diff --git a/agent/ajax.php b/agent/ajax.php index 799c08f9c..558a8daa9 100644 --- a/agent/ajax.php +++ b/agent/ajax.php @@ -413,6 +413,54 @@ if (isset($_GET['get_canned_response'])) { } +/* + * Returns a document's rendered content for the file previewer on agent/files.php. + * + * The previewer shows files by pointing an iframe at file.php, but a document is + * rows in a table, not bytes on disk. Rather than embedding every document's + * HTML in the page payload - a folder of long documents would be megabytes of + * JSON on a page that shows two dozen tiles - it is fetched when the document is + * actually opened. + * + * Purified here rather than at save time, the same way canned responses above + * and agent/document.php do it. + */ +if (isset($_GET['get_document_content'])) { + enforceUserPermission('module_support'); + + $document_id = intval($_GET['get_document_content']); + + $document_sql = mysqli_query($mysqli, "SELECT document_client_id, document_content, document_name + FROM documents WHERE document_id = $document_id LIMIT 1"); + + $document_row = mysqli_fetch_assoc($document_sql); + + $response = []; + + if ($document_row) { + // Scope the fetch to the client the document belongs to - this endpoint + // takes an id straight from the query string + $client_id = intval($document_row['document_client_id']); + enforceClientAccess(); + + require_once "../libs/htmlpurifier/HTMLPurifier.standalone.php"; + + $document_purifier_config = HTMLPurifier_Config::createDefault(); + $document_purifier_config->set('Cache.DefinitionImpl', null); + $document_purifier_config->set('URI.AllowedSchemes', ['data' => true, 'src' => true, 'http' => true, 'https' => true]); + $document_purifier = new HTMLPurifier($document_purifier_config); + + $response['name'] = $document_row['document_name']; + $response['content'] = $document_purifier->purify($document_row['document_content']); + } else { + $response['name'] = ''; + $response['content'] = ''; + } + + echo json_encode($response); + +} + /* * Returns ordered list of active contacts for a specified client */ diff --git a/agent/file.php b/agent/file.php index 455a64f7f..edc7fc452 100644 --- a/agent/file.php +++ b/agent/file.php @@ -54,14 +54,7 @@ enforceClientAccess(); // MIME types that are safe to render inline in the browser // Everything else (esp. HTML/SVG - stored XSS risk) falls back to download -$inline_allowed_mime_types = array( - "application/pdf", - "image/png", - "image/jpeg", - "image/gif", - "image/webp", - "text/plain" -); +$inline_allowed_mime_types = getInlineViewableMimeTypes(); if ($disposition == "inline" && !in_array($file_mime_type, $inline_allowed_mime_types, true)) { $disposition = "attachment"; diff --git a/agent/files.php b/agent/files.php index 7265c98d5..8d7340cba 100644 --- a/agent/files.php +++ b/agent/files.php @@ -16,7 +16,40 @@ if (!empty($_GET['folder_id'])) { // Folder ID (used in forms/etc) $get_folder_id = $folder_id; -// View Mode -- 0 List, 1 Thumbnail (thumbnail = files only) +/* + * Type filter -- '' all, 'file' uploads only, 'document' created documents only. + * + * Whitelisted rather than trusted: it decides which of the two queries below run + * at all, so an unexpected value should mean "everything", not an empty page. + * + * Like the view mode, it rides along on every folder link - a filter that + * silently clears itself the moment you open a folder is worse than no filter. + */ +$type_filter = $_GET['type'] ?? ''; +if (!in_array($type_filter, ['file', 'document'], true)) { + $type_filter = ''; +} + +/* + * Links for the filter buttons. Built from a copy with 'type' removed so the + * new value does not land next to the old one, and with 'page' removed because + * switching filter while on page 4 of the files would otherwise open page 4 of + * a shorter list and show nothing. + */ +$type_get_copy = $_GET; +unset($type_get_copy['type'], $type_get_copy['page'], $type_get_copy['sort'], $type_get_copy['order']); +$url_query_strings_type = http_build_query($type_get_copy); +if ($url_query_strings_type !== '') { + $url_query_strings_type .= '&'; +} + +/* + * View Mode -- 0 List, 1 Grid + * + * Carried on every folder link below. Without it, opening a folder dropped the + * parameter and the page fell back to list view, so picking grid only lasted + * until the next click. + */ if (!empty($_GET['view'])) { $view = intval($_GET['view']); } else { @@ -80,13 +113,13 @@ function isAncestorFolder($folder_id, $current_folder_id, $client_id) { } function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root = false) { - global $mysqli, $get_folder_id, $session_user_role, $archive_query, $archived, $num_root_items, $folders_expanded; + global $mysqli, $get_folder_id, $session_user_role, $archive_query, $archived, $num_root_items, $folders_expanded, $view, $type_filter; // Always render root (only once) if ($parent_folder_id == 0 && $indent == 0) { echo '
  • '; echo ''; + echo ' href="?client_id=' . $client_id . '&folder_id=0&view=' . $view . '&type=' . $type_filter . '&archived=' . $archived . '&folders_expanded=' . $folders_expanded . '">'; echo '/'; if ($num_root_items > 0) { @@ -153,7 +186,7 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root echo ''; + echo ' href="?client_id=' . $client_id . '&folder_id=' . $folder_id . '&view=' . $view . '&type=' . $type_filter . '&archived=' . $archived . '&folders_expanded=' . $folders_expanded . '">'; if ($on_active_path) { echo ''; @@ -213,46 +246,93 @@ function displayFolders($parent_folder_id, $client_id, $indent = 0, $render_root // --------------------------------------------- // DATA LOAD -// view=1 (thumbs) uses original files-only query +// view=1 (grid) - every file in the folder, thumbnail or file-type icon // view=0 (list) loads ALL files+documents, merges, sorts in PHP // --------------------------------------------- $items = []; $num_rows = [0]; +// Both views decide previewability from this, so it is set before the branch - +// it used to be assigned inside the grid arm only, which left the list arm +// passing null to in_array() +$inline_viewable_mime_types = getInlineViewableMimeTypes(); + if ($view == 1) { - // Thumbnail view - only image files, similar to original