diff --git a/htdocs/webservices/server_other.php b/htdocs/webservices/server_other.php index 64bc426d1443018af67bdb7bbfc3897fcb80a672..3578796838b06425e1a7b677cac6e3dcaa804623 100644 --- a/htdocs/webservices/server_other.php +++ b/htdocs/webservices/server_other.php @@ -27,7 +27,7 @@ require_once '../master.inc.php'; require_once NUSOAP_PATH.'/nusoap.php'; // Include SOAP require_once DOL_DOCUMENT_ROOT.'/core/lib/ws.lib.php'; require_once DOL_DOCUMENT_ROOT.'/user/class/user.class.php'; - +require_once DOL_DOCUMENT_ROOT.'/core/lib/files.lib.php'; require_once DOL_DOCUMENT_ROOT.'/core/lib/functions2.lib.php'; @@ -82,6 +82,21 @@ $server->wsdl->addComplexType( ) ); +// Define WSDL Return object for document +$server->wsdl->addComplexType( + 'document', + 'complexType', + 'struct', + 'all', + '', + array( + 'filename' => array('name'=>'filename','type'=>'xsd:string'), + 'mimetype' => array('name'=>'mimetype','type'=>'xsd:string'), + 'content' => array('name'=>'content','type'=>'xsd:string'), + 'length' => array('name'=>'length','type'=>'xsd:string') + ) +); + // Define other specific objects // None @@ -107,6 +122,20 @@ $server->register( 'WS to get Versions' ); +// Register WSDL +$server->register( + 'getDocument', + // Entry values + array('authentication'=>'tns:authentication', 'modulepart'=>'xsd:string', 'file'=>'xsd:string' ), + // Exit values + array('result'=>'tns:result','document'=>'tns:document'), + $ns, + $ns.'#getDocument', + $styledoc, + $styleuse, + 'WS to get document' +); + // Full methods code @@ -144,6 +173,187 @@ function getVersions($authentication) } +/* + * Method to get a document by webservice +* \param authentication array +* \param modulepart array Properties of document +* +*/ +function getDocument($authentication, $modulepart, $file) +{ + global $db,$conf,$langs,$mysoc; + + dol_syslog("Function: getDocument login=".$authentication['login'].' - modulepart='.$modulepart.' - file='.$file); + + if ($authentication['entity']) $conf->entity=$authentication['entity']; + + $objectresp=array(); + $errorcode='';$errorlabel=''; + $error=0; + + // Properties of doc + $original_file = $file; + $type=dol_mimetype($original_file); + $relativefilepath = $ref . "/"; + $relativepath = $relativefilepath . $ref.'.pdf'; + + $accessallowed=0; + + $fuser=check_authentication($authentication,$error,$errorcode,$errorlabel); + + if ($fuser->societe_id) $socid=$fuser->societe_id; + + // Check parameters + if (! $error && ( ! $file || ! $modulepart ) ) + { + $error++; + $errorcode='BAD_PARAMETERS'; $errorlabel="Parameter file and modulepart must be both provided."; + } + + if (! $error) + { + $fuser->getrights(); + + // Suppression de la chaine de caractere ../ dans $original_file + $original_file = str_replace("../","/", $original_file); + + // find the subdirectory name as the reference + $refname=basename(dirname($original_file)."/"); + + // Wrapping for invoices + if ($modulepart == 'facture') + { + if ($fuser->rights->facture->lire || preg_match('/^specimen/i',$original_file)) + { + $accessallowed=1; + } + $original_file = $conf->facture->dir_output.'/'.$original_file; + $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."facture WHERE ref='".$refname."' AND entity=".$conf->entity; + } + // Wrapping pour les propales + else if ($modulepart == 'propal') + { + if ($fuser->rights->propal->lire || preg_match('/^specimen/i',$original_file)) + { + $accessallowed=1; + } + $original_file = $conf->propal->dir_output.'/'.$original_file; + $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."propal WHERE ref='".$refname."' AND entity=".$conf->entity; + } + + // Wrapping pour les commandes + else if ($modulepart == 'commande') + { + if ($fuser->rights->commande->lire || preg_match('/^specimen/i',$original_file)) + { + $accessallowed=1; + } + $original_file=$conf->commande->dir_output.'/'.$original_file; + $sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."commande WHERE ref='".$refname."' AND entity=".$conf->entity; + } + // Wrapping pour generic module + else + { + if ($fuser->rights->$modulepart->read || preg_match('/^specimen/i',$original_file)) + { + $accessallowed=1; + } + $original_file=$conf->$modulepart->dir_output.'/'.$original_file; + // TODO + //$sqlprotectagainstexternals = "SELECT fk_soc as fk_soc FROM ".MAIN_DB_PREFIX."registration WHERE ref='".$refname."' AND entity=".$conf->entity; + } + + // Basic protection (against external users only) + if ($fuser->societe_id > 0) + { + if ($sqlprotectagainstexternals) + { + $resql = $db->query($sqlprotectagainstexternals); + if ($resql) + { + $num=$db->num_rows($resql); + $i=0; + while ($i < $num) + { + $obj = $db->fetch_object($resql); + if ($fuser->societe_id != $obj->fk_soc) + { + $accessallowed=0; + break; + } + $i++; + } + } + } + } + + // Security: + // Limite acces si droits non corrects + if (! $accessallowed) + { + $errorcode='NOT_PERMITTED'; + $errorlabel='Access not allowed'; + $error++; + } + + // Security: + // On interdit les remontees de repertoire ainsi que les pipe dans + // les noms de fichiers. + if (preg_match('/\.\./',$original_file) || preg_match('/[<>|]/',$original_file)) + { + dol_syslog("Refused to deliver file ".$original_file); + $errorcode='REFUSED'; + $errorlabel=''; + $error++; + } + + clearstatcache(); + + if(!$error) + { + if(file_exists($original_file)) + { + dol_syslog("Function: getDocument $original_file $filename content-type=$type"); + + $file=$fileparams['fullname']; + $filename = basename($file); + + $f = fopen($original_file,'r'); + $content_file = fread($f,filesize($original_file)); + + $objectret = array( + 'filename' => basename($original_file), + 'mimetype' => dol_mimetype($original_file), + 'content' => base64_encode($content_file), + 'length' => filesize($original_file) + ); + + // Create return object + $objectresp = array( + 'result'=>array('result_code'=>'OK', 'result_label'=>''), + 'document'=>$objectret + ); + } + else + { + dol_syslog("File doesn't exist ".$original_file); + $errorcode='NOT_FOUND'; + $errorlabel=''; + $error++; + } + } + } + + if ($error) + { + $objectresp = array( + 'result'=>array('result_code' => $errorcode, 'result_label' => $errorlabel) + ); + } + + return $objectresp; +} + // Return the results. $server->service($HTTP_RAW_POST_DATA);