da ich gestern schon die Erweiterung der Uploadfunktion von "wogr" optimiert und "fertiggestellt" habe ist mir aufgefallen, dass der Dateischutz des DBFS, was ja eigentlich einer sehr schöne Sache ist, noch nicht wirklich ausgearbeitet und weiter beeinflussbar ist. Da ja, wie ich einiger Threads und Posts entnommen habe, durchaus auch Bedarf von Anderen besteht und ich für eines meiner aktuell Projekte ebenfalls akuten Bedarf einer solchen Erweiterung hatte, habe ich mich gestern Nacht und heute damit gleich auch noch beschäftigt und meiner Meinung nach zufriedenstellend fertiggestellt. Aber seht selber, lobt und kritisiert.
Funktionsumfang der Erweiterung:
- Beschreibung, Medienname, Keywords und die interne Notiz können direkt beim Upload angegeben werden.
- Erweiterter Dateischutz im DBFS (Zugriffskontrolle abhängig der Frontendusergruppen-Zugehörigkeit)
- Zugriffsberechtigung direkt beim Upload einstellbar.
Mandateneinstellungen:
Typ: "dbfs"
Name: "policy_error"
Wert: "login_error_page" oder "http_error"
Wird der Zugriff auf eine Datei des DBFS verweigert, so wird der User bei "login_error_page" an die entsprechende Seite weitergeleitet ("login_error_page" = weitere Mandanteneinstellung) oder bei "http_error" der "403-ERROR" ausgegeben.
Neue Funktion des DBFS-Objekts: $dbfsobjekt->checkPolicy ( $path )
Überpüft, ob dem gegenwärtigen Frontenduser der Zugriff auf die Datei $path im DBFS gewährt ist.
Rückgabewert: boolean ( true / false ), true wenn Zugriff gewährt, sonnst false.
Was mir leider noch nicht gelungen ist, den User nach dem erfolgreichen Login automatisch wieder auf die ursprünglich angeforderte Datei zu leiten. Hab meinem Login-Formular schon nen verstecktes Feld mit dem Name "file" und dem jeweiligen dynamisch zugewiesenen File als Value, aber trotz erfolgreichen Logins wird nicht auf die Datei verwiesen. Muss ja eigentlich ähnlich wie bei den normalen geschützten Contenido-Artikeln laufen, oder?
Beste Grüße,
Schwarzesocke
Datei: contenido/classes/class.dbfs.php
Bakup der Datei anlegen!
Suche:
Code: Alles auswählen
cInclude("classes", "class.genericdb.php");
Code: Alles auswählen
cInclude("classes", "class.genericdb.php");
cInclude("classes", "class.frontend.users.php");
Code: Alles auswählen
function outputFile ($path)
{
global $client, $auth;
...
Code: Alles auswählen
...
header("Etag: ".md5(mt_rand()));
header("Content-Disposition: filename=$file");
echo $item->get("content");
}
}
Code: Alles auswählen
/*****************************************
* BEGIN: Edit by florian@administra.de : 2009/06/24
******************************************/
function outputFile ($path)
{
global $client, $auth, $cfgClient;
$newpath = $this->strip_path($path);
$dir = dirname($newpath);
$file = basename($newpath);
if ($dir == ".")
