module; } protected function isAccessAllowed($thisInstance, $module) { $system = System::getInstance(); $usrSvc = $system->getUserSvc(); $usr = $usrSvc->getUser(); if(!is_null($usr) && $usrSvc->userHasPriv($usr, $system->getSiteId(), false, false)) $allowed = true; else { $allowed = false; /* switch ($info->visible) { case 'all': $allowed = true; break; case 'user': if (is_null($usr)) break; $allowed = true; break; case 'acl': if (is_null($usr)) break; if ($system->getDB()->table('moduleinstanceacl')->getObject( array( 'instance' => $instanceName, 'site_id' => $system->getSiteId(), 'account_id' => $usr->getId(), ) ) ) { $allowed = true; } // TODO: add group support // TODO: add timing support break; case 'none': default: $response->addError(403,'Access denied','http'); break; } */ } return $allowed; } public function handleRequest(Request $request, Response &$response, $context) { $system = System::getInstance(); $params = $request->getParam(); if(empty($params['target'])) { $response->setContent('Missing target'); return; } $target = $params['target']; $info = NULL; if($system->cacheExists($system->getSiteId(), '$p:mcms.mmpimaincontent:modinstinfo', $target)) { $info = $system->cacheFetch($system->getSiteId(), '$p:mcms.mmpimaincontent:modinstinfo', $target); } if(empty($info)) { $info = $system->getDB()->table('moduleinstances')->getObject(array( 'instance' => $target,'site_id' => $system->getSiteId())); $system->cacheStore($system->getSiteId(), '$p:mcms.mmpimaincontent:modinstinfo', $target, $info, 60); } // if (is_null($info) || $info === false) // throw new RuntimeException('no module found for ident '+$target); $usrSvc = $system->getUserSvc(); $usr = $usrSvc->getUser(); $realName = $this->getRealName($info); if(!$this->isAccessAllowed($target, $realName)) { $classname = loadModule($realName); if(class_exists($classname)) { $obj = new $classname(); if($obj instanceof \MCMS\Module\iModule) { $activeInstance = &$obj; if(!method_exists($activeInstance, 'hasFilePriv') || !$activeInstance->hasFilePriv($usr, $params)) { $response->setContent('Not found or access denied'); return; } } else throw new \Mammut\Exception\IllegalStateException('class does not define the module interface: ' . $classname); } else { $response->setContent('Not found or access denied'); return; } } $type = isset($params['part']) ? $params['part'] : 'base'; $dir = isset($params['dir']) ? $params['dir'] : ''; $st = 'invalid request'; $basedir = dirname($_SERVER['SCRIPT_FILENAME']) . '/datax/media/' . $system->getSiteId(); $dirParts = preg_split('#(/|\\\\)#', $dir); foreach($dirParts as $id=>$part) { $part = trim($part); if($part == '' || preg_match('#^\.+$#', $part)) unset($dirParts[$id]); } $dir = implode(__DS__, $dirParts); $realDir = $basedir . __DS__ . $dir; $mode = 'file'; if(isset($_REQUEST['mode']) && $_REQUEST['mode'] == 'image') $mode = 'image'; if(isset($_REQUEST['mode']) && $_REQUEST['mode'] == 'flash') $mode = 'flash'; if(isset($_REQUEST['mode']) && $_REQUEST['mode'] == 'video') $mode = 'video'; $id = 0; switch($type) { case 'base': $st = ''; $st .= ''; $st .= '
'; $st .= 'file deleted:' . $filename . '
'; } $st .= ''; $st .= ' | ' . $text['th']['filename'] . ' | '; $st .= '' . $text['th']['filesize'] . ' | '; $st .= ''; $st .= ' |
---|---|---|---|
'; $st .= ' | ' . $file . ' | '; $st .= '' . $fsize . ' ' . $fsunit . ' | '; $st .= '';
$st .= '' . $text['lnk']['usefile'] . ' '; $st .= '' . $text['lnk']['delfile'] . ''; $st .= ' | ';
$st .= '