Dolibarr\Code\Api\Api\Documents::post()

Complexity

Conditions	80
Paths	> 20000

Size

Total Lines	261
Code Lines	154

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function post($filename, $modulepart, $ref = '', $subdir = '', $filecontent = '', $fileencoding = '', $overwriteifexists = 0, $createdirifnotexists = 1)
    {
        global $conf;

        //var_dump($modulepart);
        //var_dump($filename);
        //var_dump($filecontent);exit;

        $modulepartorig = $modulepart;

        if (empty($modulepart)) {
            throw new RestException(400, 'Modulepart not provided.');
        }

        $newfilecontent = '';
        if (empty($fileencoding)) {
            $newfilecontent = $filecontent;
        }
        if ($fileencoding == 'base64') {
            $newfilecontent = base64_decode($filecontent);
        }

        $original_file = dol_sanitizeFileName($filename);

        // Define $uploadir
        $object = null;
        $entity = DolibarrApiAccess::$user->entity;
        if (empty($entity)) {
            $entity = 1;
        }

        if ($ref) {
            $tmpreldir = '';
            $fetchbyid = false;

            if ($modulepart == 'facture' || $modulepart == 'invoice') {
                $modulepart = 'facture';

                $object = new Facture($this->db);
            } elseif ($modulepart == 'facture_fournisseur' || $modulepart == 'supplier_invoice') {
                $modulepart = 'supplier_invoice';

                $object = new FactureFournisseur($this->db);
            } elseif ($modulepart == 'commande' || $modulepart == 'order') {
                $modulepart = 'commande';

                $object = new Commande($this->db);
            } elseif ($modulepart == 'commande_fournisseur' || $modulepart == 'supplier_order') {
                $modulepart = 'supplier_order';

                $object = new CommandeFournisseur($this->db);
            } elseif ($modulepart == 'projet' || $modulepart == 'project') {
                $object = new Project($this->db);
            } elseif ($modulepart == 'task' || $modulepart == 'project_task') {
                $modulepart = 'project_task';

                $object = new Task($this->db);

                $task_result = $object->fetch('', $ref);

                // Fetching the tasks project is required because its out_dir might be a sub-directory of the project
                if ($task_result > 0) {
                    $project_result = $object->fetch_projet();

                    if ($project_result >= 0) {
                        $tmpreldir = dol_sanitizeFileName($object->project->ref) . '/';
                    }
                } else {
                    throw new RestException(500, 'Error while fetching Task ' . $ref);
                }
            } elseif ($modulepart == 'product' || $modulepart == 'produit' || $modulepart == 'service' || $modulepart == 'produit|service') {
                $object = new Product($this->db);
            } elseif ($modulepart == 'expensereport') {
                $object = new ExpenseReport($this->db);
            } elseif ($modulepart == 'fichinter') {
                $object = new Fichinter($this->db);
            } elseif ($modulepart == 'adherent' || $modulepart == 'member') {
                $modulepart = 'adherent';

                $object = new Adherent($this->db);
            } elseif ($modulepart == 'proposal' || $modulepart == 'propal' || $modulepart == 'propale') {
                $modulepart = 'propale';

                $object = new Propal($this->db);
            } elseif ($modulepart == 'agenda' || $modulepart == 'action' || $modulepart == 'event') {
                $modulepart = 'agenda';
                $object = new ActionComm($this->db);
            } elseif ($modulepart == 'contact' || $modulepart == 'socpeople') {
                $modulepart = 'contact';

                $object = new Contact($this->db);
                $fetchbyid = true;
            } elseif ($modulepart == 'contrat' || $modulepart == 'contract') {
                $modulepart = 'contrat';
                $object = new Contrat($this->db);
            } else {
                // TODO Implement additional moduleparts
                throw new RestException(500, 'Modulepart ' . $modulepart . ' not implemented yet.');
            }

            if (is_object($object)) {
                if ($fetchbyid) {
                    // @phan-suppress-next-line PhanPluginSuspiciousParamPosition
                    $result = $object->fetch($ref);
                } else {
                    $result = $object->fetch('', $ref);
                }

                if ($result == 0) {
                    throw new RestException(404, "Object with ref '" . $ref . "' was not found.");
                } elseif ($result < 0) {
                    throw new RestException(500, 'Error while fetching object: ' . $object->error);
                }
            }

            if (!($object->id > 0)) {
                throw new RestException(404, 'The object ' . $modulepart . " with ref '" . $ref . "' was not found.");
            }

            // Special cases that need to use get_exdir to get real dir of object
            // In future, all object should use this to define path of documents.
            if ($modulepart == 'supplier_invoice') {
                $tmpreldir = get_exdir($object->id, 2, 0, 0, $object, 'invoice_supplier');
            }

            // Test on permissions
            if ($modulepart != 'ecm') {
                $relativefile = $tmpreldir . dol_sanitizeFileName($object->ref);
                $tmp = dol_check_secure_access_document($modulepart, $relativefile, $entity, DolibarrApiAccess::$user, $ref, 'write');
                $upload_dir = $tmp['original_file']; // No dirname here, tmp['original_file'] is already the dir because dol_check_secure_access_document was called with param original_file that is only the dir
            } else {
                if (!DolibarrApiAccess::$user->hasRight('ecm', 'upload')) {
                    throw new RestException(403, 'Missing permission to upload files in ECM module');
                }
                $upload_dir = $conf->medias->multidir_output[$conf->entity];
            }

            if (empty($upload_dir) || $upload_dir == '/') {
                throw new RestException(500, 'This value of modulepart (' . $modulepart . ') does not support yet usage of ref. Check modulepart parameter or try to use subdir parameter instead of ref.');
            }
        } else {
            if ($modulepart == 'invoice') {
                $modulepart = 'facture';
            }
            if ($modulepart == 'member') {
                $modulepart = 'adherent';
            }

