir_output.'/'.$original_file; $original_file=$conf->facture->dir_output.'/'.$original_file;
$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."facture WHERE ref='$refname'"; $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."facture WHERE ref='$refname'";
} }
if ($modulepart == 'unpayed') if ($modulepart == 'unpayed')
{ {
$user->getrights('facture'); $user->getrights('facture');
@ -169,7 +169,7 @@ if ($modulepart)
$original_file=$conf->commande->dir_output.'/'.$original_file; $original_file=$conf->commande->dir_output.'/'.$original_file;
$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande WHERE ref='$refname'"; $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande WHERE ref='$refname'";
} }
// Wrapping pour les commandes fournisseurs // Wrapping pour les commandes fournisseurs
if ($modulepart == 'commande_fournisseur') if ($modulepart == 'commande_fournisseur')
{ {
@ -181,7 +181,7 @@ if ($modulepart)
$original_file=$conf->fournisseur->commande->dir_output.'/'.$original_file; $original_file=$conf->fournisseur->commande->dir_output.'/'.$original_file;
$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande_fournisseur WHERE ref='$refname'"; $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande_fournisseur WHERE ref='$refname'";
} }
// Wrapping pour les factures fournisseurs // Wrapping pour les factures fournisseurs
if ($modulepart == 'facture_fournisseur') if ($modulepart == 'facture_fournisseur')
{ {
@ -241,7 +241,7 @@ if ($modulepart)
$original_file=$conf->expedition_bon->dir_output.'/'.$original_file; $original_file=$conf->expedition_bon->dir_output.'/'.$original_file;
//$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."fichinter WHERE ref='$refname'"; //$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."fichinter WHERE ref='$refname'";
} }
// Wrapping pour les bons de livraison // Wrapping pour les bons de livraison
if ($modulepart == 'livraison') if ($modulepart == 'livraison')
{ {
@ -335,7 +335,7 @@ if ($modulepart)
} }
$original_file= DOL_DATA_ROOT.'/ecm/'.$original_file; $original_file= DOL_DATA_ROOT.'/ecm/'.$original_file;
} }
// Wrapping pour les dons // Wrapping pour les dons
if ($modulepart == 'donation') if ($modulepart == 'donation')
{ {
@ -356,7 +356,7 @@ if ($modulepart)
{ {
$accessallowed=1; $accessallowed=1;
} }
$original_file=DOL_DATA_ROOT.'/compta/bordereau/'.get_exdir(basename($original_file,".pdf")).$original_file; $original_file=DOL_DATA_ROOT.'/compta/bordereau/'.get_exdir(basename($original_file,".pdf")).$original_file;
$sqlprotectagainstexternals = ''; $sqlprotectagainstexternals = '';
} }
@ -370,7 +370,7 @@ if ($modulepart)
$original_file=$conf->export->dir_temp.'/'.$user->id.'/'.$original_file; $original_file=$conf->export->dir_temp.'/'.$user->id.'/'.$original_file;
$sqlprotectagainstexternals = ''; $sqlprotectagainstexternals = '';
} }
// Wrapping pour l'editeur wysiwyg // Wrapping pour l'editeur wysiwyg
if ($modulepart == 'editor') if ($modulepart == 'editor')
{ {
@ -417,7 +417,7 @@ if (! $accessallowed)
} }
// Security: // Security:
// On interdit les remontees de repertoire ainsi que les pipe dans // On interdit les remontees de repertoire ainsi que les pipe dans
// les noms de fichiers. // les noms de fichiers.
if (eregi('\.\.',$original_file) || eregi('[<>|]',$original_file)) if (eregi('\.\.',$original_file) || eregi('[<>|]',$original_file))
{ {
@ -434,14 +434,14 @@ if ($action == 'remove_file')
/* /*
* Suppression fichier * Suppression fichier
*/ */
clearstatcache(); clearstatcache();
$filename = basename($original_file); $filename = basename($original_file);
dolibarr_syslog("document.php remove $original_file $filename $urlsource", LOG_DEBUG); dolibarr_syslog("document.php remove $original_file $filename $urlsource", LOG_DEBUG);
if (! file_exists($original_file)) if (! file_exists($original_file))
{ {
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$_GET["file"])); dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$_GET["file"]));
exit; exit;
} }
unlink($original_file); unlink($original_file);
@ -457,28 +457,29 @@ else
/* /*
* Open and return file * Open and return file
*/ */
clearstatcache(); clearstatcache();
$filename = basename($original_file); $filename = basename($original_file);
dolibarr_syslog("document.php download $original_file $filename content-type=$type"); dolibarr_syslog("document.php download $original_file $filename content-type=$type");
if (! file_exists($original_file)) if (! file_exists($original_file))
{ {
dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$original_file)); dolibarr_print_error(0,$langs->trans("ErrorFileDoesNotExists",$original_file));
exit; exit;
} }
// Les drois sont ok et fichier trouve, on l'envoie // Les drois sont ok et fichier trouve, on l'envoie
if ($encoding) header('Content-Encoding: '.$encoding); if ($encoding) header('Content-Encoding: '.$encoding);
if ($type) header('Content-Type: '.$type); if ($type) header('Content-Type: '.$type);
if ($attachment) header('Content-Disposition: attachment; filename="'.$filename.'"'); if ($attachment) header('Content-Disposition: attachment; filename="'.$filename.'"');
else header('Content-Disposition: inline; filename="'.$filename.'"');
// Ajout directives pour resoudre bug IE // Ajout directives pour resoudre bug IE
header('Cache-Control: Public, must-revalidate'); header('Cache-Control: Public, must-revalidate');
header('Pragma: public'); header('Pragma: public');
readfile($original_file); readfile($original_file);
} }