edithtml.php

<?php
/**
 * Licensed to The Apereo Foundation under one or more contributor license
 * agreements. See the NOTICE file distributed with this work for
 * additional information regarding copyright ownership.

 * The Apereo Foundation licenses this file to you under the Apache License,
 * Version 2.0 (the "License"); you may not use this file except in
 * compliance with the License. You may obtain a copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 * 
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
 
/**
 *
 * Edit page, brings up the xerte editor window
 *
 * @author Patrick Lockley
 * @version 1.0
 * @package
 */

require_once(dirname(__FILE__) . "/config.php");

require $xerte_toolkits_site->php_library_path . "screen_size_library.php";
require $xerte_toolkits_site->php_library_path . "template_status.php";
require $xerte_toolkits_site->php_library_path . "display_library.php";
require $xerte_toolkits_site->php_library_path . "user_library.php";
require $xerte_toolkits_site->php_library_path . "template_library.php";

/**
 * Function update_access_time
 * This function updates the time a template was last edited
 * @param array $row_edit = an array returned from a mysql query
 * @return bool True or False if two params match
 * @version 1.0
 * @author Patrick Lockley
 */
function update_access_time($row_edit){
    global $xerte_toolkits_site;
    /* This function is called even if the template is new - in which case it fails as a record doesn't exist */
    db_query("UPDATE {$xerte_toolkits_site->database_table_prefix}templatedetails SET date_accessed=? WHERE template_id = ?", array(date('Y-m-d H:i:s'), $row_edit['template_id']));
    return true;
}


/*
 * Check the template ID is numeric
 */

if(!isset($_GET['template_id']) || !is_numeric($_GET['template_id'])) {
    _debug("Template id is not numeric. ->" . $_GET['template_id']);
    dont_show_template();
    exit(0);
}

/*
 * Find out if this user has rights to the template
 */

$safe_template_id = (int) $_GET['template_id'];

//$query_for_edit_content_strip = str_replace("\" . \$xerte_toolkits_site->database_table_prefix . \"", $xerte_toolkits_site->database_table_prefix, $xerte_toolkits_site->play_edit_preview_query);

$query_for_edit_content = "select " . $xerte_toolkits_site->database_table_prefix . "originaltemplatesdetails.template_name, " . $xerte_toolkits_site->database_table_prefix . "originaltemplatesdetails.parent_template, " . $xerte_toolkits_site->database_table_prefix . "logindetails.username, " . $xerte_toolkits_site->database_table_prefix . "originaltemplatesdetails.template_framework, " . $xerte_toolkits_site->database_table_prefix . "templaterights.user_id, " . $xerte_toolkits_site->database_table_prefix . "templaterights.folder, " . $xerte_toolkits_site->database_table_prefix . "templaterights.template_id, " . $xerte_toolkits_site->database_table_prefix . "templatedetails.access_to_whom from " . $xerte_toolkits_site->database_table_prefix . "originaltemplatesdetails, " . $xerte_toolkits_site->database_table_prefix . "templaterights, " . $xerte_toolkits_site->database_table_prefix . "templatedetails, " . $xerte_toolkits_site->database_table_prefix . "logindetails where " . $xerte_toolkits_site->database_table_prefix . "templatedetails.template_type_id = " . $xerte_toolkits_site->database_table_prefix . "originaltemplatesdetails.template_type_id and " . $xerte_toolkits_site->database_table_prefix . "templatedetails.creator_id = " . $xerte_toolkits_site->database_table_prefix . "logindetails.login_id and " . $xerte_toolkits_site->database_table_prefix . "templaterights.template_id = " . $xerte_toolkits_site->database_table_prefix . "templatedetails.template_id and " . $xerte_toolkits_site->database_table_prefix . "templaterights.template_id=? and role='creator'";

$row_edit = db_query_one($query_for_edit_content, array($safe_template_id));

if(empty($row_edit)) {
    die("Invalid template_id (could not find in DB)");
}

if(isset($_SESSION['toolkits_logon_id'])){

	if(has_rights_to_this_template($safe_template_id,$_SESSION['toolkits_logon_id'])){

		// Check if user is editor (could be read only)

		if(is_user_an_editor($safe_template_id,$_SESSION['toolkits_logon_id'])){

			// Check for multiple editors
			//if(has_template_multiple_editors($safe_template_id)){

				// Check for lock file. A lock file is created to prevent more than one editor editing the same template at the same time
				if(file_exists($xerte_toolkits_site->users_file_area_full . $row_edit['template_id'] . "-" . $row_edit['username'] . "-" . $row_edit['template_name'] . "/lockfile.txt")){

					// Lock file exists, so open it up and see who created it
					$lock_file_data = file_get_contents($xerte_toolkits_site->users_file_area_full . $row_edit['template_id'] . "-" . $row_edit['username'] . "-" . $row_edit['template_name'] . "/lockfile.txt");

