Upgrade 1-11.38

main/template/.htaccess

@@ -0,0 +1,6 @@
+# Deny direct access to template files.
+# Templates are loaded by PHP internally via the filesystem, not via HTTP,
+# so they never need to be web-accessible.
+<FilesMatch "\.tpl$">
+    Require all denied
+</FilesMatch>

main/template/default/javascript/editor/elfinder_standalone.tpl

@@ -19,9 +19,17 @@
 
     $().ready(function() {
         var funcNum = getUrlParam('CKEditorFuncNum');
+        var sessionId = {{ session_id }};
+        // Pattern matches Chamilo's document suffix format: __<sessionId>__<groupId>
+        // First captured group is always session ID, second is always group ID.
+        var suffixPattern = /__(\d+)__(\d+)(?:\.[^.]+)?$/;
         var elf = $('#elfinder').elfinder({
             url : '{{ _p.web_lib ~ 'elfinder/connectorAction.php?' }}{{ course_condition }}',  // connector URL (REQUIRED)
             getFileCallback : function(file) {
+                var match = suffixPattern.exec(file.name);
+                if (match && parseInt(match[1]) !== 0 && parseInt(match[1]) !== sessionId) {
+                    return;
+                }
                 if (window.opener) {
                     if (window.opener.CKEDITOR) {
                         window.opener.CKEDITOR.tools.callFunction(funcNum, file.url);
@@ -36,7 +44,21 @@
             },
             startPathHash: 'l2_Lw', // Sets the course driver as default
             resizable: false,
-            lang: '{{ elfinder_lang }}'
+            lang: '{{ elfinder_lang }}',
+            handlers : {
+                open : function(event, elfinderInstance) {
+                    // Defer until after the CWD plugin has rendered the file list DOM
+                    setTimeout(function() {
+                        var files = elfinderInstance.files();
+                        for (var key in files) {
+                            var match = suffixPattern.exec(files[key].name);
+                            if (match && parseInt(match[1]) !== 0 && parseInt(match[1]) !== sessionId) {
+                                elfinderInstance.cwdHash2Elm(files[key].hash).hide();
+                            }
+                        }
+                    }, 0);
+                }
+            }
         }).elfinder('instance');
     });
 </script>