← All changes | admin/controllers/backup.php +305 -0 1.6.1 → 1.8.16 View file →

		@@ -1,0 +1,305 @@
	1	+<?php
	2	+/**
	3	+ * @package VikBooking
	4	+ * @subpackage core
	5	+ * @author E4J s.r.l.
	6	+ * @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved.
	7	+ * @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
	8	+ * @link https://vikwp.com
	9	+ */
	10	+
	11	+// No direct access
	12	+defined('ABSPATH') or die('No script kiddies please!');
	13	+
	14	+/**
	15	+ * VikBooking backup controller.
	16	+ *
	17	+ * @since 1.5
	18	+ */
	19	+class VikBookingControllerBackup extends JControllerAdmin
	20	+{
	21	+ /**
	22	+ * Task used to save the record data set in the request.
	23	+ * After saving, the user is redirected to the management
	24	+ * page of the record that has been saved.
	25	+ *
	26	+ * @return boolean
	27	+ */
	28	+ public function save()
	29	+ {
	30	+ $app = JFactory::getApplication();
	31	+ $input = $app->input;
	32	+ $user = JFactory::getUser();
	33	+
	34	+ $ajax = $input->getBool('ajax');
	35	+
	36	+ if (!JSession::checkToken())
	37	+ {
	38	+ if ($ajax)
	39	+ {
	40	+ // missing CSRF-proof token
	41	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));
	42	+ }
	43	+ else
	44	+ {
	45	+ // back to main list, missing CSRF-proof token
	46	+ $app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
	47	+ $this->cancel();
	48	+
	49	+ return false;
	50	+ }
	51	+ }
	52	+
	53	+ // fetch requested action
	54	+ $args = [];
	55	+ $args['action'] = $input->get('backup_action');
	56	+
	57	+ if ($args['action'] === 'create')
	58	+ {
	59	+ // get requested backup type
	60	+ $args['type'] = $input->get('type');
	61	+ }
	62	+ elseif ($args['action'] === 'upload')
	63	+ {
	64	+ /**
	65	+ * Take uploaded file.
	66	+ * Use "raw" filter because Joomla seems to block the attachments
	67	+ * containing PHP files.
	68	+ */
	69	+ $args['file'] = $input->files->get('file', null, 'raw');
	70	+ }
	71	+ else
	72	+ {
	73	+ VBOHttpDocument::getInstance($app)->close(400, 'Missing request values. Request entity may be too large.');
	74	+ }
	75	+
	76	+ // check user permissions
	77	+ if (!$user->authorise('core.create', 'com_vikbooking') || !$user->authorise('core.admin', 'com_vikbooking'))
	78	+ {
	79	+ if ($ajax)
	80	+ {
	81	+ // not allowed
	82	+ VBOHttpDocument::getInstance($app)->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));
	83	+ }
	84	+ else
	85	+ {
	86	+ // back to main list, not authorised to create/edit records
	87	+ $app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
	88	+ $this->cancel();
	89	+
	90	+ return false;
	91	+ }
	92	+ }
	93	+
	94	+ // get backup model
	95	+ $backup = new VBOModelBackup();
	96	+
	97	+ // try to save arguments
	98	+ $id = $backup->save($args);
	99	+
	100	+ if ($id === false)
	101	+ {
	102	+ // get string error
	103	+ $error = $backup->getError(null, true);
	104	+
	105	+ if ($ajax)
	106	+ {
	107	+ VBOHttpDocument::getInstance($app)->close(500, $error);
	108	+ }
	109	+ else
	110	+ {
	111	+ // display error message
	112	+ $app->enqueueMessage(JText::sprintf('JLIB_APPLICATION_ERROR_SAVE_FAILED', $error), 'error');
	113	+
	114	+ // redirect to list page
	115	+ $this->cancel();
	116	+
	117	+ return false;
	118	+ }
	119	+ }
	120	+
	121	+ if ($ajax)
	122	+ {
	123	+ // send the details of the created backup
	124	+ VBOHttpDocument::getInstance($app)->json($backup->getItem($id));
	125	+ }
	126	+ else
	127	+ {
	128	+ // display generic successful message
	129	+ $app->enqueueMessage(JText::translate('JLIB_APPLICATION_SAVE_SUCCESS'));
	130	+
	131	+ // redirect to list page
	132	+ $this->cancel();
	133	+
	134	+ return true;
	135	+ }
	136	+ }
	137	+
	138	+ /**
	139	+ * Deletes a list of records set in the request.
	140	+ *
	141	+ * @return boolean
	142	+ */
	143	+ public function delete()
	144	+ {
	145	+ $app = JFactory::getApplication();
	146	+ $cid = $app->input->get('cid', array(), 'string');
	147	+
	148	+ /**
	149	+ * Added token validation.