					$temp = explode("*", $lock_file_data);

					$lock_file_creator = $temp[0];

					// get username only
					$temp = explode(" ", $lock_file_creator);
					$lock_file_creator_username = $temp[0];

					/*
					 * Check if lock file creator is current user, if so, continue into the code
					 */

					//if($lock_file_creator_username==$_SESSION['toolkits_logon_username']) {
					//	if(update_access_time($row_edit)) {
					//		// Display the editor
					//		require $xerte_toolkits_site->root_file_path . "modules/" . $row_edit['template_framework'] . "/edithtml.php";
					//		output_editor_code($row_edit, $xerte_toolkits_site, "true", true);
					//	}
					//	else {
					//		// show error
					//		error_show_template();
					//		exit(0);
					//	}
					//}
					//else {
						if(isset($_POST['lockfile_clear'])) {

							/*
							 * Modify the lockfile to just the user entry
							 */

							$file_handle = fopen($xerte_toolkits_site->users_file_area_full . $row_edit['template_id'] . "-" . $row_edit['username'] . "-" . $row_edit['template_name'] . "/lockfile.txt", 'w');

							fwrite($file_handle, $_SESSION['toolkits_logon_username'] . " (" . date("Y-m-d H:i:s") . ")*");

							fclose($file_handle);

							/*
							 * Update the time this template was last edited
							 */

							if(update_access_time($row_edit)){

								require $xerte_toolkits_site->root_file_path . "modules/" . $row_edit['template_framework'] . "/edithtml.php";
								output_editor_code($row_edit, $xerte_toolkits_site, "true", true);
							}
							else {
								error_show_template();
								exit(0);
							}
						}
						else {

							// Update the lock file. The lock file format is: creator_id (date/time)*[user_id (date/time),...]
							// where 'user_id' are users who tried to edit the template when it was already being edited
							$new_lock_file = $lock_file_data . $_SESSION['toolkits_logon_username'] . " (" . date("Y-m-d H:i:s") . "),";
							$file_handle = fopen($xerte_toolkits_site->users_file_area_full . $row_edit['template_id'] . "-" . $row_edit['username'] . "-" . $row_edit['template_name'] . "/lockfile.txt",'w');
							fwrite($file_handle, $new_lock_file);
							fclose($file_handle);
							output_locked_file_code($lock_file_creator);
						}
					//}
				}
				else {

					// No lock file, so create one
					$file_handle = fopen($xerte_toolkits_site->users_file_area_full . $row_edit['template_id'] . "-" . $row_edit['username'] . "-" . $row_edit['template_name'] . "/lockfile.txt", 'w');
					fwrite($file_handle, $_SESSION['toolkits_logon_username'] . " (" . date("Y-m-d H:i:s") . ")*");
					fclose($file_handle);

					// Update the time this template was last edited
					if(update_access_time($row_edit)){
						require $xerte_toolkits_site->root_file_path . "modules/" . $row_edit['template_framework'] . "/edithtml.php";
						output_editor_code($row_edit, $xerte_toolkits_site, "true", true);
					}else{
						error_show_template();
						exit(0);
					}

				}

			//}
			//else {
			//	// One editor (but shared) for this project, so continue without creating a lock file
			//	if(update_access_time($row_edit)){
			//		require $xerte_toolkits_site->root_file_path . "modules/" . $row_edit['template_framework'] . "/edithtml.php";
			//		output_editor_code($row_edit, $xerte_toolkits_site, "true", false);
			//	}
			//	else {
			//		error_show_template();
			//		exit(0);
			//	}
			//}
		}
		else {
			// Read-only access!
			die("Access denied, you have no editing rights to this object.");
		}
	}
	else if(is_user_permitted("projectadmin")) {
		// Is the current user an administrator - If so access here.
		require $xerte_toolkits_site->root_file_path . "modules/" . $row_edit['template_framework'] . "/edithtml.php";
		output_editor_code($row_edit, $xerte_toolkits_site, "false", false);
	}
	else {
		// Wiki mode - check to see if template allows anonymous editing.

		$string_for_flash_xml = $xerte_toolkits_site->users_file_area_short . $row_edit['template_id'] . "-" . $row_edit['username'] . "-" . $row_edit['template_name'] . "/data.xml";
		$buffer = file_get_contents($string_for_flash_xml);
		if(strpos($buffer,"editable=true")==false){
			die("Permission denied");
		}else{
			// Wiki mode set
			require $xerte_toolkits_site->root_file_path . "modules/" . $row_edit['template_framework'] . "/edithtml.php";
			output_editor_code($row_edit, $xerte_toolkits_site, "true", false);
		}
	}

}else{
	die("Session ID not set");
}