store_add_dropbox()

Complexity

Conditions	44
Paths	693

Size

Total Lines	250
Code Lines	158

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
function store_add_dropbox($file = [], $work = null)
{
    $_course = api_get_course_info();
    $_user = api_get_user_info();

    if (empty($file)) {
        $file = isset($_FILES['file']) ? $_FILES['file'] : null;
    }

    if (empty($work)) {
        // Validating the form data
        // there are no recipients selected
        if (!isset($_POST['recipients']) || count($_POST['recipients']) <= 0) {
            return get_lang('YouMustSelectAtLeastOneDestinee');
        } else {
            // Check if all the recipients are valid
            $thisIsAMailing = false;
            $thisIsJustUpload = false;
            foreach ($_POST['recipients'] as $rec) {
                if ($rec == 'mailing') {
                    $thisIsAMailing = true;
                } elseif ($rec == 'upload') {
                    $thisIsJustUpload = true;
                } elseif (strpos($rec, 'user_') === 0 && !isCourseMember(substr($rec, strlen('user_')))) {
                    Display::addFlash(
                        Display::return_message(
                            get_lang('InvalideUserDetected'),
                            'warning'
                        )
                    );
                    return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

                } elseif (strpos($rec, 'group_') !== 0 && strpos($rec, 'user_') !== 0) {
                    Display::addFlash(
                        Display::return_message(
                            get_lang('InvalideGroupDetected'),
                            'warning'
                        )
                    );

                    return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

                }
            }
        }

        // we are doing a mailing but an additional recipient is selected
        if ($thisIsAMailing && (count($_POST['recipients']) != 1)) {
            Display::addFlash(
                Display::return_message(
                    get_lang('MailingSelectNoOther'),
                    'warning'
                )
            );

            return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

        }

        // we are doing a just upload but an additional recipient is selected.
        // note: why can't this be valid? It is like sending a document to
        // yourself AND to a different person (I do this quite often with my e-mails)
        if ($thisIsJustUpload && (count($_POST['recipients']) != 1)) {
            Display::addFlash(
                Display::return_message(
                    get_lang('MailingJustUploadSelectNoOther'),
                    'warning'
                )
            );

            return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

        }
    }

    if (empty($file['name'])) {
        Display::addFlash(Display::return_message(get_lang('NoFileSpecified'), 'warning'));
        return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

    }

    // are we overwriting a previous file or sending a new one
    $dropbox_overwrite = false;
    if (isset($_POST['cb_overwrite']) && $_POST['cb_overwrite']) {
        $dropbox_overwrite = true;
    }

    // doing the upload
    $dropbox_filename = $file['name'];
    $dropbox_filesize = $file['size'];
    $dropbox_filetype = $file['type'];
    $dropbox_filetmpname = $file['tmp_name'];

    // check if the filesize does not exceed the allowed size.
    $maxFileSize = api_get_setting('dropbox_max_filesize');
    if ($dropbox_filesize <= 0 || $dropbox_filesize > $maxFileSize) {
        Display::addFlash(Display::return_message(get_lang('DropboxFileTooBig'), 'warning'));

        return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

    }

    // check if the file is actually uploaded
    if (!is_uploaded_file($dropbox_filetmpname)) { // check user fraud : no clean error msg.
        Display::addFlash(Display::return_message(get_lang('TheFileIsNotUploaded'), 'warning'));

        return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

    }

    $upload_ok = process_uploaded_file($file, true);

    if (!$upload_ok) {
        return null;
    }

    // Try to add an extension to the file if it hasn't got one
    $dropbox_filename = add_ext_on_mime($dropbox_filename, $dropbox_filetype);
    // Replace dangerous characters
    $dropbox_filename = api_replace_dangerous_char($dropbox_filename);
    // Transform any .php file in .phps fo security
    $dropbox_filename = php2phps($dropbox_filename);

    //filter extension
    if (!filter_extension($dropbox_filename)) {
        Display::addFlash(
            Display::return_message(
                get_lang('UplUnableToSaveFileFilteredExtension'),
                'warning'
            )
        );
        return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

    }

    // set title
    $dropbox_title = $dropbox_filename;
    // note: I think we could better migrate everything from here on to
    // separate functions: store_new_dropbox, store_new_mailing, store_just_upload
    if ($dropbox_overwrite && empty($work)) {
        $dropbox_person = new Dropbox_Person(
            $_user['user_id'],
            api_is_course_admin(),
            api_is_course_tutor()
        );
        $mailId = get_mail_id_base();
        foreach ($dropbox_person->sentWork as $w) {
            if ($w->title == $dropbox_filename) {
                if (($w->recipients[0]['id'] > $mailId) xor $thisIsAMailing) {

The variable $thisIsAMailing does not seem to be defined for all execution paths leading up to this point.

