C:/xampp/htdocs/moodle/lib/uploadlib.php

Go to the documentation of this file.

<?php

// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle.  If not, see <http://www.gnu.org/licenses/>.

defined('MOODLE_INTERNAL') || die();

class upload_manager {

    var $files;
    var $config;
    var $status;
    var $course;
    var $inputname;
    var $notify;

    function upload_manager($inputname='', $deleteothers=false, $handlecollisions=false, $course=null, $recoverifmultiple=false, $modbytes=0, $silent=false, $allownull=false, $allownullmultiple=true) {

        global $CFG, $SITE;

        if (empty($course->id)) {
            $course = $SITE;
        }

        $this->config->deleteothers = $deleteothers;
        $this->config->handlecollisions = $handlecollisions;
        $this->config->recoverifmultiple = $recoverifmultiple;
        $this->config->maxbytes = get_max_upload_file_size($CFG->maxbytes, $course->maxbytes, $modbytes);
        $this->config->silent = $silent;
        $this->config->allownull = $allownull;
        $this->files = array();
        $this->status = false;
        $this->course = $course;
        $this->inputname = $inputname;
        if (empty($this->inputname)) {
            $this->config->allownull = $allownullmultiple;
        }
    }

    function preprocess_files() {
        global $CFG, $OUTPUT;

        foreach ($_FILES as $name => $file) {
            $this->status = true; // only set it to true here so that we can check if this function has been called.
            if (empty($this->inputname) || $name == $this->inputname) { // if we have input name, only process if it matches.
                $file['originalname'] = $file['name']; // do this first for the log.
                $this->files[$name] = $file; // put it in first so we can get uploadlog out in print_upload_log.
                $this->files[$name]['uploadlog'] = ''; // initialize error log
                $this->status = $this->validate_file($this->files[$name]); // default to only allowing empty on multiple uploads.
                if (!$this->status && ($this->files[$name]['error'] == 0 || $this->files[$name]['error'] == 4) && ($this->config->allownull || empty($this->inputname))) {
                    // this shouldn't cause everything to stop.. modules should be responsible for knowing which if any are compulsory.
                    continue;
                }
                if ($this->status && !empty($CFG->runclamonupload)) {
                    $this->status = clam_scan_moodle_file($this->files[$name],$this->course);
                }
                if (!$this->status) {
                    if (!$this->config->recoverifmultiple && count($this->files) > 1) {
                        $a = new stdClass();
                        $a->name    = $this->files[$name]['originalname'];
                        $a->problem = $this->files[$name]['uploadlog'];
                        if (!$this->config->silent) {
                            echo $OUTPUT->notification(get_string('uploadfailednotrecovering','moodle',$a));
                        }
                        else {
                            $this->notify .= '<br />'. get_string('uploadfailednotrecovering','moodle',$a);
                        }
                        $this->status = false;
                        return false;

                    } else if (count($this->files) == 1) {

                        if (!$this->config->silent and !$this->config->allownull) {
                            echo $OUTPUT->notification($this->files[$name]['uploadlog']);
                        } else {
                            $this->notify .= '<br />'. $this->files[$name]['uploadlog'];
                        }
                        $this->status = false;
                        return false;
                    }
                }
                else {
                    $newname = clean_filename($this->files[$name]['name']);
                    if ($newname != $this->files[$name]['name']) {
                        $a = new stdClass();
                        $a->oldname = $this->files[$name]['name'];
                        $a->newname = $newname;
                        $this->files[$name]['uploadlog'] .= get_string('uploadrenamedchars','moodle', $a);
                    }
                    $this->files[$name]['name'] = $newname;
                    $this->files[$name]['clear'] = true; // ok to save.
                    $this->config->somethingtosave = true;
                }
            }
        }
        if (!is_array($_FILES) || count($_FILES) == 0) {
            return $this->config->allownull;
        }
        $this->status = true;
        return true; // if we've got this far it means that we're recovering so we want status to be ok.
    }

    function validate_file(&$file) {
        if (empty($file)) {
            return false;
        }
        if (!is_uploaded_file($file['tmp_name']) || $file['size'] == 0) {
            $file['uploadlog'] .= "\n".$this->get_file_upload_error($file);
            return false;
        }
        if ($file['size'] > $this->config->maxbytes) {
            $file['uploadlog'] .= "\n". get_string('uploadedfiletoobig', 'moodle', $this->config->maxbytes);
            return false;
        }
        return true;
    }

    function save_files($destination) {
        global $CFG, $USER, $OUTPUT;

        if (!$this->status) { // preprocess_files hasn't been run
            $this->preprocess_files();
        }

