fix git cvs drift
[moodle.git] / userfile.php
CommitLineData
d92e7c4d 1<?php
2
3// This file is part of Moodle - http://moodle.org/
4//
5// Moodle is free software: you can redistribute it and/or modify
6// it under the terms of the GNU General Public License as published by
7// the Free Software Foundation, either version 3 of the License, or
8// (at your option) any later version.
9//
10// Moodle is distributed in the hope that it will be useful,
11// but WITHOUT ANY WARRANTY; without even the implied warranty of
12// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13// GNU General Public License for more details.
14//
15// You should have received a copy of the GNU General Public License
16// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
17
18/**
11e1f828 19 * This script serves user's private files
d92e7c4d 20 *
21 * @package moodlecore
22 * @subpackage file
23 * @copyright 2008 Petr Skoda (http://skodak.org)
24 * @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
25 */
26
27require_once('config.php');
28require_once('lib/filelib.php');
29
30// disable moodle specific debug messages
31disable_debugging();
32
33$relativepath = get_file_argument();
34$forcedownload = optional_param('forcedownload', 0, PARAM_BOOL);
35
36// relative path must start with '/'
37if (!$relativepath) {
38 print_error('invalidargorconf');
39} else if ($relativepath{0} != '/') {
40 print_error('pathdoesnotstartslash');
41}
42
43// extract relative path components
44$args = explode('/', ltrim($relativepath, '/'));
45
46if (count($args) == 0) { // always at least user id
47 print_error('invalidarguments');
48}
49
50$contextid = (int)array_shift($args);
51$filearea = array_shift($args);
52
53$context = get_context_instance_by_id($contextid);
54if ($context->contextlevel != CONTEXT_USER) {
55 print_error('invalidarguments');
56}
57
58$userid = $context->instanceid;
59
60switch ($filearea) {
61 case 'user_profile':
62 require_login();
63 if (isguestuser()) {
64 print_error('noguest');
65 }
66
67 // access controll here must match user edit forms
68 if ($userid == $USER->id) {
69 if (!has_capability('moodle/user:editownprofile', get_context_instance(CONTEXT_SYSTEM))) {
106f3b67 70 send_file_not_found();
d92e7c4d 71 }
72 } else {
73 if (!has_capability('moodle/user:editprofile', $context) and !has_capability('moodle/user:update', $context)) {
106f3b67 74 send_file_not_found();
783b6db4 75 }
d92e7c4d 76 }
77 $itemid = 0;
78 $forcedownload = true;
79 break;
80
81 case 'user_private':
82 require_login();
83 if (isguestuser()) {
783b6db4 84 send_file_not_found();
d92e7c4d 85 }
86 if ($USER->id != $userid) {
87 send_file_not_found();
88 }
89 $itemid = 0;
90 $forcedownload = true;
91 break;
172dd12c 92
d92e7c4d 93 default:
94 send_file_not_found();
95}
172dd12c 96
d92e7c4d 97$relativepath = '/'.implode('/', $args);
172dd12c 98
d92e7c4d 99$fs = get_file_storage();
100
101$fullpath = $context->id.$filearea.$itemid.$relativepath;
102
103if (!$file = $fs->get_file_by_hash(sha1($fullpath)) or $file->get_filename() == '.') {
104 send_file_not_found();
105}
172dd12c 106
d92e7c4d 107// ========================================
108// finally send the file
109// ========================================
110session_get_instance()->write_close(); // unlock session during fileserving
111send_stored_file($file, 0, false, $forcedownload);