You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
233 lines
8.8 KiB
233 lines
8.8 KiB
<?php |
|
|
|
/** |
|
* Document Template Management Module. |
|
* |
|
* @package OpenEMR |
|
* @link http://www.open-emr.org |
|
* @author Rod Roark <rod@sunsetsystems.com> |
|
* @author Brady Miller <brady.g.miller@gmail.com> |
|
* @author Tyler Wrenn <tyler@tylerwrenn.com> |
|
* @copyright Copyright (c) 2013-2014 Rod Roark <rod@sunsetsystems.com> |
|
* @copyright Copyright (c) 2018 Brady Miller <brady.g.miller@gmail.com> |
|
* @copyright Copyright (c) 2020 Tyler Wrenn <tyler@tylerwrenn.com> |
|
* @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 |
|
*/ |
|
|
|
require_once('../globals.php'); |
|
|
|
use OpenEMR\Common\Acl\AclMain; |
|
use OpenEMR\Common\Crypto\CryptoGen; |
|
use OpenEMR\Common\Csrf\CsrfUtils; |
|
use OpenEMR\Common\Twig\TwigContainer; |
|
use OpenEMR\Core\Header; |
|
|
|
if (!AclMain::aclCheckCore('admin', 'super')) { |
|
echo (new TwigContainer(null, $GLOBALS['kernel']))->getTwig()->render('core/unauthorized.html.twig', ['pageTitle' => xl("Document Template Management")]); |
|
exit; |
|
} |
|
|
|
// Set up crypto object |
|
$cryptoGen = new CryptoGen(); |
|
|
|
$form_filename = convert_safe_file_dir_name($_REQUEST['form_filename'] ?? ''); |
|
|
|
$templatedir = "$OE_SITE_DIR/documents/doctemplates"; |
|
|
|
// If downloading a file, do the download and nothing else. |
|
// Thus the current browser page should remain displayed. |
|
// |
|
if (!empty($_POST['bn_download'])) { |
|
//verify csrf |
|
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) { |
|
CsrfUtils::csrfNotVerified(); |
|
} |
|
|
|
$templatepath = "$templatedir/$form_filename"; |
|
|
|
// Place file in variable |
|
$fileData = file_get_contents($templatepath); |
|
|
|
// Decrypt file, if applicable |
|
if ($cryptoGen->cryptCheckStandard($fileData)) { |
|
$fileData = $cryptoGen->decryptStandard($fileData, null, 'database'); |
|
} |
|
|
|
header('Content-Description: File Transfer'); |
|
header('Content-Transfer-Encoding: binary'); |
|
header('Expires: 0'); |
|
header('Cache-Control: must-revalidate, post-check=0, pre-check=0'); |
|
header('Pragma: public'); |
|
// attachment, not inline |
|
header("Content-Disposition: attachment; filename=\"$form_filename\""); |
|
// Note we avoid providing a mime type that suggests opening the file. |
|
header("Content-Type: application/octet-stream"); |
|
header("Content-Length: " . strlen($fileData)); |
|
echo $fileData; |
|
exit; |
|
} |
|
|
|
if (!empty($_POST['bn_delete'])) { |
|
//verify csrf |
|
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) { |
|
CsrfUtils::csrfNotVerified(); |
|
} |
|
|
|
$templatepath = "$templatedir/$form_filename"; |
|
if (is_file($templatepath)) { |
|
unlink($templatepath); |
|
} |
|
} |
|
|
|
if (!empty($_POST['bn_upload'])) { |
|
//verify csrf |
|
if (!CsrfUtils::verifyCsrfToken($_POST["csrf_token_form"])) { |
|
CsrfUtils::csrfNotVerified(); |
|
} |
|
|
|
// Handle uploads. |
|
$tmp_name = $_FILES['form_file']['tmp_name']; |
|
if (is_uploaded_file($tmp_name) && $_FILES['form_file']['size']) { |
|
// Choose the destination path/filename. |
|
$form_dest_filename = $_POST['form_dest_filename']; |
|
if ($form_dest_filename == '') { |
|
$form_dest_filename = $_FILES['form_file']['name']; |
|
} |
|
|
|
$form_dest_filename = convert_safe_file_dir_name(basename($form_dest_filename)); |
|
if ($form_dest_filename == '') { |
|
die(xlt('Cannot determine a destination filename')); |
|
} |
|
$path_parts = pathinfo($form_dest_filename); |
|
if (!in_array(strtolower($path_parts['extension']), array('odt', 'txt', 'docx', 'zip'))) { |
|
die(text(strtolower($path_parts['extension'])) . ' ' . xlt('filetype is not accepted')); |
|
} |
|
|
|
$templatepath = "$templatedir/$form_dest_filename"; |
|
// If the site's template directory does not yet exist, create it. |