        // if there are no files, bail before we create an empty directory.
        if (empty($this->config->somethingtosave)) {
            return true;
        }

        $savedsomething = false;

        if ($this->status) {
            if (!(strpos($destination, $CFG->dataroot) === false)) {
                // take it out for giving to make_upload_directory
                $destination = substr($destination, strlen($CFG->dataroot)+1);
            }

            if ($destination{strlen($destination)-1} == '/') { // strip off a trailing / if we have one
                $destination = substr($destination, 0, -1);
            }

            if (!make_upload_directory($destination, true)) { //TODO maybe put this function here instead of moodlelib.php now.
                $this->status = false;
                return false;
            }

            $destination = $CFG->dataroot .'/'. $destination; // now add it back in so we have a full path

            $exceptions = array(); //need this later if we're deleting other files.

            foreach (array_keys($this->files) as $i) {

                if (!$this->files[$i]['clear']) {
                    // not ok to save
                    continue;
                }

                if ($this->config->handlecollisions) {
                    $this->handle_filename_collision($destination, $this->files[$i]);
                }
                if (move_uploaded_file($this->files[$i]['tmp_name'], $destination.'/'.$this->files[$i]['name'])) {
                    chmod($destination .'/'. $this->files[$i]['name'], $CFG->directorypermissions);
                    $this->files[$i]['fullpath'] = $destination.'/'.$this->files[$i]['name'];
                    $this->files[$i]['uploadlog'] .= "\n".get_string('uploadedfile');
                    $this->files[$i]['saved'] = true;
                    $exceptions[] = $this->files[$i]['name'];
                    // now add it to the log (this is important so we know who to notify if a virus is found later on)
                    clam_log_upload($this->files[$i]['fullpath'], $this->course);
                    $savedsomething=true;
                }
            }
            if ($savedsomething && $this->config->deleteothers) {
                $this->delete_other_files($destination, $exceptions);
            }
        }
        if (empty($savedsomething)) {
            $this->status = false;
            if ((empty($this->config->allownull) && !empty($this->inputname)) || (empty($this->inputname) && empty($this->config->allownullmultiple))) {
                echo $OUTPUT->notification(get_string('uploadnofilefound'));
            }
            return false;
        }
        return $this->status;
    }

    function process_file_uploads($destination) {
        if ($this->preprocess_files()) {
            return $this->save_files($destination);
        }
        return false;
    }

    function delete_other_files($destination, $exceptions=null) {
        global $OUTPUT;
        $deletedsomething = false;
        if ($filestodel = get_directory_list($destination)) {
            foreach ($filestodel as $file) {
                if (!is_array($exceptions) || !in_array($file, $exceptions)) {
                    unlink($destination .'/'. $file);
                    $deletedsomething = true;
                }
            }
        }
        if ($deletedsomething) {
            if (!$this->config->silent) {
                echo $OUTPUT->notification(get_string('uploadoldfilesdeleted'));
            }
            else {
                $this->notify .= '<br />'. get_string('uploadoldfilesdeleted');
            }
        }
    }

    function handle_filename_collision($destination, &$file) {
        if (!file_exists($destination .'/'. $file['name'])) {
            return;
        }

        $parts     = explode('.', $file['name']);
        if (count($parts) > 1) {
            $extension = '.'.array_pop($parts);
            $name      = implode('.', $parts);
        } else {
            $extension = '';
            $name      = $file['name'];
        }

        $current = 0;
        if (preg_match('/^(.*)_(\d*)$/s', $name, $matches)) {
            $name    = $matches[1];
            $current = (int)$matches[2];
        }
        $i = $current + 1;

        while (!$this->check_before_renaming($destination, $name.'_'.$i.$extension, $file)) {
            $i++;
        }
        $a = new stdClass();
        $a->oldname = $file['name'];
        $file['name'] = $name.'_'.$i.$extension;
        $a->newname = $file['name'];
        $file['uploadlog'] .= "\n". get_string('uploadrenamedcollision','moodle', $a);
    }