{
$dir = "";
}
$this->select("dirname = '$dir' AND filename = '$file' AND idclient = '$client'");
if ($item = $this->next())
{
$mimetype = $item->get("mimetype");
if ($this->checkPolicy($path)) {
header("Cache-Control: ");// leave blank to avoid IE errors
header("Pragma: ");// leave blank to avoid IE errors
header("Content-Type: $mimetype");
header("Etag: ".md5(mt_rand()));
header("Content-Disposition: filename=$file");
echo $item->get("content");
} elseif (trim(getEffectiveSetting("dbfs","policy_error", "http_error"))=="http_error") {
header("HTTP/1.0 403 Forbidden");
return;
} elseif (trim(getEffectiveSetting("dbfs","policy_error", ""))=="login_error_page") {
header("location: ".$cfgClient[$client]["path"]["htmlpath"].trim(getEffectiveSetting("generator","front_content_name", "front_content"))
.".php?idcat=".trim(getEffectiveSetting("login_error_page","idcat", ""))
."&idart=".trim(getEffectiveSetting("login_error_page","idart", ""))
."&file=".$path);
exit;
}
}
}
function checkPolicy ($path)
{
global $client, $auth;
$path = $this->strip_path($path);
$dir = (dirname($path)=='.')?'':dirname($path).'/';
$file = basename($path);
$properties = new PropertyCollection();
$protected = $properties->getValue("upload", "dbfs:/".$dir.$file, "file", "protected");
if ((!empty($protected) AND strpos($protected,",")===FALSE) OR $protected == "0") {
$protected = array($protected);
} elseif (!empty($protected) AND strpos($protected,",")!==FALSE) {
$protected = explode(",",$protected);
} else {
$protected = false;
}
if (is_array($protected))
{
$checkPolicy = false;
$myuser = new FrontendUser();
$myuser->loadBy("idfrontenduser", $auth->auth["uid"]);
$mygroups = $myuser->getGroupsForUser ();
foreach ($protected as $mygroup)
{
if (in_array($mygroup, $mygroups))
{
$checkPolicy = true;
break;
}
}
return $checkPolicy;
} else {
return true;
}
}
function getAllowedGroups ($sPath)
{
$sPath = $this->strip_path($sPath);
$sDir = (dirname($sPath)=='.')?'':dirname($sPath).'/';
$sFile = basename($sPath);
$oPropCol = new PropertyCollection();
$aProtected = $oPropCol->getValue("upload", "dbfs:/".$sDir.$sFile, "file", "protected");
if ((!empty($aProtected) AND strpos($aProtected,",")===FALSE) OR $aProtected == "0") {
$aProtected = array($aProtected);
} elseif (!empty($aProtected) AND strpos($aProtected,",")!==FALSE) {
$aProtected = explode(",",$aProtected);
} else {
$aProtected = false;
}
return $aProtected;
}
/*****************************************
* END: Edit by florian@administra.de : 2009/06/24
******************************************/
Datei: contenido/includes/include.upl_edit.php
Bakup der Datei anlegen!
Kompletten Inhalt der Datei durch folgenden Code ersetzten:
Code: Alles auswählen
<?php
/*****************************************
* File : $RCSfile: include.upl_edit.php,v $
* Project : Contenido
* Descr : Directory overview
*
* Author : Timo A. Hummel
*
* Created : 30.12.2003
* Modified : $Date: 2006/04/28 09:20:54 $
*
* © four for business AG, www.4fb.de
*
* $Id: include.upl_edit.php,v 1.7 2006/04/28 09:20:54 timo.hummel Exp $
******************************************/
cInclude("classes", "class.ui.php");
cInclude("classes", "class.htmlelements.php");
cInclude("classes", "class.properties.php");
cInclude("includes", "functions.upl.php");
$page = new UI_Page;
$form = new UI_Table_Form("properties");
$form->setVar("frame", $frame);
$form->setVar("area", "upl");
$form->setVar("path", $_REQUEST["path"]);
$form->setVar("file", $_REQUEST["file"]);
$form->setVar("action", "upl_modify_file");
$form->setVar("startpage", $_REQUEST["startpage"]);
$form->setVar("sortby", $_REQUEST["sortby"]);
$form->setVar("sortmode", $_REQUEST["sortmode"]);
$form->setVar("thumbnailmode", $_REQUEST["thumbnailmode"]);
$form->addHeader(i18n("Edit"));
$properties = new PropertyCollection;
$uploads = new UploadCollection;
if (is_dbfs($_REQUEST["path"]))
{
$qpath = $_REQUEST["path"] . "/";
} else {
$qpath = $_REQUEST["path"];
}
$uploads->select("idclient = '$client' AND dirname = '$qpath' AND filename='".$_REQUEST["file"]."'");
if ($upload = $uploads->next())
{
$keywords = $properties->getValue("upload", $qpath.$_REQUEST["file"], "file", "keywords");
