From 47cbb529f5723b246125ae083a193e11481b89ef Mon Sep 17 00:00:00 2001 From: George Halkiadakis Date: Sun, 12 Mar 2023 07:01:30 +0200 Subject: initializing classroom structure using anom framework --- .gitignore | 72 ++ README.md | 266 +++++++ auth/.gitkeep | 0 classes/Benchmark.php | 150 ++++ classes/Cart.php | 71 ++ classes/Database.php | 331 +++++++++ classes/Registry.php | 129 ++++ classes/Repository.php | 43 ++ classes/Request.php | 94 +++ classes/Route.php | 97 +++ classes/Security.php | 923 +++++++++++++++++++++++++ classes/User.php | 111 +++ classes/authenticator/PasswordTrait.php | 40 ++ classes/authenticator/User.php | 102 +++ classes/authenticator/UserInterface.php | 15 + classes/authenticator/UserManager.php | 69 ++ classes/authenticator/UserManagerInterface.php | 21 + classes/authenticator/UserToken.php | 33 + classes/authenticator/UserTokenInterface.php | 13 + classes/authenticator/info.md | 114 +++ classes/cache/Cache_interface.php | 34 + classes/cache/FileCache.php | 93 +++ classes/cache/MemcachedCache.php | 37 + classes/cache/RedisCache.php | 69 ++ classes/session/DatabaseSession.php | 138 ++++ classes/session/DefaultSession.php | 35 + classes/session/FilesSession.php | 142 ++++ classes/session/SessionHandlerInterface.php | 169 +++++ cli/micro/setup.php | 120 ++++ cli/micro/term_utilities.php | 44 ++ config/anom_settings.php | 169 +++++ config/constants.php | 28 + config/credentials.php | 126 ++++ config/init.php | 76 ++ helpers/autoload.php | 43 ++ helpers/design_patterns.php | 104 +++ helpers/error_handling.php | 119 ++++ helpers/render.php | 338 +++++++++ 38 files changed, 4578 insertions(+) create mode 100644 .gitignore create mode 100644 README.md create mode 100644 auth/.gitkeep create mode 100644 classes/Benchmark.php create mode 100644 classes/Cart.php create mode 100644 classes/Database.php create mode 100644 classes/Registry.php create mode 100644 classes/Repository.php create mode 100644 classes/Request.php create mode 100644 classes/Route.php create mode 100644 classes/Security.php create mode 100644 classes/User.php create mode 100644 classes/authenticator/PasswordTrait.php create mode 100644 classes/authenticator/User.php create mode 100644 classes/authenticator/UserInterface.php create mode 100644 classes/authenticator/UserManager.php create mode 100644 classes/authenticator/UserManagerInterface.php create mode 100644 classes/authenticator/UserToken.php create mode 100644 classes/authenticator/UserTokenInterface.php create mode 100644 classes/authenticator/info.md create mode 100644 classes/cache/Cache_interface.php create mode 100644 classes/cache/FileCache.php create mode 100644 classes/cache/MemcachedCache.php create mode 100644 classes/cache/RedisCache.php create mode 100644 classes/session/DatabaseSession.php create mode 100644 classes/session/DefaultSession.php create mode 100644 classes/session/FilesSession.php create mode 100644 classes/session/SessionHandlerInterface.php create mode 100644 cli/micro/setup.php create mode 100644 cli/micro/term_utilities.php create mode 100644 config/anom_settings.php create mode 100644 config/constants.php create mode 100644 config/credentials.php create mode 100644 config/init.php create mode 100644 helpers/autoload.php create mode 100644 helpers/design_patterns.php create mode 100644 helpers/error_handling.php create mode 100644 helpers/render.php diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..0b728f0 --- /dev/null +++ b/.gitignore @@ -0,0 +1,72 @@ +# commonly ignored file patterns. +# --------------------------------------------- + +# -- Node artifact files +node_modules/ +# dist/ + +# -- Compiled Java class files +# *.class + +# -- Compiled Python bytecode +# *.py[cod] + +# -- Log files +*.log + +# -- Package files +# *.jar + +# -- Maven +# target/ +# dist/ + +# -- JetBrains IDE +.idea/ + +# -- Unit test reports +# TEST*.xml + +# -- Generated by MacOS +.DS_Store + +# -- Generated by Windows +Thumbs.db + +# -- Applications +*.app +*.exe +*.war + +# Large media files +*.mp4 +*.tiff +*.avi +*.flv +*.mov +*.wmv + + +# x-anom gitignore rules +# --------------------------------------------- + +# -- enviriment-variables +.env + +# -- data files of data/ folder +data/* + +# -- local cache +html/cache/* + +# -- exceptions: keep proposing directory-structure +!data/.gitkeep +!core/auth/.gitkeep +!html/cache/.gitkeep + +# -- ignore vendor files +vendor/* + +# -- vscode ide configurations +.vscode +.vscode/* diff --git a/README.md b/README.md new file mode 100644 index 0000000..fb92086 --- /dev/null +++ b/README.md @@ -0,0 +1,266 @@ +## x-anom +### X is ANOther Mvc + +x-anom is an Object-Oriented MVC php-framework. + +Main advantages of the framework: + +* It is super-light and fast; +* Core has almost zero dependences and contains almost anything you need to start and optimize a server-based web-application. +* It is extensible especialy if you use Composer (which is recommended, though not required) +* Handles security; and as long as you write code using secure practices, it will be secure +* It's easy to configure, easy to code, easy to use + + + +### Requirements + +* PHP 8+ +* Some webserver (Apache/Nginx) +* Some SQL server (MySQL/MariaDB/Postgress) +* Basic knowledge of php and SQL + + + + +### What is included + +Core components: + + +#### Router + +Routes request to the appropriate Controller +- matches static paths +- matches dynamic paths through regex expressions +- takes care of request-method + + +#### Controller and Model + +(just write your Controller and Model classes) + + +#### View (rendering engine) + +Usually you just need to call the render_view(template, data) function. +For templating we use the php short-tag syntax. + +main functions: + +* load_template( template, data) + +* render_view( view_file , data ) + +* load_asset( type, assets_array ) + +* set_headers( content_type, ttl, more_array ) + +* render_text( data, content_type, ttl ) + +* reply_json( data, ttl ) + + +#### Class autoloader + +Composer is recomende; +but if is not available this one will do the job + + +#### Caching + +* File Caching mechanism + +* Redis Cache + +* Memcached Caching + + +#### Session Management + +* DefaultSession: psevdo-handler with passthrough methods + +* FileSession: custom file-based session handler + +* DatabaseSession: database session handler + + + +#### More + +* Proxy design pattern + +* Error handling + +* Repository + +* Cli interface (*summarizes anom*) + + + + + +### Other features + +* Docker ready + +You can run the framework as is in a Docker environment; +Also. you can edit just a bit the configuration files to customize the project +to support various technologies; Check the README file in the project's root +folder to find out more. + + + +### What is not included + +* It lacks a query builder (SQL is easy and very powerful); do not forget to use prepared statements for all your SQL queries. + +* TODO: User-Role based administration class. + +* TODO: Shoping-Cart class. + + + +## Life (and death) of a Client_Request–Server_reply session + +1. THE REQUEST: client makes a request -> request arives to the server -> .htaccess sends the request to the index.php + +2. index loads Configuration (constants.php + config.php) and AUTOLOADER in order load classes easily + +3. index loads init.php -> after initialization the APP is READY -> index loads the routes; Route::run() -> the APP is RUNNING + +4. Router resolves the request pattern and calls a Controller + +5. (if needed) Controller asks data from the Model; then responds a reply to the client using **render** functions -> APP dies + + + +## Direcrtory structure + +NOTE: directory structure needs updata, but the main structure ramains untouched. + + . + |-- container * for docker/container configuration + | |-- bin * scripts + | `-- config * settings + | + |-- core * core code + | |-- auth * authentication and credentials + | | + | |-- config * application parametres + | | |-- config.php + | | |-- constants.php + | | |-- credentials.php + | | `-- init.php + | | + | |-- classes * core classes + | | |-- cacher + | | |-- Benchmark.php + | | |-- Database.php + | | |-- Route.php + | | |-- Security.php + | | `-- Session.php + | | + | `-- helpers * core helpers + | |-- autoload.php + | |-- error-handling.php + | `-- render.php + | + |-- data * folder for batch data-imports to database + | + |-- html ** PUBLIC directory + | |-- app * APP + | | |-- Controllers * Controllers + | | | |-- Art.php + | | | `-- ... + | | | + | | |-- Models * Models + | | | |-- Art_model.php + | | | `-- ... + | | | + | | |-- Views * Views + | | | |-- group.php + | | | `-- item.php + | | | + | | `-- routes.php * application routes + | | + | `-- cache * Caching folder + | + `-- vendor * Vendor classes and autoloader + |-- composer + `-- ... + + + + +## Naming Conventions and good practices + +1. Keep Controllers, Models, Views in their folders + +2. Organize View elements in subfolders + +3. Controller and Model names shall be camelcased; + - fist letter should be Uppercase; + - classes shall be named exactly as their filenames + +4. Model names shall be suffixed with _model + +5. Comment every-single Controller/Model/class and comment every method + +6. On Views (php templates) use php short-tags when possible + - Views are about rendering data; avoid complex-logic + - [if/else], [foreach] and some flag/temp [variables] sould be fair enough + +7. All of the above rules are strongly recommended (although not obligatory); + + + +## Notes and brainstorming + +### for template system check + https://css-tricks.com/php-is-a-ok-for-templating/ + +### for rendering system you may check volt too + https://docs.phalcon.io/4.0/en/volt + + + +## Brainstorming + +* take care of various hacks + chk: https://stackoverflow.com/questions/1996122/how-to-prevent-xss-with-html-php + +* HTML to MarkDown! + chk: https://github.com/thephpleague/html-to-markdown + + + + + +VIEW data + +-> ceo -> title + -> description + -> keywords + -> ... + +-> content -> view : view_filename + -> key : some_variable_name + -> data : the_data + + + + +## Knowledge Requirements + +## Tools of work + +None of the following tools is necessary, but they will help very very-much. + +- Composer + +- Docker + +- Code editor + +- Coffee + Nicotine diff --git a/auth/.gitkeep b/auth/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/classes/Benchmark.php b/classes/Benchmark.php new file mode 100644 index 0000000..a7e93ea --- /dev/null +++ b/classes/Benchmark.php @@ -0,0 +1,150 @@ +'; + $close = '

