use C4::UploadedFiles;

package C4::UploadedFiles;

# Copyright 2011-2012 BibLibre

#

# This file is part of Koha.

#

# Koha is free software; you can redistribute it and/or modify it under the

# terms of the GNU General Public License as published by the Free Software

# Foundation; either version 2 of the License, or (at your option) any later

# version.

#

# Koha is distributed in the hope that it will be useful, but WITHOUT ANY

# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR

# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License along

# with Koha; if not, write to the Free Software Foundation, Inc.,

# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

=head1 NAME

C4::UploadedFiles - Functions to deal with files uploaded with cataloging plugin upload.pl

=head1 SYNOPSIS

    use C4::UploadedFiles;

    my $filename = $cgi->param('uploaded_file');

    my $file = $cgi->upload('uploaded_file');

    my $dir = $input->param('dir');

    # upload file

    my $id = C4::UploadedFiles::UploadFile($filename, $dir, $file->handle);

    # retrieve file infos

    my $uploaded_file = C4::UploadedFiles::GetUploadedFile($id);

    # delete file

    C4::UploadedFiles::DelUploadedFile($id);

=head1 DESCRIPTION

This module provides basic functions for adding, retrieving and deleting files related to

cataloging plugin upload.pl.

It uses uploaded_files table.

It is not related to C4::UploadedFile

=head1 FUNCTIONS

=cut

use Modern::Perl;

use Digest::SHA;

use Fcntl;

use C4::Context;

=head2 GetUploadedFile

    my $file = C4::UploadedFiles::GetUploadedFile($id);

Returns a hashref containing infos on uploaded files.

Hash keys are:

=over 2

=item * id: id of the file (same as given in argument)

=item * filename: name of the file

=item * dir: directory where file is stored (relative to syspref 'uploadPath')

=back

It returns undef if file is not found

=cut

sub GetUploadedFile {

    my ($id) = @_;

    return unless $id;

    my $dbh = C4::Context->dbh;

    my $query = qq{

        SELECT id, filename, dir

        FROM uploaded_files

        WHERE id = ?

    };

    my $sth = $dbh->prepare($query);

    $sth->execute($id);

    my $file = $sth->fetchrow_hashref;

    return $file;

}

=head2 UploadFile

    my $id = C4::UploadedFiles::UploadFile($filename, $dir, $io_handle);

Upload a new file and returns its id (its SHA-1 sum, actually).

Parameters:

=over 2

=item * $filename: name of the file

=item * $dir: directory where to store the file (path relative to syspref 'uploadPath'

=item * $io_handle: valid IO::Handle object, can be retrieved with

$cgi->upload('uploaded_file')->handle;

=back

=cut

sub UploadFile {

    my ($filename, $dir, $handle) = @_;

    if($filename =~ m#/(^|/)\.\.(/|$)# or $dir =~ m#(^|/)\.\.(/|$)#) {

        warn "Filename or dirname contains '..'. Aborting upload";

        return;

    }

    my $buffer;

    my $data = '';

    while($handle->read($buffer, 1024)) {

        $data .= $buffer;

    }

    $handle->close;

    my $sha = new Digest::SHA;

    $sha->add($data);

    my $id = $sha->hexdigest;

    # Test if this id already exist

    my $file = GetUploadedFile($id);

    if($file) {

        return $file->{id};

    }

    my $upload_path = C4::Context->preference("uploadPath");

    my $file_path = "$upload_path/$dir/$filename";

    $file_path =~ s#/+#/#;

    my $out_fh;

    # Create the file only if it doesn't exist

    unless( sysopen($out_fh, $file_path, O_WRONLY|O_CREAT|O_EXCL) ) {

        warn "Failed to open file '$file_path': $!";

        return;

    }

    print $out_fh $data;

    close $out_fh;

    my $dbh = C4::Context->dbh;

    my $query = qq{

        INSERT INTO uploaded_files (id, filename, dir)

        VALUES (?,?, ?);

    };

    my $sth = $dbh->prepare($query);

    if($sth->execute($id, $filename, $dir)) {

        return $id;

    }

    return undef;

}

=head2 DelUploadedFile

    C4::UploadedFiles::DelUploadedFile($id);

Remove a previously uploaded file, given its id.

Returns a false value if an error occurs.

=cut

sub DelUploadedFile {

    my ($id) = @_;

    my $file = GetUploadedFile($id);

    if($file) {

        my $upload_path = C4::Context->preference("uploadPath");

        my $file_path = "$upload_path/$file->{dir}/$file->{filename}";

        $file_path =~ s#/+#/#;

        my $file_deleted = 0;

        unless( -f $file_path ) {

            warn "Id $file->{id} is in database but not in filesystem, removing id from database";

            $file_deleted = 1;

        } else {

            if(unlink $file_path) {

                $file_deleted = 1;

            }

        }

        unless($file_deleted) {

            warn "File $file_path cannot be deleted: $!";

        }

        my $dbh = C4::Context->dbh;

        my $query = qq{

            DELETE FROM uploaded_files

            WHERE id = ?

