public/main/inc/ajax/forum.ajax.php
<?php
/* For licensing terms, see /license.txt */
use Chamilo\CourseBundle\Entity\CForumPost;
/**
* Responses to AJAX calls for forum attachments.
*
* @author Daniel Barreto Alva <daniel.barreto@beeznest.com>
*/
require_once __DIR__.'/../global.inc.php';
// First, protect this script
api_protect_course_script(false);
$action = isset($_REQUEST['a']) ? $_REQUEST['a'] : null;
// Create a default error response
$json = [
'error' => true,
'errorMessage' => 'ERROR',
];
// Check if exist action
if (!empty($action)) {
switch ($action) {
case 'upload_file':
$current_forum = get_forum_information($_REQUEST['forum']);
$current_forum_category = get_forumcategory_information($current_forum['forum_category']);
$current_thread = get_thread_information($_REQUEST['forum'], $_REQUEST['thread']);
if (!empty($_FILES) && !empty($_REQUEST['forum'])) {
// The user is not allowed here if
// 1. the forum category, forum or thread is invisible (visibility==0)
// 2. the forum category, forum or thread is locked (locked <>0)
// 3. if anonymous posts are not allowed
// The only exception is the course manager
// They are several pieces for clarity.
if (!api_is_allowed_to_edit(null, true) &&
(
($current_forum_category && 0 == $current_forum_category['visibility']) ||
0 == $current_forum['visibility']
)
) {
$json['errorMessage'] = '1. the forum category, forum or thread is invisible (visibility==0)';
break;
}
if (!api_is_allowed_to_edit(null, true) &&
(
($current_forum_category && 0 != $current_forum_category['locked']) ||
0 != $current_forum['locked'] || 0 != $current_thread['locked']
)
) {
$json['errorMessage'] = '2. the forum category, forum or thread is locked (locked <>0)';
break;
}
if (api_is_anonymous() && 0 == $current_forum['allow_anonymous']) {
$json['errorMessage'] = '3. if anonymous posts are not allowed';
break;
}
// If pass all previous control, user can edit post
$courseId = isset($_REQUEST['c_id']) ? intval($_REQUEST['c_id']) : api_get_course_int_id();
$json['courseId'] = $courseId;
$forumId = isset($_REQUEST['forum']) ? intval($_REQUEST['forum']) : null;
$json['forum'] = $forumId;
$threadId = isset($_REQUEST['thread']) ? intval($_REQUEST['thread']) : null;
$json['thread'] = $threadId;
$postId = isset($_REQUEST['postId']) ? intval($_REQUEST['postId']) : null;
$json['postId'] = $postId;
if (!empty($courseId) &&
!is_null($forumId) &&
!is_null($threadId) &&
!is_null($postId)
) {
// Save forum attachment
$attachId = add_forum_attachment_file('', $postId);
if (false !== $attachId) {
// Get prepared array of attachment data
$array = getAttachedFiles(
$forumId,
$threadId,
$postId,
$attachId,
$courseId
);
// Check if array data is consistent
if (isset($array['name'])) {
$json['error'] = false;
$json['errorMessage'] = 'Success';
$json = array_merge($json, $array);
}
}
}
}
echo json_encode($json);
break;
case 'delete_file':
$current_forum = get_forum_information($_REQUEST['forum']);
$current_forum_category = get_forumcategory_information($current_forum['forum_category']);
$current_thread = get_thread_information($_REQUEST['forum'], $_REQUEST['thread']);
// Check if set attachment ID and thread ID
if (isset($_REQUEST['attachId']) && isset($_REQUEST['thread'])) {
api_block_course_item_locked_by_gradebook($_REQUEST['thread'], LINK_FORUM_THREAD);
// The user is not allowed here if
// 1. the forum category, forum or thread is invisible (visibility==0)
// 2. the forum category, forum or thread is locked (locked <>0)
// 3. if anonymous posts are not allowed
// 4. if editing of replies is not allowed
// The only exception is the course manager
// They are several pieces for clarity.
if (!api_is_allowed_to_edit(null, true) &&
(
($current_forum_category && 0 == $current_forum_category['visibility']) ||
0 == $current_forum['visibility']
)
) {
$json['errorMessage'] = '1. the forum category, forum or thread is invisible (visibility==0)';
break;
}
if (!api_is_allowed_to_edit(null, true) &&
(
($current_forum_category && 0 != $current_forum_category['locked']) ||
0 != $current_forum['locked'] || 0 != $current_thread['locked']
)
) {
$json['errorMessage'] = '2. the forum category, forum or thread is locked (locked <>0)';
break;
}
if (api_is_anonymous() && 0 == $current_forum['allow_anonymous']) {
$json['errorMessage'] = '3. if anonymous posts are not allowed';
break;
}
$group_id = api_get_group_id();
$groupEntity = api_get_group_entity();
if (!api_is_allowed_to_edit(null, true) &&
0 == $current_forum['allow_edit'] &&
($group_id && !GroupManager::isTutorOfGroup(api_get_user_id(), $groupEntity))
) {
$json['errorMessage'] = '4. if editing of replies is not allowed';
break;
}
// If pass all previous control, user can edit post
$attachId = $_REQUEST['attachId'];
$threadId = $_REQUEST['thread'];
// Delete forum attachment from database and file system
$affectedRows = delete_attachment(0, $attachId, false);
if ($affectedRows > 0) {
$json['error'] = false;
$json['errorMessage'] = 'Success';
}
}
echo json_encode($json);
break;
case 'change_post_status':
if (api_is_allowed_to_edit(false, true)) {
$postId = isset($_GET['post_id']) ? $_GET['post_id'] : '';
if (empty($postId)) {
exit;
}
$postId = str_replace('status_post_', '', $postId);
$em = Database::getManager();
/** @var CForumPost $post */
$post = $em->find(CForumPost::class, $postId);
if ($post) {
$forum = $post->getForum();
$status = $post->getStatus();
if (empty($status)) {
$status = CForumPost::STATUS_WAITING_MODERATION;
}
switch ($status) {
case CForumPost::STATUS_VALIDATED:
$changeTo = CForumPost::STATUS_REJECTED;
break;
case CForumPost::STATUS_WAITING_MODERATION:
$changeTo = CForumPost::STATUS_VALIDATED;
break;
case CForumPost::STATUS_REJECTED:
$changeTo = CForumPost::STATUS_WAITING_MODERATION;
break;
}
$post->setStatus($changeTo);
$em->persist($post);
$em->flush();
echo getPostStatus(
$forum,
[
'iid' => $post->getIid(),
'status' => $post->getStatus(),
],
false
);
}
}
break;
}
}
exit;