Cracking The Vault (part 2) - Room With A View
(Page 3 of 7 )
You'll remember that users also have the ability to view the most current version of a document, regardless of whether or not they can check it out.
<!-- from details.php -->
<td align="center"><a href="view.php?id=<? echo $id; ?> "><img
src="images/view.jpg" width=40 height=40 alt="" border="0"><br><font
size="-1">View Document</font></a></td>
The manner in which this is handled is almost identical
to the check-out process, except that this time, I'm calling "view.php" instead of "check-out.php". And "view.php" does the same thing as "check-out.php", initiating an immediate file download. However, since downloading a file for viewing should not render it inaccessible to other users, "view.php" does not UPDATE the database, leaving the file status field as is.
Here's "view.php".
<?
// view.php - performs download without updating database
// checks and includes
// verify again that user has view rights
$connection = mysql_connect($hostname, $user, $pass) or die ("Unable to
connect!");
$query = "SELECT id, realname FROM data, perms WHERE id = '$id' AND
perms.rights = '1' AND perms.uid = '$SESSION_UID' AND perms.fid = data.id";
// all checks completed
// form not yet submitted
// display information on how to initiate download
if (!$submit)
{
?>
<html>
<head>
<basefont face="Verdana">
</head>
<body bgcolor="white">
<? include("menu.inc");?>
<table width="100%" border="0" cellspacing="0" cellpadding="3">
<tr>
<td bgcolor="#0000A0">
<b><font face="Arial" color="White">View Document</font></b>
</td>
</tr>
</table>
<p>
<form action="<? echo $PHP_SELF?>" method="post">
<input type="hidden" name="id" value="<? echo $id; ?>">
<input type="submit" name="submit" value="Click here"> to begin
downloading the selected document to your local workstation.
</form>
Once the document has completed downloading, you may <a
href="out.php">continue browsing</a> The Vault.
</body>
</html>
<?
}
// form submitted - begin download
else
{
list($id, $realname) = mysql_fetch_row($result);
mysql_free_result($result);
// get the filename
$filename = $dataDir . $id . ".dat";
// send headers to browser to initiate file download
header ("Content-Type: application/octet-stream");
header ("Content-Disposition: attachment; filename=$realname");
readfile($filename);
}
}
// clean up
mysql_close($connection);
?>
This article copyright Melonfire 2001. All rights reserved.Next: All Revved Up >>
More PHP Articles
More By Vikram Vaswani, (c) Melonfire
