Skip to content

Commit 590ff2f

Browse files
andersbryrupandersbryrup
committed
Merge branch 'hotfix-1.0.1-beta1'
2 parents a4c0ece + 550d1d5 commit 590ff2f

File tree

1 file changed

+65
-29
lines changed

1 file changed

+65
-29
lines changed

‎os2web_cp_service.module

Lines changed: 65 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,13 @@ function os2web_cp_service_handler() {
6666
*/
6767
function os2web_gf_service_handler($file_id) {
6868

69+
// Mime Types which are disallowed to be downloaded.
70+
// People shouldn't be able to download special files.
71+
$disallowed_mimes = array(
72+
// Disallow .msg files.
73+
'application/vnd.ms-outlook',
74+
);
75+
6976
if ($url = variable_get('os2web_cp_service_cp_document_fileurl')) {
7077

7178
$username = variable_get('os2web_cp_service_endpoint_user');
@@ -80,39 +87,60 @@ function os2web_gf_service_handler($file_id) {
8087
$header = curl_getinfo($ch);
8188
curl_close($ch);
8289
if ($header['http_code'] === 200) {
83-
drupal_add_http_header('Content-Type', $header['content_type']);
84-
drupal_add_http_header('Content-Length', $header['download_content_length']);
85-
drupal_add_http_header('Cache-Control', 'must-revalidate, post-check=0, pre-check=0');
86-
drupal_add_http_header('Cache-Control', 'private', FALSE);
87-
drupal_add_http_header('Connection', 'close');
88-
drupal_add_http_header('Expires', '0');
89-
90-
// Check for IE only headers.
91-
if (isset($_SERVER['HTTP_USER_AGENT']) && (strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== FALSE)) {
92-
drupal_add_http_header('Pragma', 'public');
90+
if (!in_array($header['content_type'], $disallowed_mimes)) {
91+
drupal_add_http_header('Content-Type', $header['content_type']);
92+
drupal_add_http_header('Content-Length', $header['download_content_length']);
93+
drupal_add_http_header('Cache-Control', 'must-revalidate, post-check=0, pre-check=0');
94+
drupal_add_http_header('Cache-Control', 'private', FALSE);
95+
drupal_add_http_header('Connection', 'close');
96+
drupal_add_http_header('Expires', '0');
97+
98+
// Check for IE only headers.
99+
if (isset($_SERVER['HTTP_USER_AGENT']) && (strpos($_SERVER['HTTP_USER_AGENT'], 'MSIE') !== FALSE)) {
100+
drupal_add_http_header('Pragma', 'public');
101+
}
102+
else {
103+
drupal_add_http_header('Pragma', 'no-cache');
104+
}
105+
106+
// Load the title to use it as the filename.
107+
$query = new EntityFieldQuery();
108+
$result = $query
109+
->entityCondition('entity_type', 'node')
110+
->propertyCondition('type', 'os2web_cp_service_cp_document')
111+
->propertyCondition('status', 1)
112+
->fieldCondition('field_os2web_cp_service_file_id', 'value', $file_id, '=')
113+
->execute();
114+
$nids = (isset($result['node']))?array_keys($result['node']) : NULL;
115+
116+
$node = node_load(array_pop($nids));
117+
118+
if ($node) {
119+
$filename = str_replace('/', '_', $node->field_os2web_cp_service_doc_id[LANGUAGE_NONE][0]['value'] . '.' . os2web_cp_service_get_extension_from_mime($header['content_type']));
120+
drupal_add_http_header('Content-Disposition', 'attachment; filename=' . $filename);
121+
}
122+
echo $data;
123+
drupal_exit();
93124
}
94125
else {
95-
drupal_add_http_header('Pragma', 'no-cache');
96-
}
97126

98-
// Load the title to use it as the filename.
99-
$query = new EntityFieldQuery();
100-
$result = $query
101-
->entityCondition('entity_type', 'node')
102-
->propertyCondition('type', 'os2web_cp_service_cp_document')
103-
->propertyCondition('status', 1)
104-
->fieldCondition('field_os2web_cp_service_file_id', 'value', $file_id, '=')
105-
->execute();
106-
$nids = (isset($result['node']))?array_keys($result['node']) : NULL;
107-
108-
$node = node_load(array_pop($nids));
109-
110-
if ($node) {
111-
$filename = str_replace('/', '_', $node->field_os2web_cp_service_doc_id[LANGUAGE_NONE][0]['value'] . '.' . os2web_cp_service_get_extension_from_mime($header['content_type']));
112-
drupal_add_http_header('Content-Disposition', 'attachment; filename=' . $filename);
127+
// Show a polite message if the file cant be downloaded.
128+
// If the message isnt set in config, deliver a access denied page.
129+
if ($error_message = variable_get('os2web_cp_service_access_denied_message')) {
130+
$markup = '<div class="messages error"><ul><li>';
131+
$markup .= $error_message;
132+
$markup .= '</li></ul></div>';
133+
134+
$page['region'] = array(
135+
'#type' => 'markup',
136+
'#markup' => $markup,
137+
);
138+
return $page;
139+
}
140+
else {
141+
drupal_access_denied();
142+
}
113143
}
114-
echo $data;
115-
drupal_exit();
116144
}
117145
else {
118146
error_log(basename(__FILE__) . ':' . __LINE__ . ' HTTP header recieved = ' . print_r($header, 1));
@@ -828,6 +856,12 @@ function os2web_cp_service_form_os2web_settings_settings_form_alter(&$form, &$fo
828856
'#description' => 'Komma separeret liste af ip-addresser der kan tilgå <em>webservicen</em>.',
829857
'#default_value' => variable_get('os2web_cp_service_cp_access_ip', ip_address()),
830858
);
859+
$form['os2web_cp_service_config_group']['os2web_cp_service_access_denied_message'] = array(
860+
'#type' => 'textfield',
861+
'#title' => 'Besked til brugeren, hvis fil ikke er tilgængelig.',
862+
'#description' => 'Vises når den modtagede filtype ikke er godkendt til Download.',
863+
'#default_value' => variable_get('os2web_cp_service_access_denied_message'),
864+
);
831865
}
832866

833867
/**
@@ -863,6 +897,8 @@ function os2web_cp_service_date_format_types() {
863897
* The file ext without the dot.
864898
*/
865899
function os2web_cp_service_get_extension_from_mime($mime) {
900+
901+
// Todo: use file_mimetype_mapping().
866902
$map = array(
867903
'application/pdf' => 'pdf',
868904
'application/zip' => 'zip',

0 commit comments

Comments
 (0)