$medianame = $properties->getValue("upload", $qpath.$_REQUEST["file"], "file", "medianame");
$medianotes = $properties->getValue("upload", $qpath.$_REQUEST["file"], "file", "medianotes");
$vprotected = $properties->getValue("upload", $qpath.$_REQUEST["file"], "file", "protected");
$kwedit = new cHTMLTextarea("keywords", $keywords);
$mnedit = new cHTMLTextbox("medianame", $medianame,60);
$moedit = new cHTMLTextarea("medianotes", $medianotes);
$dsedit = new cHTMLTextarea("description", $upload->get("description"));
if (is_dbfs($_REQUEST["path"]))
{
$thumbnail = '<a target="_blank" href="'.$sess->url($cfgClient[$client]["path"]["htmlpath"]."dbfs.php?file=".$qpath.$_REQUEST["file"]).'"><img style="padding: 10px; background: white; border: 1px; border-style: solid; border-color: '.$cfg["color"]["table_border"].';" src="'.uplGetThumbnail($qpath.$_REQUEST["file"], 350).'"></a>';
} else {
$thumbnail = '<a target="_blank" href="'.$cfgClient[$client]["upl"]["htmlpath"].$qpath.$_REQUEST["file"].'"><img style="padding: 10px; background: white; border: 1px; border-style: solid; border-color: '.$cfg["color"]["table_border"].';" src="'.uplGetThumbnail($qpath.$_REQUEST["file"], 350).'"></a>';
}
$uplelement = new cHTMLUpload("file",40);
$form->add(i18n("File name"), $_REQUEST["file"]);
$form->add(i18n("Path"), $qpath);
$form->add(i18n("Replace file"), $uplelement->render());
$form->add(i18n("Media name"), $mnedit->render());
$form->add(i18n("Description"), $dsedit->render());
$form->add(i18n("Keywords"), $kwedit->render());
$form->add(i18n("Internal notes"), $moedit->render());
if (is_dbfs($_REQUEST["path"]))
{
/*****************************************
* BEGIN: Edit by florian@administra.de : 2009/06/24
******************************************/
if ((!empty($vprotected) AND strpos($vprotected,",")===FALSE) OR $vprotected == "0") {
$vprotected = array($vprotected);
} elseif (!empty($vprotected) AND strpos($vprotected,",")!==FALSE) {
$vprotected = explode(",",$vprotected);
} else {
$vprotected = false;
}
$protection = '';
$event = '';
$mydb = new DB_Contenido();
$myquery = "SELECT idfrontendgroup, groupname FROM ".$cfg["tab"]["frontendgroups"]." WHERE idclient = $client ORDER BY groupname";
$mydb->query($myquery);
for ($i=1; $mydb->next_record(); $i++) {
$protected = new cHTMLCheckbox("allowed_frontendgroups[]", $mydb->f("idfrontendgroup"), "afeg".$i);
if (is_array($vprotected)) {
$protected->setChecked(in_array($mydb->f("idfrontendgroup"),$vprotected));
}
$protected->setDisabled(!is_array($vprotected));
$protected->setLabelText(urldecode($mydb->f("groupname")));
$divtag = new cHTMLDIV($protected->render());
$divtag->setStyle("margin-left:20px");
$protection .= $divtag->render();
$event .= "document.getElementById('afeg$i').disabled=SETTO;";
}
$protected_opt = new cHTMLRadiobutton("protected","");
$protected_opt->setLabelText(i18n("Nicht geschützt"));
$protected_opt->setChecked(!is_array($vprotected));
$protected_opt->setEvent("onclick",str_replace("SETTO","true",$event));
$protection_opt = $protected_opt->render().'<br />';
$protected_opt = new cHTMLRadiobutton("protected","1");
$protected_opt->setLabelText(i18n("Geschützt, zugriff erlauben für FrontendUser-Gruppen"));
$protected_opt->setChecked(is_array($vprotected));
$protected_opt->setEvent("onclick",str_replace("SETTO","false",$event));
$protection_opt .= $protected_opt->render().'<br />';
$form->add(i18n("Protection"), $protection_opt.$protection);
/*****************************************
* END: Edit by florian@administra.de : 2009/06/24
******************************************/
}
$form->add(i18n("Preview"), $thumbnail);
$form->add(i18n("Author"), $classuser->getUserName($upload->get("author")) . " (". $upload->get("created").")" );
$form->add(i18n("Last modified by"), $classuser->getUserName($upload->get("modifiedby")). " (". $upload->get("lastmodified").")" );
$page->setContent($form->render());
} else {
$page->setContent(sprintf(i18n("Could not load file %s"),$_REQUEST["file"]));
}
$page->render();
?>
Datei: contenido/includes/include.upl_files_overview.php
Bakup der Datei anlegen!
