Your IP : 192.168.165.1
<?php
// This file is part of Moodle - http://moodle.org/
//
// Moodle is free software: you can redistribute it and/or modify
// it under the terms of the GNU General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// Moodle is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU General Public License for more details.
//
// You should have received a copy of the GNU General Public License
// along with Moodle. If not, see <http://www.gnu.org/licenses/>.
/**
* Manages the creation and usage of access controlled links.
*
* @package repository_nextcloud
* @copyright 2017 Nina Herrmann (Learnweb, University of Münster)
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
namespace repository_nextcloud;
use context;
use \core\oauth2\api;
use \core\notification;
use repository_exception;
defined('MOODLE_INTERNAL') || die();
require_once($CFG->libdir . '/webdavlib.php');
/**
* Manages the creation and usage of access controlled links.
*
* @package repository_nextcloud
* @copyright 2017 Nina Herrmann (Learnweb, University of Münster)
* @license http://www.gnu.org/copyleft/gpl.html GNU GPL v3 or later
*/
class access_controlled_link_manager{
/**
* OCS client that uses the Open Collaboration Services REST API.
* @var ocs_client
*/
protected $ocsclient;
/**
* ocsclient of the systemaccount.
* @var ocs_client
*/
protected $systemocsclient;
/**
* Client to manage oauth2 features from the systemaccount.
* @var \core\oauth2\client
*/
protected $systemoauthclient;
/**
* Client to manage webdav request from the systemaccount..
* @var \webdav_client
*/
protected $systemwebdavclient;
/**
* Issuer from the oauthclient.
* @var \core\oauth2\issuer
*/
protected $issuer;
/**
* Name of the related repository.
* @var string
*/
protected $repositoryname;
/**
* Access_controlled_link_manager constructor.
* @param ocs_client $ocsclient
* @param \core\oauth2\client $systemoauthclient
* @param ocs_client $systemocsclient
* @param \core\oauth2\issuer $issuer
* @param string $repositoryname
* @throws configuration_exception
*/
public function __construct($ocsclient, $systemoauthclient, $systemocsclient, $issuer, $repositoryname) {
$this->ocsclient = $ocsclient;
$this->systemoauthclient = $systemoauthclient;
$this->systemocsclient = $systemocsclient;
$this->repositoryname = $repositoryname;
$this->issuer = $issuer;
$this->systemwebdavclient = $this->create_system_dav();
}
/**
* Deletes the share of the systemaccount and a user. In case the share could not be deleted a notification is
* displayed.
* @param int $shareid Remote ID of the share to be deleted.
*/
public function delete_share_dataowner_sysaccount($shareid) {
$shareid = (int) $shareid;
$deleteshareparams = [
'share_id' => $shareid
];
$deleteshareresponse = $this->ocsclient->call('delete_share', $deleteshareparams);
$xml = simplexml_load_string($deleteshareresponse);
if (empty($xml->meta->statuscode) || $xml->meta->statuscode != 100 ) {
notification::warning('You just shared a file with a access controlled link.
However, the share between you and the systemaccount could not be deleted and is still present in your instance.');
}
}
/**
* Creates a share between a user and the system account. If $username is set the sharing direction is system account -> user,
* otherwise user -> system account.
* @param string $path Remote path of the file that will be shared
* @param string $username optional when set the file is shared with the corresponding user otherwise with
* the systemaccount.
* @param bool $maywrite if false, only(!) read access is granted.
* @return array statuscode, shareid, and filetarget
* @throws request_exception
*/
public function create_share_user_sysaccount($path, $username = null, $maywrite = false) {
$result = array();
if ($username != null) {
$shareusername = $username;
} else {
$systemaccount = \core\oauth2\api::get_system_account($this->issuer);
$shareusername = $systemaccount->get('username');
}
$permissions = ocs_client::SHARE_PERMISSION_READ;
if ($maywrite) {
// Add more privileges (write, reshare) if allowed for the given user.