	150	+ * Both GET and POST are supported.
	151	+ */
	152	+ if (!JSession::checkToken() && !JSession::checkToken('get'))
	153	+ {
	154	+ // back to main list, missing CSRF-proof token
	155	+ $app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
	156	+ $this->cancel();
	157	+
	158	+ return false;
	159	+ }
	160	+
	161	+ // check user permissions
	162	+ if (!JFactory::getUser()->authorise('core.delete', 'com_vikbooking') || !JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
	163	+ {
	164	+ // back to main list, not authorised to delete records
	165	+ $app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
	166	+ $this->cancel();
	167	+
	168	+ return false;
	169	+ }
	170	+
	171	+ // delete selected records
	172	+ $res = (new VBOModelBackup)->delete($cid);
	173	+
	174	+ // back to main list
	175	+ $this->cancel();
	176	+
	177	+ return true;
	178	+ }
	179	+
	180	+ /**
	181	+ * Restores the specified backup.
	182	+ *
	183	+ * @return boolean
	184	+ */
	185	+ public function restore()
	186	+ {
	187	+ $app = JFactory::getApplication();
	188	+ $cid = $app->input->get('cid', array(), 'string');
	189	+
	190	+ // take only the first backup
	191	+ $cid = array_shift($cid);
	192	+
	193	+ /**
	194	+ * Added token validation.
	195	+ * Both GET and POST are supported.
	196	+ */
	197	+ if (!JSession::checkToken() && !JSession::checkToken('get'))
	198	+ {
	199	+ // back to main list, missing CSRF-proof token
	200	+ $app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
	201	+ $this->cancel();
	202	+
	203	+ return false;
	204	+ }
	205	+
	206	+ // check user permissions
	207	+ if (!JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
	208	+ {
	209	+ // back to main list, not authorised to delete records
	210	+ $app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
	211	+ $this->cancel();
	212	+
	213	+ return false;
	214	+ }
	215	+
	216	+ $model = new VBOModelBackup();
	217	+
	218	+ // restore backup
	219	+ $res = $model->restore($cid);
	220	+
	221	+ if (!$res)
	222	+ {
	223	+ // get last error
	224	+ $error = $model->getError(null, true);
	225	+
	226	+ if ($error)
	227	+ {
	228	+ $app->enqueueMessage($error, 'error');
	229	+ }
	230	+ }
	231	+ else
	232	+ {
	233	+ $app->enqueueMessage(JText::translate('VBOBACKUPRESTORED'));
	234	+ }
	235	+
	236	+ // back to main list
	237	+ $this->cancel();
	238	+
	239	+ return $res;
	240	+ }
	241	+
	242	+ /**
	243	+ * End-point used to download a backuo archive.
	244	+ *
	245	+ * @return boolean
	246	+ */
	247	+ public function download()
	248	+ {
	249	+ $app = JFactory::getApplication();
	250	+ $cid = $app->input->get('cid', array(), 'string');
	251	+
	252	+ // take only the first backup
	253	+ $cid = array_shift($cid);
	254	+
	255	+ /**
	256	+ * Added token validation.
	257	+ * Both GET and POST are supported.
	258	+ */
	259	+ if (!JSession::checkToken() && !JSession::checkToken('get'))
	260	+ {
	261	+ // back to main list, missing CSRF-proof token
	262	+ $app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
	263	+ $this->cancel();
	264	+
	265	+ return false;
	266	+ }
	267	+
	268	+ // check user permissions
	269	+ if (!JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
	270	+ {
	271	+ // back to main list, not authorised to delete records
	272	+ $app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
	273	+ $this->cancel();
	274	+
	275	+ return false;
	276	+ }
	277	+
	278	+ // fetch backup details
	279	+ $item = (new VBOModelBackup)->getItem($cid);
	280	+
	281	+ if (!$item)
	282	+ {
	283	+ // backup not found
	284	+ $app->enqueueMessage(JText::translate('JGLOBAL_NO_MATCHING_RESULTS'), 'error');
	285	+ $this->cancel();
	286	+
	287	+ return false;
	288	+ }
	289	+
	290	+ // execute archive download
	291	+ VBOArchiveFactory::download($item->path);
	292	+
	293	+ $app->close();
	294	+ }
	295	+
	296	+ /**
	297	+ * Redirects the users to the main records list.
	298	+ *
	299	+ * @return void
	300	+ */
	301	+ public function cancel()
	302	+ {
	303	+ $this->setRedirect('index.php?option=com_vikbooking&view=backups');
	304	+ }
	305	+}