Vor die "If"-Anweisung für die Aktion "upl_modify_file", also vor
Code: Alles auswählen
if ($action == "upl_modify_file")
{
/* Did the user upload a new file? */
if (count($_FILES) == 1 && ($_FILES["file"]["size"] > 0) && ($_FILES["file"]["name"] != ""))
...
Code: Alles auswählen
/*****************************************
* BEGIN: Edit by florian@administra.de : 2009/06/24
******************************************/
if ($action == "upl_withinfo")
{
if (count($_FILES) == 1)
{
foreach ($_FILES['file']['name'] as $key => $value)
{
if ($_FILES['file']['tmp_name'][$key] != "")
{
$tmp_name = $_FILES['file']['tmp_name'][$key];
$_cecIterator = $_cecRegistry->getIterator("Contenido.Upload.UploadPreprocess");
if ($_cecIterator->count() > 0)
{
/* Copy file to a temporary location */
move_uploaded_file($tmp_name, $cfg["path"]["contenido"] . $cfg["path"]["temp"].$_FILES['file']['name'][$key]);
$tmp_name = $cfg["path"]["contenido"] . $cfg["path"]["temp"].$_FILES['file']['name'][$key];
while ($chainEntry = $_cecIterator->next())
{
if (is_dbfs($path)) {
$sPathPrepend = '';
$sPathApppend = '/';
} else {
$sPathPrepend = $cfgClient[$client]['upl']['path'];
$sPathApppend = '';
}
$modified = $chainEntry->execute($tmp_name, $sPathPrepend.$path.$sPathApppend.uplCreateFriendlyName($_FILES['file']['name'][$key]));
if ($modified !== false)
{
$tmp_name = $modified;
}
}
}
if (is_dbfs($qpath))
{
$dbfs->writeFromFile($tmp_name, $qpath.uplCreateFriendlyName($_FILES['file']['name'][$key]));
unlink($tmp_name);
} else {
if (is_uploaded_file($tmp_name))
{
$final_filename = $cfgClient[$client]['upl']['path'].$path.uplCreateFriendlyName($_FILES['file']['name'][$key]);
move_uploaded_file($tmp_name, $final_filename);
$iterator = $_cecRegistry->getIterator("Contenido.Upload.UploadPostprocess");
while ($chainEntry = $iterator->next())
{
$chainEntry->execute($final_filename);
}
} else {
rename($tmp_name, $cfgClient[$client]['upl']['path'].$path.uplCreateFriendlyName($_FILES['file']['name'][$key]));
}
}
$filename = uplCreateFriendlyName($_FILES['file']['name'][$key]);
$uploads->sync($qpath,$filename);
$uploads->select("idclient = '$client' AND dirname = '".$qpath."' AND filename='".uplCreateFriendlyName($_FILES['file']['name'][$key])."'");
$upload = $uploads->next();
$upload->set("description", stripslashes($description[$key]));
$upload->store();
$properties = new PropertyCollection;
$properties->setValue("upload", $qpath.$filename, "file", "keywords", stripslashes($keywords[$key]));
$properties->setValue("upload", $qpath.$filename, "file", "medianame", stripslashes($medianame[$key]));
$properties->setValue("upload", $qpath.$filename, "file", "medianotes", stripslashes($medianotes[$key]));
if ($protected[$key]==1) {
if (count($allowed_frontendgroups[$key])==0) {
$protected[$key] = 0;
} else {
reset($allowed_frontendgroups[$key]);
$protected[$key]="";
for ($i=0; $frontendgroup = current($allowed_frontendgroups[$key]); $i++) {
$protected[$key] .= (($i+1)<count($allowed_frontendgroups[$key])) ? $frontendgroup.',' : $frontendgroup;
next($allowed_frontendgroups[$key]);
}
}
$properties->setValue("upload", $qpath.$filename, "file", "protected", $protected[$key]);
} else {
$properties->setValue("upload", $qpath.$filename, "file", "protected", "");
}
}
}
}
}
/*****************************************
* END: Edit by florian@administra.de : 2009/06/24