'; + $divider = ":"; + $prefix = '
'; + $suffix = '
'; + break; + case 'code': + $open = ''; + $close = ''; + $divider = ": "; + $prefix = '
';
+                    $suffix = '
'; + break; + case 'comment': + default: + $open = ''; + $divider = ":"; + $prefix = ''; + $suffix = ''; + break; + } + + echo $prefix; + + // TIME REPORT + // --------------------------------------------------------------------- + echo "\n\n{$open} Timings {$close}"; + + // valid from php 7.3 + // $start = self::$timeSpots[ array_key_first(self::$timespots) ]; + // $end = self::$timeSpots[ array_key_last(self::$timespots) ]; + $start = self::$timeSpots['start']; + $end = self::$timeSpots['end']; + $all_dt = number_format($end - $start , 4)*1000 ." ms"; + + + + // if more than 2 timespots + // echo dt between each spot + if (count(self::$timeSpots) > 2) { + + // calculate dt between spots + $time_results = array(); + $prev_key = ''; + $prev_time = 0; + foreach(self::$timeSpots as $key => $t) { + if (!$prev_time) { + $prev_time = $t; + $prev_key = $key; + } + else { + $dt = number_format($t - $prev_time , 4)*1000 ." ms"; + $time_results[] = array( + 'part' => "{$prev_key}[..{$key}]", ///$key, + 'dt' => $dt + ); + $prev_key = $key; //// "{$prev_key}[..{$key}]"; + $prev_time = $t; + } + } + + // echo timings + foreach ($time_results as $key => $val) { + echo "\n\t{$open} {$val['part']} {$divider} {$val['dt']} {$close}"; + } + } + + // echo total time + echo "\n\t{$open} total {$divider} {$all_dt} {$close}"; + + + // MEMORY REPORT + // --------------------------------------------------------------------- + echo "\n\n{$open} Memory Usage {$close}"; + + if (count(self::$memoryUse) > 2) { + + foreach (self::$memoryUse as $key => $val) { + echo "\n\t{$open} {$key} {$divider} {$val}MB {$close}"; + } + + } else { + echo "\n\t{$open} memory usage {$divider} ". round(memory_get_usage()/(1024*1024),2) ."MB {$close}"; + } + + echo $suffix; + + } + + } +} diff --git a/classes/Cart.php b/classes/Cart.php new file mode 100644 index 0000000..4e6f585 --- /dev/null +++ b/classes/Cart.php @@ -0,0 +1,71 @@ +uid], 10) + // + // oranize in results = [ + // { + // oid, + // prods: [ + // { + // pid, + // prodlabel, + // count + // }, + // ... + // ] + // }, + // ..., + // ] + // + // return $results + + } +} + + + +/* --- +orders: + : id + : uid (user id) + +order_products + : id + : oid (order id) + : pid (product id) + -- */ \ No newline at end of file diff --git a/classes/Database.php b/classes/Database.php new file mode 100644 index 0000000..35ff65f --- /dev/null +++ b/classes/Database.php @@ -0,0 +1,331 @@ +throw_errors = PRODUCTION ? false : true; + + if (null == $this->connection) { + try { + $this->connection = new PDO( + "mysql:" . PDO_HOST . ";" . "dbname=" . DB_NAME, + DB_USER, + DB_PASS, + array( + PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'utf8'", + PDO::MYSQL_ATTR_LOCAL_INFILE => true + ) + ); + + // handle error reporting + if ($this->throw_errors) { + $this->connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + } + $this->setTimezone(); + + } catch (PDOException $exc) { handle_exception($exc); } + } + # return $this->connection; + } + + + /** disconnect + * CHECK: not sure if needed + */ + public function disconnect() + { + $this->connection = null; + } + + + /** set Timezone + * (Self-explanatory) + */ + public function setTimezone($timezone = DB_TIMEZONE) { + // $this->connection->prepare($timezone)->execute(); + } + + + /** lastInsertID + * returns the ID of last inserted record + */ + public function lastInsertID() + { + return $this->connection->insert_id; + } + + + /** query + * --- + * set and execute a query safely; + * save results as associative array; DO NOT RETURN RESULTS + * @param $sql (string): SQL query + * @param $args (array): array of values to bind into SQL + * @param $pypass (boolean): flag to bypass security check + * @return $this (database handler) + */ + public function query($sql, $args=[]) + { + try { + + $stmt = $this->connection->prepare($sql); + + if ($args == []) { + $result = $stmt->execute(); + + } else { + $result = $stmt->execute($args); + + } + + $result = $stmt->fetchAll(PDO::FETCH_ASSOC); + + $this->result = $result; + + return $this; + + } catch (PDOException $exc) { handle_exception($exc); } + + } + + + /** getAll + * --- + * return all resulted records + * use it after db->query(); + */ + public function getAll() + { + return ($this->result === null) ? false : $this->result; + } + + + /** getFirst + * --- + * get first row of the resulted query; + * used when one row is expected + * ex. $db->query('SELECT * FROM users WHERE id = :id',['id'=>1])->getFirst(); + */ + public function getFirst() + { + if (($this->result === null) || ($this->result == [])) { + return false; + + } else { return $this->result[0]; } + } + + + /** getOnly + * --- + * return the first column value of the first row + * used when only one value is needed + * ex. $db->query('SELECT Count(id) FROM table',[])->getOnly(); + */ + public function getOnly() + { + if (($this->result === null) || ($this->result == [])) { + return false; + + } else { return array_values($this->result[0])[0]; } + } + + + /** runQuery + * --- (shortcut method) + * execute a query safely; + * return results as associative array + * @param $sql (string): SQL query + * @param $args (array): array of values to bind into SQL + * @param $pypass (boolean): flag to bypass security check + */ + public function runQuery($sql, $args=[]) + { + return $this->query($sql, $args)->getAll(); + } + + + /** runLimitQuery( sql, args, limit=100, offset = null ) + * set LIMIT / OFFSET clauses in a secure way + * @param $sql (string): SQL query + * @param $args (array): array of values to bind into SQL + * @param $limit (int): LIMIT number + * @param $offset (int): OFFSET number + */ + public function runLimitQuery($sql, $args, $limit = 100, $offset = null) + { + $limitStr = $offsetStr = ""; + + // construct LIMIT clause + if (is_int($limit)) { + $limitStr = " LIMIT {$limit}"; + + // construct OFFSET clause (when a LIMIT pre-exists) + if (is_int($offset)) { + $offsetStr =" OFFSET {$offset}"; + } + } + + $sql = $sql . $limitStr . $offsetStr; + + return $this->runQuery($sql, $args); + } + + + /** insert + * @param $table (string): name of table + * @param $values: an associative of (fieldName => value) pairs + * + * example call: + * --- + * $db->insert('products', + * [ + * 'title' => 'My Dark Chocolate 200g', + * 'text' => 'Lorem ipsum dolor sit amet, consectetur adipiscing elit ...', + * 'isFood' => 1, + * 'isToxic' => 0 + * ] + * ); + * + * ...which prepares the SQL query: + * INSERT INTO products (title, text, isFood, isToxic) + * VALUES (:title, :text, :isFood, :isToxic) + * + * ...and injects the values: [ :title => 'My Dark Chocolate 200g' , ... ] + */ + public function insert($table, array $values) + { + $fieldSets = []; + $valueSets = []; + $bindSets = []; + + foreach($values as $key => $val) { + $fieldSets[] = $key; + $valueSets[] =':'. $key; + $bindSets[':'. $key] = $val; + } + + $sql = "INSERT INTO {$table} (". implode(', ', $fieldSets) .") + VALUES (". implode(', ', $valueSets) .")"; + + return $this->runQuery($sql, $bindSets); + } + + + /** update + * @param $table (string): name of table + * @param $values: an associative of (fieldName => value) pairs + * @param $id: an associative of (fieldName => value) index fields + * + * example call: + * --- + * $db->update('products', + * [ 'title' => 'My Chocolate','isFood' => 1 ], + * [ 'id' => 123 ] + * ); + * + * ...which prepares the SQL query: + * UPDATE products SET `title` = :title, `isFood` = :isFood WHERE id = :id + * + * ...and injects: [':title'=> 'My Chocolate' , ':isFood'=> 1 , ':id'=> 123] + */ + public function update( $table, array $values, array $identity) + { + $fieldSets = []; // array of field names + $idSets = []; // array of data-holders + $bindSets = []; // array of data-bindings + + foreach($values as $key => $val) { + $fieldSets[] = "{$key} = :{$key}"; + $bindSets[':'. $key] = $val; + } + + foreach($identity as $key => $val) { + $idSets = "{$key} = :{$key}"; + $bindSets[':'. $key] = $val; + } + + $sql = "UPDATE {$table} SET ". implode(', ', $fieldSets) + ." WHERE ". implode(" AND ", $idSets); + + return $this->runQuery($sql, $bindsArray); + } + + + /** multiInsert( table, fields , values ) + * Construct a multiple-insert clause + * + * @param $table (string): name of table + * @param $fields (array): array with field-names + * @param $values (array): array of value-arrays + * + * example call: + * --- + * $db->multiInsert('order_products', + * [ 'orderID', 'productID', 'unitPrice', 'quantity', 'note' ], + * [ + * [ 124, 102030, 1.25, 5, '' ], + * [ 124, 102040, 10.50, 2, 'some note about product #102040' ], + * [ 124, 102050, 7.20, 3, '' ], + * [ 124, 102060, 3.25, 1, 'some other note' ] + * ] + * ); + */ + public function multiInsert($table, array $fieldsArray, array $valuesArray) + { + if (count($fieldsArray) != count($valuesArray[0])) { + throw new Exception('Fields and value arrays don\'t match.'); + } + + // setup fieldsSet + // ex. "(Title, Price, Status)" + $fieldsSet = ' (`'. implode( + '`, `', // make sure fieldnames are not SQL-bound terms + str_replace('`', '', $fieldsArray) // clean fieldnames + ) .'