dolibarr/htdocs/ecm/index_medias.php
Frédéric FRANCE 585afa14de
Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (#39557)
* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm

Replaces manual '?key='.urlencode($val).'&key2='.urlencode($val2)
string-building with dolBuildUrl($path, $params) across the ECM
directory-tree/file-manager code, for consistency with the rest of
the codebase (see htdocs/core/lib/ecm.lib.php, which already uses
this pattern for the same page) and to benefit from dolBuildUrl()'s
buildurl hook.

- core/ajax/ajaxdirtree.php: the dir_card.php edit link built from
  the sql tree loop.
- ecm/dir_card.php: the edit/add-section action buttons and the two
  delete confirmation URLs. Also switches the three buttons that used
  to manually concatenate '&token='.newToken() to dolBuildUrl()'s own
  $addtoken parameter.
- ecm/class/ecmfiles.class.php: EcmFiles::getNomUrl()'s document.php
  and file_card.php URLs.
- ecm/tpl/enablefiletreeajax.tpl.php: the ajaxdirtree.php script URL
  and the ajaxdirpreview.php URL. The token here intentionally stays
  currentToken() (not dolBuildUrl()'s own newToken()-based
  $addtoken), per the existing comment: ajaxdirtree.php has
  NOTOKENRENEWAL defined, so the token must match the one already
  valid on the calling page. $paramwithoutsection is a pre-built raw
  query-string fragment from an external caller and is appended as-is
  after the dolBuildUrl() result rather than folded into it.

Verified all five refactored URL-building expressions produce byte-
identical output to the original code for representative inputs
(including values with '/', '&' and spaces), except for query
parameter order (which has no effect) and one real, minor pre-
existing bug this incidentally fixes: the delete-section confirm URL
in dir_card.php was building '&module='.$module without urlencode(),
now correctly encoded by dolBuildUrl()/http_build_query().

Could not do a live browser check (no Chrome available for Playwright
in this environment) - verified via php -l, phpcs, and a standalone
script comparing old vs new output for each call site instead.

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in filemanager.tpl.php

Same refactor as the previous commit, applied to the 7 remaining
manually-concatenated URLs in core/tpl/filemanager.tpl.php (used by
the ECM/medias file manager): the delete-file/delete-section/
convert-to-webp confirm URLs, the create-directory and refresh-list
toolbar buttons (now using dolBuildUrl()'s $addtoken instead of a
manual '&token='.newToken()), the two generate-webp buttons, and the
"Root" link.

$websitekeyandpageid is kept as a helper to build the raw sub-query
string embedded once (single-encoded) as the create-directory
button's 'backtopage' value - it is not itself passed to dolBuildUrl.

Verified all 7 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(compared as parsed, order-independent query strings, since
http_build_query() does not preserve insertion order the same way as
the original manual concatenation), including one case
(convertimgwebp confirm with sortfield/sortorder) where the original
code had a harmless but sloppy leading '?&' that dolBuildUrl() no
longer produces.

* fix

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in index_auto.php

Same refactor as the previous commits, applied to the 4 manually-
concatenated URLs in ecm/index_auto.php: the delete-file and
delete-section confirm URLs, the refresh-list toolbar link, and the
per-directory link in the auto-directories list.

Verified all 4 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(including an empty-module/empty-section case for the refresh link,
and values with '/' and spaces for the others).

* Qual: Use dolBuildUrl() instead of manual urlencode() concatenation in ecm (file_card, dir_add_card, index_medias)

Same refactor as the previous commits, applied to the remaining
manually-concatenated URLs in:
- ecm/file_card.php: the cancel and rename-file redirects, the
  internal download link (document.php), the delete-file confirm URL
  and the edit button.
- ecm/dir_add_card.php: the delete-section confirm URL and the delete
  button (now using dolBuildUrl()'s $addtoken instead of a manual
  '&token='.newToken()).
- ecm/index_medias.php: the $backtopage URL used by
  core/actions_linkedfiles.inc.php after a confirm_deletefile.

