2 if(!defined('sugarEntry') || !sugarEntry) die('Not A Valid Entry Point');
3 /*********************************************************************************
4 * SugarCRM Community Edition is a customer relationship management program developed by
5 * SugarCRM, Inc. Copyright (C) 2004-2012 SugarCRM Inc.
7 * This program is free software; you can redistribute it and/or modify it under
8 * the terms of the GNU Affero General Public License version 3 as published by the
9 * Free Software Foundation with the addition of the following permission added
10 * to Section 15 as permitted in Section 7(a): FOR ANY PART OF THE COVERED WORK
11 * IN WHICH THE COPYRIGHT IS OWNED BY SUGARCRM, SUGARCRM DISCLAIMS THE WARRANTY
12 * OF NON INFRINGEMENT OF THIRD PARTY RIGHTS.
14 * This program is distributed in the hope that it will be useful, but WITHOUT
15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
16 * FOR A PARTICULAR PURPOSE. See the GNU Affero General Public License for more
19 * You should have received a copy of the GNU Affero General Public License along with
20 * this program; if not, see http://www.gnu.org/licenses or write to the Free
21 * Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA
24 * You can contact SugarCRM, Inc. headquarters at 10050 North Wolfe Road,
25 * SW2-130, Cupertino, CA 95014, USA. or at email address contact@sugarcrm.com.
27 * The interactive user interfaces in modified source and object code versions
28 * of this program must display Appropriate Legal Notices, as required under
29 * Section 5 of the GNU Affero General Public License version 3.
31 * In accordance with Section 7(b) of the GNU Affero General Public License version 3,
32 * these Appropriate Legal Notices must retain the display of the "Powered by
33 * SugarCRM" logo. If the display of the logo is not reasonably feasible for
34 * technical reasons, the Appropriate Legal Notices must display the words
35 * "Powered by SugarCRM".
36 ********************************************************************************/
41 if(empty($_REQUEST['id']) || empty($_REQUEST['type']) || !isset($_SESSION['authenticated_user_id'])) {
42 die("Not a Valid Entry Point");
45 require_once("data/BeanFactory.php");
46 $file_type=''; // bug 45896
47 require_once("data/BeanFactory.php");
48 ini_set('zlib.output_compression','Off');//bug 27089, if use gzip here, the Content-Length in hearder may be incorrect.
49 // cn: bug 8753: current_user's preferred export charset not being honored
50 $GLOBALS['current_user']->retrieve($_SESSION['authenticated_user_id']);
51 $GLOBALS['current_language'] = $_SESSION['authenticated_user_language'];
52 $app_strings = return_application_language($GLOBALS['current_language']);
53 $mod_strings = return_module_language($GLOBALS['current_language'], 'ACL');
54 $file_type = strtolower($_REQUEST['type']);
55 if(!isset($_REQUEST['isTempFile'])) {
56 //Custom modules may have capilizations anywhere in thier names. We should check the passed in format first.
57 require('include/modules.php');
58 $module = $db->quote($_REQUEST['type']);
59 if(empty($beanList[$module])) {
60 //start guessing at a module name
61 $module = ucfirst($file_type);
62 if(empty($beanList[$module])) {
63 die($app_strings['ERROR_TYPE_NOT_VALID']);
66 $bean_name = $beanList[$module];
67 if(!file_exists('modules/' . $module . '/' . $bean_name . '.php')) {
68 die($app_strings['ERROR_TYPE_NOT_VALID']);
71 $focus = BeanFactory::newBean($module);
72 if(!$focus->ACLAccess('view')){
73 die($mod_strings['LBL_NO_ACCESS']);
75 $focus->retrieve($_REQUEST['id']);
76 // Pull up the document revision, if it's of type Document
77 if ( isset($focus->object_name) && $focus->object_name == 'Document' ) {
78 // It's a document, get the revision that really stores this file
79 $focusRevision = new DocumentRevision();
80 $focusRevision->retrieve($_REQUEST['id']);
82 if ( empty($focusRevision->id) ) {
83 // This wasn't a document revision id, it's probably actually a document id,
84 // we need to grab the latest revision and use that
85 $focusRevision->retrieve($focus->document_revision_id);
87 if ( !empty($focusRevision->id) ) {
88 $_REQUEST['id'] = $focusRevision->id;
93 // See if it is a remote file, if so, send them that direction
94 if ( isset($focus->doc_url) && !empty($focus->doc_url) ) {
95 header('Location: '.$focus->doc_url);
99 if ( isset($focusRevision) && isset($focusRevision->doc_url) && !empty($focusRevision->doc_url) ) {
100 header('Location: '.$focusRevision->doc_url);
106 if(isset($_REQUEST['ieId']) && isset($_REQUEST['isTempFile'])) {
107 $local_location = sugar_cached("modules/Emails/{$_REQUEST['ieId']}/attachments/{$_REQUEST['id']}");
108 } elseif(isset($_REQUEST['isTempFile']) && $file_type == "import") {
109 $local_location = "upload://import/{$_REQUEST['tempName']}";
111 $local_location = "upload://{$_REQUEST['id']}";
114 if(isset($_REQUEST['isTempFile']) && ($_REQUEST['type']=="SugarFieldImage")) {
115 $local_location = "upload://{$_REQUEST['id']}";
118 if(!file_exists( $local_location ) || strpos($local_location, "..")) {
119 die($app_strings['ERR_INVALID_FILE_REFERENCE']);
123 if($file_type == 'documents') {
124 // cn: bug 9674 document_revisions table has no 'name' column.