`) '; + + // setup holders array and bind-values array + // ex. "(:Title1, :Price1, :Status1), (:Title2, :Price2, :Status2), ...", + $holdersArray = []; + $bindsArray = []; + $counter = 1; + foreach($valuesArray as $key => $rowArray) { + $rowHolders = []; + + foreach($itemArray as $key => $val) { + $rowHolders = ':'. $fieldsArray[$key] . $counter; + $bindsArray[ ':'. $fieldsArray[$key] . $counter ] = $val; + } + $holdersArray[] = '('. implode(', ', $rowHolders ) .')'; + $counter++; + } + + $sql = "INSERT INTO {$table}" . $fieldsSet + . ' VALUES '. impload(', ', $holdersArray); + + return $this->runQuery($sql, $bindsArray); + } + +} diff --git a/classes/Registry.php b/classes/Registry.php new file mode 100644 index 0000000..df012e9 --- /dev/null +++ b/classes/Registry.php @@ -0,0 +1,129 @@ +URL = $_SERVER['REQUEST_URI']; + $this->PATH = (!empty($parsed['path'])) ? urldecode($parsed['path']) : ''; + $this->QUERY = (!empty($parsed['query'])) ? urldecode($parsed['query']) : false; + $this->HOST = $_SERVER['HTTP_HOST']; + $this->PORT = $_SERVER['SERVER_PORT']; + $this->TIME = $_SERVER['REQUEST_TIME']; + $this->CLI_IP = $_SERVER['REMOTE_ADDR']; + + $this->METHOD = strtolower($_SERVER['REQUEST_METHOD']); + + $this->GET = $_GET; // $_GET should only used + // to request data or specify options (never to perform + // system-changes) thus should not need any validation; + // * If (for any reason) you requide $_GET sanitization + // enable it later on the method's code + + // $this->INTERFACE = php_sapi_name(); + + $this->AGENT = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'; + $this->SIGNATURE = sha1( + $_SERVER['HTTP_USER_AGENT'] ?? 'unknown' + . $_SERVER['HTTP_ACCEPT'] ?? '' + . $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '' + . $_SERVER['HTTP_ACCEPT_ENCODING'] ?? '' + ); + + // sanitize user input + // if (isset($_GET)) { $this->GET = $this->sanitize($_GET); } + $this->GET = $this->sanitize($_GET); + if (isset($_POST)) { $this->POST = $this->sanitize($_POST); } + if (isset($_COOKIE)) { $this->COOKIE = $this->sanitize($_COOKIE); } + + // check anti-CSRF token if needed + // (again, GET requests should not need CSRF cheking) + if (in_array($this->METHOD, ['post', 'put', 'patch', 'delete'])) { + // TODO: only if CSRF protection enabled... + $this->checkCsrfToken(); + } + + } + + + private function sanitize($array) + { + // TODO: + // ... + return $array; + } + + + public function checkCsrfToken() + { + // TODO: + // ... + // if SCRF-token is not valideted, serve 403 + return $array; + } + +} + diff --git a/classes/Route.php b/classes/Route.php new file mode 100644 index 0000000..072723c --- /dev/null +++ b/classes/Route.php @@ -0,0 +1,97 @@ + $expression, + 'function' => $function, + 'method' => strtolower($method) + )); + } + + + /** notFound($function) + * --- + * @param $function : call back function to be executed + */ + public static function notFound($function) + { + self::$notFound = $function; + } + + + /** run() + * --- + * Parse request ; Find mathing route ; + * then call route's function + * usualy a Controller::method([poarametres]) + */ + public static function run(Request $request) + { + // $request = Registry::get('REQUEST'); + $path = $request->PATH; // request path + $method = $request->METHOD; // request method + + $path_match_found = false; + $route_match_found = false; + + foreach(self::$routes as $route) { + + // If method matched check the path + if ($route['method'] == $method || $method == 'any') { + + // Add 'find string start' automatically + $route['expression'] = '^'.$route['expression']; + + // Add 'find string end' automatically + $route['expression'] = $route['expression'].'$'; + + // Check path match + if (preg_match('#'. $route['expression'] .'#', $path, $matches)) { + + $route_match_found = true; + + array_shift($matches); // Always remove first element. This contains the whole string + + call_user_func_array($route['function'], $matches); + break; // Do not check other routes + + } + } + } + + // No matching route was found + if (!$route_match_found) { + header("HTTP/1.0 404 Not Found"); + if (self::$notFound) { + call_user_func_array(self::$notFound, []); + } + } + + } + +} diff --git a/classes/Security.php b/classes/Security.php new file mode 100644 index 0000000..61979db --- /dev/null +++ b/classes/Security.php @@ -0,0 +1,923 @@ +', '<', '>', + "'", '"', '&', '$', '#', + '{', '}', '[', ']', '=', + ';', '?', '%20', '%22', + '%3c', // < + '%253c', // < + '%3e', // > + '%0e', // > + '%28', // ( + '%29', // ) + '%2528', // ( + '%26', // & + '%24', // $ + '%3f', // ? + '%3b', // ; + '%3d' // = + ); + + public $charset = 'UTF-8'; // Character set @var (string) Will be overridden by the constructor. + + protected $_xss_hash; // XSS Hash: @var (string) Random Hash for protecting URLs. + + protected $_csrf_hash; // CSRF Hash: @var (string) Random hash for Cross Site Request Forgery protection cookie + + // CSRF Expire time @var (int) + // Expiration time for Cross Site Request Forgery protection cookie. + protected $_csrf_expire = 7200; // defaults to 2hours (=7200 seconds) + + // CSRF Token name: @var (string) Token name for Cross Site Request Forgery protection cookie. + protected $_csrf_token_name = 'pi_csrf_token'; + + // CSRF Cookie name: @var (string) Cookie name for Cross Site Request Forgery protection cookie. + protected $_csrf_cookie_name = 'pi_csrf_token'; + + // List of never allowed strings @var (array) + protected $_never_allowed_str = array( + 'document.cookie' => '[removed]', + '(document).cookie' => '[removed]', + 'document.write' => '[removed]', + '(document).write' => '[removed]', + '.parentNode' => '[removed]', + '.innerHTML' => '[removed]', + '-moz-binding' => '[removed]', + '' => '-->', + ' '<![CDATA[', + '' => '<comment>', + '<%' => '<%' + ); + + // List of never allowed regex replacements @var (array) + protected $_never_allowed_regex = array( + 'javascript\s*:', + '(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)', + 'expression\s*(\(|&\#40;)', // CSS and IE + 'vbscript\s*:', // IE, surprise! + 'wscript\s*:', // IE + 'jscript\s*:', // IE + 'vbs\s*:', // IE + 'Redirect\s+30\d', + "([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?" + ); + + + /** Class constructor + * --- + * @return void + */ + public function __construct($charset = 'UTF-8') + { + $this->charset = $charset; + + /* --- + // Is CSRF protection enabled? + if (CSRF_PROTCTION') && ! is_cli()) + { --*/ + /************** + // CSRF config + foreach (array('csrf_expire', 'csrf_token_name', 'csrf_cookie_name') as $key) + { + //// if (NULL !== ($val = config_item($key))) + //// { + $this->{'_'.$key} = $val; + //// } + } + + // Append application specific cookie prefix + //// if ($cookie_prefix = config_item('cookie_prefix')) + //// { + $this->_csrf_cookie_name = $cookie_prefix . $this->_csrf_cookie_name; + //// } + + // Set the CSRF hash + $this->_csrf_set_hash(); + $this->csrf_verify(); + ***************/ + /* --- + } --*/ + + //// log_message('info', 'Security Class Initialized'); + } + + + /** CSRF Verify + * --- + * @return Security + */ + public function csrf_verify() + { + // If it's not a POST request we will set the CSRF cookie + if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') + { + return $this->csrf_set_cookie(); + } + + /// // Check if URI has been whitelisted from CSRF checks + /// if ($exclude_uris = config_item('csrf_exclude_uris')) + /// { + /// $uri = load_class('URI', 'core'); + /// foreach ($exclude_uris as $excluded) + /// { + /// if (preg_match('#^'.$excluded.'$#i'.(UTF8_ENABLED ? 'u' : ''), $uri->uri_string())) + /// { + /// return $this; + /// } + /// } + /// } + + // Check CSRF token validity, but don't error on mismatch just yet - we'll want to regenerate + $valid = isset($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]) + && is_string($_POST[$this->_csrf_token_name]) && is_string($_COOKIE[$this->_csrf_cookie_name]) + && hash_equals($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]); + + // We kill this since we're done and we don't want to pollute the _POST array + unset($_POST[$this->_csrf_token_name]); + + // Regenerate on every submission? + if (config_item('csrf_regenerate')) + { + // Nothing should last forever + unset($_COOKIE[$this->_csrf_cookie_name]); + $this->_csrf_hash = NULL; + } + + $this->_csrf_set_hash(); + $this->csrf_set_cookie(); + + if ($valid !== TRUE) + { + $this->csrf_show_error(); + } + + log_message('info', 'CSRF token verified'); + return $this; + } + + + /** CSRF Set Cookie + * --- + * @codeCoverageIgnore + * @return Security + */ + public function csrf_set_cookie() + { + $expire = time() + $this->_csrf_expire; + $secure_cookie = (bool) config_item('cookie_secure'); + + if ($secure_cookie && ! is_https()) + { + return FALSE; + } + + // php7.3+ + setcookie( + $this->_csrf_cookie_name, + $this->_csrf_hash, + array( + 'expires' => $expire, + 'path' => config_item('cookie_path'), + 'domain' => config_item('cookie_domain'), + 'secure' => $secure_cookie, + 'httponly' => config_item('cookie_httponly'), + 'samesite' => 'Strict' + ) + ); + + log_message('info', 'CSRF cookie sent'); + + return $this; + } + + + /** Show CSRF Error + * -- + * @return void + */ + public function csrf_show_error() + { + show_error('The action you have requested is not allowed.', 403); + } + + + /** Get CSRF Hash + * --- + * @see CI_Security::$_csrf_hash + * @return string CSRF hash + */ + public function get_csrf_hash() + { + return $this->_csrf_hash; + } + + + /** Get CSRF Token Name + * --- + * @see CI_Security::$_csrf_token_name + * @return string CSRF token name + */ + public function get_csrf_token_name() + { + return $this->_csrf_token_name; + } + + + /** XSS Clean + * --- + * Sanitizes data so that Cross Site Scripting Hacks can be + * prevented. This method does a fair amount of work but + * it is extremely thorough, designed to prevent even the + * most obscure XSS attempts. Nothing is ever 100% foolproof, + * of course, but I haven't been able to get anything passed + * the filter. + * + * Note: Should only be used to deal with data upon submission. + * It's not something that should be used for general + * runtime processing. + * + * @link http://channel.bitflux.ch/wiki/XSS_Prevention + * Based in part on some code and ideas from Bitflux. + * + * @link http://ha.ckers.org/xss.html + * To help develop this script I used this great list of + * vulnerabilities along with a few other hacks I've + * harvested from examining vulnerabilities in other programs. + * + * @param string|string[] $str Input data + * @param bool $is_image Whether the input is an image + * @return string + */ + public function xss_clean($str, $is_image = FALSE) + { + // Is the string an array? + if (is_array($str)) + { + foreach ($str as $key => &$value) + { + $str[$key] = $this->xss_clean($value); + } + + return $str; + } + + // Remove Invisible Characters + $str = remove_invisible_characters($str); + + // URL Decode + // Just in case stuff like this is submitted: + // Google + // NOTE: Use rawurldecode() so it does not remove plus signs + if (stripos($str, '%') !