← All changes | libraries/system/request.php +478 -0 1.6.1 → 1.8.16 View file →

		@@ -1,0 +1,478 @@
	1	+<?php
	2	+/**
	3	+ * @package VikWP - Libraries
	4	+ * @author E4J s.r.l.
	5	+ * @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved.
	6	+ * @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
	7	+ * @link https://vikwp.com
	8	+ */
	9	+
	10	+// No direct access
	11	+defined('ABSPATH') or die('No script kiddies please!');
	12	+
	13	+defined('VIKREQUEST_ALLOWRAW') or define('VIKREQUEST_ALLOWRAW', 2);
	14	+defined('VIKREQUEST_ALLOWHTML') or define('VIKREQUEST_ALLOWHTML', 4);
	15	+
	16	+if (!class_exists('VikRequest')) {
	17	+ /**
	18	+ * Request helper class.
	19	+ *
	20	+ * @since June 2021
	21	+ * @see JInput
	22	+ */
	23	+ abstract class VikRequest
	24	+ {
	25	+ /**
	26	+ * Fetches and returns a given variable.
	27	+ *
	28	+ * The default behaviour is fetching variables depending on the
	29	+ * current request method: GET and HEAD will result in returning
	30	+ * an entry from $_GET, POST and PUT will result in returning an
	31	+ * entry from $_POST.
	32	+ *
	33	+ * You can force the source by setting the $hash parameter:
	34	+ *
	35	+ * post $_POST
	36	+ * get $_GET
	37	+ * files $_FILES
	38	+ * cookie $_COOKIE
	39	+ * env $_ENV
	40	+ * server $_SERVER
	41	+ * method via current $_SERVER['REQUEST_METHOD']
	42	+ * default $_REQUEST
	43	+ *
	44	+ * @param string $name Variable name.
	45	+ * @param string $default Default value if the variable does not exist.
	46	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
	47	+ * @param string $type The return type for the variable:
	48	+ * INT: An integer, or an array of integers;
	49	+ * UINT: An unsigned integer, or an array of unsigned integers;
	50	+ * FLOAT: A floating point number, or an array of floating point numbers;
	51	+ * BOOLEAN: A boolean value;
	52	+ * WORD: A string containing A-Z or underscores only (not case sensitive);
	53	+ * ALNUM: A string containing A-Z or 0-9 only (not case sensitive);
	54	+ * CMD: A string containing A-Z, 0-9, underscores, periods or hyphens (not case sensitive);
	55	+ * BASE64: A string containing A-Z, 0-9, forward slashes, plus or equals (not case sensitive);
	56	+ * STRING: A fully decoded and sanitised string (default);
	57	+ * HTML: A sanitised string;
	58	+ * ARRAY: An array;
	59	+ * PATH: A sanitised file path, or an array of sanitised file paths;
	60	+ * TRIM: A string trimmed from normal, non-breaking and multibyte spaces;
	61	+ * USERNAME: Do not use (use an application specific filter);
	62	+ * RAW: The raw string is returned with no filtering;
	63	+ * unknown: An unknown filter will act like STRING. If the input is an array it will return an
	64	+ * array of fully decoded and sanitised strings.
	65	+ * @param integer $mask Filter mask for the variable.
	66	+ *
	67	+ * @return mixed Requested variable.
	68	+ */
	69	+ public static function getVar($name, $default = null, $hash = 'default', $type = 'none', $mask = 0)
	70	+ {
	71	+ $input = &JFactory::getApplication()->input;
	72	+
	73	+ // ensure hash is uppercase
	74	+ $hash = strtoupper($hash);
	75	+
	76	+ if ($hash === 'METHOD')
	77	+ {
	78	+ $hash = strtoupper($input->server->get('REQUEST_METHOD'));
	79	+ }
	80	+
	81	+ // get the input hash
	82	+ switch ($hash)
	83	+ {
	84	+ case 'GET':
	85	+ $input = &$input->get;
	86	+ break;
	87	+
	88	+ case 'POST':
	89	+ $input = &$input->post;
	90	+ break;
	91	+
	92	+ case 'REQUEST':
	93	+ $input = &$input->request;
	94	+ break;
	95	+
	96	+ case 'FILES':
	97	+ $input = &$input->files;
	98	+ break;
	99	+
	100	+ case 'COOKIE':
	101	+ $input = &$input->cookie;
	102	+ break;
	103	+
	104	+ case 'SERVER':
	105	+ $input = &$input->server;
	106	+ break;
	107	+
	108	+ default:
	109	+ // do not alter default source
	110	+ }
	111	+
	112	+ if ($mask == VIKREQUEST_ALLOWRAW || $mask == VIKREQUEST_ALLOWHTML)
	113	+ {
	114	+ // set type to obtain the raw value.