125 $query = "SELECT filename name FROM document_revisions INNER JOIN documents ON documents.id = document_revisions.document_id ";
126 $query .= "WHERE document_revisions.id = '".$db->quote($_REQUEST['id'])."' ";
127 } elseif($file_type == 'kbdocuments') {
128 $query="SELECT document_revisions.filename name FROM document_revisions INNER JOIN kbdocument_revisions ON document_revisions.id = kbdocument_revisions.document_revision_id INNER JOIN kbdocuments ON kbdocument_revisions.kbdocument_id = kbdocuments.id ";
129 $query .= "WHERE document_revisions.id = '" . $db->quote($_REQUEST['id']) ."'";
130 } elseif($file_type == 'notes') {
131 $query = "SELECT filename name FROM notes ";
132 $query .= "WHERE notes.id = '" . $db->quote($_REQUEST['id']) ."'";
133 } elseif( !isset($_REQUEST['isTempFile']) && !isset($_REQUEST['tempName'] ) && isset($_REQUEST['type']) && $file_type!='temp' ){ //make sure not email temp file.
134 $query = "SELECT filename name FROM ". $file_type ." ";
135 $query .= "WHERE ". $file_type .".id= '".$db->quote($_REQUEST['id'])."'";
136 }elseif( $file_type == 'temp'){
140 if($doQuery && isset($query)) {
141 $rs = $GLOBALS['db']->query($query);
142 $row = $GLOBALS['db']->fetchByAssoc($rs);
145 die($app_strings['ERROR_NO_RECORD']);
147 $name = $row['name'];
148 $download_location = "upload://{$_REQUEST['id']}";
149 } else if(isset( $_REQUEST['tempName'] ) && isset($_REQUEST['isTempFile']) ){
150 // downloading a temp file (email 2.0)
151 $download_location = $local_location;
152 $name = isset($_REQUEST['tempName'])?$_REQUEST['tempName']:'';
153 } else if(isset($_REQUEST['isTempFile']) && ($_REQUEST['type']=="SugarFieldImage")) {
154 $download_location = $local_location;
155 $name = isset($_REQUEST['tempName'])?$_REQUEST['tempName']:'';
158 if(isset($_SERVER['HTTP_USER_AGENT']) && preg_match("/MSIE/", $_SERVER['HTTP_USER_AGENT']))
160 $name = urlencode($name);
161 $name = str_replace("+", "_", $name);
164 header("Pragma: public");
165 header("Cache-Control: maxage=1, post-check=0, pre-check=0");
166 if(isset($_REQUEST['isTempFile']) && ($_REQUEST['type']=="SugarFieldImage")) {
167 $mime = getimagesize($download_location);
169 header("Content-Type: {$mime['mime']}");
171 header("Content-Type: image/png");
174 header("Content-Type: application/force-download");
175 header("Content-type: application/octet-stream");
176 header("Content-Disposition: attachment; filename=\"".$name."\";");
178 // disable content type sniffing in MSIE
179 header("X-Content-Type-Options: nosniff");
180 header("Content-Length: " . filesize($local_location));
181 header("Expires: 0");
187 readfile($download_location);