← All changes | framework/mvc/controller.inc.php +71 -108 trunk → 8.0.3 View file →

		@@ -11,43 +11,43 @@
11	11	/**
12	12	* CJT controller base class.
13	13	*/
14	14	abstract class CJTController extends CJTHookableClass {
15		-
	15	+
16	16	/** */
17	17	const NONCE_ACTION = 'cjtoolbox';
18		-
	18	+
19	19	/**
20	20	* put your comment there...
21		- *
	21	+ *
22	22	* @var mixed
23	23	*/
24	24	protected $action;
25		-
	25	+
26	26	/**
27	27	* put your comment there...
28		- *
	28	+ *
29	29	* @var mixed
30	30	*/
31	31	protected $controllerInfo = null;
32		-
	32	+
33	33	/**
34	34	* put your comment there...
35		- *
	35	+ *
36	36	* @var mixed
37	37	*/
38	38	protected $defaultAction = 'index';
39		-
	39	+
40	40	/**
41	41	* put your comment there...
42		- *
	42	+ *
43	43	* @var mixed
44	44	*/
45	45	protected $request;
46		-
	46	+
47	47	/**
48	48	* put your comment there...
49		- *
	49	+ *
50	50	* @var mixed
51	51	*/
52	52	protected $model = null;
53	53
		@@ -52,51 +52,51 @@
52	52	protected $model = null;
53	53
54	54	/**
55	55	* put your comment there...
56		- *
	56	+ *
57	57	* @var mixed
58	58	*/
59	59	protected $oncallback = array('parameters' => array('callback', 'action', 'args'));
60		-
	60	+
61	61	/**
62	62	* put your comment there...
63		- *
	63	+ *
64	64	* @var mixed
65	65	*/
66	66	protected $ongetactionname = array('parameters' => array('action'));
67		-
	67	+
68	68	/**
69	69	* put your comment there...
70		- *
	70	+ *
71	71	* @var mixed
72	72	*/
73	73	protected static $ongetclassname = array('parameters' => array('class', 'name', 'type'));
74		-
	74	+
75	75	/**
76	76	* put your comment there...
77		- *
	77	+ *
78	78	* @var mixed
79	79	*/
80	80	protected $ongetviewname = array('parameters' => array('view'));
81		-
	81	+
82	82	/**
83	83	* put your comment there...
84		- *
	84	+ *
85	85	* @var mixed
86	86	*/
87	87	protected static $onloadcontroller = array('parameters' => array('file', 'name'));
88		-
	88	+
89	89	/**
90	90	* put your comment there...
91		- *
	91	+ *
92	92	* @var mixed
93	93	*/
94	94	protected $view = null;
95		-
	95	+
96	96	/**
97	97	* put your comment there...
98		- *
	98	+ *
99	99	* @param mixed $hasView
100	100	* @param mixed $request
101	101	* @param mixed $overrideControllerPath
102	102	* @param mixed $overrideContollerPrefix
		@@ -101,18 +101,16 @@
101	101	* @param mixed $overrideControllerPath
102	102	* @param mixed $overrideContollerPrefix
103	103	* @return CJTController
104	104	*/
105		- public function __construct($hasView = null,
106		- $request = null,
107		- $overrideControllerPath = null,
	105	+ public function __construct($hasView = null,
	106	+ $request = null,
	107	+ $overrideControllerPath = null,
108	108	$overrideContollerPrefix = null) {
109	109	// Initialize hookable!
110	110	parent::__construct();
111	111	// Read request parameters.
112	112	$this->request = array_merge(((array) $_REQUEST), ((array) $request));
113		-
114		- $overrideControllerPath = $overrideControllerPath ? null : '';
115	113	// Create default model.
116	114	if (isset($this->controllerInfo['model'])) {
117	115	// E_ALL complain!
118	116	if (!isset($this->controllerInfo['model_file'])) {
		@@ -117,10 +115,10 @@
117	115	// E_ALL complain!
118	116	if (!isset($this->controllerInfo['model_file'])) {
119	117	$this->controllerInfo['model_file'] = null;
120	118	}
121		- $this->model = CJTModel::create($this->controllerInfo['model'],
122		- $this->request,
	119	+ $this->model = CJTModel::create($this->controllerInfo['model'],
	120	+ $this->request,
123	121	$this->controllerInfo['model_file'],
124	122	dirname($overrideControllerPath),
125	123	$overrideContollerPrefix);
126	124	}
		@@ -126,14 +124,14 @@
126	124	}
127	125	// Create default view.
128	126	if ($hasView === null) { // Default value for $hasView = true
129	127	// Request/passed parameters has priority over controller default view!