== false) + { + do + { + $oldstr = $str; + $str = rawurldecode($str); + $str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', array($this, '_urldecodespaces'), $str); + } + while ($oldstr !== $str); + unset($oldstr); + } + + // Convert character entities to ASCII + // --- + // This permits our tests below to work reliably. + // We only convert entities that are within tags since + // these are the ones that will pose security problems. + $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str); + $str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str); + + // Remove Invisible Characters Again! + $str = remove_invisible_characters($str); + + + // Convert all tabs to spaces + // --- + // This prevents strings like this: ja vascript + // NOTE: we deal with spaces between characters later. + // NOTE: preg_replace was found to be amazingly slow here on + // large blocks of data, so we use str_replace. + $str = str_replace("\t", ' ', $str); + + // Capture converted string for later comparison + $converted_string = $str; + + // Remove Strings that are never allowed + $str = $this->_do_never_allowed($str); + + + // Makes PHP tags safe + // NOTE: XML tags are inadvertently replaced too: + // '), array('<?', '?>'), $str); + } + + // Compact any exploded words + // --- + // This corrects words like: j a v a s c r i p t + // These words are compacted back to their correct state. + $words = array( + 'javascript', 'expression', 'vbscript', 'jscript', 'wscript', + 'vbs', 'script', 'base64', 'applet', 'alert', 'document', + 'write', 'cookie', 'window', 'confirm', 'prompt', 'eval' + ); + + foreach ($words as $word) + { + $word = implode('\s*', str_split($word)).'\s*'; + + // We only want to do this when it is followed by a non-word character + // That way valid stuff like "dealer to" does not become "dealerto" + $str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str); + } + + + // Remove disallowed Javascript in links or img tags + // We used to do some version comparisons and use of stripos(), + // but it is dog slow compared to these simplified non-capturing + // preg_match(), especially if the pattern exists in the string + // + // Note: It was reported that not only space characters, but all in + // the following pattern can be parsed as separators between a tag name + // and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C] + // ... however, remove_invisible_characters() above already strips the + // hex-encoded ones, so we'll skip them below. + do + { + $original = $str; + + if (preg_match('/]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str); + } + + if (preg_match('/]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str); + } + + if (preg_match('/script|xss/i', $str)) + { + $str = preg_replace('##si', '[removed]', $str); + } + } + while ($original !== $str); + unset($original); + + + // Sanitize naughty HTML elements + // --- + // If a tag containing any of the words in the list + // below is found, the tag gets converted to entities. + // So this: + // Becomes: <blink> + $pattern = '#' + .'<((?/*\s*)((?[a-z0-9]+)(?=[^a-z0-9]|$)|.+)' // tag start and name, followed by a non-tag character + .'[^\s\042\047a-z0-9>/=]*' // a valid attribute character immediately after the tag would count as a separator + // optional attributes + .'(?(?:[\s\042\047/=]*' // non-attribute characters, excluding > (tag close) for obvious reasons + .'[^\s\042\047>/=]+' // attribute characters + // optional attribute-value + .'(?:\s*=' // attribute-value separator + .'(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))' // single, double or non-quoted value + .')?' // end optional attribute-value group + .')*)' // end optional attributes group + .'[^>]*)(?\>)?#isS'; + + // Note: It would be nice to optimize this for speed, BUT + // only matching the naughty elements here results in + // false positives and in turn - vulnerabilities! + do + { + $old_str = $str; + $str = preg_replace_callback($pattern, array($this, '_sanitize_naughty_html'), $str); + } + while ($old_str !== $str); + unset($old_str); + + // Sanitize naughty scripting elements + // --- + // Similar to above, only instead of looking for + // tags it looks for PHP and JavaScript commands + // that are disallowed. Rather than removing the + // code, it simply converts the parenthesis to entities + // rendering the code un-executable. + // * For example: eval('some code') + // ... Becomes: eval('some code') + $str = preg_replace( + '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', + '\\1\\2(\\3)', + $str + ); + + // Same thing, but for "tag functions" (e.g. eval`some code`) + // See https://github.com/bcit-ci/CodeIgniter/issues/5420 + $str = preg_replace( + '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si', + '\\1\\2`\\3`', + $str + ); + + // Final clean up + // This adds a bit of extra precaution in case + // something got through the above filters + $str = $this->_do_never_allowed($str); + + // Images are Handled in a Special Way + // - Essentially, we want to know that after all of the character + // conversion is done whether any unwanted, likely XSS, code was found. + // If not, we return TRUE, as the image is clean. + // However, if the string post-conversion does not matched the + // string post-removal of XSS, then it fails, as there was unwanted XSS + // code found and removed/changed during processing. + if ($is_image === TRUE) + { + return ($str === $converted_string); + } + + return $str; + } + + + /** XSS Hash + * --- + * Generates the XSS hash if needed and returns it. + * @see CI_Security::$_xss_hash + * @return string XSS hash + */ + public function xss_hash() + { + if ($this->_xss_hash === NULL) + { + $rand = $this->get_random_bytes(16); + $this->_xss_hash = ($rand === FALSE) + ? md5(uniqid(mt_rand(), TRUE)) + : bin2hex($rand); + } + + return $this->_xss_hash; + } + + + /** Get random bytes + * --- + * @param int $length Output length + * @return string + */ + public function get_random_bytes($length) + { + if (empty($length) OR ! ctype_digit((string) $length)) + { + return FALSE; + } + + if (function_exists('random_bytes')) + { + try + { + // The cast is required to avoid TypeError + return random_bytes((int) $length); + } + catch (Exception $e) + { + // If random_bytes() can't do the job, we can't either ... + // There's no point in using fallbacks. + log_message('error', $e->getMessage()); + return FALSE; + } + } + + // Unfortunately, none of the following PRNGs is guaranteed to exist ... + if (defined('MCRYPT_DEV_URANDOM') && ($output = mcrypt_create_iv($length, MCRYPT_DEV_URANDOM)) !== FALSE) + { + return $output; + } + + if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE) + { + // Try not to waste entropy ... + stream_set_chunk_size($fp, $length); + $output = fread($fp, $length); + fclose($fp); + if ($output !== FALSE) + { + return $output; + } + } + + if (function_exists('openssl_random_pseudo_bytes')) + { + return openssl_random_pseudo_bytes($length); + } + + return FALSE; + } + + + /** HTML Entities Decode + * --- + * A replacement for html_entity_decode() + * + * The reason we are not using html_entity_decode() by itself is because + * while it is not technically correct to leave out the semicolon + * at the end of an entity most browsers will still interpret the entity + * correctly. html_entity_decode() does not convert entities without + * semicolons, so we are left with our own little solution here. Bummer. + * + * @link https://secure.php.net/html-entity-decode + * + * @param string $str Input + * @param string $charset Character set + * @return string + */ + public function entity_decode($str, $charset = NULL) + { + if (strpos($str, '&') === FALSE) + { + return $str; + } + + static $_entities; + + isset($charset) OR $charset = $this->charset; + isset($_entities) OR $_entities = array_map('strtolower', get_html_translation_table(HTML_ENTITIES, ENT_COMPAT | ENT_HTML5, $charset)); + + do + { + $str_compare = $str; + + // Decode standard entities, avoiding false positives + if (preg_match_all('/&[a-z]{2,}(?![a-z;])/i', $str, $matches)) + { + $replace = array(); + $matches = array_unique(array_map('strtolower', $matches[0])); + foreach ($matches as &$match) + { + if (($char = array_search($match.';', $_entities, TRUE)) !== FALSE) + { + $replace[$match] = $char; + } + } + + $str = str_replace(array_keys($replace), array_values($replace), $str); + } + + // Decode numeric & UTF16 two byte entities + $str = html_entity_decode( + preg_replace('/(&#(?:x0*[0-9a-f]{2,5}(?![0-9a-f;])|(?:0*\d{2,4}(?![0-9;]))))/iS', '$1;', $str), + ENT_COMPAT | ENT_HTML5, + $charset + ); + } + while ($str_compare !== $str); + return $str; + } + + + /** Sanitize Filename + * --- + * @param string $str Input file name + * @param bool $relative_path Whether to preserve paths + * @return string + */ + public function sanitize_filename($str, $relative_path = FALSE) + { + $bad = $this->filename_bad_chars; + + if ( ! $relative_path) + { + $bad[] = './'; + $bad[] = '/'; + } + + $str = remove_invisible_characters($str, FALSE); + + do + { + $old = $str; + $str = str_replace($bad, '', $str); + } + while ($old !