From 7076343338ae3439f3c86f01144818abe8c31978 Mon Sep 17 00:00:00 2001 From: George Halkiadakis Date: Sun, 12 Mar 2023 07:16:23 +0200 Subject: add container helpers; constuct public directory-tree --- classes/Benchmark.php | 150 ---- classes/Cart.php | 71 -- classes/Database.php | 331 --------- classes/Registry.php | 129 ---- classes/Repository.php | 43 -- classes/Request.php | 94 --- classes/Route.php | 97 --- classes/Security.php | 923 ------------------------- classes/User.php | 111 --- classes/authenticator/PasswordTrait.php | 40 -- classes/authenticator/User.php | 102 --- classes/authenticator/UserInterface.php | 15 - classes/authenticator/UserManager.php | 69 -- classes/authenticator/UserManagerInterface.php | 21 - classes/authenticator/UserToken.php | 33 - classes/authenticator/UserTokenInterface.php | 13 - classes/authenticator/info.md | 114 --- classes/cache/Cache_interface.php | 34 - classes/cache/FileCache.php | 93 --- classes/cache/MemcachedCache.php | 37 - classes/cache/RedisCache.php | 69 -- classes/session/DatabaseSession.php | 138 ---- classes/session/DefaultSession.php | 35 - classes/session/FilesSession.php | 142 ---- classes/session/SessionHandlerInterface.php | 169 ----- 25 files changed, 3073 deletions(-) delete mode 100644 classes/Benchmark.php delete mode 100644 classes/Cart.php delete mode 100644 classes/Database.php delete mode 100644 classes/Registry.php delete mode 100644 classes/Repository.php delete mode 100644 classes/Request.php delete mode 100644 classes/Route.php delete mode 100644 classes/Security.php delete mode 100644 classes/User.php delete mode 100644 classes/authenticator/PasswordTrait.php delete mode 100644 classes/authenticator/User.php delete mode 100644 classes/authenticator/UserInterface.php delete mode 100644 classes/authenticator/UserManager.php delete mode 100644 classes/authenticator/UserManagerInterface.php delete mode 100644 classes/authenticator/UserToken.php delete mode 100644 classes/authenticator/UserTokenInterface.php delete mode 100644 classes/authenticator/info.md delete mode 100644 classes/cache/Cache_interface.php delete mode 100644 classes/cache/FileCache.php delete mode 100644 classes/cache/MemcachedCache.php delete mode 100644 classes/cache/RedisCache.php delete mode 100644 classes/session/DatabaseSession.php delete mode 100644 classes/session/DefaultSession.php delete mode 100644 classes/session/FilesSession.php delete mode 100644 classes/session/SessionHandlerInterface.php (limited to 'classes') diff --git a/classes/Benchmark.php b/classes/Benchmark.php deleted file mode 100644 index a7e93ea..0000000 --- a/classes/Benchmark.php +++ /dev/null @@ -1,150 +0,0 @@ -'; - $close = '

'; - $divider = ":"; - $prefix = '
'; - $suffix = '
'; - break; - case 'code': - $open = ''; - $close = ''; - $divider = ": "; - $prefix = '
';
-                    $suffix = '
'; - break; - case 'comment': - default: - $open = ''; - $divider = ":"; - $prefix = ''; - $suffix = ''; - break; - } - - echo $prefix; - - // TIME REPORT - // --------------------------------------------------------------------- - echo "\n\n{$open} Timings {$close}"; - - // valid from php 7.3 - // $start = self::$timeSpots[ array_key_first(self::$timespots) ]; - // $end = self::$timeSpots[ array_key_last(self::$timespots) ]; - $start = self::$timeSpots['start']; - $end = self::$timeSpots['end']; - $all_dt = number_format($end - $start , 4)*1000 ." ms"; - - - - // if more than 2 timespots - // echo dt between each spot - if (count(self::$timeSpots) > 2) { - - // calculate dt between spots - $time_results = array(); - $prev_key = ''; - $prev_time = 0; - foreach(self::$timeSpots as $key => $t) { - if (!