$permissions |= ocs_client::SHARE_PERMISSION_ALL;
}
$createshareparams = [
'path' => $path,
'shareType' => ocs_client::SHARE_TYPE_USER,
'publicUpload' => false,
'shareWith' => $shareusername,
'permissions' => $permissions,
];
// File is now shared with the system account.
if ($username === null) {
$createshareresponse = $this->ocsclient->call('create_share', $createshareparams);
} else {
$createshareresponse = $this->systemocsclient->call('create_share', $createshareparams);
}
$xml = simplexml_load_string($createshareresponse);
$statuscode = (int)$xml->meta->statuscode;
if ($statuscode != 100 && $statuscode != 403) {
$details = get_string('filenotaccessed', 'repository_nextcloud');
throw new request_exception(get_string('request_exception',
'repository_nextcloud', array('instance' => $this->repositoryname, 'errormessage' => $details)));
}
$result['shareid'] = (int)$xml->data->id;
$result['statuscode'] = $statuscode;
$result['filetarget'] = (string)$xml->data[0]->file_target;
return $result;
}
/** Copy or moves a file to a new path.
* @param string $srcpath source path
* @param string $dstpath
* @param string $operation move or copy
* @param \webdav_client $webdavclient needed when moving files.
* @return String Http-status of the request
* @throws configuration_exception
* @throws \coding_exception
* @throws \moodle_exception
* @throws \repository_nextcloud\request_exception
*/
public function transfer_file_to_path($srcpath, $dstpath, $operation, $webdavclient = null) {
$this->systemwebdavclient->open();
$webdavendpoint = issuer_management::parse_endpoint_url('webdav', $this->issuer);
$srcpath = ltrim($srcpath, '/');
$sourcepath = $webdavendpoint['path'] . $srcpath;
$dstpath = ltrim($dstpath, '/');
$destinationpath = $webdavendpoint['path'] . $dstpath . '/' . $srcpath;
if ($operation === 'copy') {
$result = $this->systemwebdavclient->copy_file($sourcepath, $destinationpath, true);
} else if ($operation === 'move') {
$result = $webdavclient->move($sourcepath, $destinationpath, false);
if ($result == 412) {
// A file with that name already exists at that target. Find a unique location!
$increment = 0; // Will be appended to/inserted into the filename.
// Define the pattern that is used to insert the increment to the filename.
if (substr_count($srcpath, '.') === 0) {
// No file extension; append increment to the (sprintf-escaped) name.
$namepattern = str_replace('%', '%%', $destinationpath) . ' (%s)';
} else {
// Append the increment to the second-to-last component, which is presumably the one before the extension.
// Again, the original path is sprintf-escaped.
$components = explode('.', str_replace('%', '%%', $destinationpath));
$components[count($components) - 2] .= ' (%s)';
$namepattern = implode('.', $components);
}
}
while ($result == 412) {
$increment++;
$destinationpath = sprintf($namepattern, $increment);
$result = $webdavclient->move($sourcepath, $destinationpath, false);
}
}
$this->systemwebdavclient->close();
if (!($result == 201 || $result == 412)) {
$details = get_string('contactadminwith', 'repository_nextcloud',
'A webdav request to ' . $operation . ' a file failed.');
throw new request_exception(array('instance' => $this->repositoryname, 'errormessage' => $details));
}
return $result;
}
/**
* Creates a unique folder path for the access controlled link.
* @param context $context
* @param string $component
* @param string $filearea
* @param string $itemid
* @return string $result full generated path.
* @throws request_exception If the folder path cannot be created.
*/
public function create_folder_path_access_controlled_links($context, $component, $filearea, $itemid) {
global $CFG, $SITE;
// The fullpath to store the file is generated from the context.
$contextlist = array_reverse($context->get_parent_contexts(true));
$fullpath = '';
$allfolders = [];
foreach ($contextlist as $ctx) {
// Prepare human readable context folders names, making sure they are still unique within the site.
$prevlang = force_current_language($CFG->lang);
$foldername = $ctx->get_context_name();
force_current_language($prevlang);
if ($ctx->contextlevel === CONTEXT_SYSTEM) {
// Append the site short name to the root folder.