behavior - $query_images = "AND (file_ext LIKE 'JPG' OR file_ext LIKE 'jpg' OR file_ext LIKE 'JPEG' OR file_ext LIKE 'jpeg' OR file_ext LIKE 'png' OR file_ext LIKE 'PNG' OR file_ext LIKE 'webp' OR file_ext LIKE 'WEBP')"; + /* + * GRID VIEW: files AND documents, same as the list view beside it. + * + * This used to be a single files-only query with SQL_CALC_FOUND_ROWS and a + * LIMIT. Two sources cannot be paginated by one LIMIT, so it now mirrors + * exactly what the list view does: fetch both unpaginated, merge, sort by + * name, and slice in PHP. That also fixes the grid quietly omitting every + * created document - they were only ever visible in list view. + */ + $safe_q = mysqli_real_escape_string($mysqli, $q); if ($get_folder_id == 0 && isset($_GET["q"])) { - $sql = mysqli_query( - $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM files - LEFT JOIN users ON file_created_by = user_id - WHERE file_client_id = $client_id - AND file_$archive_query - AND (file_name LIKE '%$q%' OR file_ext LIKE '%$q%' OR file_description LIKE '%$q%') - $query_images - ORDER BY file_name ASC - LIMIT $record_from, $record_to" - ); + $file_folder_snippet = ""; // search across all folders + $doc_folder_snippet = ""; } else { - $sql = mysqli_query( + $file_folder_snippet = "AND file_folder_id = $folder_id"; + $doc_folder_snippet = "AND document_folder_id = $folder_id"; + } + + $file_search_snippet = ""; + $doc_search_snippet = ""; + if (!empty($q)) { + $file_search_snippet = "AND (file_name LIKE '%$safe_q%' OR file_ext LIKE '%$safe_q%' OR file_description LIKE '%$safe_q%')"; + $doc_search_snippet = "AND (MATCH(document_content_raw) AGAINST ('$safe_q') OR document_name LIKE '%$safe_q%')"; + } + + // Skipped outright when the type filter excludes them + $sql_grid_files = false; + if ($type_filter !== 'document') { + $sql_grid_files = mysqli_query( $mysqli, - "SELECT SQL_CALC_FOUND_ROWS * FROM files + "SELECT files.*, users.user_name + FROM files LEFT JOIN users ON file_created_by = user_id WHERE file_client_id = $client_id - AND file_folder_id = $folder_id AND file_$archive_query - AND (file_name LIKE '%$q%' OR file_ext LIKE '%$q%' OR file_description LIKE '%$q%') - $query_images - ORDER BY file_name ASC - LIMIT $record_from, $record_to" + $file_folder_snippet + $file_search_snippet" ); } - $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()")); + $sql_grid_documents = false; + if ($type_filter !== 'file') { + $sql_grid_documents = mysqli_query( + $mysqli, + "SELECT documents.*, users.user_name + FROM documents + LEFT JOIN users ON document_created_by = user_id + WHERE document_client_id = $client_id + AND document_$archive_query + $doc_folder_snippet + $doc_search_snippet" + ); + } + + while ($sql_grid_files && ($row = mysqli_fetch_assoc($sql_grid_files))) { + $row['grid_kind'] = 'file'; + $items[] = $row; + } + + while ($sql_grid_documents && ($row = mysqli_fetch_assoc($sql_grid_documents))) { + $row['grid_kind'] = 'document'; + $items[] = $row; + } + + usort($items, function ($a, $b) { + $a_name = strtolower($a['grid_kind'] === 'file' ? $a['file_name'] : $a['document_name']); + $b_name = strtolower($b['grid_kind'] === 'file' ? $b['file_name'] : $b['document_name']); + return strcmp($a_name, $b_name); + }); + + $num_rows = [count($items)]; + $items = array_slice($items, $record_from, $record_to); } else { @@ -280,8 +360,11 @@ if ($view == 1) { $doc_search_snippet = "AND (MATCH(document_content_raw) AGAINST ('$safe_q') OR document_name LIKE '%$safe_q%')"; } - // Files query (NO limit - we'll paginate in PHP) - $sql_files = mysqli_query( + // Files query (NO limit - we'll paginate in PHP). Skipped outright when the + // type filter excludes files, rather than fetching rows to throw away. + $sql_files = false; + if ($type_filter !== 'document') { + $sql_files = mysqli_query( $mysqli, "SELECT files.*, users.user_name FROM files @@ -290,10 +373,13 @@ if ($view == 1) { AND file_$archive_query $file_folder_snippet $file_search_snippet" - ); + ); + } // Documents query (NO limit - paginate in PHP) - $sql_documents = mysqli_query( + $sql_documents = false; + if ($type_filter !== 'file') { + $sql_documents = mysqli_query( $mysqli, "SELECT documents.*, users.user_name FROM documents @@ -302,10 +388,11 @@ if ($view == 1) { AND document_$archive_query $doc_folder_snippet $doc_search_snippet" - ); + ); + } // Normalize FILES into $items - while ($row = mysqli_fetch_assoc($sql_files)) { + while ($sql_files && ($row = mysqli_fetch_assoc($sql_files))) { $file_id = intval($row['file_id']); $file_name = escapeHtml($row['file_name']); $file_description = escapeHtml($row['file_description']); @@ -349,6 +436,7 @@ if ($view == 1) { 'description' => $file_description, 'reference_name' => $file_reference_name, 'icon' => $file_icon, + 'ext' => $file_ext, 'mime' => $file_mime_type, 'size' => $file_size, 'created_at' => $file_created_at, @@ -358,7 +446,7 @@ if ($view == 1) { } // Normalize DOCUMENTS into $items - while ($row = mysqli_fetch_assoc($sql_documents)) { + while ($sql_documents && ($row = mysqli_fetch_assoc($sql_documents))) { $document_id = intval($row['document_id']); $document_name = escapeHtml($row['document_name']); $document_description = escapeHtml($row['document_description']); @@ -501,6 +589,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    + @@ -515,6 +604,11 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    +
    + " title="Files and documents">All + " title="Uploaded files only">Files + " title="Created documents only">Docs +
    " title="List View"> " title="Grid View"> @@ -566,7 +660,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    + $file_id, + 'name' => basename($file_name), + 'kind' => ($file_mime_type === 'application/pdf') ? 'pdf' + : (($file_mime_type === 'text/plain' || $file_mime_type === 'application/json') ? 'text' : 'image'), + 'icon' => $file_icon, + 'ext' => strtoupper($file_ext), + 'size' => $file_size_human, + 'excerpt' => '', + 'preview' => "file.php?file_id=$file_id&action=view", + 'download' => "file.php?file_id=$file_id", + 'action' => 'Download' + ]; + } + ?> - + = 0) { ?> + + + +
    @@ -864,9 +1169,12 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])
    +
    - +