130		- $view = $this->ongetviewname(isset($this->request['view']) ? esc_html($this->request['view']) :
	128	+ $view = $this->ongetviewname(isset($this->request['view']) ? $this->request['view'] :
131	129	(isset($this->controllerInfo['view']) ? $this->controllerInfo['view'] : null)
132	130	);
133	131	if ($view) {
134		- $this->view = self::getView($view,
135		- null,
	132	+ $this->view = self::getView($view,
	133	+ null,
136	134	dirname($overrideControllerPath),
137	135	$overrideContollerPrefix)
138	136	// Push data into view.
139	137	->setModel($this->model)
		@@ -140,18 +138,18 @@
140	138	->setRequest($this->request);
141	139	}
142	140	}
143	141	}
144		-
	142	+
145	143	/**
146	144	* put your comment there...
147		- *
	145	+ *
148	146	*/
149	147	public function _doAction() {
150	148	// Force use of internal action untless its empty
151	149	// then look for submitted action or get the default!
152		- $action = $this->action ? $this->action :
153		- (isset($_GET['action']) ? esc_html($_GET['action']) : $this->defaultAction);
	150	+ $action = $this->action ? $this->action :
	151	+ (isset($_GET['action']) ? $_GET['action'] : $this->defaultAction);
154	152	// filter action name!
155	153	$action = $this->ongetactionname($action);
156	154	if ($action) {
157	155	$actionHandler = "{$action}Action";
		@@ -160,12 +158,12 @@
160	158	// Callback!
161	159	call_user_func($callback);
162	160	}
163	161	}
164		-
	162	+
165	163	/**
166	164	* put your comment there...
167		- *
	165	+ *
168	166	* @param mixed $name
169	167	* @param mixed $hasView
170	168	* @param mixed $request
171	169	* @param mixed $overrideControllersPath
		@@ -170,18 +168,13 @@
170	168	* @param mixed $request
171	169	* @param mixed $overrideControllersPath
172	170	* @param mixed $overrideControllersPrefix
173	171	*/
174		- public static function create($name,
175		- $hasView = null,
176		- $request = null,
	172	+ public static function create($name,
	173	+ $hasView = null,
	174	+ $request = null,
177	175	$overrideControllersPath = null,
178	176	$overrideControllersPrefix = null) {
179		- // Validate controller name to prevent path traversal attacks
180		- if (!self::isValidControllerName($name)) {
181		- throw new Exception('Invalid controller name: ' . esc_html($name));
182		- }
183		-
184	177	// Import controller file.
185	178	$pathToControllers = $overrideControllersPath ? $overrideControllersPath : CJTOOLBOX_CONTROLLERS_PATH;
186	179	$controllerFile = "{$pathToControllers}/{$name}.php";
187	180	require_once self::trigger('CJTController.loadcontroller', $controllerFile, $name);
		@@ -189,42 +182,12 @@
189	182	$class = self::getClassName($name, 'Controller', $overrideControllersPrefix);
190	183	// Instantiate controller class.
191	184	return new $class($hasView, $request, $overrideControllersPath, $overrideControllersPrefix);
192	185	}
193		-
	186	+
194	187	/**
195		- * Validate controller name to prevent path traversal attacks
196		- *
197		- * @param string $name Controller name to validate
198		- * @return bool True if valid, false otherwise
199		- */
200		- private static function isValidControllerName($name) {
201		- // Check for null or empty string
202		- if (empty($name) || !is_string($name)) {
203		- return false;
204		- }
205		-
206		- // Check for path traversal attempts
207		- if (strpos($name, '..') !== false) {
208		- return false;
209		- }
210		-
211		- // Check for directory separators
212		- if (strpos($name, '/') !== false || strpos($name, '\\') !== false) {
213		- return false;
214		- }
215		-
216		- // Only allow alphanumeric characters, hyphens, and underscores
217		- if (!preg_match('/^[a-zA-Z0-9_-]+$/', $name)) {
218		- return false;
219		- }
220		-
221		- return true;
222		- }
223		-
224		- /**
225	188	* put your comment there...
226		- *
	189	+ *
227	190	* @deprecated Use cssJSToolbox::createSecurityToken
228	191	*/
229	192	public function createSecurityToken() {
230	193	return wp_create_nonce(self::NONCE_ACTION);
		@@ -231,13 +194,13 @@
231	194	}
232	195
233	196	/**
234	197	* put your comment there...
235		- *
	198	+ *
236	199	*/
237	200	protected function displayAction() {
238	201	// Get view layout!
239		- $layout = isset($this->request['layout']) ? esc_html($this->request['layout']) : 'default';
	202	+ $layout = isset($this->request['layout']) ? $this->request['layout'] : 'default';
240	203	ob_start();
241	204	$this->view->display($layout);
242	205	$content = ob_get_clean();
243	206	return $content;
		@@ -244,9 +207,9 @@
244	207	}
245	208
246	209	/**
247	210	* put your comment there...