|
if (!is_dir($templatedir)) { |
|
mkdir($templatedir); |
|
} |
|
|
|
// If the target file already exists, delete it. |
|
if (is_file($templatepath)) { |
|
unlink($templatepath); |
|
} |
|
|
|
// Place uploaded file in variable. |
|
$fileData = file_get_contents($tmp_name); |
|
|
|
// Encrypt uploaded file, if applicable. |
|
if ($GLOBALS['drive_encryption']) { |
|
$storedData = $cryptoGen->encryptStandard($fileData, null, 'database'); |
|
} else { |
|
$storedData = $fileData; |
|
} |
|
|
|
// Store the uploaded file. |
|
if (file_put_contents($templatepath, $storedData) === false) { |
|
die(xlt('Unable to create') . " '" . text($templatepath) . "'"); |
|
} |
|
} |
|
} |
|
|
|
?> |
|
<html> |
|
<head> |
|
<title><?php echo xlt('Document Template Management'); ?></title> |
|
<?php Header::setupHeader(); ?> |
|
<style> |
|
.dehead { |
|
color: var(--black); |
|
font-family: sans-serif; |
|
font-size: 0.8125rem; |
|
font-weight:bold; |
|
} |
|
.detail { |
|
color: var(--black); |
|
font-family: sans-serif; |
|
font-size: 0.8125rem; |
|
font-weight: normal; |
|
} |
|
</style> |
|
</head> |
|
<body class="body_top"> |
|
<div class="container"> |
|
<form method='post' action='manage_document_templates.php' enctype='multipart/form-data' |
|
onsubmit='return top.restoreSession()'> |
|
<input type="hidden" name="csrf_token_form" value="<?php echo attr(CsrfUtils::collectCsrfToken()); ?>" /> |
|
<h2 class="text-center"><?php echo xlt('Document Template Management'); ?></h2> |
|
<div class="row"> |
|
<div class="col-6"> |
|
<div class="mx-auto mt-3"> |
|
<div class="card"> |
|
<h5 class="card-header"><?php echo xlt('Upload a Template'); ?></h5> |
|
<div class="card-body"> |
|
<div class="custom-file"> |
|
<input type="hidden" name="MAX_FILE_SIZE" value="250000000" /> |
|
<input type="file" name="form_file" size="40" class="custom-file-input" id="customFile" /> |
|
<label class="custom-file-label" for="customFile"><?php echo xlt('Choose file'); ?></label> |
|
</div> |
|
<div class="input-group mt-3"> |
|
<label for="form_dest_filename"><?php echo xlt('Destination Filename'); ?>:</label> |
|
<input type='text' class="form-control" name='form_dest_filename' id='form_dest_filename' size='30' /> |
|
<div class="input-group-append"> |
|
<input type='submit' class="btn btn-primary" name='bn_upload' value='<?php echo xla('Upload') ?>' /> |
|
</div> |
|
</div> |
|
</div> |
|
</div> |
|
</div> |
|
</div> |
|
<div class="col-6"> |
|
<div class="mx-auto mt-3"> |
|
<div class="card"> |
|
<h5 class="card-header"><?php echo xlt('Download or Delete a Template'); ?></h5> |
|
<div class="card-body"> |
|
<select class="form-control" name='form_filename'> |
|
<?php |
|
// Generate an <option> for each existing file. |
|
if (file_exists($templatedir)) { |
|
$dh = opendir($templatedir); |
|
} else { |
|
$dh = false; |
|
} |
|
if ($dh) { |
|
$templateslist = array(); |
|
while (false !== ($sfname = readdir($dh))) { |
|
if (substr($sfname, 0, 1) == '.') { |
|
continue; |
|
} |
|
|
|
$templateslist[$sfname] = $sfname; |
|
} |
|
|
|
closedir($dh); |
|
ksort($templateslist); |
|
foreach ($templateslist as $sfname) { |
|
echo " <option value='" . attr($sfname) . "'"; |
|
echo ">" . text($sfname) . "</option>\n"; |
|
} |
|
} |
|
?> |
|
</select> |
|
<div class="mt-3"> |
|
<input type='submit' class="btn btn-success" name='bn_download' value='<?php echo xla('Download') ?>' /> |
|
<input type='submit' class="btn btn-danger" name='bn_delete' value='<?php echo xla('Delete') ?>' /> |
|
</div> |
|
</div> |
|
</div> |
|
</div> |
|
</div> |
|
</div> |
|
</form> |
|
</div> |
|
<script> |
|
//display file name |
|
$(".custom-file-input").on("change", function() { |
|
var fileName = $(this).val().split("\\").pop(); |
|
$(this).siblings(".custom-file-label").addClass("selected").html(jsText(fileName)); |
|
}); |
|
</script> |
|
</body> |
|
</html>
|
|
|