Left ecm/search.php's '$param = "&section=".urlencode($section)'
alone: it is a raw query-string fragment (starting with '&', no
leading path) passed into FormFile::list_of_documents(), not a
base+params URL build, so it does not fit the dolBuildUrl($path,
$params) shape - same reasoning as $paramwithoutsection in the
already-refactored enablefiletreeajax.tpl.php.

Verified all 8 refactored URL-building expressions produce the same
query parameters as the original code for representative inputs
(order-independent comparison, since http_build_query() does not
preserve the original insertion order).
2026-08-17 04:41:05 +02:00

333 lines
11 KiB
PHP

<?php
/* Copyright (C) 2008-2017 Laurent Destailleur <eldy@users.sourceforge.net>
* Copyright (C) 2008-2010 Regis Houssin <regis.houssin@inodbox.com>
* Copyright (C) 2024-2026 Frédéric France <frederic.france@free.fr>
* Copyright (C) 2026 MDW <mdeweerd@users.noreply.github.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*
* You can call this page with param module=medias to get a filemanager for medias.
*/
/**
* \file htdocs/ecm/index_medias.php
* \ingroup ecm
* \brief Main page for ECM section of public media directories area
*/
// Load Dolibarr environment
require '../main.inc.php';
/**
* @var Conf $conf
* @var DoliDB $db
* @var HookManager $hookmanager
* @var Translate $langs
* @var User $user
*/
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formfile.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/ecm.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php';
require_once DOL_DOCUMENT_ROOT.'/core/lib/treeview.lib.php';
require_once DOL_DOCUMENT_ROOT.'/ecm/class/ecmdirectory.class.php';
// Load translation files required by the page
$langs->loadLangs(array('ecm', 'companies', 'other', 'users', 'orders', 'propal', 'bills', 'contracts'));
// Get parameters
$action = GETPOST('action', 'aZ09');
$confirm = GETPOST('confirm', 'alpha');
$backtopage = GETPOST('backtopage', 'alpha');
$socid = GETPOSTINT('socid');
$file_manager = GETPOST('file_manager', 'alpha');
$section = GETPOSTINT('section') ? GETPOSTINT('section') : GETPOSTINT('section_id');
if (!$section) {
$section = 0;
}
$section_dir = GETPOST('section_dir', 'alpha');
$overwritefile = GETPOSTINT('overwritefile');
if (empty($action) && $file_manager) {
$action = 'file_manager';
}
$pageid = GETPOSTINT('pageid');
$limit = GETPOSTINT('limit') ? GETPOSTINT('limit') : $conf->liste_limit;
$sortfield = GETPOST('sortfield', 'aZ09comma');
$sortorder = GETPOST('sortorder', 'aZ09comma');
$page = GETPOSTISSET('pageplusone') ? (GETPOSTINT('pageplusone') - 1) : GETPOSTINT("page");
if (empty($page) || $page == -1) {
$page = 0;
} // If $page is not defined, or '' or -1
$offset = $limit * $page;
$pageprev = $page - 1;
$pagenext = $page + 1;
if (!$sortorder) {
$sortorder = "ASC";
}
if (!$sortfield) {
$sortfield = "name";
}
$ecmdir = new EcmDirectory($db);
if ($section > 0) {
$result = $ecmdir->fetch($section);
if (!($result > 0)) {
dol_print_error($db, $ecmdir->error);
exit;
}
}
$form = new Form($db);
$ecmdirstatic = new EcmDirectory($db);
$userstatic = new User($db);
$error = 0;
// Security check
if ($user->socid) {
$socid = $user->socid;
}
// Initialize a technical object to manage hooks of page. Note that conf->hooks_modules contains an array of hook context
$hookmanager->initHooks(array('ecmmediascard', 'globalcard'));
$result = restrictedArea($user, 'ecm', 0);
$permissiontoread = ($user->hasRight('ecm', 'read') || $user->hasRight('mailing', 'lire') || $user->hasRight('website', 'read'));
