vikbooking / libraries / adapter / input / filter.php

filter.php in VikBooking Hotel Booking Engine & PMS trunk, at libraries/adapter/input/filter.php

464 lines 10.4 KB

Raw Download Zip

1	<?php
2	/**
3	* @package VikWP - Libraries
4	* @subpackage adapter.input
5	* @author E4J s.r.l.
6	* @copyright Copyright (C) 2023 E4J s.r.l. All Rights Reserved.
7	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
8	* @link https://vikwp.com
9	*/
10
11	// No direct access
12	defined('ABSPATH') or die('No script kiddies please!');
13
14	/**
15	* Class used for filtering input from any data source.
16	*
17	* @since 10.0
18	*/
19	class JInputFilter
20	{
21	/**
22	* Creates a new instance.
23	*
24	* @return self
25	*
26	* @since 10.1.23
27	*/
28	public static function getInstance()
29	{
30	return new static();
31	}
32
33	/**
34	* Method used to strip bad code from the specified source.
35	*
36	* @param mixed $source Input string/array-of-string to be 'cleaned'.
37	* @param string $type The return type for the variable:
38	* INT: An integer, or an array of integers;
39	* UINT: An unsigned integer, or an array of unsigned integers;
40	* FLOAT: A floating point number, or an array of floating point numbers;
41	* BOOLEAN: A boolean value;
42	* WORD: A string containing A-Z or underscores only (not case sensitive);
43	* ALNUM: A string containing A-Z or 0-9 only (not case sensitive);
44	* CMD: A string containing A-Z, 0-9, underscores, periods or hyphens (not case sensitive);
45	* BASE64: A string containing A-Z, 0-9, forward slashes, plus or equals (not case sensitive);
46	* STRING: A fully decoded and sanitised string (default);
47	* HTML: A sanitised string;
48	* ARRAY: An array;
49	* PATH: A sanitised file path, or an array of sanitised file paths;
50	* TRIM: A string trimmed from normal, non-breaking and multibyte spaces;
51	* USERNAME: Do not use (use an application specific filter);
52	* RAW: The raw string is returned with no filtering;
53	* unknown: An unknown filter will act like STRING. If the input is an array it will return an
54	* array of fully decoded and sanitised strings.
55	*
56	* @return mixed 'Cleaned' version of input parameter.
57	*/
58	public function clean($source, $type = 'string')
59	{
60	// handle the type constraint cases
61	switch (strtoupper($type))
62	{
63	case 'INT':
64	case 'INTEGER':
65	$pattern = '/[-+]?[0-9]+/';
66
67	if (is_array($source))
68	{
69	$result = array();
70
71	// iterate through the array
72	foreach ($source as $eachString)
73	{
74	preg_match($pattern, (string) $eachString, $matches);
75	$result[] = isset($matches[0]) ? (int) $matches[0] : 0;
76	}
77	}
78	else
79	{
80	preg_match($pattern, (string) $source, $matches);
81	$result = isset($matches[0]) ? (int) $matches[0] : 0;
82	}
83
84	break;
85
86	case 'UINT':
87	$pattern = '/[-+]?[0-9]+/';
88
89	if (is_array($source))
90	{
91	$result = array();
92
93	// iterate through the array
94	foreach ($source as $eachString)
95	{
96	preg_match($pattern, (string) $eachString, $matches);
97	$result[] = isset($matches[0]) ? abs((int) $matches[0]) : 0;
98	}
99	}
100	else
101	{
102	preg_match($pattern, (string) $source, $matches);
103	$result = isset($matches[0]) ? abs((int) $matches[0]) : 0;