            // Test on permissions
            if ($modulepart != 'ecm') {
                $relativefile = $subdir;
                $tmp = dol_check_secure_access_document($modulepart, $relativefile, $entity, DolibarrApiAccess::$user, '', 'write');
                $upload_dir = $tmp['original_file']; // No dirname here, tmp['original_file'] is already the dir because dol_check_secure_access_document was called with param original_file that is only the dir
            } else {
                if (!DolibarrApiAccess::$user->hasRight('ecm', 'upload')) {
                    throw new RestException(403, 'Missing permission to upload files in ECM module');
                }
                $upload_dir = $conf->medias->multidir_output[$conf->entity];
            }

            if (empty($upload_dir) || $upload_dir == '/') {
                if (!empty($tmp['error'])) {
                    throw new RestException(403, 'Error returned by dol_check_secure_access_document: ' . $tmp['error']);
                } else {
                    throw new RestException(400, 'This value of modulepart (' . $modulepart . ') is not allowed with this value of subdir (' . $relativefile . ')');
                }
            }
        }
        // $original_file here is still value of filename without any dir.

        $upload_dir = dol_sanitizePathName($upload_dir);

        if (!empty($createdirifnotexists)) {
            if (dol_mkdir($upload_dir) < 0) { // needed by products
                throw new RestException(500, 'Error while trying to create directory ' . $upload_dir);
            }
        }

        $destfile = $upload_dir . '/' . $original_file;
        $destfiletmp = DOL_DATA_ROOT . '/admin/temp/' . $original_file;
        dol_delete_file($destfiletmp);
        //var_dump($original_file);exit;

        if (!dol_is_dir(dirname($destfile))) {
            throw new RestException(400, 'Directory does not exists : ' . dirname($destfile));
        }

        if (!$overwriteifexists && dol_is_file($destfile)) {
            throw new RestException(400, "File with name '" . $original_file . "' already exists.");
        }

        // in case temporary directory admin/temp doesn't exist
        if (!dol_is_dir(dirname($destfiletmp))) {
            dol_mkdir(dirname($destfiletmp));
        }

        $fhandle = @fopen($destfiletmp, 'w');
        if ($fhandle) {
            $nbofbyteswrote = fwrite($fhandle, $newfilecontent);
            fclose($fhandle);
            dolChmod($destfiletmp);
        } else {
            throw new RestException(500, "Failed to open file '" . $destfiletmp . "' for write");
        }

        $disablevirusscan = 0;
        $src_file = $destfiletmp;
        $dest_file = $destfile;

        // Security:
        // If we need to make a virus scan
        if (empty($disablevirusscan) && file_exists($src_file)) {
            $checkvirusarray = dolCheckVirus($src_file, $dest_file);
            if (count($checkvirusarray)) {
                dol_syslog('Files.lib::dol_move_uploaded_file File "' . $src_file . '" (target name "' . $dest_file . '") KO with antivirus: errors=' . implode(',', $checkvirusarray), LOG_WARNING);
                throw new RestException(500, 'ErrorFileIsInfectedWithAVirus: ' . implode(',', $checkvirusarray));
            }
        }

        // Security:
        // Disallow file with some extensions. We rename them.
        // Because if we put the documents directory into a directory inside web root (very bad), this allows to execute on demand arbitrary code.
        if (isAFileWithExecutableContent($dest_file) && !getDolGlobalString('MAIN_DOCUMENT_IS_OUTSIDE_WEBROOT_SO_NOEXE_NOT_REQUIRED')) {
            // $upload_dir ends with a slash, so be must be sure the medias dir to compare to ends with slash too.
            $publicmediasdirwithslash = $conf->medias->multidir_output[$conf->entity];
            if (!preg_match('/\/$/', $publicmediasdirwithslash)) {
                $publicmediasdirwithslash .= '/';
            }

            if (strpos($upload_dir, $publicmediasdirwithslash) !== 0 || !getDolGlobalInt("MAIN_DOCUMENT_DISABLE_NOEXE_IN_MEDIAS_DIR")) {    // We never add .noexe on files into media directory
                $dest_file .= '.noexe';
            }
        }

        // Security:
        // We refuse cache files/dirs, upload using .. and pipes into filenames.
        if (preg_match('/^\./', basename($src_file)) || preg_match('/\.\./', $src_file) || preg_match('/[<>|]/', $src_file)) {
            dol_syslog("Refused to deliver file " . $src_file, LOG_WARNING);
            throw new RestException(500, "Refused to deliver file " . $src_file);
        }

        // Security:
        // We refuse cache files/dirs, upload using .. and pipes into filenames.
        if (preg_match('/^\./', basename($dest_file)) || preg_match('/\.\./', $dest_file) || preg_match('/[<>|]/', $dest_file)) {
            dol_syslog("Refused to deliver file " . $dest_file, LOG_WARNING);
            throw new RestException(500, "Refused to deliver file " . $dest_file);
        }

        $moreinfo = array('note_private' => 'File uploaded using API /documents from IP ' . getUserRemoteIP());
        if (!empty($object) && is_object($object) && $object->id > 0) {
            $moreinfo['src_object_type'] = $object->table_element;
            $moreinfo['src_object_id'] = $object->id;
        }

        // Move the temporary file at its final emplacement
        $result = dol_move($destfiletmp, $dest_file, 0, $overwriteifexists, 1, 1, $moreinfo);
        if (!$result) {
            throw new RestException(500, "Failed to move file into '" . $destfile . "'");
        }

        return dol_basename($destfile);
    }