forked from bkilgore/sugarcrm_dev
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathdownload.php
190 lines (171 loc) · 8.34 KB
/
download.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
<?php
if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
/*********************************************************************************
* SugarCRM Community Edition is a customer relationship management program developed by
* SugarCRM, Inc. Copyright (C) 2004-2011 SugarCRM Inc.
*
* This program is free software; you can redistribute it and/or modify it under
* the terms of the GNU Affero General Public License version 3 as published by the
* Free Software Foundation with the addition of the following permission added
* to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
* IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
* OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
*
* This program is distributed in the hope that it will be useful, but WITHOUT
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
* FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
* details.
*
* You should have received a copy of the GNU Affero General Public License along with
* this program; if not, see http://www.gnu.org/licenses or write to the Free
* Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
* 02110-1301 USA.
*
* You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
* SW2-130, Cupertino, CA 95014, USA. or at email address contact@sugarcrm.com.
*
* The interactive user interfaces in modified source and object code versions
* of this program must display Appropriate Legal Notices, as required under
* Section 5 of the GNU Affero General Public License version 3.
*
* In accordance with Section 7(b) of the GNU Affero General Public License version 3,
* these Appropriate Legal Notices must retain the display of the "Powered by
* SugarCRM" logo. If the display of the logo is not reasonably feasible for
* technical reasons, the Appropriate Legal Notices must display the words
* "Powered by SugarCRM".
********************************************************************************/
global $db;
if(empty($_REQUEST['id']) || empty($_REQUEST['type']) || !isset($_SESSION['authenticated_user_id'])) {
die("Not a Valid Entry Point");
}
else {
$file_type=''; // bug 45896
require_once("data/BeanFactory.php");
ini_set('zlib.output_compression','Off');//bug 27089, if use gzip here, the Content-Length in hearder may be incorrect.
// cn: bug 8753: current_user's preferred export charset not being honored
$GLOBALS['current_user']->retrieve($_SESSION['authenticated_user_id']);
$GLOBALS['current_language'] = $_SESSION['authenticated_user_language'];
$app_strings = return_application_language($GLOBALS['current_language']);
$mod_strings = return_module_language($GLOBALS['current_language'], 'ACL');
$file_type = strtolower($_REQUEST['type']);
if(!isset($_REQUEST['isTempFile'])) {
//Custom modules may have capilizations anywhere in thier names. We should check the passed in format first.
require('include/modules.php');
$module = $db->quote($_REQUEST['type']);
if(empty($beanList[$module])) {
//start guessing at a module name
$module = ucfirst($file_type);
if(empty($beanList[$module])) {
die($app_strings['ERROR_TYPE_NOT_VALID']);
}
}
$bean_name = $beanList[$module];
if(!file_exists('modules/' . $module . '/' . $bean_name . '.php')) {
die($app_strings['ERROR_TYPE_NOT_VALID']);
}
$focus = BeanFactory::newBean($module);
if(!$focus->ACLAccess('view')){
die($mod_strings['LBL_NO_ACCESS']);
} // if
$focus->retrieve($_REQUEST['id']);
// Pull up the document revision, if it's of type Document
if ( isset($focus->object_name) && $focus->object_name == 'Document' ) {
// It's a document, get the revision that really stores this file
$focusRevision = new DocumentRevision();
$focusRevision->retrieve($_REQUEST['id']);
if ( empty($focusRevision->id) ) {
// This wasn't a document revision id, it's probably actually a document id,
// we need to grab the latest revision and use that
$focusRevision->retrieve($focus->document_revision_id);
if ( !empty($focusRevision->id) ) {
$_REQUEST['id'] = $focusRevision->id;
}
}
}
// See if it is a remote file, if so, send them that direction
if ( isset($focus->doc_url) && !empty($focus->doc_url) ) {
header('Location: '.$focus->doc_url);
sugar_die();
}
if ( isset($focusRevision) && isset($focusRevision->doc_url) && !empty($focusRevision->doc_url) ) {
header('Location: '.$focusRevision->doc_url);
sugar_die();
}
} // if
if(isset($_REQUEST['ieId']) && isset($_REQUEST['isTempFile'])) {
$local_location = sugar_cached("modules/Emails/{$_REQUEST['ieId']}/attachments/{$_REQUEST['id']}");
} elseif(isset($_REQUEST['isTempFile']) && $file_type == "import") {
$local_location = "upload://import/{$_REQUEST['tempName']}";
} else {
$local_location = "upload://{$_REQUEST['id']}";
}
if(isset($_REQUEST['isTempFile']) && ($_REQUEST['type']=="SugarFieldImage")) {
$local_location = "upload://{$_REQUEST['id']}";
}
if(!file_exists( $local_location ) || strpos($local_location, "..")) {
die($app_strings['ERR_INVALID_FILE_REFERENCE']);
} else {
$doQuery = true;
if($file_type == 'documents') {
// cn: bug 9674 document_revisions table has no 'name' column.