104	}
105
106	break;
107
108	case 'FLOAT':
109	case 'DOUBLE':
110	$pattern = '/[-+]?[0-9]+(\.[0-9]+)?([eE][-+]?[0-9]+)?/';
111
112	if (is_array($source))
113	{
114	$result = array();
115
116	// iterate through the array
117	foreach ($source as $eachString)
118	{
119	preg_match($pattern, (string) $eachString, $matches);
120	$result[] = isset($matches[0]) ? (float) $matches[0] : 0;
121	}
122	}
123	else
124	{
125	preg_match($pattern, (string) $source, $matches);
126	$result = isset($matches[0]) ? (float) $matches[0] : 0;
127	}
128
129	break;
130
131	case 'BOOL':
132	case 'BOOLEAN':
133
134	if (is_array($source))
135	{
136	$result = array();
137
138	// iterate through the array
139	foreach ($source as $eachString)
140	{
141	$result[] = (bool) $eachString;
142	}
143	}
144	else
145	{
146	$result = (bool) $source;
147	}
148
149	break;
150
151	case 'WORD':
152	$pattern = '/[^A-Z_]/i';
153
154	if (is_array($source))
155	{
156	$result = array();
157
158	// iterate through the array
159	foreach ($source as $eachString)
160	{
161	$result[] = (string) preg_replace($pattern, '', $eachString);
162	}
163	}
164	else
165	{
166	$result = (string) preg_replace($pattern, '', $source);
167	}
168
169	break;
170
171	case 'ALNUM':
172	$pattern = '/[^A-Z0-9]/i';
173
174	if (is_array($source))
175	{
176	$result = array();
177
178	// iterate through the array
179	foreach ($source as $eachString)
180	{
181	$result[] = (string) preg_replace($pattern, '', $eachString);
182	}
183	}
184	else
185	{
186	$result = (string) preg_replace($pattern, '', $source);
187	}
188
189	break;
190
191	case 'CMD':
192	$pattern = '/[^A-Z0-9_\.-]/i';
193
194	if (is_array($source))
195	{
196	$result = array();
197
198	// iterate through the array
199	foreach ($source as $eachString)
200	{
201	$cleaned = (string) preg_replace($pattern, '', $eachString);
202	$result[] = ltrim($cleaned, '.');
203	}
204	}
205	else
206	{
207	$result = (string) preg_replace($pattern, '', $source);
208	$result = ltrim($result, '.');
209	}
210
211	break;
212
213	case 'BASE64':
214	$pattern = '/[^A-Z0-9\/+=]/i';
215
216	if (is_array($source))
217	{
218	$result = array();
219
220	// iterate through the array
221	foreach ($source as $eachString)
222	{
223	$result[] = (string) preg_replace($pattern, '', $eachString);
224	}
225	}
226	else
227	{
228	$result = (string) preg_replace($pattern, '', $source);
229	}
230
231	break;
232
233	case 'STRING':
234	if (is_array($source))
235	{
236	$result = array();
237
238	// iterate through the array
239	foreach ($source as $eachString)
240	{
241	$result[] = (string) $this->remove($this->decode((string) $eachString));
242	}
243	}
244	else
245	{
246	$result = (string) $this->remove($this->decode((string) $source));
247	}
248
249	break;
250
251	case 'HTML':
252	if (is_array($source))
253	{
254	$result = array();
255
256	// iterate through the array
257	foreach ($source as $eachString)
258	{
259	$result[] = $this->safeHtml((string) $eachString);
260	}
261	}
262	else
263	{
264	$result = $this->safeHtml((string) $source);
265	}
266
267	break;
268
269	case 'ARRAY':
270	/**
271	* Unslash array elements as they might contain
272	* escaped values, such as \'.
