This change implements the print_proxy method. This method allows a 1 time

security bypass for the remote print processor to retrieve the fullsize image.

2 files changed, 27 insertions, 13 deletions

diff --git a/modules/digibug/controllers/digibug.php b/modules/digibug/controllers/digibug.php
index f90b88e2..b0807aa5 100644
--- a/modules/digibug/controllers/digibug.php
+++ b/modules/digibug/controllers/digibug.php
@@ -51,24 +51,43 @@ class Digibug_Controller extends Controller {
       "thumb_width_1" => $item->thumb_width,
       "title" => $item->title);
 
-    Kohana::log("error", Kohana::debug($digibug_parms));
-
     message::success(
       t("Photo '%title' was submitted for printing.", array("title" => $item->title)));
     print json_encode(array("result" => "success", "reload" => 1));
   }
 
   public function print_proxy($id, $thumb=null) {
+    $proxy = ORM::factory("proxy")
+      ->where("uuid", $id)
+      ->find();
+
+    if (!$proxy->loaded) {
+      Kohana::show_404();
+    }
+
+    if (!$proxy->item->loaded) {
+      Kohana::show_404();
+    }
+
+    $file = empty($thumb) ? $proxy->item->file_path() : $proxy->item->thumb_path();
+    if (!file_exists($file)) {
+      kohana::show_404();
+    }
 
     // We don't need to save the session for this request
     Session::abort_save();
 
     // Dump out the image
-    header("Content-Type: $item->mime_type");
+    header("Content-Type: $proxy->item->mime_type");
     Kohana::close_buffers(false);
     $fd = fopen($file, "rb");
     fpassthru($fd);
     fclose($fd);
+
+    // If the request was for the image and not the thumb, then delete the proxy.
+    if (empty($thumb)) {
+      $proxy->delete();
+    }
   }
 
 }
\ No newline at end of file
diff --git a/modules/digibug/helpers/digibug_theme.php b/modules/digibug/helpers/digibug_theme.php
index 2e44b115..0fe2ce2e 100644
--- a/modules/digibug/helpers/digibug_theme.php
+++ b/modules/digibug/helpers/digibug_theme.php
@@ -32,16 +32,11 @@ class digibug_theme_Core {
 
   static function thumb_bottom($theme, $child) {
     if ($theme->page_type() == "album" && $child->type == "photo") {
-      $csrf = access::csrf_token();
-      $return = "album/{$child->parent()->id}";
-      $href = url::site("digibug/print_photo/$child->id?csrf={$csrf}&return=$return");
-      $title = t("Print photo with Digibug");
-      return "<div class=\"gDigibugPrintButton\">
-                <a class=\"gButtonLink ui-corner-all ui-state-default ui-icon-left\" href=\"$href\"
-                   title=\"$title\">
-                  <span class=\"ui-icon ui-icon-print\">$title</span>
-                </a>
-             </div>";
+      $v = new View("digibug_album.html");
+      $v->id = $child->id;
+      $v->return = "album/{$child->parent()->id}";
+      $v->title = t("Print photo with Digibug");
+      return $v->render();
     }
     return "";
   }