Log of /moodle/file.php

MDL-20693 new NO_DEBUG_DISPLAY define

MDL-18111 improving file api comments and docs, fixing license header

MDL-18820 add module_is_moddata_trusted() callback to file.php (improved anti XSS protection for contrib modules); HEAD already has this feature

MDL-14589 removed obsoleted comments

MDL-14992 refactored use of session_write_close()

MDL-17754, MDL-11061, MDL-9276, MDL-17777, MDL-17787 - various url handling improvemetns; rewritten $FULLME and added $ME, $SCRIPT and $FULLSCRIPT; improved slashargument handling especially for IIS; removed legacy slasharguments functions obsoleted since 1.6; some other refactoring; reverse procy support, ssl appliance support

MDL-14589 new file not found general function

MDL-14589 initial file storage implementation, temporary file manager, migration of course files; blog conversion MDL-15905; assignment conversion MDL-15904; fromslib  related file improvements MDL-15906

MDL-14279: use get_file_url instead of checking $CFG->slashargument manually (merge from 1.9)

MDL-14279: use get_file_url instead of checking $CFG->slashargument manually

MDL-13776 assignment attachment access now verified in module context; merged from MOODLE_19_STABLE

MDL-13776 assignment attachment access now verified in module context

MDL-14679 ok, here is the big patch with new dmllib and ddlib API, some code is already converted, XML db editor works; see tracker for details of regressions and TODOs

Backporting MDL-14495 to 18_STABLE

"MDL-14129, fix print_error call"

New setting in require_login() to avoid certain scripts (file.php)
to mess $SESSION->wantsurl. MDL-14495 ; merged from 19_STABLE

New setting in require_login() to avoid certain scripts (file.php)
to mess $SESSION->wantsurl. MDL-14495

MDL-14129, remove all the other error() call

MDL-14128, remove all error(getstring()) to print_error()

MDL-14128, remove all uses of error(get_string())

MDL-11434 $CFG->filelifetime = 0 has no effect; patch by Chris Fryer; backported from HEAD

MDL-11434 $CFG->filelifetime = 0 has no effect; patch by Chris Fryer

MDL-9168 nested site policy when forcelogin enabled; merged from MOODLE_18_STABLE

MDL-9168 nested site policy when forcelogin enabled

Restoring changes all the changes in MOODLE_16_STABLE since MOODLE_16_BETA.

This had to be done because the MOODLE_16_STABLE branch tags were moved.

Hopefully after this MOODLE_16_STABLE will be back to how it was (and a
proper branch) but some of the history may look a bit odd.

See MDL-9032 for more discussion and details.

MDL-8015 improved file uploading
- changed file upload api in formslib
- fixed blog attachments and related code in file.php
- fixed glossary attachments
- fixed embedded images in forum posts and blogs - only gif, png and jpeg; the problme was that svg were embedded using img tag which was wrong, the same applied to other picture formats unsupported by browsers (please note that student submitted svg should be never embedded in moodle page for security reasons)
- other minor fixes

adding attachment for blogs

Advanced Upload assignment type - student can't read teacher's uploaded response file MDL-6771

fix for MDL-6599 - problem with hiding of resource when $CFG->preventaccesstohiddenfiles enabled

debugging and error reporting level fixes and improvements MDL-6671

removed moodle specific debug messages from file.php

fixed warning caused by missing fields in $course; tweaked mime info for firefox when forcing download - it should use default system mime associations which should be safe in case of firefox.

backupdata folder is not visible in directory resource any more, the backup files were not downloadable, but they might be stored in browser cache when teacher and student were logged from the same browser and computer account - MDL-6280 ; merged from MOODLE_16_STABLE

backupdata folder is not visible in directory resource any more, the backup files were not downloadable, but they might be stored in browser cache when teacher and student were logged from the same browser and computer account - MDL-6280

changing sql calls from user_students table to role_assignments table

fixing missing bracket

replacing legacy calls

adding capabilities

SC #280 force downloading of database files; merged from MOODLE_16_STABLE

SC #280 force downloading of database files

Corrected oversight with uploaded file filters change
See http://moodle.org/mod/forum/discuss.php?d=40177

new parameter forcedownload; merged from MOODLE_15_STABLE

new parameter forcedownload

Merged from MOODLE_14_STABLE - Unlock session during fileserving.

Call new lib/filelib.php

slashargument test fix

SC#98 protection of uploaded files in resources, please review and test

Small fix that prevents large files from hogging the session... Just this
should be good for most situations but 1.4.3 maintainers feel free to
do this more comprehensively as per the moodle.org discussion on it.  ;-)

Reverting accept-ranges change, it did break PDFs on one site - see http://moodle.org/mod/forum/discuss.php?d=16465

Fix for SC44 to disallow dots in $file parameter

improved directory handling and PDF compatibility SC#5

new handling of uploaded files, please TEST, TEST, TEST

Added a file level phpdoc docblock tag. Also converted double quote strings to single quote literals.

Merged from stable

CourseID is now mandatory on file.php

Added a 404 header but it seems not to work ... not sure why not.

Remove possible path disclosure and add a translatable error message

Don't put HTML and text files through clean_text.

FIxed link after file not found error

Use forcelogin on site files if it's defined   bug 1486

Parameters fix for files.

This allows

   http://example.com/file.php/1/somefile.swf?a=xxx&b=xxxx

Thanks to Bernard Boucher!

file.php now calculates content-length correctly for filtered text and HTML files.

Bug 1240

Can now handle a  $CFG->filelifetime  to determine cacheability of files

Some security fixes with directory listing

Added an option on the filters page to control whether uploaded
files are parsed by filters.    bug 1128

Filter text files as well

If the uploaded file is HTML, then put it through the filters

Decode pathinfo in case it has encoded spaces etc in it

Displayed time formats are now stored in lang files
(see the new strftime* strings) so they can be customised per language

Bummer ... I introduced a new bug in 1.0.8.1 with pathinfo.  Fixed.

Cleaned up file argument processing a bit

Clean sweep through all the important changing all include(), include_once()
and require() to require_once()

Better error message when invalid arguments are supplied.

Added Content-disposition header to help some browsers suggest the right
filename when saving pictures and files.

Changes to use a new configuration variable: CFG->slasharguments

If true, then display of user pictures or filenames will use the
method of providing arguments as "slash" arguments - this is much
better for caching, proxies, search engines etc.  Unfortunately
it doesn't seem to work on some PHP installations.

If false (the default), then a more compatible method is used
(ie usual way of passing parameters to scripts)

Several changes related to the front page, so that it now works OK.

moodle

Initial revision