vikbooking / libraries / system / request.php

request.php in VikBooking Hotel Booking Engine & PMS trunk, at libraries/system/request.php

479 lines 14.5 KB

Raw Download Zip

1	<?php
2	/**
3	* @package VikWP - Libraries
4	* @author E4J s.r.l.
5	* @copyright Copyright (C) 2021 E4J s.r.l. All Rights Reserved.
6	* @license http://www.gnu.org/licenses/gpl-2.0.html GNU/GPL
7	* @link https://vikwp.com
8	*/
9
10	// No direct access
11	defined('ABSPATH') or die('No script kiddies please!');
12
13	defined('VIKREQUEST_ALLOWRAW') or define('VIKREQUEST_ALLOWRAW', 2);
14	defined('VIKREQUEST_ALLOWHTML') or define('VIKREQUEST_ALLOWHTML', 4);
15
16	if (!class_exists('VikRequest')) {
17	/**
18	* Request helper class.
19	*
20	* @since June 2021
21	* @see JInput
22	*/
23	abstract class VikRequest
24	{
25	/**
26	* Fetches and returns a given variable.
27	*
28	* The default behaviour is fetching variables depending on the
29	* current request method: GET and HEAD will result in returning
30	* an entry from $_GET, POST and PUT will result in returning an
31	* entry from $_POST.
32	*
33	* You can force the source by setting the $hash parameter:
34	*
35	* post $_POST
36	* get $_GET
37	* files $_FILES
38	* cookie $_COOKIE
39	* env $_ENV
40	* server $_SERVER
41	* method via current $_SERVER['REQUEST_METHOD']
42	* default $_REQUEST
43	*
44	* @param string $name Variable name.
45	* @param string $default Default value if the variable does not exist.
46	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
47	* @param string $type The return type for the variable:
48	* INT: An integer, or an array of integers;
49	* UINT: An unsigned integer, or an array of unsigned integers;
50	* FLOAT: A floating point number, or an array of floating point numbers;
51	* BOOLEAN: A boolean value;
52	* WORD: A string containing A-Z or underscores only (not case sensitive);
53	* ALNUM: A string containing A-Z or 0-9 only (not case sensitive);
54	* CMD: A string containing A-Z, 0-9, underscores, periods or hyphens (not case sensitive);
55	* BASE64: A string containing A-Z, 0-9, forward slashes, plus or equals (not case sensitive);
56	* STRING: A fully decoded and sanitised string (default);
57	* HTML: A sanitised string;
58	* ARRAY: An array;
59	* PATH: A sanitised file path, or an array of sanitised file paths;
60	* TRIM: A string trimmed from normal, non-breaking and multibyte spaces;
61	* USERNAME: Do not use (use an application specific filter);
62	* RAW: The raw string is returned with no filtering;
63	* unknown: An unknown filter will act like STRING. If the input is an array it will return an
64	* array of fully decoded and sanitised strings.
65	* @param integer $mask Filter mask for the variable.
66	*
67	* @return mixed Requested variable.
68	*/
69	public static function getVar($name, $default = null, $hash = 'default', $type = 'none', $mask = 0)
70	{
71	$input = &JFactory::getApplication()->input;
72
73	// ensure hash is uppercase
74	$hash = strtoupper($hash);
75
76	if ($hash === 'METHOD')
77	{
78	$hash = strtoupper($input->server->get('REQUEST_METHOD'));
79	}
80
81	// get the input hash
82	switch ($hash)
83	{
84	case 'GET':
85	$input = &$input->get;
86	break;
87
88	case 'POST':
89	$input = &$input->post;
90	break;
91
92	case 'REQUEST':
93	$input = &$input->request;
94	break;
95
96	case 'FILES':
97	$input = &$input->files;
98	break;
99
100	case 'COOKIE':
101	$input = &$input->cookie;
102	break;
103
104	case 'SERVER':
105	$input = &$input->server;
106	break;
107
108	default:
109	// do not alter default source
110	}
111
112	if ($mask == VIKREQUEST_ALLOWRAW \|\| $mask == VIKREQUEST_ALLOWHTML)
113	{
114	// set type to obtain the raw value.
115	$type = 'raw';
116	}
117
118	if ($hash === 'FILES')
119	{
120	/**
121	* Adapter for multi-file upload to keep the PHP native structure.