$prev_time) { - $prev_time = $t; - $prev_key = $key; - } - else { - $dt = number_format($t - $prev_time , 4)*1000 ." ms"; - $time_results[] = array( - 'part' => "{$prev_key}[..{$key}]", ///$key, - 'dt' => $dt - ); - $prev_key = $key; //// "{$prev_key}[..{$key}]"; - $prev_time = $t; - } - } - - // echo timings - foreach ($time_results as $key => $val) { - echo "\n\t{$open} {$val['part']} {$divider} {$val['dt']} {$close}"; - } - } - - // echo total time - echo "\n\t{$open} total {$divider} {$all_dt} {$close}"; - - - // MEMORY REPORT - // --------------------------------------------------------------------- - echo "\n\n{$open} Memory Usage {$close}"; - - if (count(self::$memoryUse) > 2) { - - foreach (self::$memoryUse as $key => $val) { - echo "\n\t{$open} {$key} {$divider} {$val}MB {$close}"; - } - - } else { - echo "\n\t{$open} memory usage {$divider} ". round(memory_get_usage()/(1024*1024),2) ."MB {$close}"; - } - - echo $suffix; - - } - - } -} diff --git a/classes/Cart.php b/classes/Cart.php deleted file mode 100644 index 4e6f585..0000000 --- a/classes/Cart.php +++ /dev/null @@ -1,71 +0,0 @@ -uid], 10) - // - // oranize in results = [ - // { - // oid, - // prods: [ - // { - // pid, - // prodlabel, - // count - // }, - // ... - // ] - // }, - // ..., - // ] - // - // return $results - - } -} - - - -/* --- -orders: - : id - : uid (user id) - -order_products - : id - : oid (order id) - : pid (product id) - -- */ \ No newline at end of file diff --git a/classes/Database.php b/classes/Database.php deleted file mode 100644 index 35ff65f..0000000 --- a/classes/Database.php +++ /dev/null @@ -1,331 +0,0 @@ -throw_errors = PRODUCTION ? false : true; - - if (null == $this->connection) { - try { - $this->connection = new PDO( - "mysql:" . PDO_HOST . ";" . "dbname=" . DB_NAME, - DB_USER, - DB_PASS, - array( - PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'utf8'", - PDO::MYSQL_ATTR_LOCAL_INFILE => true - ) - ); - - // handle error reporting - if ($this->throw_errors) { - $this->connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); - } - $this->setTimezone(); - - } catch (PDOException $exc) { handle_exception($exc); } - } - # return $this->connection; - } - - - /** disconnect - * CHECK: not sure if needed - */ - public function disconnect() - { - $this->connection = null; - } - - - /** set Timezone - * (Self-explanatory) - */ - public function setTimezone($timezone = DB_TIMEZONE) { - // $this->connection->prepare($timezone)->execute(); - } - - - /** lastInsertID - * returns the ID of last inserted record - */ - public function lastInsertID() - { - return $this->connection->insert_id; - } - - - /** query - * --- - * set and execute a query safely; - * save results as associative array; DO NOT RETURN RESULTS - * @param $sql (string): SQL query - * @param $args (array): array of values to bind into SQL - * @param $pypass (boolean): flag to bypass security check - * @return $this (database handler) - */ - public function query($sql, $args=[]) - { - try { - - $stmt = $this->connection->prepare($sql); - - if ($args == []) { - $result = $stmt->execute(); - - } else { - $result = $stmt->execute($args); - - } - - $result = $stmt->fetchAll(PDO::FETCH_ASSOC); - - $this->result = $result; - - return $this; - - } catch (PDOException $exc) { handle_exception($exc); } - - } - - - /** getAll - * --- - * return all resulted records - * use it after db->query(); - */ - public function getAll() - { - return ($this->result === null) ? false : $this->result; - } - - - /** getFirst - * --- - * get first row of the resulted query; - * used when one row is expected - * ex. $db->query('SELECT * FROM users WHERE id = :id',['id'=>1])->getFirst(); - */ - public function getFirst() - { - if (($this->result === null) || ($this->result == [])) { - return false; - - } else { return $this->result[0]; } - } - - - /** getOnly - * --- - * return the first column value of the first row - * used when only one value is needed - * ex. $db->query('SELECT Count(id) FROM table',[])->getOnly(); - */ - public function getOnly() - { - if (($this->result === null) || ($this->result == [])) { - return false; - - } else { return array_values($this->result[0])[0]; } - } - - - /** runQuery - * --- (shortcut method) - * execute a query safely; - * return results as associative array - * @param $sql (string): SQL query - * @param $args (array): array of values to bind into SQL - * @param $pypass (boolean): flag to bypass security check - */ - public function runQuery($sql, $args=[]) - { - return $this->query($sql, $args)->getAll(); - } - - - /** runLimitQuery( sql, args, limit=100, offset = null ) - * set LIMIT / OFFSET clauses in a secure way - * @param $sql (string): SQL query - * @param $args (array): array of values to bind into SQL - * @param $limit (int): LIMIT number - * @param $offset (int): OFFSET number - */ - public function runLimitQuery($sql, $args, $limit = 100, $offset = null) - { - $limitStr = $offsetStr = ""; - - // construct LIMIT clause - if (is_int($limit)) { - $limitStr = " LIMIT {$limit}"; - - // construct OFFSET clause (when a LIMIT pre-exists) - if (is_int($offset)) { - $offsetStr =" OFFSET {$offset}"; - } - } - - $sql = $sql . $limitStr . $offsetStr; - - return $this->runQuery($sql, $args); - } - - - /** insert - * @param $table (string): name of table - * @param $values: an associative of (fieldName => value) pairs - * - * example call: - * --- - * $db->insert('products', - * [ - * 'title' => 'My Dark Chocolate 200g', - * 'text' => 'Lorem ipsum dolor sit amet, consectetur adipiscing elit ...', - * 'isFood' => 1, - * 'isToxic' => 0 - * ] - * ); - * - * ...which prepares the SQL query: - * INSERT INTO products (title, text, isFood, isToxic) - * VALUES (:title, :text, :isFood, :isToxic) - * - * ...and injects the values: [ :title => 'My Dark Chocolate 200g' , ... ] - */ - public function insert($table, array $values) - { - $fieldSets = []; - $valueSets = []; - $bindSets = []; - - foreach($values as $key => $val) { - $fieldSets[] = $key; - $valueSets[] =':'. $key; - $bindSets[':'. $key] = $val; - } - - $sql = "INSERT INTO {$table} (". implode(', ', $fieldSets) .") - VALUES (". implode(', ', $valueSets) .")"; - - return $this->runQuery($sql, $bindSets); - } - - - /** update - * @param $table (string): name of table - * @param $values: an associative of (fieldName => value) pairs - * @param $id: an associative of (fieldName => value) index fields - * - * example call: - * --- - * $db->update('products', - * [ 'title' => 'My Chocolate','isFood' => 1 ], - * [ 'id' => 123 ] - * ); - * - * ...which prepares the SQL query: - * UPDATE products SET `title` = :title, `isFood` = :isFood WHERE id = :id - * - * ...and injects: [':title'=> 'My Chocolate' , ':isFood'=> 1 , ':id'=> 123] - */ - public function update( $table, array $values, array $identity) - { - $fieldSets = []; // array of field names - $idSets = []; // array of data-holders - $bindSets = []; // array of data-bindings - - foreach($values as $key => $val) { - $fieldSets[] = "{$key} = :{$key}"; - $bindSets[':'. $key] = $val; - } - - foreach($identity as $key => $val) { - $idSets = "{$key} = :{$key}"; - $bindSets[':'. $key] = $val; - } - - $sql = "UPDATE {$table} SET ". implode(', ', $fieldSets) - ." WHERE ". implode(" AND ", $idSets); - - return $this->runQuery($sql, $bindsArray); - } - - - /** multiInsert( table, fields , values ) - * Construct a multiple-insert clause - * - * @param $table (string): name of table - * @param $fields (array): array with field-names - * @param $values (array): array of value-arrays - * - * example call: - * --- - * $db->multiInsert('order_products', - * [ 'orderID', 'productID', 'unitPrice', 'quantity', 'note' ], - * [ - * [ 124, 102030, 1.25, 5, '' ], - * [ 124, 102040, 10.50, 2, 'some note about product #102040' ], - * [ 124, 102050, 7.20, 3, '' ], - * [ 124, 102060, 3.25, 1, 'some other note' ] - * ] - * ); - */ - public function multiInsert($table, array $fieldsArray, array $valuesArray) - { - if (count($fieldsArray) != count($valuesArray[0])) { - throw new Exception('Fields and value arrays don\'t match.'); - } - - // setup fieldsSet - // ex. "(Title, Price, Status)" - $fieldsSet = ' (`'. implode( - '`, `', // make sure fieldnames are not SQL-bound terms - str_replace('`', '', $fieldsArray) // clean fieldnames - ) .'`) '; - - // setup holders array and bind-values array - // ex. "(:Title1, :Price1, :Status1), (:Title2, :Price2, :Status2), ...", - $holdersArray = []; - $bindsArray = []; - $counter = 1; - foreach($valuesArray as $key => $rowArray) { - $rowHolders = []; - - foreach($itemArray as $key => $val) { - $rowHolders = ':'. $fieldsArray[$key] . $counter; - $bindsArray[ ':'. $fieldsArray[$key] . $counter ] = $val; - } - $holdersArray[] = '('. implode(', ', $rowHolders ) .')'; - $counter++; - } - - $sql = "INSERT INTO {$table}" . $fieldsSet - . ' VALUES '. impload(', ', $holdersArray); - - return $this->runQuery($sql, $bindsArray); - } - -} diff --git a/classes/Registry.php b/classes/Registry.php deleted file mode 100644 index df012e9..0000000 --- a/classes/Registry.php +++ /dev/null @@ -1,129 +0,0 @@ -URL = $_SERVER['REQUEST_URI']; - $this->PATH = (!empty($parsed['path'])) ? urldecode($parsed['path']) : ''; - $this->QUERY = (!empty($parsed['query'])) ? urldecode($parsed['query']) : false; - $this->HOST = $_SERVER['HTTP_HOST']; - $this->PORT = $_SERVER['SERVER_PORT']; - $this->TIME = $_SERVER['REQUEST_TIME']; - $this->CLI_IP = $_SERVER['REMOTE_ADDR']; - - $this->METHOD = strtolower($_SERVER['REQUEST_METHOD']); - - $this->GET = $_GET; // $_GET should only used - // to request data or specify options (never to perform - // system-changes) thus should not need any validation; - // * If (for any reason) you requide $_GET sanitization - // enable it later on the method's code - - // $this->INTERFACE = php_sapi_name(); - - $this->AGENT = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'; - $this->SIGNATURE = sha1( - $_SERVER['HTTP_USER_AGENT'] ?? 'unknown' - . $_SERVER['HTTP_ACCEPT'] ?? '' - . $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '' - . $_SERVER['HTTP_ACCEPT_ENCODING'] ?? '' - ); - - // sanitize user input - // if (isset($_GET)) { $this->GET = $this->sanitize($_GET); } - $this->GET = $this->sanitize($_GET); - if (isset($_POST)) { $this->POST = $this->sanitize($_POST); } - if (isset($_COOKIE)) { $this->COOKIE = $this->sanitize($_COOKIE); } - - // check anti-CSRF token if needed - // (again, GET requests should not need CSRF cheking) - if (in_array($this->METHOD, ['post', 'put', 'patch', 'delete'])) { - // TODO: only if CSRF protection enabled... - $this->checkCsrfToken(); - } - - } - - - private function sanitize($array) - { - // TODO: - // ... - return $array; - } - - - public function checkCsrfToken() - { - // TODO: - // ... - // if SCRF-token is not valideted, serve 403 - return $array; - } - -} - diff --git a/classes/Route.php