    function check_before_renaming($destination, $nametocheck, $file) {
        if (!file_exists($destination .'/'. $nametocheck)) {
            return true;
        }
        if ($this->config->deleteothers) {
            foreach ($this->files as $tocheck) {
                // if we're deleting files anyway, it's not THIS file and we care about it and it has the same name and has already been saved..
                if ($file['tmp_name'] != $tocheck['tmp_name'] && $tocheck['clear'] && $nametocheck == $tocheck['name'] && $tocheck['saved']) {
                    $collision = true;
                }
            }
            if (!$collision) {
                return true;
            }
        }
        return false;
    }

    function get_file_upload_error(&$file) {

        switch ($file['error']) {
        case 0: // UPLOAD_ERR_OK
            if ($file['size'] > 0) {
                $errmessage = get_string('uploadproblem', $file['name']);
            } else {
                $errmessage = get_string('uploadnofilefound'); 
            }
            break;

        case 1: // UPLOAD_ERR_INI_SIZE
            $errmessage = get_string('uploadserverlimit');
            break;

        case 2: // UPLOAD_ERR_FORM_SIZE
            $errmessage = get_string('uploadformlimit');
            break;

        case 3: // UPLOAD_ERR_PARTIAL
            $errmessage = get_string('uploadpartialfile');
            break;

        case 4: // UPLOAD_ERR_NO_FILE
            $errmessage = get_string('uploadnofilefound');
            break;

        // Note: there is no error with a value of 5

        case 6: // UPLOAD_ERR_NO_TMP_DIR
            $errmessage = get_string('uploadnotempdir');
            break;

        case 7: // UPLOAD_ERR_CANT_WRITE
            $errmessage = get_string('uploadcantwrite');
            break;

        case 8: // UPLOAD_ERR_EXTENSION
            $errmessage = get_string('uploadextension');
            break;

        default:
            $errmessage = get_string('uploadproblem', $file['name']);
        }
        return $errmessage;
    }

    function print_upload_log($return=false,$skipemptyifmultiple=false) {
        $str = '';
        foreach (array_keys($this->files) as $i => $key) {
            if (count($this->files) > 1 && !empty($skipemptyifmultiple) && $this->files[$key]['error'] == 4) {
                continue;
            }
            $str .= '<strong>'. get_string('uploadfilelog', 'moodle', $i+1) .' '
                .((!empty($this->files[$key]['originalname'])) ? '('.$this->files[$key]['originalname'].')' : '')
                .'</strong> :'. nl2br($this->files[$key]['uploadlog']) .'<br />';
        }
        if ($return) {
            return $str;
        }
        echo $str;
    }

    function get_new_filename() {
        if (!empty($this->inputname) and count($this->files) == 1 and $this->files[$this->inputname]['error'] != 4) {
            return $this->files[$this->inputname]['name'];
        }
        return false;
    }

    function get_new_filepath() {
        if (!empty($this->inputname) and count($this->files) == 1 and $this->files[$this->inputname]['error'] != 4) {
            return $this->files[$this->inputname]['fullpath'];
        }
        return false;
    }

    function get_original_filename() {
        if (!empty($this->inputname) and count($this->files) == 1 and $this->files[$this->inputname]['error'] != 4) {
            return $this->files[$this->inputname]['originalname'];
        }
        return false;
    }

    function get_errors() {
        if (!empty($this->notify)) {
            return '<p class="notifyproblem">'. $this->notify .'</p>';
        } else {
            return null;
        }
    }
}

/**************************************************************************************
THESE FUNCTIONS ARE OUTSIDE THE CLASS BECAUSE THEY NEED TO BE CALLED FROM OTHER PLACES.
FOR EXAMPLE CLAM_HANDLE_INFECTED_FILE AND CLAM_REPLACE_INFECTED_FILE USED FROM CRON
UPLOAD_PRINT_FORM_FRAGMENT DOESN'T REALLY BELONG IN THE CLASS BUT CERTAINLY IN THIS FILE
***************************************************************************************/