$foldername .= ' ('.$SITE->shortname.')';
// Append the relevant object id.
} else if ($ctx->instanceid) {
$foldername .= ' (id '.$ctx->instanceid.')';
} else {
// This does not really happen but just in case.
$foldername .= ' (ctx '.$ctx->id.')';
}
$foldername = clean_param($foldername, PARAM_FILE);
$allfolders[] = $foldername;
}
$allfolders[] = clean_param($component, PARAM_FILE);
$allfolders[] = clean_param($filearea, PARAM_FILE);
$allfolders[] = clean_param($itemid, PARAM_FILE);
// Extracts the end of the webdavendpoint.
$parsedwebdavurl = issuer_management::parse_endpoint_url('webdav', $this->issuer);
$webdavprefix = $parsedwebdavurl['path'];
$this->systemwebdavclient->open();
// Checks whether folder exist and creates non-existent folders.
foreach ($allfolders as $foldername) {
$fullpath .= '/' . $foldername;
$isdir = $this->systemwebdavclient->is_dir($webdavprefix . $fullpath);
// Folder already exist, continue.
if ($isdir === true) {
continue;
}
$response = $this->systemwebdavclient->mkcol($webdavprefix . $fullpath);
if ($response != 201) {
$this->systemwebdavclient->close();
$details = get_string('contactadminwith', 'repository_nextcloud',
get_string('pathnotcreated', 'repository_nextcloud', $fullpath));
throw new request_exception(array('instance' => $this->repositoryname,
'errormessage' => $details));
}
}
$this->systemwebdavclient->close();
return $fullpath;
}
/** Creates a new webdav_client for the system account.
* @return \webdav_client
* @throws configuration_exception
*/
public function create_system_dav() {
$webdavendpoint = issuer_management::parse_endpoint_url('webdav', $this->issuer);
// Selects the necessary information (port, type, server) from the path to build the webdavclient.
$server = $webdavendpoint['host'];
if ($webdavendpoint['scheme'] === 'https') {
$webdavtype = 'ssl://';
$webdavport = 443;
} else if ($webdavendpoint['scheme'] === 'http') {
$webdavtype = '';
$webdavport = 80;
}
// Override default port, if a specific one is set.
if (isset($webdavendpoint['port'])) {
$webdavport = $webdavendpoint['port'];
}
// Authentication method is `bearer` for OAuth 2. Pass oauth client from which WebDAV obtains the token when needed.
$dav = new \webdav_client($server, '', '', 'bearer', $webdavtype,
$this->systemoauthclient->get_accesstoken()->token, $webdavendpoint['path']);
$dav->port = $webdavport;
$dav->debug = false;
return $dav;
}
/** Creates a folder to store access controlled links.
* @param string $controlledlinkfoldername
* @param \webdav_client $webdavclient
* @throws \coding_exception
* @throws configuration_exception
* @throws request_exception
*/
public function create_storage_folder($controlledlinkfoldername, $webdavclient) {
$parsedwebdavurl = issuer_management::parse_endpoint_url('webdav', $this->issuer);
$webdavprefix = $parsedwebdavurl['path'];
// Checks whether folder exist and creates non-existent folders.
$webdavclient->open();
$isdir = $webdavclient->is_dir($webdavprefix . $controlledlinkfoldername);
// Folder already exist, continue.
if (!$isdir) {
$responsecreateshare = $webdavclient->mkcol($webdavprefix . $controlledlinkfoldername);
if ($responsecreateshare != 201) {
$webdavclient->close();
throw new request_exception(array('instance' => $this->repositoryname,
'errormessage' => get_string('contactadminwith', 'repository_nextcloud',
'The folder to store files in the user account could not be created.')));
}
}
$webdavclient->close();
}
/** Gets all shares from a path (the path is file specific) and extracts the share of a specific user. In case
* multiple shares exist the first one is taken. Multiple shares can only appear when shares are created outside
* of this plugin, therefore this case is not handled.