    @@ -877,7 +1185,7 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num'])

    - Document + Document - @@ -956,6 +1264,16 @@ $num_root_items = intval($row_root_files['num']) + intval($row_root_docs['num']) + + +
    @@ -971,8 +1289,74 @@ function openModal(index) { } function updateModalContent() { - document.getElementById('modalTitle').innerText = files[currentIndex].name; - document.getElementById('modalImage').src = files[currentIndex].preview; + var file = files[currentIndex]; + var image = document.getElementById('modalImage'); + var frame = document.getElementById('modalFrame'); + var fallback = document.getElementById('modalFallback'); + var text = document.getElementById('modalText'); + var docPanel = document.getElementById('modalDocument'); + + document.getElementById('modalTitle').innerText = file.name; + document.getElementById('modalMeta').innerText = file.size ? (file.ext + ' \u00b7 ' + file.size) : file.ext; + var action = document.getElementById('modalDownload'); + action.href = file.download; + action.innerHTML = '' + file.action; + document.getElementById('modalPosition').innerText = (currentIndex + 1) + ' of ' + files.length; + + // Blank the previous file's source before switching panels, or a heavy PDF + // keeps rendering behind the next image until the browser gets round to it + image.classList.add('d-none'); + image.removeAttribute('src'); + frame.classList.add('d-none'); + frame.removeAttribute('src'); + fallback.classList.add('d-none'); + text.classList.add('d-none'); + docPanel.classList.add('d-none'); + docPanel.innerHTML = ''; + + if (file.kind === 'document') { + + /* + * Fetched rather than carried in the page payload - see the endpoint's + * note in ajax.php. The index is captured so a fast click through to the + * next file does not get overwritten by a response that arrives late. + */ + var requestedIndex = currentIndex; + docPanel.innerHTML = '