	115	+ $type = 'raw';
	116	+ }
	117	+
	118	+ if ($hash === 'FILES')
	119	+ {
	120	+ /**
	121	+ * Adapter for multi-file upload to keep the PHP native structure.
	122	+ *
	123	+ * @since 10.1.16
	124	+ */
	125	+ $arr = $input->get($name, $default, $type);
	126	+ if (count($arr) && isset($arr[0]))
	127	+ {
	128	+ // re-arrange the array like before for code compatibility
	129	+ /*
	130	+ Array
	131	+ (
	132	+ [name] => Array
	133	+ (
	134	+ [0] => x.png
	135	+ [1] => y.jpg
	136	+ )
	137	+ [type] => Array
	138	+ (
	139	+ [0] => image/png
	140	+ [1] => image/jpeg
	141	+ )
	142	+ )
	143	+ */
	144	+ $legacy_map = array();
	145	+ foreach ($arr as $ak => $av)
	146	+ {
	147	+ foreach ($av as $updk => $updv)
	148	+ {
	149	+ if (!isset($legacy_map[$updk]))
	150	+ {
	151	+ $legacy_map[$updk] = array();
	152	+ }
	153	+ $legacy_map[$updk][] = $updv;
	154	+ }
	155	+ }
	156	+ return $legacy_map;
	157	+ }
	158	+ }
	159	+
	160	+ $value = $input->get($name, $default, $type);
	161	+
	162	+ if ($mask == VIKREQUEST_ALLOWHTML) {
	163	+ // html will be sanitized recursively
	164	+ self::filterHtml($value);
	165	+ }
	166	+
	167	+ return $value;
	168	+ }
	169	+
	170	+ /**
	171	+ * Fetches and returns a given filtered variable. The integer
	172	+ * filter will allow only digits and the - sign to be returned. This is currently
	173	+ * only a proxy function for getVar().
	174	+ *
	175	+ * @param string $name Variable name.
	176	+ * @param string $default Default value if the variable does not exist.
	177	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
	178	+ *
	179	+ * @return integer Requested variable.
	180	+ */
	181	+ public static function getInt($name, $default = 0, $hash = 'default')
	182	+ {
	183	+ return self::getVar($name, (int) $default, $hash, 'int');
	184	+ }
	185	+
	186	+ /**
	187	+ * Fetches and returns a given filtered variable. The unsigned integer
	188	+ * filter will allow only digits to be returned. This is currently
	189	+ * only a proxy function for getVar().
	190	+ *
	191	+ * @param string $name Variable name.
	192	+ * @param string $default Default value if the variable does not exist.
	193	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
	194	+ *
	195	+ * @return integer Requested variable.
	196	+ */
	197	+ public static function getUInt($name, $default = 0, $hash = 'default')
	198	+ {
	199	+ return self::getVar($name, abs((int) $default), $hash, 'uint');
	200	+ }
	201	+
	202	+ /**
	203	+ * Fetches and returns a given filtered variable. The float
	204	+ * filter only allows digits and periods. This is currently
	205	+ * only a proxy function for getVar().
	206	+ *
	207	+ * @param string $name Variable name.
	208	+ * @param string $default Default value if the variable does not exist.
	209	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
	210	+ *
	211	+ * @return float Requested variable.
	212	+ */
	213	+ public static function getFloat($name, $default = 0.0, $hash = 'default')
	214	+ {
	215	+ return self::getVar($name, (float) $default, $hash, 'float');
	216	+ }
	217	+
	218	+ /**
	219	+ * Fetches and returns a given filtered variable. The bool
	220	+ * filter will only return true/false bool values. This is
	221	+ * currently only a proxy function for getVar().
	222	+ *
	223	+ * @param string $name Variable name.
	224	+ * @param string $default Default value if the variable does not exist.
	225	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
	226	+ *
	227	+ * @return boolean Requested variable.
	228	+ */
	229	+ public static function getBool($name, $default = false, $hash = 'default')
	230	+ {
	231	+ return self::getVar($name, (bool) $default, $hash, 'bool');
	232	+ }
	233	+
	234	+ /**
	235	+ * Fetches and returns a given filtered variable. The word
	236	+ * filter only allows the characters [A-Za-z_]. This is currently
	237	+ * only a proxy function for getVar().