== $str); + + return stripslashes($str); + } + + + /** Strip Image Tags + * --- + * @param string $str + * @return string + */ + public function strip_image_tags($str) + { + return preg_replace( + array( + '##i', + '#`]+)).*?\>#i' + ), + '\\2', + $str + ); + } + + + /** URL-decode taking spaces into account + * --- + * @see https://github.com/bcit-ci/CodeIgniter/issues/4877 + * @param array $matches + * @return string + */ + protected function _urldecodespaces($matches) + { + $input = $matches[0]; + $nospaces = preg_replace('#\s+#', '', $input); + return ($nospaces === $input) + ? $input + : rawurldecode($nospaces); + } + + + /** Compact Exploded Words + * --- + * Callback method for xss_clean() to remove whitespace from + * things like 'j a v a s c r i p t'. + * + * @used-by Security::xss_clean() + * @param array $matches + * @return string + */ + protected function _compact_exploded_words($matches) + { + return preg_replace('/\s+/s', '', $matches[1]).$matches[2]; + } + + + /** Sanitize Naughty HTML + * --- + * Callback method for xss_clean() to remove naughty HTML elements. + * @used-by Security::xss_clean() + * @param array $matches + * @return string + */ + protected function _sanitize_naughty_html($matches) + { + static $naughty_tags = array( + 'alert', 'area', 'prompt', 'confirm', 'applet', 'audio', 'basefont', 'base', 'behavior', 'bgsound', + 'blink', 'body', 'embed', 'expression', 'form', 'frameset', 'frame', 'head', 'html', 'ilayer', + 'iframe', 'input', 'button', 'select', 'isindex', 'layer', 'link', 'meta', 'keygen', 'object', + 'plaintext', 'style', 'script', 'textarea', 'title', 'math', 'video', 'svg', 'xml', 'xss' + ); + + static $evil_attributes = array( + 'on\w+', 'style', 'xmlns', 'formaction', 'form', 'xlink:href', 'FSCommand', 'seekSegmentTime' + ); + + // First, escape unclosed tags + if (empty($matches['closeTag'])) + { + return '<'.$matches[1]; + } + // Is the element that we caught naughty? If so, escape it + elseif (in_array(strtolower($matches['tagName']), $naughty_tags, TRUE)) + { + return '<'.$matches[1].'>'; + } + // For other tags, see if their attributes are "evil" and strip those + elseif (isset($matches['attributes'])) + { + // We'll store the already filtered attributes here + $attributes = array(); + + // Attribute-catching pattern + $attributes_pattern = '#' + .'(?[^\s\042\047>/=]+)' // attribute characters + // optional attribute-value + .'(?:\s*=(?[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*)))' // attribute-value separator + .'#i'; + + // Blacklist pattern for evil attribute names + $is_evil_pattern = '#^('.implode('|', $evil_attributes).')$#i'; + + // Each iteration filters a single attribute + do + { + // Strip any non-alpha characters that may precede an attribute. + // Browsers often parse these incorrectly and that has been a + // of numerous XSS issues we've had. + $matches['attributes'] = preg_replace('#^[^a-z]+#i', '', $matches['attributes']); + + if ( ! preg_match($attributes_pattern, $matches['attributes'], $attribute, PREG_OFFSET_CAPTURE)) + { + // No (valid) attribute found? Discard everything else inside the tag + break; + } + + if ( + // Is it indeed an "evil" attribute? + preg_match($is_evil_pattern, $attribute['name'][0]) + // Or does it have an equals sign, but no value and not quoted? Strip that too! + OR (trim($attribute['value'][0]) === '') + ) + { + $attributes[] = 'xss=removed'; + } + else + { + $attributes[] = $attribute[0][0]; + } + + $matches['attributes'] = substr($matches['attributes'], $attribute[0][1] + strlen($attribute[0][0])); + } + while ($matches['attributes'] !== ''); + + $attributes = empty($attributes) + ? '' + : ' '.implode(' ', $attributes); + return '<'.$matches['slash'].$matches['tagName'].$attributes.'>'; + } + + return $matches[0]; + } + + + /** JS Link Removal + * --- + * Callback method for xss_clean() to sanitize links. + * + * This limits the PCRE backtracks, making it more performance friendly + * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in + * PHP 5.2+ on link-heavy strings. + * + * @used-by CI_Security::xss_clean() + * @param array $match + * @return string + */ + protected function _js_link_removal($match) + { + return str_replace( + $match[1], + preg_replace( + '#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|_filter_attributes($match[1]) + ), + $match[0] + ); + } + + + /** JS Image Removal + * --- + * Callback method for xss_clean() to sanitize image tags. + * + * This limits the PCRE backtracks, making it more performance friendly + * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in + * PHP 5.2+ on image tag heavy strings. + * + * @used-by Security::xss_clean() + * @param array $match + * @return string + */ + protected function _js_img_removal($match) + { + return str_replace( + $match[1], + preg_replace( + '#src=.*?(?:(?:alert|prompt|confirm|eval)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|_filter_attributes($match[1]) + ), + $match[0] + ); + } + + + /** Attribute Conversion + * --- + * @used-by CI_Security::xss_clean() + * @param array $match + * @return string + */ + protected function _convert_attribute($match) + { + return str_replace(array('>', '<', '\\'), array('>', '<', '\\\\'), $match[0]); + } + + + /** Filter Attributes + * --- + * Filters tag attributes for consistency and safety. + * @used-by CI_Security::_js_img_removal() + * @used-by CI_Security::_js_link_removal() + * @param string $str + * @return string + */ + protected function _filter_attributes($str) + { + $out = ''; + if (preg_match_all('#\s*[a-z\-]+\s*=\s*(\042|\047)([^\\1]*?)\\1#is', $str, $matches)) + { + foreach ($matches[0] as $match) + { + $out .= preg_replace('#/\*.*?\*/#s', '', $match); + } + } + + return $out; + } + + + /** HTML Entity Decode Callback + * --- + * @used-by CI_Security::xss_clean() + * @param array $match + * @return string + */ + protected function _decode_entity($match) + { + // Protect GET variables in URLs + // 901119URL5918AMP18930PROTECT8198 + $match = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-/]+)|i', $this->xss_hash().'\\1=\\2', $match[0]); + + // Decode, then un-protect URL GET vars + return str_replace( + $this->xss_hash(), + '&', + $this->entity_decode($match, $this->charset) + ); + } + + + /** Do Never Allowed + * --- + * @used-by CI_Security::xss_clean() + * @param string + * @return string + */ + protected function _do_never_allowed($str) + { + $str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str); + + foreach ($this->_never_allowed_regex as $regex) + { + $str = preg_replace('#'.$regex.'#is', '[removed]', $str); + } + + return $str; + } + + + /** Set CSRF Hash and Cookie + * --- + * @return string + */ + protected function _csrf_set_hash() + { + if ($this->_csrf_hash === NULL) + { + // If the cookie exists we will use its value. + // We don't necessarily want to regenerate it with + // each page load since a page could contain embedded + // sub-pages causing this feature to fail + if (isset($_COOKIE[$this->_csrf_cookie_name]) && is_string($_COOKIE[$this->_csrf_cookie_name]) + && preg_match('#^[0-9a-f]{32}$#iS', $_COOKIE[$this->_csrf_cookie_name]) === 1) + { + return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name]; + } + + $rand = $this->get_random_bytes(16); + $this->_csrf_hash = ($rand === FALSE) + ? md5(uniqid(mt_rand(), TRUE)) + : bin2hex($rand); + } + + return $this->_csrf_hash; + } +} diff --git a/classes/User.php b/classes/User.php new file mode 100644 index 0000000..65b5018 --- /dev/null +++ b/classes/User.php @@ -0,0 +1,111 @@ + '', + 'name' => '', + 'middle'=> '', + 'surname' =>'', + 'email' => '' + ); + + private $addresses = Array(); + + + + /** METHODS + * ------------------------------------------------------------------------- + */ + + + public function create() + { + + } + + + public function setDefaultAddress($id) + { + + } + + + public function addAddress() + { + // update session data + // update user record + } + + + public function changePassword() + { + + } + + + public function confirmEmail() + { + + } + + + public function sendEmail() + { + + } + + /** sendOTP() + * sent One-Time-Password + * + */ + public function sendOTP($ttl) + { + $to = $this->who; + $otp = rand(10000,99999); + $expire = time() + $ttl; + + $mail = new PHPMailer(true); + try { + //Server settings + // ... + + //Recipients + $mail->setFrom('from@example.com', 'Mailer'); + $mail->addAddress($to['email'], $to['surname'] .' '. $to['name']); //Add a recipient + $mail->addReplyTo('info@example.com', 'Information'); + + //Attachments + $mail->addAttachment('/var/tmp/file.tar.gz'); //Add attachments + $mail->addAttachment('/tmp/image.jpg', 'new.jpg'); //Optional name + + //Content + $mail->isHTML(true); //Set email format to HTML + $mail->Subject = 'Your OTP'; + $mail->Body = 'This is the HTML message body in bold!'; + $mail->AltBody = 'This is the body in plain text for non-HTML mail clients'; + + $mail->send(); + echo 'Message has been sent'; + } catch (Exception $e) { + echo "Message could not be sent. Mailer Error: {$mail->ErrorInfo}"; + } + + } + + /** updateSession() + * regenerates session + */ + public function updateSession() + { + + } + +} diff --git a/classes/authenticator/PasswordTrait.php b/classes/authenticator/PasswordTrait.php new file mode 100644 index 0000000..22976d8 --- /dev/null +++ b/classes/authenticator/PasswordTrait.php @@ -0,0 +1,40 @@ + $this->cost] + ); + } + + public function isPasswordValid(UserInterface $user, string $plainPassword): bool + { + return password_verify( + $plainPassword, + $user->getPassword() + ); + } + + public function setCost(int $cost): void + { + if ($cost < 4 || $cost > 12) { + throw new \InvalidArgumentException('Cost must be in the range of 4-31.'); + } + $this->cost = $cost; + } +} diff --git a/classes/authenticator/User.php