← All changes | framework/access-points/access-point.class.php +87 -55 11.7 → 12.0.4 View file →

		@@ -1,7 +1,7 @@
1	1	<?php
2	2	/**
3		-*
	3	+*
4	4	*/
5	5
6	6	// Disallow direct access.
7	7	defined('ABSPATH') or die("Access denied");
		@@ -9,60 +9,60 @@
9	9	/**
10	10	* Access Point interface
11	11	*/
12	12	interface CJTIAccessPoint {
13		-
	13	+
14	14	/**
15	15	* put your comment there...
16		- *
	16	+ *
17	17	*/
18	18	public function listen();
19		-
	19	+
20	20	}
21	21
22	22	/**
23		-*
	23	+*
24	24	*/
25	25	abstract class CJTAccessPoint extends CJTHookableClass implements CJTIAccessPoint {
26		-
	26	+
27	27	/**
28	28	* put your comment there...
29		- *
	29	+ *
30	30	* @var mixed
31	31	*/
32	32	protected static $connected;
33		-
	33	+
34	34	/**
35	35	* put your comment there...
36		- *
	36	+ *
37	37	* @var mixed
38	38	*/
39	39	protected $controller;
40		-
	40	+
41	41	/**
42	42	* put your comment there...
43		- *
	43	+ *
44	44	* @var mixed
45	45	*/
46	46	protected $controllerName;
47		-
	47	+
48	48	/**
49	49	* put your comment there...
50		- *
	50	+ *
51	51	* @var mixed
52	52	*/
53	53	protected $name;
54		-
	54	+
55	55	/**
56	56	* put your comment there...
57		- *
	57	+ *
58	58	* @var mixed
59	59	*/
60	60	protected $onconnected = array('parameters' => array('state'));
61		-
	61	+
62	62	/**
63	63	* put your comment there...
64		- *
	64	+ *
65	65	* @var mixed
66	66	*/
67	67	protected $ongetdefaultcontrollername = array('parameters' => array('controller'));
68	68
		@@ -67,44 +67,44 @@
67	67	protected $ongetdefaultcontrollername = array('parameters' => array('controller'));
68	68
69	69	/**
70	70	* put your comment there...
71		- *
	71	+ *
72	72	* @var mixed
73	73	*/
74	74	protected $onlisten = array('hookType' =>CJTWordpressEvents::HOOK_ACTION);
75		-
	75	+
76	76	/**
77	77	* put your comment there...
78		- *
	78	+ *
79	79	* @var mixed
80	80	*/
81	81	protected $onsetcontroller = array('parameters' => array('controller'));
82		-
	82	+
83	83	/**
84	84	* put your comment there...
85		- *
	85	+ *
86	86	* @var mixed
87	87	*/
88	88	protected $overrideControllersPath = null;
89		-
	89	+
90	90	/**
91	91	* put your comment there...
92		- *
	92	+ *
93	93	* @var mixed
94	94	*/
95	95	protected $overrideControllersPrefix = null;
96		-
	96	+
97	97	/**
98	98	* put your comment there...
99		- *
	99	+ *
100	100	* @var mixed
101	101	*/
102	102	protected $pageId = CJTPlugin::PLUGIN_REQUEST_ID;
103		-
	103	+
104	104	/**
105	105	* put your comment there...
106		- *
	106	+ *
107	107	*/
108	108	public function __construct($defaultController = 'blocks') {
109	109	// Initialize Hookable.
110	110	parent::__construct();
		@@ -110,18 +110,50 @@
110	110	parent::__construct();
111	111	// Overrides controllers path using current Access Point model class path
112	112	$accessPointClassLoader =& CJT_Framework_Autoload_Loader::findClassLoader(get_class($this));
113	113	if ($accessPointClassLoader) {
114		- $this->overrideControllersPath = $accessPointClassLoader->getPath() . DIRECTORY_SEPARATOR . 'controllers';
	114	+ $this->overrideControllersPath = $accessPointClassLoader->getPath() . DIRECTORY_SEPARATOR . 'controllers';
115	115	$this->overrideControllersPrefix = $accessPointClassLoader->getPrefix();
116	116	}
117		- // Initialize!
118		- $this->controllerName = $this->ongetdefaultcontrollername(isset($_REQUEST['controller']) ? $_REQUEST['controller'] : $defaultController);
	117	+ // Initialize with validation!