	238	+ *
	239	+ * @param string $name Variable name.
	240	+ * @param string $default Default value if the variable does not exist.
	241	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
	242	+ *
	243	+ * @return string Requested variable.
	244	+ */
	245	+ public static function getWord($name, $default = '', $hash = 'default')
	246	+ {
	247	+ return self::getVar($name, $default, $hash, 'word');
	248	+ }
	249	+
	250	+ /**
	251	+ * Cmd (Word and Integer) filter.
	252	+ *
	253	+ * Fetches and returns a given filtered variable. The cmd
	254	+ * filter only allows the characters [A-Za-z0-9.-_]. This is
	255	+ * currently only a proxy function for getVar().
	256	+ *
	257	+ * @param string $name Variable name
	258	+ * @param string $default Default value if the variable does not exist
	259	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD)
	260	+ *
	261	+ * @return string Requested variable
	262	+ */
	263	+ public static function getCmd($name, $default = '', $hash = 'default')
	264	+ {
	265	+ return self::getVar($name, $default, $hash, 'cmd');
	266	+ }
	267	+
	268	+ /**
	269	+ * Fetches and returns a given filtered variable. The string
	270	+ * filter deletes 'bad' HTML code, if not overridden by the mask.
	271	+ * This is currently only a proxy function for getVar().
	272	+ *
	273	+ * @param string $name Variable name
	274	+ * @param string $default Default value if the variable does not exist
	275	+ * @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD)
	276	+ * @param integer $mask Filter mask for the variable
	277	+ *
	278	+ * @return string Requested variable
	279	+ */
	280	+ public static function getString($name, $default = '', $hash = 'default', $mask = 0)
	281	+ {
	282	+ return self::getVar($name, $default, $hash, 'string', $mask);
	283	+ }
	284	+
	285	+ /**
	286	+ * Set a variable in one of the request variables.
	287	+ *
	288	+ * @param string $name Name
	289	+ * @param string $value Value
	290	+ * @param string $hash Hash
	291	+ * @param boolean $overwrite Boolean
	292	+ *
	293	+ * @return string Previous value.
	294	+ */
	295	+ public static function setVar($name, $value = null, $hash = 'default', $overwrite = true)
	296	+ {
	297	+ $input = &JFactory::getApplication()->input;
	298	+
	299	+ // ensure hash is uppercase
	300	+ $hash = strtoupper($hash);
	301	+
	302	+ if ($hash === 'METHOD')
	303	+ {
	304	+ $hash = strtoupper($input->server->get('REQUEST_METHOD'));
	305	+ }
	306	+
	307	+ // get the input hash
	308	+ switch ($hash)
	309	+ {
	310	+ case 'GET':
	311	+ $input = &$input->get;
	312	+ break;
	313	+
	314	+ case 'POST':
	315	+ $input = &$input->post;
	316	+ break;
	317	+
	318	+ case 'REQUEST':
	319	+ $input = &$input->request;
	320	+ break;
	321	+
	322	+ case 'FILES':
	323	+ $input = &$input->files;
	324	+ break;
	325	+
	326	+ case 'COOKIE':
	327	+ $input = &$input->cookie;
	328	+ break;
	329	+
	330	+ case 'SERVER':
	331	+ $input = &$input->server;
	332	+ break;
	333	+
	334	+ default:
	335	+ // do not alter default source
	336	+ }
	337	+
	338	+ $prev = $input->get($name, null, 'raw');
	339	+
	340	+ // if overwrite is false, make sure the variable hasn't been set yet
	341	+ if ($overwrite || $prev === null)
	342	+ {
	343	+ $input->set($name, $value);
	344	+ }
	345	+
	346	+ return $prev;
	347	+ }
	348	+
	349	+ /**
	350	+ * Adapter method to safely send a cookie to the browser depending on the current PHP version,
	351	+ * by also supporting the old function's signature before PHP 7.3 that will be adjusted:
	352	+ * (name, value, expire, path, domain, secure, httpOnly)
	353	+ *
	354	+ * @param string $name The name of the value to set for the cookie.
	355	+ * @param mixed $value The value to assign to the cookie.
	356	+ * @param mixed $options An associative array which may have any of the keys expires, path, domain,
	357	+ * secure, httponly and samesite. The values have the same meaning as described
	358	+ * for the parameters with the same name. The value of the samesite element should
	359	+ * be either None, Lax or Strict.
