65 lines
1.9 KiB
PHP
65 lines
1.9 KiB
PHP
<?php
|
|
|
|
use ProcessMaker\Model\User;
|
|
|
|
if (($RBAC_Response = $RBAC->userCanAccess( "PM_LOGIN" )) != 1) {
|
|
return $RBAC_Response;
|
|
}
|
|
|
|
// Validate transversal path in pUID parameter
|
|
$pUID = basename($_REQUEST['pUID']); // Elimina path traversal
|
|
$pUID = preg_replace('/[^a-zA-Z0-9_-]/', '', $pUID); // Solo caracteres seguros
|
|
|
|
if (empty($pUID)) {
|
|
$filename = PATH_HOME . 'public_html/images/user.gif';
|
|
} else {
|
|
$filename = PATH_IMAGES_ENVIRONMENT_USERS . $pUID . ".gif";
|
|
}
|
|
|
|
// Verify if user image exists, if not, try to get it by USR_UID, if still not found, use default user image
|
|
if (!file_exists($filename)) {
|
|
$user = new User();
|
|
$filters = array(
|
|
'limit' => 1,
|
|
'fields' => ['USR_UID'],
|
|
'conditions' => [['USR_ID', '=', $pUID]]
|
|
);
|
|
$result = $user->show($filters);
|
|
if ($result['total'] == 1){
|
|
$filename = PATH_IMAGES_ENVIRONMENT_USERS . $result['data'][0]['USR_UID'] . ".gif";
|
|
if (!file_exists($filename)) {
|
|
$filename = PATH_HOME . 'public_html/images/user.gif';
|
|
}
|
|
} else {
|
|
$filename = PATH_HOME . 'public_html/images/user.gif';
|
|
}
|
|
}
|
|
|
|
// Verify if file exists, if not, return 404
|
|
if (! file_exists( $filename )) {
|
|
header('HTTP/1.1 404 Not Found');
|
|
exit();
|
|
}
|
|
|
|
// Get file info
|
|
$lastModified = filemtime($filename);
|
|
$fileSize = filesize($filename);
|
|
$etag = md5($fileSize . $lastModified . $filename);
|
|
|
|
header('Content-Type: image/gif');
|
|
header('ETag: "' . $etag . '"');
|
|
header('Last-Modified: ' . gmdate('D, d M Y H:i:s', $lastModified) . ' GMT');
|
|
header('Content-Length: ' . $fileSize);
|
|
header('Cache-Control: public, must-revalidate, max-age=300'); // 5 min cache
|
|
|
|
// Validate Client eTAg
|
|
$clientEtag = isset($_SERVER['HTTP_IF_NONE_MATCH']) ? trim($_SERVER['HTTP_IF_NONE_MATCH']) : '';
|
|
if ($clientEtag === '"' . $etag . '"') {
|
|
header('HTTP/1.1 304 Not Modified');
|
|
exit;
|
|
}
|
|
|
|
// Show image
|
|
readfile($filename);
|
|
exit();
|