    Loading...

    '; + docPanel.classList.remove('d-none'); + + fetch(file.preview, { headers: { 'X-Requested-With': 'XMLHttpRequest' } }) + .then(function (r) { return r.json(); }) + .then(function (data) { + if (requestedIndex !== currentIndex) { + return; + } + // The endpoint returns HTMLPurifier output, which is what + // document.php renders too + docPanel.innerHTML = data.content || '

    This document is empty.

    '; + }) + .catch(function () { + if (requestedIndex === currentIndex) { + docPanel.innerHTML = '

    Could not load this document.

    '; + } + }); + + } else if (file.kind === 'image') { + image.src = file.preview; + image.alt = file.name; + image.classList.remove('d-none'); + } else if (file.kind === 'pdf' || file.kind === 'text') { + frame.src = file.preview; + frame.classList.remove('d-none'); + } else { + document.getElementById('modalFallbackIcon').className = 'fas fa-' + file.icon + ' fa-4x text-secondary'; + fallback.classList.remove('d-none'); + } + + // One file in the folder means nothing to page through + var single = files.length < 2; + document.getElementById('modalPrev').classList.toggle('d-none', single); + document.getElementById('modalNext').classList.toggle('d-none', single); } function nextFile() { @@ -984,6 +1368,19 @@ function prevFile() { currentIndex = (currentIndex - 1 + files.length) % files.length; updateModalContent(); } + +// Arrow keys page the gallery while the preview is open +document.addEventListener('keydown', function (e) { + var modal = document.getElementById('viewFileModal'); + if (!modal || !modal.classList.contains('show') || files.length < 2) { + return; + } + if (e.key === 'ArrowRight') { + nextFile(); + } else if (e.key === 'ArrowLeft') { + prevFile(); + } +}); diff --git a/agent/modals/file/file_view.php b/agent/modals/file/file_view.php index 9b0579a53..3e8bec780 100644 --- a/agent/modals/file/file_view.php +++ b/agent/modals/file/file_view.php @@ -1,23 +1,66 @@ +