controllers/api/file/FileApiHandler.inc.php

<?php
// Import the base handler.
import('classes.handler.Handler');
import('lib.pkp.classes.core.JSONMessage');

class FileApiHandler extends Handler {

   function FileApiHandler() {
      parent::Handler();
      $this->addRoleAssignment(
         array(ROLE_ID_PRESS_MANAGER, ROLE_ID_SERIES_EDITOR, ROLE_ID_PRESS_ASSISTANT, ROLE_ID_REVIEWER, ROLE_ID_AUTHOR),
         array('downloadFile', 'downloadLibraryFile', 'viewFile', 'downloadAllFiles', 'recordDownload', 'enableLinkAction')
      );
   }


   //
   // Implement methods from PKPHandler
   //
   function authorize(&$request, $args, $roleAssignments) {
      $monographFilesIds = $request->getUserVar('filesIdsAndRevisions');
      $libraryFileId = $request->getUserVar('libraryFileId');

      import('classes.security.authorization.OmpMonographFileAccessPolicy');

      if (is_string($monographFilesIds)) {
         $monographFilesIdsArray = explode(';', $monographFilesIds);
         array_pop($monographFilesIdsArray);
      }
      if (!empty($monographFilesIdsArray)) {
         $multipleMonographFileAccessPolicy = new PolicySet(COMBINING_DENY_OVERRIDES);
         foreach ($monographFilesIdsArray as $fileIdAndRevision) {
            $multipleMonographFileAccessPolicy->addPolicy(new OmpMonographFileAccessPolicy($request, $args, $roleAssignments, MONOGRAPH_FILE_ACCESS_READ, $fileIdAndRevision));
         }
         $this->addPolicy($multipleMonographFileAccessPolicy);
      }else if (is_numeric($libraryFileId)) {
         import('classes.security.authorization.OmpPressAccessPolicy');
         $this->addPolicy(new OmpPressAccessPolicy($request, $roleAssignments));
      }else {
         $this->addPolicy(new OmpMonographFileAccessPolicy($request, $args, $roleAssignments, MONOGRAPH_FILE_ACCESS_READ));
      }

      return parent::authorize($request, $args, $roleAssignments);
   }

   //
   // Public handler methods
   //
   function downloadFile($args, &$request) {
      $monographFile =& $this->getAuthorizedContextObject(ASSOC_TYPE_MONOGRAPH_FILE);
      assert($monographFile); // Should have been validated already
      import('classes.file.MonographFileManager');
      $press =& $request->getPress();
      $monographFileManager = new MonographFileManager($press->getId(), $monographFile->getMonographId());
      $monographFileManager->downloadFile($monographFile->getFileId(), $monographFile->getRevision());
   }

   function downloadLibraryFile($args, &$request) {
      import('classes.file.LibraryFileManager');
      $press =& $request->getPress();
      $libraryFileManager = new LibraryFileManager($press->getId());
      $libraryFileDao =& DAORegistry::getDAO('LibraryFileDAO');
      $libraryFile =& $libraryFileDao->getById($request->getUserVar('libraryFileId'));
      if ($libraryFile) {

         // If this file has a monograph ID, ensure that the current
         // user is assigned to that submission.
         if ($libraryFile->getMonographId()) {
            $user =& $request->getUser();
            $allowedAccess = false;
            $userStageAssignmentDao =& DAORegistry::getDAO('UserStageAssignmentDAO');
            $assignedUsers = $userStageAssignmentDao->getUsersBySubmissionAndStageId($libraryFile->getMonographId(), WORKFLOW_STAGE_ID_SUBMISSION);
            if (!$assignedUsers->wasEmpty()) {
               while ($assignedUser =& $assignedUsers->next()) {
                  if ($assignedUser->getId()  == $user->getId()) {
                     $allowedAccess = true;
                     break;
                  }
               }
            }
         } else {
            $allowedAccess = true; // this is a Press submission document, default to access policy.
         }

         if ($allowedAccess) {
            $filePath = $libraryFileManager->getBasePath() .  $libraryFile->getOriginalFileName();
            $libraryFileManager->downloadFile($filePath);
         } else {
            fatalError('Unauthorized access to library file.');
         }
      }
   }

   function viewFile($args, &$request) {
      $monographFile =& $this->getAuthorizedContextObject(ASSOC_TYPE_MONOGRAPH_FILE);
      assert($monographFile); // Should have been validated already
      import('classes.file.MonographFileManager');
      $press =& $request->getPress();
      $monographFileManager = new MonographFileManager($press->getId(), $monographFile->getMonographId());
      $monographFileManager->downloadFile($monographFile->getFileId(), $monographFile->getRevision(), true);
   }

   function downloadAllFiles($args, &$request) {
      // Retrieve the authorized objects.
      $monographFiles = $this->getAuthorizedContextObject(ASSOC_TYPE_MONOGRAPH_FILES);
      $monograph =& $this->getAuthorizedContextObject(ASSOC_TYPE_MONOGRAPH);

      // Find out the paths of all files in this grid.
      import('classes.file.MonographFileManager');
      $monographFileManager = new MonographFileManager($monograph->getPressId(), $monograph->getId());
      $filesDir = $monographFileManager->getBasePath();
      $filePaths = array();
      foreach ($monographFiles as $monographFile) {
         // Remove absolute path so the archive doesn't include it (otherwise all files are organized by absolute path)
         $filePaths[] = str_replace($filesDir, '', $monographFile->getFilePath());

         unset($monographFile);
      }

      import('lib.pkp.classes.file.FileArchive');
      $fileArchive = new FileArchive();
      $archivePath = $fileArchive->create($filePaths, $filesDir);

      if (file_exists($archivePath)) {
         $fileManager = new FileManager();
         if ($fileArchive->zipFunctional()) {
            $fileManager->downloadFile($archivePath, 'application/x-zip', false, 'files.zip');
         } else {
            $fileManager->downloadFile($archivePath, 'application/x-gtar', false, 'files.tar.gz');
         }
         $fileManager->deleteFile($archivePath);
      } else {
         fatalError('Creating archive with submission files failed!');
      }
   }

   function recordDownload($args, &$request) {
      $monographFiles = $this->getAuthorizedContextObject(ASSOC_TYPE_MONOGRAPH_FILES);
      $fileId = null;

      foreach ($monographFiles as $monographFile) {
         import('classes.file.MonographFileManager');
         MonographFileManager::recordView($monographFile);
         $fileId = $monographFile->getFileId();
         unset($monographFile);
      }

      if (count($monographFiles) > 1) {
         $fileId = null;
      }

      return $this->enableLinkAction($args, $request);
   }

   function enableLinkAction($args, &$request) {
      return DAO::getDataChangedEvent();
   }
}

?>