b/classes/Route.php deleted file mode 100644 index 072723c..0000000 --- a/classes/Route.php +++ /dev/null @@ -1,97 +0,0 @@ - $expression, - 'function' => $function, - 'method' => strtolower($method) - )); - } - - - /** notFound($function) - * --- - * @param $function : call back function to be executed - */ - public static function notFound($function) - { - self::$notFound = $function; - } - - - /** run() - * --- - * Parse request ; Find mathing route ; - * then call route's function - * usualy a Controller::method([poarametres]) - */ - public static function run(Request $request) - { - // $request = Registry::get('REQUEST'); - $path = $request->PATH; // request path - $method = $request->METHOD; // request method - - $path_match_found = false; - $route_match_found = false; - - foreach(self::$routes as $route) { - - // If method matched check the path - if ($route['method'] == $method || $method == 'any') { - - // Add 'find string start' automatically - $route['expression'] = '^'.$route['expression']; - - // Add 'find string end' automatically - $route['expression'] = $route['expression'].'$'; - - // Check path match - if (preg_match('#'. $route['expression'] .'#', $path, $matches)) { - - $route_match_found = true; - - array_shift($matches); // Always remove first element. This contains the whole string - - call_user_func_array($route['function'], $matches); - break; // Do not check other routes - - } - } - } - - // No matching route was found - if (!$route_match_found) { - header("HTTP/1.0 404 Not Found"); - if (self::$notFound) { - call_user_func_array(self::$notFound, []); - } - } - - } - -} diff --git a/classes/Security.php b/classes/Security.php deleted file mode 100644 index 61979db..0000000 --- a/classes/Security.php +++ /dev/null @@ -1,923 +0,0 @@ -', '<', '>', - "'", '"', '&', '$', '#', - '{', '}', '[', ']', '=', - ';', '?', '%20', '%22', - '%3c', // < - '%253c', // < - '%3e', // > - '%0e', // > - '%28', // ( - '%29', // ) - '%2528', // ( - '%26', // & - '%24', // $ - '%3f', // ? - '%3b', // ; - '%3d' // = - ); - - public $charset = 'UTF-8'; // Character set @var (string) Will be overridden by the constructor. - - protected $_xss_hash; // XSS Hash: @var (string) Random Hash for protecting URLs. - - protected $_csrf_hash; // CSRF Hash: @var (string) Random hash for Cross Site Request Forgery protection cookie - - // CSRF Expire time @var (int) - // Expiration time for Cross Site Request Forgery protection cookie. - protected $_csrf_expire = 7200; // defaults to 2hours (=7200 seconds) - - // CSRF Token name: @var (string) Token name for Cross Site Request Forgery protection cookie. - protected $_csrf_token_name = 'pi_csrf_token'; - - // CSRF Cookie name: @var (string) Cookie name for Cross Site Request Forgery protection cookie. - protected $_csrf_cookie_name = 'pi_csrf_token'; - - // List of never allowed strings @var (array) - protected $_never_allowed_str = array( - 'document.cookie' => '[removed]', - '(document).cookie' => '[removed]', - 'document.write' => '[removed]', - '(document).write' => '[removed]', - '.parentNode' => '[removed]', - '.innerHTML' => '[removed]', - '-moz-binding' => '[removed]', - '' => '-->', - ' '<![CDATA[', - '' => '<comment>', - '<%' => '<%' - ); - - // List of never allowed regex replacements @var (array) - protected $_never_allowed_regex = array( - 'javascript\s*:', - '(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)', - 'expression\s*(\(|&\#40;)', // CSS and IE - 'vbscript\s*:', // IE, surprise! - 'wscript\s*:', // IE - 'jscript\s*:', // IE - 'vbs\s*:', // IE - 'Redirect\s+30\d', - "([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?" - ); - - - /** Class constructor - * --- - * @return void - */ - public function __construct($charset = 'UTF-8') - { - $this->charset = $charset; - - /* --- - // Is CSRF protection enabled? - if (CSRF_PROTCTION') && ! is_cli()) - { --*/ - /************** - // CSRF config - foreach (array('csrf_expire', 'csrf_token_name', 'csrf_cookie_name') as $key) - { - //// if (NULL !