        };

        my $sth = $dbh->prepare($query);

        return $sth->execute($id);

    }

}

1;

#!/usr/bin/perl

# Copyright 2011-2012 BibLibre

#

# This file is part of Koha.

#

# Koha is free software; you can redistribute it and/or modify it under the

# terms of the GNU General Public License as published by the Free Software

# Foundation; either version 2 of the License, or (at your option) any later

# version.

#

# Koha is distributed in the hope that it will be useful, but WITHOUT ANY

# WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR

# A PARTICULAR PURPOSE.  See the GNU General Public License for more details.

#

# You should have received a copy of the GNU General Public License along

# with Koha; if not, write to the Free Software Foundation, Inc.,

# 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.

use Modern::Perl;

use CGI qw/-utf8/;

use File::Basename;

use C4::Auth;

use C4::Context;

use C4::Output;

use C4::UploadedFiles;

my $upload_path = C4::Context->preference('uploadPath');

sub plugin_parameters {

    my ( $dbh, $record, $tagslib, $i, $tabloop ) = @_;

    return "";

}

sub plugin_javascript {

    my ( $dbh, $record, $tagslib, $field_number, $tabloop ) = @_;

    my $function_name = $field_number;

    my $res           = "

    <script type=\"text/javascript\">

        function Focus$function_name(subfield_managed) {

            return 1;

        }

        function Blur$function_name(subfield_managed) {

            return 1;

        }

        function Clic$function_name(index) {

            var id = document.getElementById(index).value;

            if(id.match(/id=([0-9a-f]+)/)){

                id = RegExp.\$1;

            }

            window.open(\"../cataloguing/plugin_launcher.pl?plugin_name=upload.pl&index=\"+index+\"&id=\"+id, 'upload', 'width=600,height=400,toolbar=false,scrollbars=no');

        }

    </script>

";

    return ( $function_name, $res );

}

sub plugin {

    my ($input) = @_;

    my $index = $input->param('index');

    my $id = $input->param('id');

    my $delete = $input->param('delete');

    my $uploaded_file = $input->param('uploaded_file');

    my $template_name = ($id || $delete)

                    ? "upload_delete_file.tt"

                    : "upload.tt";

    my ( $template, $loggedinuser, $cookie ) = get_template_and_user(

        {   template_name   => "cataloguing/value_builder/$template_name",

            query           => $input,

            type            => "intranet",

            authnotrequired => 0,

            flagsrequired   => { editcatalogue => '*' },

            debug           => 1,

        }

    );

    # Dealing with the uploaded file

    if ($uploaded_file) {

        my $fh = $input->upload('uploaded_file');

        my $dir = $input->param('dir');

        $id = C4::UploadedFiles::UploadFile($uploaded_file, $dir, $fh->handle);

        if($id) {

            my $OPACBaseURL = C4::Context->preference('OPACBaseURL');

            $OPACBaseURL =~ s#/$##;

            my $return = "$OPACBaseURL/cgi-bin/koha/opac-retrieve-file.pl?id=$id";

            $template->param(

                success => 1,

                return => $return,

                uploaded_file => $uploaded_file,

            );

        } else {

            $template->param(error => 1);

        }

    } elsif ($delete || $id) {

        # If there's already a file uploaded for this field,

        # We handle its deletion

        if ($delete) {

            if(C4::UploadedFiles::DelUploadedFile($id)) {;

                $template->param(success => 1);

            } else {

                $template->param(error => 1);

            }

        }

    } else {

        my $filefield = CGI::filefield(

            -name => 'uploaded_file',

            -size => 50,

        );

        my $dirs_tree = [ {

            name => '/',

            value => '/',

            dirs => finddirs($upload_path)

        } ];

        $template->param(

            dirs_tree => $dirs_tree,

            filefield => $filefield

        );

    }

    $template->param(

        index => $index,

        id => $id

    );

    output_html_with_http_headers $input, $cookie, $template->output;

}

# Build a hierarchy of directories

sub finddirs {

    my $base = shift || $upload_path;

    my $found = 0;

    my @dirs;

    my @files = <$base/*>;

    foreach (@files) {

        if (-d $_ and -w $_) {

            my $lastdirname = basename($_);

            my $dirname =  $_;

            $dirname =~ s/^$upload_path//g;

            push @dirs, {

                value => $dirname,

                name => $lastdirname,

                dirs => finddirs($_)

            };

            $found = 1;

        };

    }

    return \@dirs;

}

1;

__END__

=head1 upload.pl

This plugin allow to upload files on the server and reference it in a marc

field.