122	*
123	* @since 10.1.16
124	*/
125	$arr = $input->get($name, $default, $type);
126	if (count($arr) && isset($arr[0]))
127	{
128	// re-arrange the array like before for code compatibility
129	/*
130	Array
131	(
132	[name] => Array
133	(
134	[0] => x.png
135	[1] => y.jpg
136	)
137	[type] => Array
138	(
139	[0] => image/png
140	[1] => image/jpeg
141	)
142	)
143	*/
144	$legacy_map = array();
145	foreach ($arr as $ak => $av)
146	{
147	foreach ($av as $updk => $updv)
148	{
149	if (!isset($legacy_map[$updk]))
150	{
151	$legacy_map[$updk] = array();
152	}
153	$legacy_map[$updk][] = $updv;
154	}
155	}
156	return $legacy_map;
157	}
158	}
159
160	$value = $input->get($name, $default, $type);
161
162	if ($mask == VIKREQUEST_ALLOWHTML) {
163	// html will be sanitized recursively
164	self::filterHtml($value);
165	}
166
167	return $value;
168	}
169
170	/**
171	* Fetches and returns a given filtered variable. The integer
172	* filter will allow only digits and the - sign to be returned. This is currently
173	* only a proxy function for getVar().
174	*
175	* @param string $name Variable name.
176	* @param string $default Default value if the variable does not exist.
177	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
178	*
179	* @return integer Requested variable.
180	*/
181	public static function getInt($name, $default = 0, $hash = 'default')
182	{
183	return self::getVar($name, (int) $default, $hash, 'int');
184	}
185
186	/**
187	* Fetches and returns a given filtered variable. The unsigned integer
188	* filter will allow only digits to be returned. This is currently
189	* only a proxy function for getVar().
190	*
191	* @param string $name Variable name.
192	* @param string $default Default value if the variable does not exist.
193	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
194	*
195	* @return integer Requested variable.
196	*/
197	public static function getUInt($name, $default = 0, $hash = 'default')
198	{
199	return self::getVar($name, abs((int) $default), $hash, 'uint');
200	}
201
202	/**
203	* Fetches and returns a given filtered variable. The float
204	* filter only allows digits and periods. This is currently
205	* only a proxy function for getVar().
206	*
207	* @param string $name Variable name.
208	* @param string $default Default value if the variable does not exist.
209	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
210	*
211	* @return float Requested variable.
212	*/
213	public static function getFloat($name, $default = 0.0, $hash = 'default')
214	{
215	return self::getVar($name, (float) $default, $hash, 'float');
216	}
217
218	/**
219	* Fetches and returns a given filtered variable. The bool
220	* filter will only return true/false bool values. This is
221	* currently only a proxy function for getVar().
222	*
223	* @param string $name Variable name.
224	* @param string $default Default value if the variable does not exist.
225	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
226	*
227	* @return boolean Requested variable.
228	*/
229	public static function getBool($name, $default = false, $hash = 'default')
230	{
231	return self::getVar($name, (bool) $default, $hash, 'bool');
232	}
233
234	/**
235	* Fetches and returns a given filtered variable. The word
236	* filter only allows the characters [A-Za-z_]. This is currently
237	* only a proxy function for getVar().
238	*
239	* @param string $name Variable name.
240	* @param string $default Default value if the variable does not exist.
241	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD).
242	*
243	* @return string Requested variable.
244	*/
245	public static function getWord($name, $default = '', $hash = 'default')
246	{
247	return self::getVar($name, $default, $hash, 'word');
248	}
249
250	/**
251	* Cmd (Word and Integer) filter.
252	*
253	* Fetches and returns a given filtered variable. The cmd
254	* filter only allows the characters [A-Za-z0-9.-_]. This is
255	* currently only a proxy function for getVar().
256	*
257	* @param string $name Variable name
258	* @param string $default Default value if the variable does not exist
259	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD)
260	*
261	* @return string Requested variable
262	*/
263	public static function getCmd($name, $default = '', $hash = 'default')
264	{
265	return self::getVar($name, $default, $hash, 'cmd');
266	}
267
268	/**
269	* Fetches and returns a given filtered variable. The string
270	* filter deletes 'bad' HTML code, if not overridden by the mask.
271	* This is currently only a proxy function for getVar().
272	*
273	* @param string $name Variable name
274	* @param string $default Default value if the variable does not exist
275	* @param string $hash Where the var should come from (POST, GET, FILES, COOKIE, METHOD)
276	* @param integer $mask Filter mask for the variable
277	*
278	* @return string Requested variable
279	*/
280	public static function getString($name, $default = '', $hash = 'default', $mask = 0)
281	{
282	return self::getVar($name, $default, $hash, 'string', $mask);
283	}
284
285	/**
286	* Set a variable in one of the request variables.
287	*
288	* @param string $name Name
289	* @param string $value Value
290	* @param string $hash Hash
291	* @param boolean $overwrite Boolean
292	*
293	* @return string Previous value.
