| 1 | efrain | 1 | <?php
 | 
        
           |  |  | 2 | // This file is part of Moodle - http://moodle.org/
 | 
        
           |  |  | 3 | //
 | 
        
           |  |  | 4 | // Moodle is free software: you can redistribute it and/or modify
 | 
        
           |  |  | 5 | // it under the terms of the GNU General Public License as published by
 | 
        
           |  |  | 6 | // the Free Software Foundation, either version 3 of the License, or
 | 
        
           |  |  | 7 | // (at your option) any later version.
 | 
        
           |  |  | 8 | //
 | 
        
           |  |  | 9 | // Moodle is distributed in the hope that it will be useful,
 | 
        
           |  |  | 10 | // but WITHOUT ANY WARRANTY; without even the implied warranty of
 | 
        
           |  |  | 11 | // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 | 
        
           |  |  | 12 | // GNU General Public License for more details.
 | 
        
           |  |  | 13 | //
 | 
        
           |  |  | 14 | // You should have received a copy of the GNU General Public License
 | 
        
           |  |  | 15 | // along with Moodle.  If not, see <http://www.gnu.org/licenses/>.
 | 
        
           |  |  | 16 |   | 
        
           |  |  | 17 | /**
 | 
        
           |  |  | 18 |  * Entry point for token-based access to pluginfile.php.
 | 
        
           |  |  | 19 |  *
 | 
        
           |  |  | 20 |  * @package    core
 | 
        
           |  |  | 21 |  * @copyright  2018 Andrew Nicols <andrew@nicols.co.uk>
 | 
        
           |  |  | 22 |  * @license    http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
 | 
        
           |  |  | 23 |  */
 | 
        
           |  |  | 24 |   | 
        
           |  |  | 25 | // Disable the use of sessions/cookies - we recreate $USER for every call.
 | 
        
           |  |  | 26 | define('NO_MOODLE_COOKIES', true);
 | 
        
           |  |  | 27 |   | 
        
           |  |  | 28 | // Disable debugging for this script.
 | 
        
           |  |  | 29 | // It is typically used to display images.
 | 
        
           |  |  | 30 | define('NO_DEBUG_DISPLAY', true);
 | 
        
           |  |  | 31 |   | 
        
           |  |  | 32 | require_once('config.php');
 | 
        
           |  |  | 33 |   | 
        
           |  |  | 34 | // Allow CORS requests.
 | 
        
           |  |  | 35 | header('Access-Control-Allow-Origin: *');
 | 
        
           | 1441 | ariadna | 36 | header('Access-Control-Allow-Headers: range');
 | 
        
           |  |  | 37 | header('Access-Control-Expose-Headers: Content-Range');
 | 
        
           | 1 | efrain | 38 |   | 
        
           |  |  | 39 | $relativepath = get_file_argument();
 | 
        
           |  |  | 40 | $token = optional_param('token', '', PARAM_ALPHANUM);
 | 
        
           |  |  | 41 | if (0 == strpos($relativepath, '/token/')) {
 | 
        
           |  |  | 42 |     $relativepath = ltrim($relativepath, '/');
 | 
        
           |  |  | 43 |     $pathparts = explode('/', $relativepath, 2);
 | 
        
           |  |  | 44 |     $token = $pathparts[0];
 | 
        
           |  |  | 45 |     $token = clean_param($token, PARAM_ALPHANUM);
 | 
        
           |  |  | 46 |     $relativepath = "/{$pathparts[1]}";
 | 
        
           |  |  | 47 | }
 | 
        
           |  |  | 48 |   | 
        
           |  |  | 49 | require_user_key_login('core_files', null, $token);
 | 
        
           |  |  | 50 | require_once('pluginfile.php');
 |