Two system preference are used:

=over 4

=item * uploadPath: the real absolute path where files will be stored

=item * OPACBaseURL: for building URLs to be stored in MARC

=back

--

-- Table structure for table uploaded_files

--

DROP TABLE IF EXISTS uploaded_files

CREATE TABLE uploaded_files (

    id CHAR(40) NOT NULL PRIMARY KEY,

    filename TEXT NOT NULL,

    dir TEXT NOT NULL

) ENGINE=InnoDB DEFAULT CHARSET=utf8;

INSERT INTO systempreferences (variable,value,explanation,options,type) VALUES ('uploadPath','','Sets the upload path for the upload.pl plugin. For security reasons, the upload path MUST NOT be a public, webserver accessible directory.','','');

$DBversion = "XXX";

if ( C4::Context->preference("Version") < TransformToNum($DBversion) ) {

    $dbh->do("

        INSERT IGNORE INTO systempreferences (variable,value,explanation,options,type)

        VALUES('uploadPath','','Sets the upload path for the upload.pl plugin','','');

    ");

    $dbh->do("

        CREATE TABLE uploaded_files (

            id CHAR(40) NOT NULL PRIMARY KEY,

            filename TEXT NOT NULL,

            dir TEXT NOT NULL

        ) ENGINE=InnoDB DEFAULT CHARSET=utf8;

    ");

    print "Upgrade to $DBversion done (New cataloging plugin upload.pl)\n";

    print "This plugin comes with a new syspref (uploadPath) and a new table (uploaded_files)\n";

    print "To use it, set 'uploadPath' and 'OPACBaseURL' system preferences and link this plugin to a subfield (856\$u for instance)\n";

    SetVersion($DBversion);

}

        -

            - Absolute path where to store files uploaded in MARC record (plugin upload.pl)

            - pref: uploadPath

              class: multi

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

    <title>Upload plugin</title>

    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

    <script type="text/javascript" src="[% themelang %]/lib/jquery/jquery.js"></script>

    <link rel="stylesheet" type="text/css" href="[% themelang %]/css/staff-global.css" />

</head>

<body>

[% IF ( success ) %]

    <script type="text/javascript">

        function report() {

            var doc   = opener.document;

            var field = doc.getElementById("[% index %]");

            field.value =  "[% return %]";

        }

        $(document).ready(function() {

            report();

        });

    </script>

    The file [% uploaded_file | html %] has been successfully uploaded.

    <p><input type="button" value="close" onclick="window.close();" /></p>

[% ELSE %]

    [% IF ( error ) %]

        <p>Error: Failed to upload file. See logs for details.</p>

        <input type="button" value="close" onclick="window.close();" />

    [% ELSE %]

        [%# This block display recursively a directory tree in variable 'dirs' %]

        [% BLOCK list_dirs %]

            [% IF dirs.size %]

                <ul>

                    [% FOREACH dir IN dirs %]

                        <li style="list-style-type:none">

                            <input type="radio" name="dir" id="[% dir.value %]" value="[% dir.value %]">

                                <label for="[% dir.value %]">

                                    [% IF (dir.name == '/') %]

                                        <em>(root)</em>

                                    [% ELSE %]

                                        [% dir.name %]

                                    [% END %]

                                </label>

                            </input>

                            [% INCLUDE list_dirs dirs=dir.dirs %]

                        </li>

                    [% END %]

                </ul>

            [% END %]

        [% END %]

        <h2>Please select the file to upload : </h2>

        <form method="post" enctype="multipart/form-data" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl">

            [% filefield %]

            <h3>Choose where to upload file</h3>

            [% INCLUDE list_dirs dirs = dirs_tree %]

            <input type="hidden" name="plugin_name" value="upload.pl" />

            <input type="hidden" name="index" value="[% index %]" />

            <input type="submit">

        </form>

    [% END %]

[% END %]

</body>

</html>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

    "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

    <title>Upload plugin</title>

    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

    <script type="text/javascript" src="[% themelang %]/lib/jquery/jquery.js"></script>

    <link rel="stylesheet" type="text/css" href="[% themelang %]/css/staff-global.css" />

</head>

<body>

[% IF ( success ) %]

    <script type="text/javascript">

        function report() {

            var doc   = opener.document;

            var field = doc.getElementById("[% index %]");

            field.value =  "";

        }

        $(document).ready(function() {

            report();

        });

    </script>

    The file has been successfully deleted.

    <p><input type="button" value="close" onclick="window.close();" /></p>

[% ELSE %]

    [% IF ( error ) %]

        Error: Unable to delete the file.

        <p><input type="button" value="close" onclick="window.close();" /></p>

    [% ELSE %]

        <h2>File deletion</h2>

        <p>A file has already been uploaded for this field. Do you want to delete it?</p>

        <form method="post" action="/cgi-bin/koha/cataloguing/plugin_launcher.pl">

        <input type="hidden" name="plugin_name" value="upload.pl" />

        <input type="hidden" name="delete" value="delete" />

        <input type="hidden" name="id" value="[% id %]" />

        <input type="hidden" name="index" value="[% index %]" />

        <input type="button" value="Cancel" onclick="javascript:window.close();" />

        <input type="submit" value="Delete" />

        </form>

    [% END %]

[% END %]

</body>

</html>