294	*/
295	public static function setVar($name, $value = null, $hash = 'default', $overwrite = true)
296	{
297	$input = &JFactory::getApplication()->input;
298
299	// ensure hash is uppercase
300	$hash = strtoupper($hash);
301
302	if ($hash === 'METHOD')
303	{
304	$hash = strtoupper($input->server->get('REQUEST_METHOD'));
305	}
306
307	// get the input hash
308	switch ($hash)
309	{
310	case 'GET':
311	$input = &$input->get;
312	break;
313
314	case 'POST':
315	$input = &$input->post;
316	break;
317
318	case 'REQUEST':
319	$input = &$input->request;
320	break;
321
322	case 'FILES':
323	$input = &$input->files;
324	break;
325
326	case 'COOKIE':
327	$input = &$input->cookie;
328	break;
329
330	case 'SERVER':
331	$input = &$input->server;
332	break;
333
334	default:
335	// do not alter default source
336	}
337
338	$prev = $input->get($name, null, 'raw');
339
340	// if overwrite is false, make sure the variable hasn't been set yet
341	if ($overwrite \|\| $prev === null)
342	{
343	$input->set($name, $value);
344	}
345
346	return $prev;
347	}
348
349	/**
350	* Adapter method to safely send a cookie to the browser depending on the current PHP version,
351	* by also supporting the old function's signature before PHP 7.3 that will be adjusted:
352	* (name, value, expire, path, domain, secure, httpOnly)
353	*
354	* @param string $name The name of the value to set for the cookie.
355	* @param mixed $value The value to assign to the cookie.
356	* @param mixed $options An associative array which may have any of the keys expires, path, domain,
357	* secure, httponly and samesite. The values have the same meaning as described
358	* for the parameters with the same name. The value of the samesite element should
359	* be either None, Lax or Strict.
360	* If the samesite element is omitted, SameSite cookie attribute will default
361	* to Lax. If the current PHP version supports this element the new signature will
362	* be used, otherwise we will use the headers to set the Lax cookie in the browser.
363	* @return void
364	*
365	* @since 10.1.30
366	*/
367	public static function setCookie($name, $value, $options = array())
368	{
369	// BC layer to convert old method parameters
370	if (!is_array($options))
371	{
372	$argList = func_get_args();
373
374	$options = array(
375	'expires' => isset($argList[2]) ? $argList[2] : 0,
376	'path' => isset($argList[3]) ? $argList[3] : '',
377	'domain' => isset($argList[4]) ? $argList[4] : '',
378	'secure' => isset($argList[5]) ? $argList[5] : false,
379	'httponly' => isset($argList[6]) ? $argList[6] : false,
380	);
381	}
382
383	// we make the samesite element default to Lax if no value given
384	if (!isset($options['samesite']))
385	{
386	// Mozilla is going to deprecate/penalise the use of SameSite = None,
387	// which is used by default if no element is set for samesite
388	$options['samesite'] = 'Lax';
389	}
390
391	// samesite attribute validation
392	$samesite_types = array(
393	'None',
394	'Lax',
395	'Strict',
396	);
397
398	if (!empty($options['samesite']) && !in_array((string) $options['samesite'], $samesite_types))
399	{
400	// default to Lax after validation
401	$options['samesite'] = 'Lax';
402	}
403
404	// set the cookie
405	if (version_compare(PHP_VERSION, '7.3', '>='))
406	{
407	// Most recent PHP versions will always pass the attribute samesite for the cookie.
408	// This is the new function's signature to ensure cookies will not be rejected.
409	@setcookie($name, $value, $options);
410	}
411	else
412	{
413	// using the setcookie function on PHP < 7.3, make sure we have the default values
414	if (!isset($options['expires']))
415	{
416	$options['expires'] = 0;
417	}
418
419	if (!isset($options['path']))
420	{
421	$options['path'] = '';
422	}
423
424	if (!isset($options['domain']))
425	{
426	$options['domain'] = '';
427	}
428
429	if (!isset($options['secure']))
430	{
431	$options['secure'] = false;
432	}
433
434	if (!isset($options['httponly']))
435	{
436	$options['httponly'] = false;
437	}
438
439	if (!headers_sent())
440	{
441	// we use the headers to send the cookie to the browser to support the samesite attribute
442	header('Set-Cookie: ' . rawurlencode($name) . '=' . rawurlencode($value)
443	. ($options['expires'] ? '; expires=' . gmdate('D, d-M-Y H:i:s', $options['expires']) . ' GMT' : '')
444	. ($options['path'] ? '; path=' . $options['path'] : '')
445	. ($options['domain'] ? '; domain=' . $options['domain'] : '')
446	. ($options['secure'] ? '; secure' : '')
447	. ($options['httponly'] ? '; HttpOnly' : '')
448	. ($options['samesite'] ? '; SameSite=' . $options['samesite'] : '')
449	, false);
450	}
451	}
452	}
453
454	/**
455	* Applies sanitification recursively to get clean HTML contents.
456	*
457	* @param mixed $value reference to array or string to be sanitized.
458	*
459	* @return mixed sanitized array or string.
460	*
461	* @since June 2021
462	*/
463	public static function filterHtml(&$value)
464	{
465	if (is_array($value))
466	{
467	foreach ($value as $k => $content)
468	{
469	self::filterHtml($value[$k]);
470	}
471	}
472	else
473	{
474	$value = JComponentHelper::filterText($value);
475	}
476	}
477	}
478	}
479