$query = "SELECT filename name FROM document_revisions INNER JOIN documents ON documents.id = document_revisions.document_id ";
$query .= "WHERE document_revisions.id = '".$db->quote($_REQUEST['id'])."' ";
} elseif($file_type == 'kbdocuments') {
$query="SELECT document_revisions.filename name FROM document_revisions INNER JOIN kbdocument_revisions ON document_revisions.id = kbdocument_revisions.document_revision_id INNER JOIN kbdocuments ON kbdocument_revisions.kbdocument_id = kbdocuments.id ";
$query .= "WHERE document_revisions.id = '" . $db->quote($_REQUEST['id']) ."'";
} elseif($file_type == 'notes') {
$query = "SELECT filename name FROM notes ";
$query .= "WHERE notes.id = '" . $db->quote($_REQUEST['id']) ."'";
} elseif( !isset($_REQUEST['isTempFile']) && !isset($_REQUEST['tempName'] ) && isset($_REQUEST['type']) && $file_type!='temp' ){ //make sure not email temp file.
$query = "SELECT filename name FROM ". $file_type ." ";
$query .= "WHERE ". $file_type .".id= '".$db->quote($_REQUEST['id'])."'";
}elseif( $file_type == 'temp'){
$doQuery = false;
}
if($doQuery && isset($query)) {
$rs = $GLOBALS['db']->query($query);
$row = $GLOBALS['db']->fetchByAssoc($rs);
if(empty($row)){
die($app_strings['ERROR_NO_RECORD']);
}
$name = $row['name'];
$download_location = "upload://{$_REQUEST['id']}";
} else if(isset( $_REQUEST['tempName'] ) && isset($_REQUEST['isTempFile']) ){
// downloading a temp file (email 2.0)
$download_location = $local_location;
$name = isset($_REQUEST['tempName'])?$_REQUEST['tempName']:'';
} else if(isset($_REQUEST['isTempFile']) && ($_REQUEST['type']=="SugarFieldImage")) {
$download_location = $local_location;
$name = isset($_REQUEST['tempName'])?$_REQUEST['tempName']:'';
}
if(isset($_SERVER['HTTP_USER_AGENT']) && preg_match("/MSIE/", $_SERVER['HTTP_USER_AGENT']))
{
$name = urlencode($name);
$name = str_replace("+", "_", $name);
}
header("Pragma: public");
header("Cache-Control: maxage=1, post-check=0, pre-check=0");
if(isset($_REQUEST['isTempFile']) && ($_REQUEST['type']=="SugarFieldImage")) {
$mime = getimagesize($download_location);
if(!empty($mime)) {
header("Content-Type: {$mime['mime']}");
} else {
header("Content-Type: image/png");
}
} else {
header("Content-Type: application/force-download");
header("Content-type: application/octet-stream");
header("Content-Disposition: attachment; filename=\"".$name."\";");
}
// disable content type sniffing in MSIE
header("X-Content-Type-Options: nosniff");
header("Content-Length: " . filesize($local_location));
header("Expires: 0");
set_time_limit(0);
@ob_end_clean();
ob_start();
readfile($download_location);
@ob_flush();
}
}
?>