* @param string $path
* @param string $username
* @return \SimpleXMLElement
* @throws \moodle_exception
*/
public function get_shares_from_path($path, $username) {
$ocsparams = [
'path' => $path,
'reshares' => true
];
$getsharesresponse = $this->systemocsclient->call('get_shares', $ocsparams);
$xml = simplexml_load_string($getsharesresponse);
$validelement = array();
foreach ($fileid = $xml->data->element as $element) {
if ($element->share_with == $username) {
$validelement = $element;
break;
}
}
if (empty($validelement)) {
throw new request_exception(array('instance' => $this->repositoryname,
'errormessage' => get_string('filenotaccessed', 'repository_nextcloud')));
}
return $validelement->id;
}
/** This method can only be used if the response is from a newly created share. In this case there is more information
* in the response. For a reference refer to
* https://docs.nextcloud.com/server/13/developer_manual/core/ocs-share-api.html#get-information-about-a-known-share.
* @param int $shareid
* @param string $username
* @return mixed the id of the share
* @throws \coding_exception
* @throws \repository_nextcloud\request_exception
*/
public function get_share_information_from_shareid($shareid, $username) {
$ocsparams = [
'share_id' => (int) $shareid
];
$shareinformation = $this->ocsclient->call('get_information_of_share', $ocsparams);
$xml = simplexml_load_string($shareinformation);
foreach ($fileid = $xml->data->element as $element) {
if ($element->share_with == $username) {
$validelement = $element;
break;
}
}
if (empty($validelement)) {
throw new request_exception(array('instance' => $this->repositoryname,
'errormessage' => get_string('filenotaccessed', 'repository_nextcloud')));
}
return (string) $validelement->file_target;
}
/**
* Find a file that has previously been shared with the system account.
* @param string $path Path to file in user context.
* @return array shareid: ID of share, filetarget: path to file in sys account.
* @throws request_exception If the share cannot be resolved.
*/
public function find_share_in_sysaccount($path) {
$systemaccount = \core\oauth2\api::get_system_account($this->issuer);
$systemaccountuser = $systemaccount->get('username');
// Find out share ID from user files.
$ocsparams = [
'path' => $path,
'reshares' => true
];
$getsharesresponse = $this->ocsclient->call('get_shares', $ocsparams);
$xml = simplexml_load_string($getsharesresponse);
$validelement = array();
foreach ($fileid = $xml->data->element as $element) {
if ($element->share_with == $systemaccountuser) {
$validelement = $element;
break;
}
}
if (empty($validelement)) {
throw new request_exception(array('instance' => $this->repositoryname,
'errormessage' => get_string('filenotaccessed', 'repository_nextcloud')));
}
$shareid = (int) $validelement->id;
// Use share id to find file name in system account's context.
$ocsparams = [
'share_id' => $shareid
];
$shareinformation = $this->systemocsclient->call('get_information_of_share', $ocsparams);
$xml = simplexml_load_string($shareinformation);
foreach ($fileid = $xml->data->element as $element) {
if ($element->share_with == $systemaccountuser) {
$validfile = $element;
break;
}
}
if (empty($validfile)) {
throw new request_exception(array('instance' => $this->repositoryname,
'errormessage' => get_string('filenotaccessed', 'repository_nextcloud')));
}
return [
'shareid' => $shareid,
'filetarget' => (string) $validfile->file_target
];
}
/**
* Download a file from the system account for the purpose of offline usage.
* @param string $srcpath Name of a file owned by the system account
* @param string $targetpath Temporary filename in Moodle
* @throws repository_exception The download was unsuccessful, maybe the file does not exist.
*/
public function download_for_offline_usage(string $srcpath, string $targetpath): void {
$this->systemwebdavclient->open();
$webdavendpoint = issuer_management::parse_endpoint_url('webdav', $this->issuer);
$srcpath = ltrim($srcpath, '/');
$sourcepath = $webdavendpoint['path'] . $srcpath;
// Write file into temp location.
if (!$this->systemwebdavclient->get_file($sourcepath, $targetpath)) {
$this->systemwebdavclient->close();
throw new repository_exception('cannotdownload', 'repository');
}
$this->systemwebdavclient->close();
}
}