248		- *
	211	+ *
249	212	* @param mixed $name
250	213	* @param mixed $hasView
251	214	* @param mixed $request
252	215	* @param mixed $overrideControllersPath
		@@ -251,22 +214,22 @@
251	214	* @param mixed $request
252	215	* @param mixed $overrideControllersPath
253	216	*/
254	217	public static function getInstance($name,
255		- $hasView = null,
256		- $request = null,
	218	+ $hasView = null,
	219	+ $request = null,
257	220	$overrideControllersPath = null,
258	221	$overrideControllersPrefix = null) {
259	222	return self::create($name, $hasView, $request, $overrideControllersPath, $overrideControllersPrefix);
260	223	}
261		-
	224	+
262	225	/**
263	226	* Use CJTModel::create instead.
264		- *
	227	+ *
265	228	* @deprecated No longer used.
266	229	*/
267		- public static function getModel($name,
268		- $params = array(),
	230	+ public static function getModel($name,
	231	+ $params = array(),
269	232	$file = null,
270	233	$overrideModelsPath = null,
271	234	$overrideModelsPrefix = null) {
272	235	$model = null;
		@@ -284,9 +247,9 @@
284	247	}
285	248	$model = new $modelClass($params);
286	249	return $model;
287	250	}
288		-
	251	+
289	252	/**
290	253	* @deprecated No longer used.
291	254	*/
292	255	public static function getClassName($name, $type, $prefix = null) {
		@@ -303,27 +266,27 @@
303	266	// Filter.
304	267	$className = self::trigger('CJTController.getclassname', "{$prefix}{$sanitizedName}", $name, $type);
305	268	return $className;
306	269	}
307		-
	270	+
308	271	/**
309	272	* put your comment there...
310		- *
	273	+ *
311	274	* @param mixed $name
312	275	*/
313	276	public function getRequestParameter($name) {
314		- return isset($this->request[$name]) ? esc_html($this->request[$name]) : null;
	277	+ return isset($this->request[$name]) ? $this->request[$name] : null;
315	278	}
316		-
	279	+
317	280	/**
318		- *
	281	+ *
319	282	* Use CJTView:create instrad.
320		- *
	283	+ *
321	284	* @deprecated
322	285	*/
323		- public static function getView($path,
324		- $params = null,
325		- $overrideViewsPath = null,
	286	+ public static function getView($path,
	287	+ $params = null,
	288	+ $overrideViewsPath = null,
326	289	$overrideViewsPrefix = null) {
327	290	$view = null;
328	291	// Import view file.
329	292	$viewInfo = self::getViewInfo($path, $overrideViewsPath, $overrideViewsPrefix);
		@@ -333,16 +296,16 @@
333	296	$viewClass = self::getClassName($name, 'view', $overrideViewsPrefix);
334	297	$view = new $viewClass($viewInfo, $params);
335	298	return $view;
336	299	}
337		-
	300	+
338	301	/**
339	302	* put your comment there...
340		- *
	303	+ *
341	304	*/
342	305	public static function getViewInfo($path, $overrideViewsPath = null, $overrideViewsPrefix = null) {
343	306	// Plugin views Url
344		- $viewsUrl = $overrideViewsPath ?
	307	+ $viewsUrl = $overrideViewsPath ?
345	308	WP_PLUGIN_URL . '/' . basename(dirname($overrideViewsPath)) :
346	309	CJTOOLBOX_VIEWS_URL;
347	310	// Path to views dir.
348	311	$pathToViews = $overrideViewsPath ? ($overrideViewsPath . DIRECTORY_SEPARATOR . 'views') : CJTOOLBOX_VIEWS_PATH;
		@@ -358,12 +321,12 @@
358	321	'viewFile' => "{$pathToViews}/{$path}/view.php",
359	322	);
360	323	return $viewInfo;
361	324	}
362		-
	325	+
363	326	/**
364	327	* put your comment there...
365		- *
	328	+ *
366	329	* @param mixed $action
367	330	*/
368	331	public function setAction($action) {
369	332	$this->action = $action;
		@@ -368,12 +331,12 @@
368	331	public function setAction($action) {
369	332	$this->action = $action;
370	333	return $this;
371	334	}
372		-
	335	+
373	336	/**
374	337	* put your comment there...
375		- *
	338	+ *
376	339	* @param mixed $name
377	340	* @param mixed $value
378	341	*/
379	342	public function setRequestParameter($name, $value) {
		@@ -379,9 +342,9 @@
379	342	public function setRequestParameter($name, $value) {
380	343	$this->request[$name] = $value;
381	344	return $this;
382	345	}
383		-
	346	+
384	347	} // End class.
385	348
386	349	// Hookable!
387		-CJTController::define('CJTController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));
	350	+CJTController::define('CJTController', array('hookType' => CJTWordpressEvents::HOOK_FILTER));