audit.prg

<?php
/**
 * File: audit.prg
 * Used for showing audit and financials of HomeCU.
 */

$string = array("filter" => HCUFILTER_INPUT_STRING);
$parameters = array("a" => array("operation" => ""));
HCU_ImportVars($parameters, "a", array("operation" => $string, "fileIndex" => $string));
extract($parameters["a"]);

$operation = isset($operation) ? trim($operation) : "";
$fileIndex = isset($fileIndex) ? trim($fileIndex) : "";

/**
 * function GetTocFile()
 * @return the filename of the table of contents file (string).
 */
function GetTocFile() {
    return "duediligence.toc";
}

/**
 * function GetAuditDir()
 * @return the directory of the audit files (string).
 */
function GetAuditDir() {
    return "/home/homecu/audit";
}

/**
 * function GetSelf()
 * @return the URL of this script (string).
 */
function GetSelf() {
    return "main.prg?ft=14";
}

/**
 * @var operation
 * Based on the value of operation (string), either show the file or show the table of contents.
 */
switch ($operation) {
    case "showFile":
        ShowFile($fileIndex);
        break;
    case "":
        PrintPage(GetFileList());
        break;
}

/**
 * function GetFileList()
 * This function gets the list of files from the table of contents file.  Blank lines are escaped and file is assumed to be in a CSV format.
 * This file will contain a comma separated name value pair of files that can be shown to admin user.
 *
 * @return array with "list", "error", and "code".
 * "List" will contain information about what is in the table of contents file: The text to display for the link, the filename to retrieve from the server, and the type of the file.
 * "Error" will contain a string if there is an error.  Otherwise, it will be a blank string.
 * "Code" will be zero if there isn't an error.  Otherwise, it will be zero.
 */
function GetFileList() {
    try {
        $auditDir = GetAuditDir();
        $tocFile = GetTocFile();
        $fullFile = "$auditDir/$tocFile";

        if (!is_readable($fullFile)) {
            throw new exception("File is not readable.", 2); // If the directory doesn't exist (i.e. branch is changed without rebuilding, error in the console.  Let's control the error.)
        }

        $tocFP = fopen($fullFile, "r");
        $fileList = array();

        if (!$tocFP) {
            throw new exception("File handle is not found.", 1);
        }

        while (($row = fgetcsv($tocFP)) !== false) {
            // Blank line.  According to the documentation: "A blank line in a CSV file will be returned as an array comprising a single null field, and will not be treated as an error."
            if (count($row) == 1 && !isset($row[0])) {
                continue;
            }

            // Also skip over lines that are not formatted correctly.  In this case, the file will not be able to retrieved so it doesn't appear in the list.
            if (count($row) < 3) {
                continue;
            }

            $fileList[] = array("text" => $row[0], "filename" => $row[1], "filetype" => $row[2]);
        }

        return array("list" => $fileList, "error" => "", "code" => 0);
    } catch (exception $e) {
        return array("list" => array(), "error" => $e->getMessage(), "code" => $e->getCode());
    }
}

/**
 * function ShowFile($fileIndex)
 * This function will show the file if a file exists and is accessible.  Otherwise, it will show a message that the file is not found.
 *
 * @param $fileIndex -- this is an integer corresponding to the index of the file in the table of contents.
 * @return nothing but prints out the file or displays a file not found error.
 */
function ShowFile($fileIndex) {
    try {
        $auditDir = GetAuditDir();
        $fileList = GetFileList();

        if ($fileList["code"] != 0) {
            throw new exception("File list handle was not found.", 1);
        }

        $fileList = $fileList["list"];

        if (!HCU_array_key_exists($fileIndex, $fileList)) {
            throw new exception("File index was not found.", 2);
        }

        $fileRow = $fileList[$fileIndex];

        if ($fileRow["filename"] == "") {
            throw new exception("Filename is not set.", 4); // If the filename is empty, then it is not allowed.  "$auditDir/" IS readable (as the directory.)
        }

        if (basename($fileRow["filename"]) != $fileRow["filename"]) {
            throw new exception("Do not allow filename to traverse the filesystem.", 5); // Prevent using /../ to get to the parent directory.
        }

        $file = realpath("$auditDir/" . $fileRow["filename"]); // Ensure that the space is part of the filename.  A filename like "With Spaces" or like " " works.

        if (!is_readable($file)) {
            throw new exception("File is not readable.", 3);
        }

        switch($fileRow["filetype"]) { // At this current time, PDFs are the only acceptable filetype.  This is also the case in the mammoth version.
            case "pdf":
                $fileContents = file_get_contents($file);
                $exgmt = gmdate("D M d Y H:i:s", time() + 60);
                header("Expires: $exgmt GMT");
                header("Content-type: application/pdf"); // add here more headers for diff. extensions
                header("Content-Disposition: inline; filename=\"" . $fileRow["text"] . ".pdf\""); // use 'attachment' to force a download
                header('Content-Transfer-Encoding: binary');

                print $fileContents;
                exit;
            default:
                throw new exception("File is not in a format this script handles.", 4);
                break;
        }


    } catch (exception $e) {
        PrintNotFoundFilePage();
    }
}

/**
 * function PrintNotFoundFilePage()
 * @return nothing but prints out the file not found error.
 * NOTE: at this point, it is "just script" so cannot use bootstrap formatting.
 */
function PrintNotFoundFilePage() { ?>
    <html>
        <head>
            <title>404 Not Found</title>
        </head>
        <body>
            <h1>Not Found</h1>
            <p>The requested file was not found on the server.</p>
            <hr>
        </body>
    </html>
<?php }

/**
 * function PrintPage($fileList)
 * @param $fileList -- an array of files read from the table of contents file.
 * @return nothing but prints out the page: confidence notice and then links for the files in the table of contents file.
 */
function PrintPage($fileList) {
    $self = GetSelf(); ?>
    <div class="container-fluid userAlertsDiv vsgPrimary" id="auditDiv">
        <div class="row">
            <div id="formValidateAlertsDiv" class="k-block k-error-colored formValidateDiv" style="display:none;"></div>
        </div>
        <div class="well well-sm">
            <div class="row">
                <h3 class="col-xs-12">Confidentially Notice</h3>
            </div>
            <div class="row">
                <div class="col-xs-12">
                This Confidential Information is intended solely for Home CU, LLC., customers and their employees, agents, consultants, subcontractors, or regulatory agencies. Any review, retransmission, dissemination or other use of this information by persons or entities other than the intended recipient is prohibited.
                </div>
            </div>
            <div class="row">
                <div class="col-xs-12">
                    By clicking the link below you agree to these confidentiality terms.
                </div>
            </div>
        </div>
        <div class="well well-sm">
            <?php if ($fileList["code"] != 0 || count($fileList["list"]) == 0) { ?>
                <div class="row hcu-secondary">
                    <div class="col-xs-12 vsgSecondary hcu-note">
                        No files were found.
                    </div>
                </div>
            <?php } else { ?>
                <div class="row">
                    <?php foreach ($fileList["list"] as $index => $fileRow) { ?>
                        <a class="col-xs-12" href="<?php echo $self; ?>&operation=showFile&fileIndex=<?php echo $index; ?>" target="HCUaudit"><?php echo $fileRow["text"]; ?></a>
                    <?php } ?>
                </div>
            <?php } ?>
        </div>
    </div>
<?php }