function clam_handle_infected_file($file, $userid=0, $basiconly=false) {

    global $CFG, $USER;
    if ($USER && !$userid) {
        $userid = $USER->id;
    }
    $delete = true;
    if (file_exists($CFG->quarantinedir) && is_dir($CFG->quarantinedir) && is_writable($CFG->quarantinedir)) {
        $now = date('YmdHis');
        if (rename($file, $CFG->quarantinedir .'/'. $now .'-user-'. $userid .'-infected')) {
            $delete = false;
            clam_log_infected($file, $CFG->quarantinedir.'/'. $now .'-user-'. $userid .'-infected', $userid);
            if ($basiconly) {
                $notice .= "\n". get_string('clammovedfilebasic');
            }
            else {
                $notice .= "\n". get_string('clammovedfile', 'moodle', $CFG->quarantinedir.'/'. $now .'-user-'. $userid .'-infected');
            }
        }
        else {
            if ($basiconly) {
                $notice .= "\n". get_string('clamdeletedfile');
            }
            else {
                $notice .= "\n". get_string('clamquarantinedirfailed', 'moodle', $CFG->quarantinedir);
            }
        }
    }
    else {
        if ($basiconly) {
            $notice .= "\n". get_string('clamdeletedfile');
        }
        else {
            $notice .= "\n". get_string('clamquarantinedirfailed', 'moodle', $CFG->quarantinedir);
        }
    }
    if ($delete) {
        if (unlink($file)) {
            clam_log_infected($file, '', $userid);
            $notice .= "\n". get_string('clamdeletedfile');
        }
        else {
            if ($basiconly) {
                // still tell the user the file has been deleted. this is only for admins.
                $notice .= "\n". get_string('clamdeletedfile');
            }
            else {
                $notice .= "\n". get_string('clamdeletedfilefailed');
            }
        }
    }
    return $notice;
}

function clam_replace_infected_file($file) {
    $newcontents = get_string('virusplaceholder');
    if (!$f = fopen($file, 'w')) {
        return false;
    }
    if (!fwrite($f, $newcontents)) {
        return false;
    }
    return true;
}


function clam_scan_moodle_file(&$file, $course) {
    global $CFG, $USER;

    if (is_array($file) && is_uploaded_file($file['tmp_name'])) { // it's from $_FILES
        $appendlog = true;
        $fullpath = $file['tmp_name'];
    }
    else if (file_exists($file)) { // it's a path to somewhere on the filesystem!
        $fullpath = $file;
    }
    else {
        return false; // erm, what is this supposed to be then, huh?
    }

    $CFG->pathtoclam = trim($CFG->pathtoclam);

    if (!$CFG->pathtoclam || !file_exists($CFG->pathtoclam) || !is_executable($CFG->pathtoclam)) {
        $newreturn = 1;
        $notice = get_string('clamlost', 'moodle', $CFG->pathtoclam);
        if ($CFG->clamfailureonupload == 'actlikevirus') {
            $notice .= "\n". get_string('clamlostandactinglikevirus');
            $notice .= "\n". clam_handle_infected_file($fullpath);
            $newreturn = false;
        }
        clam_message_admins($notice);
        if ($appendlog) {
            $file['uploadlog'] .= "\n". get_string('clambroken');
            $file['clam'] = 1;
        }
        return $newreturn; // return 1 if we're allowing clam failures
    }

    $cmd = $CFG->pathtoclam .' '. $fullpath ." 2>&1";

    // before we do anything we need to change perms so that clamscan can read the file (clamdscan won't work otherwise)
    chmod($fullpath, $CFG->directorypermissions);

    exec($cmd, $output, $return);


    switch ($return) {
    case 0: // glee! we're ok.
        return 1; // translate clam return code into reasonable return code consistent with everything else.
    case 1:  // bad wicked evil, we have a virus.
        $info = new stdClass();
        if (!empty($course)) {
            $info->course = format_string($course->fullname, true, array('context' => get_context_instance(CONTEXT_COURSE, $course->id)));
        }
        else {
            $info->course = 'No course';
        }
        $info->user = fullname($USER);
        $notice = get_string('virusfound', 'moodle', $info);
        $notice .= "\n\n". implode("\n", $output);
        $notice .= "\n\n". clam_handle_infected_file($fullpath);
        clam_message_admins($notice);
        if ($appendlog) {
            $info->filename = $file['originalname'];
            $file['uploadlog'] .= "\n". get_string('virusfounduser', 'moodle', $info);
            $file['virus'] = 1;
        }
        return false; // in this case, 0 means bad.
    default:
        // error - clam failed to run or something went wrong
        $notice .= get_string('clamfailed', 'moodle', get_clam_error_code($return));
        $notice .= "\n\n". implode("\n", $output);
        $newreturn = true;
        if ($CFG->clamfailureonupload == 'actlikevirus') {
            $notice .= "\n". clam_handle_infected_file($fullpath);
            $newreturn = false;
        }
        clam_message_admins($notice);
        if ($appendlog) {
            $file['uploadlog'] .= "\n". get_string('clambroken');
            $file['clam'] = 1;
        }
        return $newreturn; // return 1 if we're allowing failures.
    }
}

function clam_message_admins($notice) {

    $site = get_site();

