CRM-14499: Update FourFour upgrade script and changes image urls to improve security...
authorMaggie <maggie.epps@gmail.com>
Tue, 29 Apr 2014 19:06:08 +0000 (15:06 -0400)
committerMaggie <maggie.epps@gmail.com>
Tue, 29 Apr 2014 20:00:26 +0000 (16:00 -0400)
CRM/Contact/BAO/Contact.php
CRM/Contact/Page/ImageFile.php [new file with mode: 0644]
CRM/Core/xml/Menu/Contact.xml
CRM/Upgrade/Incremental/php/FourFour.php
CRM/Utils/System.php

index 3d54cde959363b677ea8f1ca2ca45375ef98eac5..73666cdc6d323291c763f954404a6ad979802b05 100644 (file)
@@ -943,7 +943,8 @@ WHERE id={$id}; ";
     );
 
     if (in_array($params[$imageIndex]['type'], $mimeType)) {
-      $params[$imageIndex] = CRM_Contact_BAO_Contact::getRelativePath($params[$imageIndex]['name']);
+      $photo = basename($params[$imageIndex]['name']);
+      $params[$imageIndex] =  CRM_Utils_System::url('civicrm/contact/imagefile', 'photo='.$photo, TRUE);
       return TRUE;
     }
     else {
diff --git a/CRM/Contact/Page/ImageFile.php b/CRM/Contact/Page/ImageFile.php
new file mode 100644 (file)
index 0000000..f0aa6f9
--- /dev/null
@@ -0,0 +1,61 @@
+<?php
+/*
+ +--------------------------------------------------------------------+
+ | CiviCRM version 4.4                                                |
+ +--------------------------------------------------------------------+
+ | Copyright CiviCRM LLC (c) 2004-2014                                |
+ +--------------------------------------------------------------------+
+ | This file is a part of CiviCRM.                                    |
+ |                                                                    |
+ | CiviCRM is free software; you can copy, modify, and distribute it  |
+ | under the terms of the GNU Affero General Public License           |
+ | Version 3, 19 November 2007 and the CiviCRM Licensing Exception.   |
+ |                                                                    |
+ | CiviCRM is distributed in the hope that it will be useful, but     |
+ | WITHOUT ANY WARRANTY; without even the implied warranty of         |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.               |
+ | See the GNU Affero General Public License for more details.        |
+ |                                                                    |
+ | You should have received a copy of the GNU Affero General Public   |
+ | License and the CiviCRM Licensing Exception along                  |
+ | with this program; if not, contact CiviCRM LLC                     |
+ | at info[AT]civicrm[DOT]org. If you have questions about the        |
+ | GNU Affero General Public License or the licensing of CiviCRM,     |
+ | see the CiviCRM license FAQ at http://civicrm.org/licensing        |
+ +--------------------------------------------------------------------+
+*/
+
+/**
+ *
+ * @package CRM
+ * @copyright CiviCRM LLC (c) 2004-2014
+ * $Id$
+ *
+ */
+class CRM_Contact_Page_ImageFile extends CRM_Core_Page {
+  function run(){
+    $currentURL = CRM_Utils_System::makeURL(NULL, FALSE, FALSE, NULL, TRUE);
+    $sql = "SELECT id FROM civicrm_contact WHERE image_url=%1;";
+    $params = array(1 => array($currentURL, 'String'));
+    $dao = CRM_Core_DAO::executeQuery($sql, $params);
+    while ($dao->fetch()){
+      $cid=$dao->id;
+    }
+    if ($cid){
+       $config = CRM_Core_Config::singleton();
+       $buffer = file_get_contents($config->customFileUploadDir . $_GET['photo']);
+       $mimeType = 'image/' .pathinfo($_GET['photo'], PATHINFO_EXTENSION);
+       CRM_Utils_System::download($_GET['photo'], $mimeType, $buffer,
+        NULL,
+        TRUE, 
+       'inline'
+      );
+    }
+    else{
+      echo 'image url not in database';
+    }
+    CRM_Utils_System::civiExit();     
+  }
+}
+
+
index ce54ca8d42e3d755cc1ce6abbf377f83d738ca37..17141ffd855f49cf57107a35e1a26f0bf1f199b5 100644 (file)
     <page_callback>CRM_Contact_BAO_Contact::processImage</page_callback>
     <access_arguments>access uploaded files</access_arguments>
   </item>
+  <item>
+     <path>civicrm/contact/imagefile</path>
+     <title>Get Image File</title>
+     <page_callback>CRM_Contact_Page_ImageFile</page_callback>
+     <access_arguments>*always allow*</access_arguments>
+  </item>  
   <item>
      <path>civicrm/contact/search/basic</path>
      <title>Find Contacts</title>
index f01e297af3a9b68c71959dfb6a64514dd013f418..b5d8b58ba7ae8b830d08a3f778c9d845db19063e 100644 (file)
@@ -95,6 +95,9 @@ WHERE ceft.entity_table = 'civicrm_contribution' AND cft.payment_instrument_id I
         $postUpgradeMessage .= '<br /><br /><strong>' . ts('Your database contains %1 financial transaction records with no payment instrument (Paid By is empty). If you use the Accounting Batches feature this may result in unbalanced transactions. If you do not use this feature, you can ignore the condition (although you will be required to select a Paid By value for new transactions). <a href="%2" target="_blank">You can review steps to correct transactions with missing payment instruments on the wiki.</a>', array(1 => $dao->N, 2 => 'http://wiki.civicrm.org/confluence/display/CRMDOC/Fixing+Transactions+Missing+a+Payment+Instrument+-+4.4.3+Upgrades')) . '</strong>';
       }
     }
+    if ($rev == '4.4.6'){
+     $postUpgradeMessage .= '<br /><br /><strong>'. ts('Your contact image urls have been upgraded. If your contact image urls did not follow the standard format for image Urls they have not been upgraded. Please check the log to see image urls that were not upgraded.'); 
+    }
   }
 