	118	+ $requestedController = isset($_REQUEST['controller']) ? esc_html($_REQUEST['controller']) : $defaultController;
	119	+ $this->controllerName = $this->ongetdefaultcontrollername($this->sanitizeControllerName($requestedController, $defaultController));
119	120	}
120		-
	121	+
121	122	/**
	123	+ * Sanitize controller name to prevent path traversal attacks
	124	+ *
	125	+ * @param string $controllerName The requested controller name
	126	+ * @param string $defaultController The default controller to use if validation fails
	127	+ * @return string Safe controller name
	128	+ */
	129	+ private function sanitizeControllerName($controllerName, $defaultController) {
	130	+ // Check for null or empty string
	131	+ if (empty($controllerName) || !is_string($controllerName)) {
	132	+ return $defaultController;
	133	+ }
	134	+
	135	+ // Check for path traversal attempts
	136	+ if (strpos($controllerName, '..') !== false) {
	137	+ return $defaultController;
	138	+ }
	139	+
	140	+ // Check for directory separators
	141	+ if (strpos($controllerName, '/') !== false || strpos($controllerName, '\\') !== false) {
	142	+ return $defaultController;
	143	+ }
	144	+
	145	+ // Only allow alphanumeric characters, hyphens, and underscores
	146	+ if (!preg_match('/^[a-zA-Z0-9_-]+$/', $controllerName)) {
	147	+ return $defaultController;
	148	+ }
	149	+
	150	+ return $controllerName;
	151	+ }
	152	+
	153	+ /**
122	154	* put your comment there...
123		- *
	155	+ *
124	156	* @return Boolean TRUE if it wasn't connected! FALSE otherwise.
125	157	*/
126	158	protected function connected() {
127	159	// Do connect only if not connected yet
		@@ -132,58 +164,58 @@
132	164	self::$connected = $this;
133	165	}
134	166	return $returns;
135	167	}
136		-
	168	+
137	169	/**
138	170	* put your comment there...
139		- *
	171	+ *
140	172	*/
141	173	protected abstract function doListen();
142		-
	174	+
143	175	/**
144	176	* put your comment there...
145		- *
	177	+ *
146	178	*/
147	179	public function & getController() {
148		- return $this->controller;
	180	+ return $this->controller;
149	181	}
150		-
	182	+
151	183	/**
152	184	* put your comment there...
153		- *
	185	+ *
154	186	*/
155	187	public function getControllerName() {
156		- return $this->controllerName;
	188	+ return $this->controllerName;
157	189	}
158		-
	190	+
159	191	/**
160	192	* put your comment there...
161		- *
	193	+ *
162	194	*/
163	195	public function getName() {
164	196	return $this->name;
165	197	}
166		-
	198	+
167	199	/**
168	200	* put your comment there...
169		- *
	201	+ *
170	202	*/
171	203	public static function & isConnected() {
172	204	return self::$connected;
173	205	}
174		-
	206	+
175	207	/**
176	208	* put your comment there...
177		- *
	209	+ *
178	210	*/
179	211	public function hasAccess() {
180	212	return current_user_can('administrator');
181	213	}
182		-
	214	+
183	215	/**
184	216	* put your comment there...
185		- *
	217	+ *
186	218	*/
187	219	public function listen() {
188	220	// Fire listen event!
189	221	$this->onlisten();
		@@ -190,12 +222,12 @@
190	222	// Allow access points to bind their hooks
191	223	$this->doListen();
192	224	return $this;
193	225	}
194		-
	226	+
195	227	/**
196	228	* put your comment there...
197		- *
	229	+ *
198	230	* @param mixed $request
199	231	*/
200	232	public function route($loadView = null, $request = null) {
201	233	// Only loading one controller is allowed.
		@@ -204,10 +236,10 @@
204	236	require_once CJTOOLBOX_MVC_FRAMEWOK . '/view.inc.php';
205	237	// Instantiate controller!
206	238	$this->controller = $this->onsetcontroller(
207	239	CJTController::getInstance(
208		- $this->controllerName,
209		- $loadView,
	240	+ $this->controllerName,
	241	+ $loadView,
210	242	$request,
211	243	$this->overrideControllersPath,
212	244	$this->overrideControllersPrefix
213	245	));
		@@ -213,9 +245,9 @@
213	245	));
214	246	}
215	247	return $this->controller;
216	248	}
217		-
	249	+
218	250	} // End class.
219	251
220	252	// Hookable!
221		-CJTAccessPoint::define('CJTAccessPoint', array('hookType' => CJTWordpressEvents::HOOK_FILTER));
	253	+CJTAccessPoint::define('CJTAccessPoint', array('hookType' => CJTWordpressEvents::HOOK_FILTER));