                    Display::addFlash(Display::return_message(get_lang('MailingNonMailingError'), 'warning'));
                    return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

                }
                if (($w->recipients[0]['id'] == $_user['user_id']) xor $thisIsJustUpload) {

The variable $thisIsJustUpload does not seem to be defined for all execution paths leading up to this point.

                    Display::addFlash(Display::return_message(get_lang('MailingJustUploadSelectNoOther'), 'warning'));
                    return false;

The expression return false returns the type false which is incompatible with the documented return type null|string|array.

                }
                $dropbox_filename = $w->filename;
                $found = true; // note: do we still need this?
                break;
            }
        }
    } else {  // rename file to login_filename_uniqueId format
        $dropbox_filename = $_user['username']."_".$dropbox_filename."_".uniqid('');
    }

    if (empty($work)) {
        // creating the array that contains all the users who will receive the file
        $new_work_recipients = [];
        foreach ($_POST['recipients'] as $rec) {
            if (strpos($rec, 'user_') === 0) {
                $new_work_recipients[] = substr($rec, strlen('user_'));
            } elseif (strpos($rec, 'group_') === 0) {
                $groupInfo = GroupManager::get_group_properties(substr($rec, strlen('group_')));
                $userList = GroupManager::get_subscribed_users($groupInfo);
                foreach ($userList as $usr) {
                    if (!in_array($usr['user_id'], $new_work_recipients) && $usr['user_id'] != $_user['user_id']) {
                        $new_work_recipients[] = $usr['user_id'];
                    }
                }
            }
        }
    }

    @move_uploaded_file(

It seems like you do not handle an error condition for move_uploaded_file(). This can introduce security issues, and is generally not recommended.

        $dropbox_filetmpname,
        api_get_path(SYS_COURSE_PATH).$_course['path'].'/dropbox/'.$dropbox_filename
    );

    $b_send_mail = api_get_course_setting('email_alert_on_new_doc_dropbox');

    if ($b_send_mail && empty($work)) {
        foreach ($new_work_recipients as $recipient_id) {

The variable $new_work_recipients does not seem to be defined for all execution paths leading up to this point.

            $recipent_temp = api_get_user_info($recipient_id);
            $additionalParameters = [
                'smsType' => SmsPlugin::NEW_FILE_SHARED_COURSE_BY,
                'userId' => $recipient_id,
                'courseTitle' => $_course['title'],
                'userUsername' => $recipent_temp['username']
            ];
            api_mail_html(
                api_get_person_name(
                    $recipent_temp['firstname'].' '.$recipent_temp['lastname'],
                    null,
                    PERSON_NAME_EMAIL_ADDRESS
                ),
                $recipent_temp['email'],
                get_lang('NewDropboxFileUploaded'),
                get_lang('NewDropboxFileUploadedContent').' <a href="'.api_get_path(WEB_CODE_PATH).'dropbox/index.php?'.api_get_cidreq().'">'.get_lang('SeeFile').'</a>'.
                "\n\n".
                api_get_person_name(
                    $_user['firstName'],
                    $_user['lastName'],
                    null,
                    PERSON_NAME_EMAIL_ADDRESS
                )."\n".get_lang('Email')." : ".$_user['mail'],
                api_get_person_name(
                    $_user['firstName'],
                    $_user['lastName'],
                    null,
                    PERSON_NAME_EMAIL_ADDRESS
                ),
                $_user['mail'],
                null,
                null,
                null,
                $additionalParameters
            );
        }
    }

    if (empty($work)) {
        // Create new
        $result = new Dropbox_SentWork(
            $_user['user_id'],
            $dropbox_title,
            isset($_POST['description']) ? $_POST['description'] : '',
            api_get_user_id(),
            $dropbox_filename,
            $dropbox_filesize,
            $new_work_recipients
        );
    } else {
        // Update
        $work->title = $dropbox_title;
        $work->filename = $dropbox_filename;
        $work->filesize = $dropbox_filesize;
        $work->upload_date = api_get_utc_datetime();
        $work->last_upload_date = api_get_utc_datetime();
        $work->description = isset($_POST['description']) ? $_POST['description'] : '';
        $work->uploader_id = api_get_user_id();
        $work->updateFile();
        $result = $work;
    }

    Security::clear_token();
    Display::addFlash(Display::return_message(get_lang('FileUploadSucces')));

    return $result;

The expression return $result returns the type Dropbox_SentWork which is incompatible with the documented return type null|string|array.

}