$permissiontouploadfile = ($user->hasRight('ecm', 'setup') || $user->hasRight('mailing', 'creer') || $user->hasRight('website', 'write'));
$permissiontoadd = $permissiontouploadfile; // Used by the include of actions_addupdatedelete.inc.php and actions_linkedfiles
$diroutput = $conf->medias->multidir_output[$conf->entity];
$relativepath = $section_dir;
$upload_dir = preg_replace('/\/$/', '', $diroutput).'/'.preg_replace('/^\//', '', $relativepath);
$websitekey = '';
/*
* Actions
*/
$savbacktopage = $backtopage;
// used after a confirm_deletefile into actions_linkedfiles.inc.php
$paramsbacktopage = array(
'file_manager' => 1,
'website' => (string) $websitekey,
'pageid' => (string) $pageid,
);
if (GETPOST('section_dir', 'alpha')) {
$paramsbacktopage['section_dir'] = GETPOST('section_dir', 'alpha');
}
if ($sortfield) {
$paramsbacktopage['sortfield'] = $sortfield;
}
if ($sortorder) {
$paramsbacktopage['sortorder'] = $sortorder;
}
$backtopage = dolBuildUrl($_SERVER["PHP_SELF"], $paramsbacktopage);
include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php'; // This manage 'sendit', 'confirm_deletefile', 'renamefile' action when submitting new file.
$backtopage = $savbacktopage;
if ($action == 'renamefile') { // Test on permission not required here. Must be after include DOL_DOCUMENT_ROOT.'/core/actions_linkedfiles.inc.php'; If action were renamefile, we set it to 'file_manager'
$action = 'file_manager';
}
// Add directory
if ($action == 'add' && $permissiontouploadfile) {
$ecmdir->ref = 'NOTUSEDYET';
$ecmdir->label = GETPOST("label");
$ecmdir->description = GETPOST("desc");
$id = $ecmdir->create($user);
if ($id > 0) {
header("Location: ".$_SERVER["PHP_SELF"]);
exit;
} else {
setEventMessages('Error '.$langs->trans($ecmdir->error), null, 'errors');
$action = "create";
}
clearstatcache();
}
// Remove directory
if ($action == 'confirm_deletesection' && GETPOST('confirm', 'alpha') == 'yes' && $permissiontoadd) {
$result = $ecmdir->delete($user);
setEventMessages($langs->trans("ECMSectionWasRemoved", $ecmdir->label), null, 'mesgs');
clearstatcache();
}
// Refresh directory view
// This refresh list of dirs, not list of files (for performance reason). List of files is refresh only if dir was not synchronized.
// To refresh content of dir with cache, just open the dir in edit mode.
if ($action == 'refreshmanual' && $permissiontoread) {
$ecmdirtmp = new EcmDirectory($db);
// This part of code is same than into file ecm/ajax/ecmdatabase.php TODO Remove duplicate
clearstatcache();
$diroutputslash = str_replace('\\', '/', $conf->ecm->dir_output);
$diroutputslash .= '/';
// Scan directory tree on disk
$disktree = dol_dir_list($conf->ecm->dir_output, 'directories', 1, '', '^temp$', '', 0, 0);
// Scan directory tree in database
$treesqldir = $ecmdirstatic->get_full_arbo(0);
$adirwascreated = 0;
// Now we compare both trees to complete missing trees into database
foreach ($disktree as $dirdesc) { // Loop on tree onto disk
$dirisindatabase = 0;
foreach ($treesqldir as $dirsqldesc) {
if ($conf->ecm->dir_output.'/'.$dirsqldesc['fullrelativename'] == $dirdesc['fullname']) {
$dirisindatabase = 1;
break;
}
}
if (!$dirisindatabase) {
$txt = "Directory found on disk ".$dirdesc['fullname'].", not found into database so we add it";
dol_syslog($txt);
// We must first find the fk_parent of directory to create $dirdesc['fullname']
$fk_parent = -1;
$relativepathmissing = str_replace($diroutputslash, '', $dirdesc['fullname']);
$relativepathtosearchparent = $relativepathmissing;