    $subject = get_string('clamemailsubject', 'moodle', format_string($site->fullname));
    $admins = get_admins();
    foreach ($admins as $admin) {
        $eventdata = new stdClass();
        $eventdata->component         = 'moodle';
        $eventdata->name              = 'errors';
        $eventdata->userfrom          = get_admin();
        $eventdata->userto            = $admin;
        $eventdata->subject           = $subject;
        $eventdata->fullmessage       = $notice;
        $eventdata->fullmessageformat = FORMAT_PLAIN;
        $eventdata->fullmessagehtml   = '';
        $eventdata->smallmessage      = '';
        message_send($eventdata);
    }
}


function get_clam_error_code($returncode) {
    $returncodes = array();
    $returncodes[0] = 'No virus found.';
    $returncodes[1] = 'Virus(es) found.';
    $returncodes[2] = ' An error occured'; // specific to clamdscan
    // all after here are specific to clamscan
    $returncodes[40] = 'Unknown option passed.';
    $returncodes[50] = 'Database initialization error.';
    $returncodes[52] = 'Not supported file type.';
    $returncodes[53] = 'Can\'t open directory.';
    $returncodes[54] = 'Can\'t open file. (ofm)';
    $returncodes[55] = 'Error reading file. (ofm)';
    $returncodes[56] = 'Can\'t stat input file / directory.';
    $returncodes[57] = 'Can\'t get absolute path name of current working directory.';
    $returncodes[58] = 'I/O error, please check your filesystem.';
    $returncodes[59] = 'Can\'t get information about current user from /etc/passwd.';
    $returncodes[60] = 'Can\'t get information about user \'clamav\' (default name) from /etc/passwd.';
    $returncodes[61] = 'Can\'t fork.';
    $returncodes[63] = 'Can\'t create temporary files/directories (check permissions).';
    $returncodes[64] = 'Can\'t write to temporary directory (please specify another one).';
    $returncodes[70] = 'Can\'t allocate and clear memory (calloc).';
    $returncodes[71] = 'Can\'t allocate memory (malloc).';
    if ($returncodes[$returncode])
       return $returncodes[$returncode];
    return get_string('clamunknownerror');

}

function clam_log_upload($newfilepath, $course=null, $nourl=false) {
    global $CFG, $USER;
    // get rid of any double // that might have appeared
    $newfilepath = preg_replace('/\/\//', '/', $newfilepath);
    if (strpos($newfilepath, $CFG->dataroot) === false) {
        $newfilepath = $CFG->dataroot .'/'. $newfilepath;
    }
    $courseid = 0;
    if ($course) {
        $courseid = $course->id;
    }
    add_to_log($courseid, 'upload', 'upload', ((!$nourl) ? substr($_SERVER['HTTP_REFERER'], 0, 100) : ''), $newfilepath);
}

function clam_log_infected($oldfilepath='', $newfilepath='', $userid=0) {
    global $DB;

    add_to_log(0, 'upload', 'infected', $_SERVER['HTTP_REFERER'], $oldfilepath, 0, $userid);

    $user = $DB->get_record('user', array('id'=>$userid));

    $errorstr = 'Clam AV has found a file that is infected with a virus. It was uploaded by '
        . ((empty($user)) ? ' an unknown user ' : fullname($user))
        . ((empty($oldfilepath)) ? '. The infected file was caught on upload ('.$oldfilepath.')'
           : '. The original file path of the infected file was '. $oldfilepath)
        . ((empty($newfilepath)) ? '. The file has been deleted ' : '. The file has been moved to a quarantine directory and the new path is '. $newfilepath);

    error_log($errorstr);
}


function clam_change_log($oldpath, $newpath, $update=true) {
    global $DB;

    if (!$record = $DB->get_record('log', array('info'=>$oldpath, 'module'=>'upload'))) {
        return false;
    }
    $record->info = $newpath;
    if ($update) {
        $DB->update_record('log', $record);
    } else {
        unset($record->id);
        $DB->insert_record('log', $record);
    }
}