b/classes/authenticator/User.php new file mode 100644 index 0000000..b99fa70 --- /dev/null +++ b/classes/authenticator/User.php @@ -0,0 +1,102 @@ +userName; + } + + /** getPassword + * @return null|string + */ + public function getPassword(): ?string + { + return $this->password; + } + + /** getRoles + * @return array + */ + public function getRoles(): array + { + return $this->roles; + } + + /** isEnabled + * @return bool + */ + public function isEnabled(): bool + { + return $this->enabled; + } + + + /** SETs + * ------------------------------------------------------------------------- + */ + + /** setUserName + * @param string $userName + * @return User + */ + public function setUserName(string $userName): self + { + $this->userName = $userName; + return $this; + } + + /** setPassword + * @param string $password + * @return User + */ + public function setPassword(string $password): self + { + $this->password = $password; + return $this; + } + + /** setRoles + * @param array $roles + * @return User + */ + public function setRoles(array $roles): self + { + $this->roles = $roles; + return $this; + } + + /** + * @param bool $enabled + * @return User + */ + public function setEnabled(bool $enabled): self + { + $this->enabled = $enabled; + return $this; + } +} diff --git a/classes/authenticator/UserInterface.php b/classes/authenticator/UserInterface.php new file mode 100644 index 0000000..5cc6d2d --- /dev/null +++ b/classes/authenticator/UserInterface.php @@ -0,0 +1,15 @@ +hasUserToken()) { + $userToken = unserialize($_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY]); + } + + return $userToken; + } + + public function hasUserToken(): bool + { + $key = UserTokenInterface::DEFAULT_PREFIX_KEY; + return (array_key_exists($key, $_SESSION) && unserialize($_SESSION[$key]) !== false); + } + + public function isGranted(array $roles): bool + { + if (!is_null($userToken = $this->getUserToken())) { + return false; + } + + if ($userToken->getUser() instanceof UserInterface) { + return (!empty(array_intersect($roles, $userToken->getUser()->getRoles()))); + } + + return false; + } + + public function createUserToken(UserInterface $user): UserTokenInterface + { + $userToken = new UserToken($user); + $_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY] = $userToken->serialize(); + + return $userToken; + } + + public function logout(): void + { + if ($this->hasUserToken()) { + unset($_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY]); + } + } +} + diff --git a/classes/authenticator/UserManagerInterface.php b/classes/authenticator/UserManagerInterface.php new file mode 100644 index 0000000..ef120c1 --- /dev/null +++ b/classes/authenticator/UserManagerInterface.php @@ -0,0 +1,21 @@ +user = $user; + } + + public function getUser(): UserInterface + { + return $this->user; + } + + public function serialize(): string + { + return serialize($this); + } +} diff --git a/classes/authenticator/UserTokenInterface.php b/classes/authenticator/UserTokenInterface.php new file mode 100644 index 0000000..2a21d8f --- /dev/null +++ b/classes/authenticator/UserTokenInterface.php @@ -0,0 +1,13 @@ +cryptPassword($req->POST['password']); + + $user = (new User()) + ->setUserName($req->POST['username']) + ->setPassword($password) + ->setRoles(['ROLE_USER']); + + $userManager->createUserToken($user); + + // check Token in Session + var_dump($userManager->getUserToken()); + // object(DevCoder\Authentication\Token\UserToken)[4] + // private 'user' => + // object(DevCoder\Authentication\User)[5] + // private 'userName' => string 'username' (length=8) + // private 'password' => string '$2y$10$iWdcmebmikUFlgKMqW7/rOmUp1DjFAuWKqdUHBhL08FZ7LL6bwRey' (length=60) + // private 'roles' => + // array (size=1) + // 0 => string 'ROLE_USER' (length=9) + // private 'enabled' => boolean true + + +## Connected or not + + hasUserToken()) { + // connected + + $token = $userManager->getUserToken(); + $user = $token->getUser(); + var_dump($user); + // object(DevCoder\Authentication\User)[5] + // private 'userName' => string 'username' (length=8) + // private 'password' => string '$2y$10$OBobeLhdvdiftuedlv1a6e4.qF6sCG/usq5WEV4E3uB.UiS1egv/m' (length=60) + // private 'roles' => + // array (size=1) + // 0 => string 'ROLE_USER' (length=9) + // private 'enabled' => boolean true + + } else { + // not connected + } + + +## Access management + + $userManager = new UserManager(); + if ($userManager->isGranted(['ROLE_ADMIN'])) { + //is admin + // return Response 200 + }else { + //is not admin + // return Response 403 + } + + Logout + + $userManager = new UserManager(); + $userManager->logout(); + + +## Login + + prepare("SELECT * FROM users WHERE username=?"); + $stmt->execute([$_POST['username']]); + $userFromDataBase = $stmt->fetch(); + /** + * Hydration + */ + $user = (new \Test\DevCoder\Authentication\User()) + ->setUserName($userFromDataBase['username']) + ->setPassword($userFromDataBase['password']) + ->setRoles(json_decode($userFromDataBase['roles'])) + ->setEnabled($userFromDataBase['active']); + + $userManager = new UserManager(); + if ($userManager->isPasswordValid($user, $_POST['password'])) { + + // login OK, set Token in session + $userManager->createUserToken($user); + + } else { + // login failed , return error + } diff --git a/classes/cache/Cache_interface.php b/classes/cache/Cache_interface.php new file mode 100644 index 0000000..7c49789 --- /dev/null +++ b/classes/cache/Cache_interface.php @@ -0,0 +1,34 @@ + $data[0]) { + + // Unlinking + unlink($filename); + return false; + + } + + return $data[1]; + } + + + public function flush(int $olderThan = 0) + { + return false; // reply false until implementation + } + +} diff --git a/classes/cache/MemcachedCache.php b/classes/cache/MemcachedCache.php new file mode 100644 index 0000000..c89d86a --- /dev/null +++ b/classes/cache/MemcachedCache.php @@ -0,0 +1,37 @@ +addServer(\MEMCACHE_HOST, 11211); + + $mc->set($hashkey, $data, $ttl); + } + + + public function get($key) + { + $hashkey = md5($key); + + $mc = new Memcached(); + $mc->addServer(\MEMCACHE_HOST, 11211); + + return $mc->get($hashkey); + + } + + public function flush($olderThan = 0) + { + return false; + } + +} \ No newline at end of file diff --git a/classes/cache/RedisCache.php b/classes/cache/RedisCache.php new file mode 100644 index 0000000..ec50f08 --- /dev/null +++ b/classes/cache/RedisCache.php @@ -0,0 +1,69 @@ + \REDIS_HOST + ]); + return $redis->set($key, $serialized, 'EX', $ttl); + + } catch (Exception $e) { + // ... + } + } + + + /** get + * fetch previously stored $data under label $key + * return $data (or false) + */ + public function get($key) + { + + try { + + $redis = new \Predis\Client([ + 'host' => \REDIS_HOST + ]); + + if ($redis->exists($key)) { + return unserialize($redis->get($key)); + + } else { + return false; + } + + } catch (Exception $e) { + // ... + } + + } + + + /** flush + * --- not umplemented yet; may not needed + */ + public function flush($olderThan = 0) + { + return false; // until implementation + } + +} \ No newline at end of file diff --git a/classes/session/DatabaseSession.php b/classes/session/DatabaseSession.php new file mode 100644 index 0000000..aa31b62 --- /dev/null +++ b/classes/session/DatabaseSession.php @@ -0,0 +1,138 @@ +db = Registry::use('database'); + + // Set handler to overide SESSION + session_set_save_handler( + array($this, "open"), + array($this, "close"), + array($this, "read"), + array($this, "write"), + array($this, "destroy"), + array($this, "gc") + ); + + // Start the session + session_name(SESSION_NAME); + session_start(); + } + + // public function open(string $path, string $name) : bool + // NOTE: $path and $name are unsued + public function open() : bool + { + if ($this->db) { + return true; + } + else { + // database connection may be closed from another class + // (ex. from some user class); in this case... + // create a new database connection, then recheck. + $conn = new Database(); + // $this->db = $conn->connect(); + + if ($conn) { + $this->db = $conn; + return true; + } + } + return false; + } + + + public function close() : bool + { + // depricated: the database object is shared (don;t clode it!) + // // Close the database connection + // if ($this->db = null) { return true; } + // else return false; + + return true; + } + + + public function read(string $id) : string|false + { + $exist = $this->db->runQuery( + "SELECT data FROM sessions WHERE id = :id", + [':id', $id] + ); + + if (($exist === false) || (count($exist) == 0)) { + return false; + + } else { + $data = $exist[0]; + } + + if (is_null($row['data'])) { + return ''; + } + return $row['data']; + } + + + public function write(string $id, string $data) : bool + { + // Create timestamp + $access = time(); + $check = $this->db->runQuery( + "REPLACE INTO sessions VALUES (:id, :access, :data)", + [':id' => $id, ':access' => $access, ':data' => $data ] + ); + return ($check == false) ? false : true; + } + + + public function destroy(string $sassionID) : bool + { + $check = $this->db->runQuery( + 'DELETE FROM sessions WHERE id = :id', + [':id' => $sassionID] + ); + return ($check == false) ? false : true; + } + + + public function gc(int $max) + { + // Calculate what is to be deemed old + $old = time() - $max; + $check = $this->db->runQuery( + 'DELETE FROM sessions WHERE access < :old', + [':old' => $old] + ); + return ($check == false) ? false : 1; + // check garbage-collector probability to run + // echo "probability: ". ini_get("session.gc_probability") ." / ". ini_get("session.gc_divisor") . ", ttl: ". ini_get("session.gc_maxlifetime"); die(); + + } + + # callable $create_sid = ?, + # callable $validate_sid = ?, + # callable $update_timestamp = ? +} diff --git a/classes/session/DefaultSession.php b/classes/session/DefaultSession.php new file mode 100644 index 0000000..d3099a5 --- /dev/null +++ b/classes/session/DefaultSession.php @@ -0,0 +1,35 @@ +sess_filename = $path; + $this->minutes = $minutes; + + // Set handler to overide SESSION + session_set_save_handler( + array($this, "open"), + array($this, "close"), + array($this, "read"), + array($this, "write"), + array($this, "destroy"), + array($this, "gc") + ); + + // Start the session + session_name(SESSION_NAME); + session_start(); + } + + /** open + * set filename; + * no need to touch the filesystem yet + * return true (always) + */ + public function open($savePath, $sessionName): bool + { + $this->sess_filename = $this->$path .'