vikbooking / admin / controllers / backup.php

backup.php in VikBooking Hotel Booking Engine & PMS trunk, at admin/controllers/backup.php

306 lines 6.5 KB

Raw Download Zip

1	<?php
2	/**
3	* @package VikBooking
4	* @subpackage core
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	/**
15	* VikBooking backup controller.
16	*
17	* @since 1.5
18	*/
19	class VikBookingControllerBackup extends JControllerAdmin
20	{
21	/**
22	* Task used to save the record data set in the request.
23	* After saving, the user is redirected to the management
24	* page of the record that has been saved.
25	*
26	* @return boolean
27	*/
28	public function save()
29	{
30	$app = JFactory::getApplication();
31	$input = $app->input;
32	$user = JFactory::getUser();
33
34	$ajax = $input->getBool('ajax');
35
36	if (!JSession::checkToken())
37	{
38	if ($ajax)
39	{
40	// missing CSRF-proof token
41	VBOHttpDocument::getInstance($app)->close(403, JText::translate('JINVALID_TOKEN'));
42	}
43	else
44	{
45	// back to main list, missing CSRF-proof token
46	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
47	$this->cancel();
48
49	return false;
50	}
51	}
52
53	// fetch requested action
54	$args = [];
55	$args['action'] = $input->get('backup_action');
56
57	if ($args['action'] === 'create')
58	{
59	// get requested backup type
60	$args['type'] = $input->get('type');
61	}
62	elseif ($args['action'] === 'upload')
63	{
64	/**
65	* Take uploaded file.
66	* Use "raw" filter because Joomla seems to block the attachments
67	* containing PHP files.
68	*/
69	$args['file'] = $input->files->get('file', null, 'raw');
70	}
71	else
72	{
73	VBOHttpDocument::getInstance($app)->close(400, 'Missing request values. Request entity may be too large.');
74	}
75
76	// check user permissions
77	if (!$user->authorise('core.create', 'com_vikbooking') \|\| !$user->authorise('core.admin', 'com_vikbooking'))
78	{
79	if ($ajax)
80	{
81	// not allowed
82	VBOHttpDocument::getInstance($app)->close(403, JText::translate('JERROR_ALERTNOAUTHOR'));
83	}
84	else
85	{
86	// back to main list, not authorised to create/edit records
87	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
88	$this->cancel();
89
90	return false;
91	}
92	}
93
94	// get backup model
95	$backup = new VBOModelBackup();
96
97	// try to save arguments
98	$id = $backup->save($args);
99
100	if ($id === false)
101	{
102	// get string error
103	$error = $backup->getError(null, true);
104
105	if ($ajax)
106	{
107	VBOHttpDocument::getInstance($app)->close(500, $error);
108	}
109	else
110	{
111	// display error message
112	$app->enqueueMessage(JText::sprintf('JLIB_APPLICATION_ERROR_SAVE_FAILED', $error), 'error');
113
114	// redirect to list page
115	$this->cancel();
116
117	return false;
118	}
119	}
120
121	if ($ajax)
122	{
123	// send the details of the created backup
124	VBOHttpDocument::getInstance($app)->json($backup->getItem($id));
125	}
126	else
127	{
128	// display generic successful message
129	$app->enqueueMessage(JText::translate('JLIB_APPLICATION_SAVE_SUCCESS'));
130
131	// redirect to list page
132	$this->cancel();
133
134	return true;
135	}
136	}
137
138	/**
139	* Deletes a list of records set in the request.
140	*
141	* @return boolean
142	*/
143	public function delete()
144	{
145	$app = JFactory::getApplication();
146	$cid = $app->input->get('cid', array(), 'string');
147
148	/**
149	* Added token validation.
150	* Both GET and POST are supported.
151	*/
152	if (!JSession::checkToken() && !JSession::checkToken('get'))
153	{
154	// back to main list, missing CSRF-proof token
155	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
156	$this->cancel();
157
158	return false;
159	}
160
161	// check user permissions
162	if (!JFactory::getUser()->authorise('core.delete', 'com_vikbooking') \|\| !JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
163	{
164	// back to main list, not authorised to delete records
165	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
166	$this->cancel();
167
168	return false;
169	}
170
171	// delete selected records
172	$res = (new VBOModelBackup)->delete($cid);
173
174	// back to main list
175	$this->cancel();
176
177	return true;
178	}
179
180	/**
181	* Restores the specified backup.
182	*
183	* @return boolean
184	*/
185	public function restore()
186	{
187	$app = JFactory::getApplication();
188	$cid = $app->input->get('cid', array(), 'string');
189
190	// take only the first backup
191	$cid = array_shift($cid);
192
193	/**
194	* Added token validation.
195	* Both GET and POST are supported.
196	*/
197	if (!JSession::checkToken() && !JSession::checkToken('get'))
198	{
199	// back to main list, missing CSRF-proof token
200	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
201	$this->cancel();
202
203	return false;
204	}
205
206	// check user permissions
207	if (!JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
208	{
209	// back to main list, not authorised to delete records
210	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
211	$this->cancel();
212
213	return false;
214	}
215
216	$model = new VBOModelBackup();
217
218	// restore backup
219	$res = $model->restore($cid);
220
221	if (!$res)
222	{
223	// get last error
224	$error = $model->getError(null, true);
225
226	if ($error)
227	{
228	$app->enqueueMessage($error, 'error');
229	}
230	}
231	else
232	{
233	$app->enqueueMessage(JText::translate('VBOBACKUPRESTORED'));
234	}
235
236	// back to main list
237	$this->cancel();
238
239	return $res;
240	}
241
242	/**
243	* End-point used to download a backuo archive.
244	*
245	* @return boolean
246	*/
247	public function download()
248	{
249	$app = JFactory::getApplication();
250	$cid = $app->input->get('cid', array(), 'string');
251
252	// take only the first backup
253	$cid = array_shift($cid);
254
255	/**
256	* Added token validation.
257	* Both GET and POST are supported.
258	*/
259	if (!JSession::checkToken() && !JSession::checkToken('get'))
260	{
261	// back to main list, missing CSRF-proof token
262	$app->enqueueMessage(JText::translate('JINVALID_TOKEN'), 'error');
263	$this->cancel();
264
265	return false;
266	}
267
268	// check user permissions
269	if (!JFactory::getUser()->authorise('core.admin', 'com_vikbooking'))
270	{
271	// back to main list, not authorised to delete records
272	$app->enqueueMessage(JText::translate('JERROR_ALERTNOAUTHOR'), 'error');
273	$this->cancel();
274
275	return false;
276	}
277
278	// fetch backup details
279	$item = (new VBOModelBackup)->getItem($cid);
280
281	if (!$item)
282	{
283	// backup not found
284	$app->enqueueMessage(JText::translate('JGLOBAL_NO_MATCHING_RESULTS'), 'error');
285	$this->cancel();
286
287	return false;
288	}
289
290	// execute archive download
291	VBOArchiveFactory::download($item->path);
292
293	$app->close();
294	}
295
296	/**
297	* Redirects the users to the main records list.
298	*
299	* @return void
300	*/
301	public function cancel()
302	{
303	$this->setRedirect('index.php?option=com_vikbooking&view=backups');
304	}
305	}
306