   function upgrade_4_4_alpha1($rev) {
@@ -304,6 +307,60 @@ ALTER TABLE civicrm_dashboard
     return TRUE;
   }
 
+  function upgrade_4_4_6($rev){
+    $minId = CRM_Core_DAO::singleValueQuery('SELECT coalesce(min(id),0) FROM civicrm_contact');
+    $maxId = CRM_Core_DAO::singleValueQuery('SELECT coalesce(max(id),0) FROM civicrm_contact');
+    for ($startId = $minId; $startId <= $maxId; $startId += self::BATCH_SIZE) {
+      $endId = $startId + self::BATCH_SIZE - 1;
+      $title = ts('Upgrade image_urls (%1 => %2)', array(1 => $startId, 2 => $endId));
+      $this->addTask($title, 'upgradeImageUrls', $startId, $endId);
+    }
+  }
+
+  static function upgradeImageUrls(CRM_Queue_TaskContext $ctx, $startId, $endId){
+    $sql = "CREATE INDEX index_image_url ON civicrm_contact (image_url);";
+    $dao = CRM_Core_DAO::executeQuery($sql);    
+    $sql = "
+SELECT id, image_url
+FROM civicrm_contact
+WHERE 1
+AND id BETWEEN %1 AND %2
+";
+    $params = array(
+      1 => array($startId, 'Integer'),
+      2 => array($endId, 'Integer'),
+    );
+    $dao = CRM_Core_DAO::executeQuery($sql, $params, TRUE, NULL, FALSE, FALSE);
+    $failures = array();
+    while ($dao->fetch()){
+      $imageURL = $dao->image_url;
+      $baseurl = CIVICRM_UF_BASEURL;
+      $baselen = strlen($baseurl);
+      if (substr($imageURL, 0, $baselen)==$baseurl){
+          $photo = basename($dao->image_url);
+          $config = CRM_Core_Config::singleton();
+          $fullpath = $config->customFileUploadDir.$photo;
+          if (file_exists($fullpath)){
+            $newimageurl =  CRM_Utils_System::url('civicrm/contact/imagefile', 'photo='.$photo, TRUE);
+            $sql = 'UPDATE civicrm_contact SET image_url=%1 WHERE id=%2';
+            $params = array(
+                1 => array($newimageurl, 'String'),
+                2 => array($dao->id, 'Integer'),
+            );
+            $updatedao = CRM_Core_DAO::executeQuery($sql, $params);
+          }
+          else{
+            $failures[$dao->id] = $dao->image_url;
+        }
+      }
+      else{     
+            $failures[$dao->id] = $dao->image_url;
+      }
+    }
+    CRM_Core_Error::debug_var('imageUrlsNotUpgraded', $failures);
+    return TRUE;
+  }
+
   /**
    * Update activity contacts CRM-12274
    *
index 5e46870e43134febd0ab20eecded05d46457d82b..b3d9de67559e5d072fe2e82d97b539ecc7c3fbf1 100644 (file)
@@ -1596,3 +1596,4 @@ class CRM_Utils_System {
   }
 }
 
+