******************************************/
Code: Alles auswählen
$uploads->select("idclient = '$client' AND dirname = '$qpath' AND filename='$file'");
$upload = $uploads->next();
$upload->set("description", stripslashes($description));
$upload->store();
$properties = new PropertyCollection;
$properties->setValue("upload", $qpath.$file, "file", "keywords", stripslashes($keywords));
$properties->setValue("upload", $qpath.$file, "file", "medianame", stripslashes($medianame));
$properties->setValue("upload", $qpath.$file, "file", "medianotes", stripslashes($medianotes));
$properties->setValue("upload", $qpath.$file, "file", "protected", stripslashes($protected));
Code: Alles auswählen
/*****************************************
* BEGIN: Edit by florian@administra.de : 2007/06/24
******************************************/
$uploads->select("idclient = '$client' AND dirname = '$qpath' AND filename='$file'");
$upload = $uploads->next();
$upload->set("description", stripslashes($description));
$upload->store();
$properties = new PropertyCollection;
$properties->setValue("upload", $qpath.$file, "file", "keywords", stripslashes($keywords));
$properties->setValue("upload", $qpath.$file, "file", "medianame", stripslashes($medianame));
$properties->setValue("upload", $qpath.$file, "file", "medianotes", stripslashes($medianotes));
if ($protected==1) {
if (count($allowed_frontendgroups)==0) {
$protected= 0;
} else {
$protected="";
for ($i=0; $i<count($allowed_frontendgroups); $i++) {
$protected .= (($i+1)<count($allowed_frontendgroups)) ? $allowed_frontendgroups[$i].',' : $allowed_frontendgroups[$i];
}
}
$properties->setValue("upload", $qpath.$file, "file", "protected", $protected);
} else {
$properties->setValue("upload", $qpath.$file, "file", "protected", "");
}
/*****************************************
* END: Edit by florian@administra.de : 2007/06/24
******************************************/
Datei: contenido/includes/include.upl_files_upload.php
Bakup der Datei anlegen!
Kompletten Inhalt der Datei durch folgenden Code ersetzten:
Code: Alles auswählen
<?php
/*****************************************
* File : $RCSfile: include.upl_files_upload.php,v $
* Project : Contenido
* Descr : Directory overview
*
* Author : Timo A. Hummel
*
* Created : 30.12.2003
* Modified : $Date: 2006/06/12 17:29:07 $
*
* © four for business AG, www.4fb.de
*
* $Id: include.upl_files_upload.php,v 1.7 2006/06/12 17:29:07 bjoern.behrens Exp $
******************************************/
cInclude("classes", "class.ui.php");
cInclude("classes", "class.htmlelements.php");
cInclude("classes", "class.properties.php");
cInclude("includes", "functions.upl.php");
$page = new UI_Page;
if (is_writable($cfgClient[$client]["upl"]["path"].$path) || is_dbfs($path))
{
$form = new UI_Table_Form("properties");
$form->setVar("frame", $frame);
$form->setVar("area", "upl");
$form->setVar("path", $path);
$form->setVar("file", $file);
# $form->setVar("action", "upl_upload");
$form->setVar("action", "upl_withinfo");
$form->setVar("appendparameters", $_REQUEST["appendparameters"]);
$form->addHeader(i18n("Upload"));
$num_upload_files = getEffectiveSetting('backend','num_upload_files',10);
/*****************************************
* BEGIN: Edit by florian@administra.de : 2007/06/23
******************************************/
$myfontenendgroups = array();
