/**
* Generate a front end module and return it as string
*
* @param mixed $intId A module ID or a Model object
* @param string $strColumn The name of the column
*
* @return string The module HTML markup
*/
protected static function getFrontendModuleAjax($intId, $strColumn = 'main')
{
if (!is_object($intId) && !strlen($intId)) {
return '';
}
if (is_object($intId)) {
$objRow = $intId;
} else {
$objRow = \ModuleModel::findByPk($intId);
if ($objRow === null) {
return '';
}
}
// Check the visibility (see #6311)
if (!\Controller::isVisibleElement($objRow)) {
return '';
}
$strClass = \Module::findClass($objRow->type);
// Return if the class does not exist
if (!class_exists($strClass)) {
\System::log('Module class "' . $strClass . '" (module "' . $objRow->type . '") does not exist', __METHOD__, TL_ERROR);
return '';
}
$objRow->typePrefix = 'mod_';
$objModule = new $strClass($objRow, $strColumn);
$strBuffer = AjaxInput::get('g') == '1' ? $objModule->generate() : $objModule->generateAjax();
// HOOK: add custom logic
if (isset($GLOBALS['TL_HOOKS']['getFrontendModule']) && is_array($GLOBALS['TL_HOOKS']['getFrontendModule'])) {
foreach ($GLOBALS['TL_HOOKS']['getFrontendModule'] as $callback) {
$strBuffer = \System::importStatic($callback[0])->{$callback}[1]($objRow, $strBuffer, $objModule);
}
}
return $strBuffer;
}
/**
* Run the controller
*/
public function run()
{
$strFile = \Input::get('file', true);
if ($strFile != '') {
// Make sure there are no attempts to hack the file system
if (preg_match('@^\\.+@i', $strFile) || preg_match('@\\.+/@i', $strFile) || preg_match('@(://)+@i', $strFile)) {
header('HTTP/1.1 404 Not Found');
die('Invalid file name');
}
// Limit downloads to the files directory
if (!preg_match('@^' . preg_quote(\Config::get('uploadPath'), '@') . '@i', $strFile)) {
header('HTTP/1.1 404 Not Found');
die('Invalid path');
}
// Check whether the file exists
if (!is_file(TL_ROOT . '/' . $strFile)) {
header('HTTP/1.1 404 Not Found');
die('File not found');
}
// find the path in the database
if (($objFile = \FilesModel::findOneByPath($strFile)) !== null) {
// authenticate the frontend user
\FrontendUser::getInstance()->authenticate();
// check if file is protected
if (!\Controller::isVisibleElement($objFile)) {
$objHandler = new $GLOBALS['TL_PTY']['error_403']();
$objHandler->generate($strFile);
} elseif ($objFile->pid) {
// check if parent folders are proteced
do {
$objFile = \FilesModel::findById($objFile->pid);
if (!\Controller::isVisibleElement($objFile)) {
$objHandler = new $GLOBALS['TL_PTY']['error_403']();
$objHandler->generate($strFile);
}
} while ($objFile->pid);
}
}
// get the file
$objFile = new \File($strFile);
// Make sure no output buffer is active
// @see http://ch2.php.net/manual/en/function.fpassthru.php#74080
while (@ob_end_clean()) {
}
// Prevent session locking (see #2804)
session_write_close();
// Disable zlib.output_compression (see #6717)
@ini_set('zlib.output_compression', 'Off');
// Set headers
header('Content-Type: ' . $objFile->mime);
header('Content-Length: ' . $objFile->filesize);
// Disable maximum execution time
@ini_set('max_execution_time', 0);
// Output the file
readfile(TL_ROOT . '/' . $objFile->path);
}
// Stop the script (see #4565)
exit;
}
protected function renderModule($objChild)
{
$objModule = \ModuleModel::findByPK($objChild->module);
if ($objModule === null) {
return '';
}
if (!\Controller::isVisibleElement($objModule)) {
return '';
}
$strClass = \Module::findClass($objModule->type);
if (!class_exists($strClass)) {
$this->log('Module class "' . $GLOBALS['FE_MOD'][$objModule->type] . '" (module "' . $objModule->type . '") does not exist', 'ModuleBlock renderModule()', TL_ERROR);
return '';
}
$objModule->typePrefix = 'mod_';
if (!$objChild->addWrapper) {
$objModule = $this->overrideCommonProps($objModule, $objChild);
}
$objModule = new $strClass($objModule);
return $objModule->generate();
}