/'. $sessionName; + return true; + } + + /** close + * nothing needs to be closed; + * return true (always) + */ + public function close(): bool + { + return true; + } + + /** read + * chech if file exists; if not return false + * read data + */ + public function read($sessionId): string|false + { + if (!file_exists($filename) || !is_readable($filename)) return false; + return file_get_contents($filename); + + # if ($this->files->isFile($path = $this->path.'/'.$sessionId) && + # $this->files->lastModified($path) >= Carbon::now()->subMinutes($this->minutes)->getTimestamp()) { + # return $this->files->sharedGet($path); + # } + + # depricated? return ''; + } + + /** write + * data serielized already by php's internal session engine + */ + public function write($sessionId, $data): bool + { + $h = fopen($filename, 'w'); + if (fwrite($h,$data) === false) { + throw new Exception('Could not write session data'); + return false; + } + fclose($h); + + return true; + } + + /** + * {@inheritdoc} + * + * @return bool + */ + public function destroy($sassionID): bool + { + unlink($this->sassionID); + + return true; + } + + /** + * {@inheritdoc} + * + * @return int + */ + public function gc($lifetime) : int + { + $files = Finder::create() + ->in($this->path) + ->files() + ->ignoreDotFiles(true) + ->date('<= now - '.$lifetime.' seconds'); + + $deletedSessions = 0; + + foreach ($files as $file) { + $this->files->delete($file->getRealPath()); + $deletedSessions++; + } + + return $deletedSessions; + } +} diff --git a/classes/session/SessionHandlerInterface.php b/classes/session/SessionHandlerInterface.php new file mode 100644 index 0000000..cf6efac --- /dev/null +++ b/classes/session/SessionHandlerInterface.php @@ -0,0 +1,169 @@ + someone visits website through server A + * -> server A creates a new session-id for the visitor and a shared-session-id + * -> saves both into database + * + * later... + * + * #2 + * -> the same device is connected (via loadbalancer) into server B + * -> server B don't have the session-id (send by the client) but gets it from db + * (is session-id do not exist on the db, then this is a new session) + * + * = now both server A and B have the same session-id localy + * + * later... + * + * #3 + * -> some server (let's say B) regenerates the visitors session-id + * -> if later the visitor falls into server A, the A will retrieve the new + * session id through the #2 scenario + * + * this way + * + any server can update/regenerate the visitor's session-id + * + the visitor can be served from both servers randomly + * + all session variables exist on the database (always) + * + all session variables exist on all servers synced-on-demand + * + * + * stucture of session: + * --- + * - shared-session-id: (secret + persistent); exposed between servers **primary + * - session-id: (may change/regenerate/update); exposed to the client **indexed + * - data: serialized array + * - creation_timestamp: + * - last_touched_timestamp: + * - expiration_timestamp: should point to the future or session has expired + * - csrf_token: + * - JWT_token + * - AES-key (this way private data can be kept in browser) + * + * + * what will kept on browser/client (via cookie) + * --- + * - session-name => session-id + * - user info => AES_ectypted(serialized[t=>csfr_token, u=> user_id, s=>SIGNATURE]) + * + * + * Writable file-system shall change + * (local writable file-system tree) + * --- + * /html/storage + * | + * |-- cache : query-caches + * | + * `-- session : FS\sessions + * | + * `-- indexes : share-session-id indexes + * + * + * + * NOTE: Session life-cycle + * + * session_start() * firsts time + * --- + * ::open(path,PHPSESSID) -> (session_id not exist) -> false + * ::create_sid -> '123def' + * ::read('123def') ?-or/and- ::close() + * + * + * session_start() * next times + * --- + * ::open(path, PHPSESSID) -> (session_id exist) -> true + * ::read('123def') -> return data -> will fill $_SESSION[*] + * + * + * $_SESSION['foo'] = 'bar'; + * --- + * ::write('123def', 'foo|s:3:"bar";') -> ['foo' => "bar"] + * ::close() + * + * + * session_regenerate_id(); + * --- + * ::create_sid() -> def123 + * + * + * session_reset() + * --- + * ::open() + * ::read('def123') + * + * + * session_write_close() + * --- + * ::write('123def', 'foo|s:3:"bar";') + * ::close() + * + * + * session_destroy() + * --- + * ::destroy('def123') + * ::close() + * + */ diff --git a/cli/micro/setup.php b/cli/micro/setup.php new file mode 100644 index 0000000..cd907e8 --- /dev/null +++ b/cli/micro/setup.php @@ -0,0 +1,120 @@ +getMessage(), "\n" +# } \ No newline at end of file diff --git a/cli/micro/term_utilities.php b/cli/micro/term_utilities.php new file mode 100644 index 0000000..971c36e --- /dev/null +++ b/cli/micro/term_utilities.php @@ -0,0 +1,44 @@ + 'text/html; charset=UTF-8', + 'html' => 'text/html; charset=UTF-8', + 'json' => 'application/json; charset=utf-8', + 'js' => 'application/javascript; charset=utf-8', + 'css' => 'text/css', + 'png' => 'image/png', + 'jpeg' => 'image/jpeg', + 'webp' => 'image/web' + ) +); + + +// PROXY_FLAGS +// ----------------------------------------------------------------------------- +// These options represend altered/non-default behaviour +// and will be resolved bitwise, so use powers of 2 +// ----------------------------------------------------------------------------- +define('PROXY_CACHE_ERRORS', 1); // cache result even if error +define('PROXY_IGNORE_CACHE', 2); // ignore cache if exist +define('PROXY_DO_NOT_CACHE', 4); // do not cache result diff --git a/config/credentials.php b/config/credentials.php new file mode 100644 index 0000000..43fa0a4 --- /dev/null +++ b/config/credentials.php @@ -0,0 +1,126 @@ + $basePath) { + + $file = APP_ROOT . $basePath . $classPath .'.php'; + + // if class-file exist, include it + if (file_exists($file)) { + require_once $file; + break; + } + + } + + // // Feel free to extend the fanctionality + // // example: + // // custom (exception) namespaced classes loader + // $customNSclasses = array( + // '\\George\\Class' => 'path/to/George/Class', + // '\\Mary\\Class' => 'path/to/Marias/Class', + // ... + // ); + // if array_key_exists($className) { + // require_once $customNSclasses[$className]; + // } + } +); diff --git a/helpers/design_patterns.php b/helpers/design_patterns.php new file mode 100644 index 0000000..d66ffa9 --- /dev/null +++ b/helpers/design_patterns.php @@ -0,0 +1,104 @@ +get($key); + + } else { $data = false; } // ignore cache? pass false + + + if ($data !== false) { // if exists, serve cached data + + // if cashed data exist + // --------------------------------------------------------------------- + # if (!PRODUCTION) Benchmark::add_spot('proxy-cached'); + if ($data == '_ERROR_') return false; // previous cached error + else return $data; // previous cache () + + + } else { // else (not exist)... + + // no data on cache -> get data from Class::method( arguments ) + // --------------------------------------------------------------------- + $data = call_user_func_array($callable, $args); + + // handle newly created data + // --------------------------------------------------------------------- + + // if faulty data, return false + if ($data == false) { + + if ($cache_errors && !$do_not_cache) { // cache the error + $cache->set($key, '_ERROR_', $ttl); + } + + # if (!PRODUCTION) Benchmark::add_spot('proxy-new-error'); + return false; + } + + // store to cache + if (!$do_not_cache) { + $cache->set($key, $data, $ttl); + } + + # if (!PRODUCTION) Benchmark::add_spot('proxy-new'); + return $data; // serve data + } + +} diff --git a/helpers/error_handling.php b/helpers/error_handling.php new file mode 100644 index 0000000..bc60968 --- /dev/null +++ b/helpers/error_handling.php @@ -0,0 +1,119 @@ +getMessage() + . " on file '". $e->getFile() . "' at line {$e->getLine()}"; + + $anom_ERRORS[] = $message; // store the error +} + + +/** + * Catch fatal error work-around + * (set_error_handler not working on fatal errors). + */ +function on_shutdown_check_for_fatal() +{ + global $anom_ERRORS; + + $error = error_get_last(); + + if ($error != null) { // ignore 'normal' system shutdowns [exit|die]() + + if ( $error["type"] == E_ERROR ) { // get as much error-info + handle_error( + $error["type"] ?? -1, + $error["message"] ?? 'unknown error', + $error["file"] ?? 'unknown file', + $error["line"] ?? -1 + ); + } + } + + if (($anom_ERRORS != [])) { + + // TODO: + // Implemetnig the design/layout of the error-messages + // output should not be an error's-handling task, thus + // shall be assigned to the Rendes/View level; + // Same about the log service channels + + // TODO: + // FORWARD ERRORS into LOG-SYSTEM + // ex. into some file... + // file_put_contents("logs/thowable.log", $message_template .PHP_EOL, FILE_APPEND); + // or ...some other channer (Email, Slack, Database etc). + // Channes can be decided according to error severity; + // a file-system error loggin for backup is recommended + // partitioniong of errors onto file-system can be useful + + // TODO: + // 1st: Log Errors + // 2nd: Show Errors + + if (PRODUCTION) { + if (!defined('VIEW_LOADED')) { + // throw a prety-error message + render_view('error/general', ['message' => 'Please forgive me, I know not what I do']); + } + + } else { + + if (!defined('VIEW_LOADED')) { + // no template loaded; render erros in general-error template + render_view('error/general', ['message' => implode("
And:
", $anom_ERRORS)]); + + } else { + echo '
+ Errors:
'. implode("
And:
", $anom_ERRORS) .'