//dol_syslog("Try to find parent id for directory ".$relativepathtosearchparent);
if (preg_match('/\//', $relativepathtosearchparent)) {
//while (preg_match('/\//',$relativepathtosearchparent))
$relativepathtosearchparent = preg_replace('/\/[^\/]*$/', '', $relativepathtosearchparent);
$txt = "Is relative parent path ".$relativepathtosearchparent." for ".$relativepathmissing." found in sql tree ?";
dol_syslog($txt);
//print $txt." -> ";
$parentdirisindatabase = 0;
foreach ($treesqldir as $dirsqldesc) {
if ($dirsqldesc['fullrelativename'] == $relativepathtosearchparent) {
$parentdirisindatabase = $dirsqldesc['id'];
break;
}
}
if ($parentdirisindatabase > 0) {
dol_syslog("Yes with id ".$parentdirisindatabase);
//print "Yes with id ".$parentdirisindatabase."<br>\n";
$fk_parent = $parentdirisindatabase;
//break; // We found parent, we can stop the while loop
} else {
dol_syslog("No");
//print "No<br>\n";
}
} else {
dol_syslog("Parent is root");
$fk_parent = 0; // Parent is root
}
if ($fk_parent >= 0) {
$ecmdirtmp->ref = 'NOTUSEDYET';
$ecmdirtmp->label = dol_basename($dirdesc['fullname']);
$ecmdirtmp->description = '';
$ecmdirtmp->fk_parent = $fk_parent;
$txt = "We create directory ".$ecmdirtmp->label." with parent ".$fk_parent;
dol_syslog($txt);
//print $ecmdirtmp->cachenbofdoc."<br>\n";exit;
$id = $ecmdirtmp->create($user);
if ($id > 0) {
$newsqldir = [
'id' => $id,
'id_mere' => $ecmdirtmp->fk_parent,
'label' => $ecmdirtmp->label,
'description' => $ecmdirtmp->description,
'fullrelativename' => $relativepathmissing,
];
$treesqldir[] = $newsqldir; // We complete fulltree for following loops
$adirwascreated = 1;
} else {
dol_syslog("Failed to create directory ".$ecmdirtmp->label, LOG_ERR);
}
} else {
$txt = "Parent of ".$dirdesc['fullname']." not found";
dol_syslog($txt);
}
}
}
// Loop now on each sql tree to check if dir exists
foreach ($treesqldir as $dirdesc) { // Loop on each treesqldir to check dir is on disk
$dirtotest = $conf->ecm->dir_output.'/'.$dirdesc['fullrelativename'];
if (!dol_is_dir($dirtotest)) {
$ecmdirtmp->id = $dirdesc['id'];
$ecmdirtmp->delete($user, 'databaseonly');
//exit;
}
}
$sql = "UPDATE ".MAIN_DB_PREFIX."ecm_directories set cachenbofdoc = -1 WHERE cachenbofdoc < 0"; // If pb into cache counting, we set to value -1 = "unknown"
dol_syslog("sql = ".$sql);
$db->query($sql);
// If a directory was added, the fulltree array is not correctly completed and sorted, so we clean
// it to be sure that fulltree array is not used without reloading it.
if ($adirwascreated) {
$treesqldir = null;
}
}
/*
* View
*/
// Define height of file area (depends on $_SESSION["dol_screenheight"])
//print $_SESSION["dol_screenheight"];
$maxheightwin = (isset($_SESSION["dol_screenheight"]) && $_SESSION["dol_screenheight"] > 466) ? ($_SESSION["dol_screenheight"] - 136) : 660; // Also into index_auto.php file
$moreheadcss = '';
$moreheadjs = '';
$morejs=array();
if (!getDolGlobalString('MAIN_ECM_DISABLE_JS')) {
$morejs[] = "public/includes/jquery/plugins/jqueryFileTree/jqueryFileTree.js";
}
llxHeader($moreheadcss.$moreheadjs, $langs->trans("ECMArea"), '', '', 0, 0, $morejs, '', '', 'mod-ecm page-index_medias');
$head = ecm_prepare_dasboard_head();
print dol_get_fiche_head($head, 'index_medias', '', -1, '');
// Add filemanager component
$module = 'medias';
if (empty($url)) {
$url = DOL_URL_ROOT.'/ecm/index_medias.php'; // Must be an url without param
}
include DOL_DOCUMENT_ROOT.'/core/tpl/filemanager.tpl.php';
// End of page
print dol_get_fiche_end();
llxFooter();
$db->close();