273	*
274	* @since 10.1.27
275	*/
276	$result = $this->unslashArray((array) $source);
277
278	break;
279
280	case 'PATH':
281	$pattern = '/^[A-Za-z0-9_\/-]+[A-Za-z0-9_\.-]([\\\\\/][A-Za-z0-9_-]+[A-Za-z0-9_\.-])*$/';
282
283	if (is_array($source))
284	{
285	$result = array();
286
287	// iterate through the array
288	foreach ($source as $eachString)
289	{
290	preg_match($pattern, (string) $eachString, $matches);
291	$result[] = isset($matches[0]) ? (string) $matches[0] : '';
292	}
293	}
294	else
295	{
296	preg_match($pattern, $source, $matches);
297	$result = isset($matches[0]) ? (string) $matches[0] : '';
298	}
299
300	break;
301
302	case 'TRIM':
303	if (is_array($source))
304	{
305	$result = array();
306
307	// iterate through the array
308	foreach ($source as $eachString)
309	{
310	$result[] = (string) trim($eachString);
311	}
312	}
313	else
314	{
315	$result = (string) trim($source);
316	}
317
318	break;
319
320	case 'USERNAME':
321	$pattern = '/[\x00-\x1F\x7F<>"\'%&]/';
322
323	if (is_array($source))
324	{
325	$result = array();
326
327	// iterate through the array
328	foreach ($source as $eachString)
329	{
330	$result[] = (string) preg_replace($pattern, '', $eachString);
331	}
332	}
333	else
334	{
335	$result = (string) preg_replace($pattern, '', $source);
336	}
337
338	break;
339
340	case 'RAW':
341	// unslash escaped quotes
342	$result = wp_unslash($source);
343
344	break;
345
346	default:
347	// are we dealing with an array?
348	if (is_array($source))
349	{
350	// iterate through the array
351	foreach ($source as $key => $value)
352	{
353	// filter element for XSS and other 'bad' code etc.
354	if (is_string($value))
355	{
356	$source[$key] = $this->remove($this->decode($value));
357	}
358	}
359
360	$result = $source;
361	}
362	// or a string?
363	else if (is_string($source) && !empty($source))
364	{
365	// filter source for XSS and other 'bad' code etc.
366	$result = $this->remove($this->decode($source));
367	}
368	// not an array or string, return the passed parameter
369	else
370	{
371	$result = $source;
372	}
373	}
374
375	return $result;
376	}
377
378	/**
379	* Internal method to remove all unwanted tags and attributes.
380	*
381	* @param string $source Input string to be cleaned.
382	*
383	* @return string Cleaned version of input parameter.
384	*/
385	protected function remove($source)
386	{
387	// escape any new line feed
388	$source = str_replace(array("\r\n", "\n", "\r"), array("\\r\\n", "\\n", "\\r"), $source);
389	// sanitize the string
390	$source = sanitize_text_field($source);
391	// restore any new line feed
392	$source = str_replace(array("\\r\\n", "\\n", "\\r"), array("\r\n", "\n", "\r"), $source);
393
394	// unslash escaped quotes
395	return wp_unslash($source);
396	}
397
398	/**
399	* Try to convert to plaintext.
400	*
401	* @param string $source The source string.
402	*
403	* @return string Plaintext string.
404	*/
405	protected function decode($source)
406	{
407	return html_entity_decode($source, ENT_QUOTES, 'UTF-8');
408	}
409
410	/**
411	* Try to unslash the elements of an array.
412	*
413	* @param array $source The source array.
414	*
415	* @return array The decoded array.
416	*
417	* @since 10.1.27
418	*/
419	protected function unslashArray($source)
420	{
421	foreach ($source as &$elem)
422	{
423	if (is_array($elem) \|\| is_object($elem))
424	{
425	// recursive self call
426	$elem = $this->unslashArray((array) $elem);
427	}
428	else
429	{
430	// unslash escaped quotes
431	$elem = wp_unslash($elem);
432	}
433	}
434
435	return $source;
436	}
437
438	/**
439	* Sanitizes the given string by removing all the tags and attributes
440	* that are not supported by WordPress KSES.
441	*
442	* @param string $source The string to sanitize.
443	*
444	* @return string The sanitized string.
445	*
446	* @since 10.1.33
447	*/
448	protected function safeHtml($source)
449	{
450	JLoader::import('adapter.component.helper');
451	return JComponentHelper::filterText($source);
452	}
453	}
454
455	/**
456	* Alias for JInputFilter, which is still used by the components.
457	*
458	* @since 10.1.23
459	*/
460	class JFilterInput extends JInputFilter
461	{
462
463	}
464