'; + } + } + } +} + + +// register callback on shutdown +register_shutdown_function( "on_shutdown_check_for_fatal" ); + +// register custom error handler callback +set_error_handler( "handle_error" ); + +// set custom exception handler function +set_exception_handler( "handle_exception" ); + +// send errors to stderr (instead of stdout) +ini_set( "display_errors", "off" ); + +// thow out all errors +error_reporting( E_ALL ); + diff --git a/helpers/render.php b/helpers/render.php new file mode 100644 index 0000000..9dcd34a --- /dev/null +++ b/helpers/render.php @@ -0,0 +1,338 @@ +"; + } + +} + +/** parse_sections + * --- + * parse a group of views (sections) + * @param $sections: an array of sections + * + * each section group is an array with view, key and data properties + * + view: defines the view template/file + * + key: the variable name that view uses to parse data OR empty-string* + * * if key is an empty then $data should be an array (which + * includes all [variable-name:data] pairs utilized by the view) + * + data: holds the actual data + */ + +function parse_sections($sections) { + + foreach($sections as $sect) { + + if ($sect['key'] == '') { + render_view( $sect['view'], $sect['data'] ); + + } else { + render_view( $sect['view'], [ $sect['key'] => $sect['data']] ); + } + } +} + + +/** render function + * --- + * uses php's short-tag syntax for templating system + * extract data into template + * @param $view: view-template filename + * @param $data: data to embed into view-template + * @param $sanitize: of true then sanitize data. + * important NOTE: data is an array [key => value] + */ +function render_view($view, $data, $sanitize = false) { + + $file = VIEWS_DIRECTORY . $view . '.php'; + + if (file_exists($file)) { + if (!defined('VIEW_LOADED')) define('VIEW_LOADED', 1); + + extract( $sanitize ? sanitize_output($data) : $data ); + require( $file ); + + } else if (!PRODUCTION) { + + echo ""; + } + +} + + +/** render asap + * --- + * render_view then output code + * so that client will get html to render + * while server calculates next html + */ +function render_asap($view, $data, $sanitize = false) { + render_view($view, $data, $sanitize); + ob_flush(); +} + + +/** render text + * --- + * This function simply echoes text + * with Content-Type and Cache Headers + * @param $data : the text to echo + * @param $cType : Content-Type header + * @param $ttl : cache-contol headers; if false response is not-cached; else (int) chache for $ttl seconds + */ +function render_text( $data, $contentType = 'text/html; charset=UTF-8', $ttl = false ) { + header('Content-Type: '. $contentType); + if ($ttl) { + $ts = gmdate("D, d M Y H:i:s", time() + $ttl) . " GMT"; + header("Expires: {$ts}"); + header("Pragma: cache"); + header("Cache-Control: max-age={$ttl}"); + + } else { + $ts = gmdate("D, d M Y H:i:s") . " GMT"; + header("Expires: {$ts}"); + header("Last-Modified: {$ts}"); + header("Pragma: no-cache"); + header("Cache-Control: no-cache, must-revalidate"); + } + echo htmlspecialchars($data); +} + + +/** reply_json + * --- + * transform a php-array to json and echo to client + * Can be used for API calls + * + * @param $data : the php array) + * @param $ttl : cache-contol headers; if false response is not-cached; else chache for $ttl seconds + */ +function reply_json( $data, $ttl = false ) { + header('Content-Type: application/json'); + if ($ttl) { + $ts = gmdate("D, d M Y H:i:s", time() + $ttl) . " GMT"; + header("Expires: {$ts}"); + header("Pragma: cache"); + header("Cache-Control: max-age={$ttl}"); + + } else { + $ts = gmdate("D, d M Y H:i:s") . " GMT"; + header("Expires: {$ts}"); + header("Last-Modified: {$ts}"); + header("Pragma: no-cache"); + header("Cache-Control: no-cache, must-revalidate"); + } + echo json_encode($data, JSON_UNESCAPED_UNICODE); +} + + + + +// HELPER FUNCTIONS +// ----------------------------------------------------------------------------- + + +/** link asset + * --- + * the function defines the assets (css or js) + * to be loaded on the client (creates the HTML) + * @param $type : type of asset [css|js] + * @param $assetIDs : an array of ('assetID' => 'paramaters') + * + * example calls: + * load_asset('css', ['main' => 'media="all"', 'filters' => 'media="all"']); + * load_asset( 'js', ['jquery' => '', 'lazyloader' => 'async']); + */ +function link_asset( $type, $assetIDs, $paramatres = '' ) { + + $code = ""; // code to return + + // make sure $assetIDs is array (for coding simplicity) + if (!is_array($assetIDs)) { + $assetIDs = [ $assetIDs ]; + } + + // check asset type and construct all asset inserts + switch ($type) { + + case 'font': + foreach($assetIDs as $asset) { + $code .= "\n\t"; + } + break; + + case 'js': + foreach($assetIDs as $asset) { + $code .= "\n\t"; + } + break; + + case 'css': + default: + foreach($assetIDs as $asset) { + $code .= "\n\t"; + } + } + + echo $code; +} + + +/** sanitize_output (recursive) + * --- + * Sanitizes data that are about to rendered + * (usually when render_view() is called). + * NOTE: mitigates XSS attachs + * @param $data: (array) + */ +function sanitize_output($data) { + //// // check https://stackoverflow.com/questions/2002710/php-how-to-perform-htmlspecialchar-on-an-array-of-arrays + + //// $output = array_map("myFunc", $data); + global $secure; + + $output = array(); + foreach($data as $key => $val) { + + if (is_string($val)) { + $output[$key] = htmlspecialchars(remove_invisible_characters($val)); + + } else if (is_array($val)) { + $output[$key] = sanitize_output($val); + + } else { + $output[$key] = $val; + } + } + return $output; +} + + +/** remove_invisible_characters() + * --- + * @used by sanitize_output() + */ +function remove_invisible_characters($str, $url_encoded = TRUE) +{ + $non_displayables = array(); + + // every control character except newline (dec 10), + // carriage return (dec 13) and horizontal tab (dec 09) + if ($url_encoded) { + $non_displayables[] = '/%0[0-8bcef]/i'; // url encoded 00-08, 11, 12, 14, 15 + $non_displayables[] = '/%1[0-9a-f]/i'; // url encoded 16-31 + $non_displayables[] = '/%7f/i'; // url encoded 127 + } + + $non_displayables[] = '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S'; // 00-08, 11, 12, 14-31, 127 + + do { + $str = preg_replace($non_displayables, '', $str, -1, $count); + } while ($count); + + return $str; +} + + +/** html + * --- + * outputs code as html + * + * @param $str (string) + * @return html5 (string) + */ +function html($str) { + if (!isset($str) || $str== null) return; + if (($str == '') || is_numeric($str)) return $str; + return htmlspecialchars_decode($str, ENT_QUOTES|ENT_HTML5); +} + + +/** set_headers + * --- + * set custom response-Headers + * + * @param $contentType + * @param $ttl: int or false) + * @param $more: array of (content-type => content-value) pairs + */ +function set_headers($contentType = 'text/html; charset=UTF-8', $ttl = false, $more = [] ) { + + // handle common content-type shorcuts + switch ($contentType) { + case 'text': + case 'html': + $contentType = 'text/html; charset=UTF-8'; + break; + case 'json': + $contentType = 'application/json; charset=utf-8'; + break; + case 'js': + $contentType = 'application/javascript; charset=utf-8'; + break; + case 'css': + $contentType = 'text/css'; + break; + default: + // $contentType stays as-is + break; + } + + // send headers + header('Content-Type: '. $contentType); + if ($ttl) { + $ts = gmdate("D, d M Y H:i:s", time() + $ttl) . " GMT"; + header("Expires: {$ts}"); + header("Pragma: cache"); + header("Cache-Control: max-age={$ttl}"); + + } else { + $ts = gmdate("D, d M Y H:i:s") . " GMT"; + header("Expires: {$ts}"); + header("Last-Modified: {$ts}"); + header("Pragma: no-cache"); + header("Cache-Control: no-cache, must-revalidate"); + } + + // send more headers + if ($more != []) { + foreach($more as $header => $value) { + header($header .': '. $value); + } + } + +} + + + -- cgit v1.2.3