$mydb = new DB_Contenido();
$myquery = "SELECT idfrontendgroup, groupname FROM ".$cfg["tab"]["frontendgroups"]." WHERE idclient = $client ORDER BY groupname";
$mydb->query($myquery);
for ($i=0; $mydb->next_record(); $i++) {
$myfontenendgroups[$i] = array ("id"=>$mydb->f("idfrontendgroup"),"name"=>$mydb->f("groupname"));
}
for ($i=0; $i<$num_upload_files; $i++) {
$uplelement = new cHTMLUpload("file[$i]",40);
$kwedit = new cHTMLTextarea("keywords[$i]", "");
$kwedit->setHeight (2);
$mnedit = new cHTMLTextbox("medianame[$i]", "",53);
$moedit = new cHTMLTextarea("medianotes[$i]", "");
$moedit->setHeight (2);
$dsedit = new cHTMLTextarea("description[$i]", "");
$dsedit->setHeight (2);
$viewoptimg = '<img style="margin-left: 2px; margin-right: 2px;" alt="'.i18n("Display properties").'" title="'.i18n("Display properties").'" src="images/but_art_conf2.gif">';
$viewoptimgdiv = new cHTMLDIV($viewoptimg);
$viewoptimgdiv->setStyle("float:right; padding-top:2px");
if (is_dbfs($path)) {
$protection = '';
$event = '';
for ($h=0; $h < count($myfontenendgroups); $h++) {
$myfrontendgroup = $myfontenendgroups[$h];
$protected = new cHTMLCheckbox("allowed_frontendgroups[$i][$h]", $myfrontendgroup["id"], "afeg[".$i."][".$h."]");
$protected->setLabelText(urldecode($myfrontendgroup["name"]));
$protected->setDisabled("disabled");
$divtag = new cHTMLDIV($protected->render());
$divtag->setStyle("margin-left:20px");
$protection .= $divtag->render();
$event .= "document.getElementById('afeg[$i][$h]').disabled=SETTO;";
}
$protected_opt = new cHTMLRadiobutton("protected[$i]","");
$protected_opt->setLabelText(i18n("Nicht geschützt"));
$protected_opt->setChecked("true");
$protected_opt->setEvent("onclick",str_replace("SETTO","true",$event));
$protection_opt = $protected_opt->render().'<br />';
$protected_opt = new cHTMLRadiobutton("protected[$i]","1");
$protected_opt->setLabelText(i18n("Geschützt, zugriff erlauben für FrontendUser-Gruppen"));
$protected_opt->setEvent("onclick",str_replace("SETTO","false",$event));
$protection_opt .= $protected_opt->render().'<br />';
$protection = i18n("Protection").'<br />'.$protection_opt.$protection;
}
$viewoptimgdiv->setEvent("click", "(document.getElementById('viewopt$i').style.display=='none')?document.getElementById('viewopt$i').style.display='inline':document.getElementById('viewopt$i').style.display='none';");
$viewoptdiv = new cHTMLDIV();
$viewoptdiv->setId('viewopt'.$i);
$viewoptdiv->setClass("text_medium");
$viewoptdiv->setStyle("display:none");
$viewoptdiv->setContent('<br /><br />'.i18n("Media name").'<br />'.$mnedit->render().'<br /><br />'.
i18n("Description").'<br />'.$dsedit->render().'<br /><br />'.
i18n("Keywords").'<br />'.$kwedit->render().'<br /><br />'.
i18n("Internal notes").'<br />'.$moedit->render().'<br /><br />'.$protection);
$form->add(i18n("File").' '.($i+1), $viewoptimgdiv->render().$uplelement->render().$viewoptdiv->render());
}
/*****************************************
* END: Edit by florian@administra.de : 2007/06/23
******************************************/
$page->setContent($form->render());
} else {
$page->setContent($notification->returnNotification("error", i18n("Directory not writable")));
}
$page->render();
?>
) mit Typ kennzeichnest (Beispiel: $sProtectionOpt statt $protection_opt, $oRadProtected statt $protected_opt [oRad = Objekt Radiobutton]). Das wäre wirklich nett.