	360	+ * If the samesite element is omitted, SameSite cookie attribute will default
	361	+ * to Lax. If the current PHP version supports this element the new signature will
	362	+ * be used, otherwise we will use the headers to set the Lax cookie in the browser.
	363	+ * @return void
	364	+ *
	365	+ * @since 10.1.30
	366	+ */
	367	+ public static function setCookie($name, $value, $options = array())
	368	+ {
	369	+ // BC layer to convert old method parameters
	370	+ if (!is_array($options))
	371	+ {
	372	+ $argList = func_get_args();
	373	+
	374	+ $options = array(
	375	+ 'expires' => isset($argList[2]) ? $argList[2] : 0,
	376	+ 'path' => isset($argList[3]) ? $argList[3] : '',
	377	+ 'domain' => isset($argList[4]) ? $argList[4] : '',
	378	+ 'secure' => isset($argList[5]) ? $argList[5] : false,
	379	+ 'httponly' => isset($argList[6]) ? $argList[6] : false,
	380	+ );
	381	+ }
	382	+
	383	+ // we make the samesite element default to Lax if no value given
	384	+ if (!isset($options['samesite']))
	385	+ {
	386	+ // Mozilla is going to deprecate/penalise the use of SameSite = None,
	387	+ // which is used by default if no element is set for samesite
	388	+ $options['samesite'] = 'Lax';
	389	+ }
	390	+
	391	+ // samesite attribute validation
	392	+ $samesite_types = array(
	393	+ 'None',
	394	+ 'Lax',
	395	+ 'Strict',
	396	+ );
	397	+
	398	+ if (!empty($options['samesite']) && !in_array((string) $options['samesite'], $samesite_types))
	399	+ {
	400	+ // default to Lax after validation
	401	+ $options['samesite'] = 'Lax';
	402	+ }
	403	+
	404	+ // set the cookie
	405	+ if (version_compare(PHP_VERSION, '7.3', '>='))
	406	+ {
	407	+ // Most recent PHP versions will always pass the attribute samesite for the cookie.
	408	+ // This is the new function's signature to ensure cookies will not be rejected.
	409	+ @setcookie($name, $value, $options);
	410	+ }
	411	+ else
	412	+ {
	413	+ // using the setcookie function on PHP < 7.3, make sure we have the default values
	414	+ if (!isset($options['expires']))
	415	+ {
	416	+ $options['expires'] = 0;
	417	+ }
	418	+
	419	+ if (!isset($options['path']))
	420	+ {
	421	+ $options['path'] = '';
	422	+ }
	423	+
	424	+ if (!isset($options['domain']))
	425	+ {
	426	+ $options['domain'] = '';
	427	+ }
	428	+
	429	+ if (!isset($options['secure']))
	430	+ {
	431	+ $options['secure'] = false;
	432	+ }
	433	+
	434	+ if (!isset($options['httponly']))
	435	+ {
	436	+ $options['httponly'] = false;
	437	+ }
	438	+
	439	+ if (!headers_sent())
	440	+ {
	441	+ // we use the headers to send the cookie to the browser to support the samesite attribute
	442	+ header('Set-Cookie: ' . rawurlencode($name) . '=' . rawurlencode($value)
	443	+ . ($options['expires'] ? '; expires=' . gmdate('D, d-M-Y H:i:s', $options['expires']) . ' GMT' : '')
	444	+ . ($options['path'] ? '; path=' . $options['path'] : '')
	445	+ . ($options['domain'] ? '; domain=' . $options['domain'] : '')
	446	+ . ($options['secure'] ? '; secure' : '')
	447	+ . ($options['httponly'] ? '; HttpOnly' : '')
	448	+ . ($options['samesite'] ? '; SameSite=' . $options['samesite'] : '')
	449	+ , false);
	450	+ }
	451	+ }
	452	+ }
	453	+
	454	+ /**
	455	+ * Applies sanitification recursively to get clean HTML contents.
	456	+ *
	457	+ * @param mixed $value reference to array or string to be sanitized.
	458	+ *
	459	+ * @return mixed sanitized array or string.
	460	+ *
	461	+ * @since June 2021
	462	+ */
	463	+ public static function filterHtml(&$value)
	464	+ {
	465	+ if (is_array($value))
	466	+ {
	467	+ foreach ($value as $k => $content)
	468	+ {
	469	+ self::filterHtml($value[$k]);
	470	+ }
	471	+ }
	472	+ else
	473	+ {
	474	+ $value = JComponentHelper::filterText($value);
	475	+ }
	476	+ }
	477	+ }
	478	+}