== ($val = config_item($key))) - //// { - $this->{'_'.$key} = $val; - //// } - } - - // Append application specific cookie prefix - //// if ($cookie_prefix = config_item('cookie_prefix')) - //// { - $this->_csrf_cookie_name = $cookie_prefix . $this->_csrf_cookie_name; - //// } - - // Set the CSRF hash - $this->_csrf_set_hash(); - $this->csrf_verify(); - ***************/ - /* --- - } --*/ - - //// log_message('info', 'Security Class Initialized'); - } - - - /** CSRF Verify - * --- - * @return Security - */ - public function csrf_verify() - { - // If it's not a POST request we will set the CSRF cookie - if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') - { - return $this->csrf_set_cookie(); - } - - /// // Check if URI has been whitelisted from CSRF checks - /// if ($exclude_uris = config_item('csrf_exclude_uris')) - /// { - /// $uri = load_class('URI', 'core'); - /// foreach ($exclude_uris as $excluded) - /// { - /// if (preg_match('#^'.$excluded.'$#i'.(UTF8_ENABLED ? 'u' : ''), $uri->uri_string())) - /// { - /// return $this; - /// } - /// } - /// } - - // Check CSRF token validity, but don't error on mismatch just yet - we'll want to regenerate - $valid = isset($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]) - && is_string($_POST[$this->_csrf_token_name]) && is_string($_COOKIE[$this->_csrf_cookie_name]) - && hash_equals($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]); - - // We kill this since we're done and we don't want to pollute the _POST array - unset($_POST[$this->_csrf_token_name]); - - // Regenerate on every submission? - if (config_item('csrf_regenerate')) - { - // Nothing should last forever - unset($_COOKIE[$this->_csrf_cookie_name]); - $this->_csrf_hash = NULL; - } - - $this->_csrf_set_hash(); - $this->csrf_set_cookie(); - - if ($valid !== TRUE) - { - $this->csrf_show_error(); - } - - log_message('info', 'CSRF token verified'); - return $this; - } - - - /** CSRF Set Cookie - * --- - * @codeCoverageIgnore - * @return Security - */ - public function csrf_set_cookie() - { - $expire = time() + $this->_csrf_expire; - $secure_cookie = (bool) config_item('cookie_secure'); - - if ($secure_cookie && ! is_https()) - { - return FALSE; - } - - // php7.3+ - setcookie( - $this->_csrf_cookie_name, - $this->_csrf_hash, - array( - 'expires' => $expire, - 'path' => config_item('cookie_path'), - 'domain' => config_item('cookie_domain'), - 'secure' => $secure_cookie, - 'httponly' => config_item('cookie_httponly'), - 'samesite' => 'Strict' - ) - ); - - log_message('info', 'CSRF cookie sent'); - - return $this; - } - - - /** Show CSRF Error - * -- - * @return void - */ - public function csrf_show_error() - { - show_error('The action you have requested is not allowed.', 403); - } - - - /** Get CSRF Hash - * --- - * @see CI_Security::$_csrf_hash - * @return string CSRF hash - */ - public function get_csrf_hash() - { - return $this->_csrf_hash; - } - - - /** Get CSRF Token Name - * --- - * @see CI_Security::$_csrf_token_name - * @return string CSRF token name - */ - public function get_csrf_token_name() - { - return $this->_csrf_token_name; - } - - - /** XSS Clean - * --- - * Sanitizes data so that Cross Site Scripting Hacks can be - * prevented. This method does a fair amount of work but - * it is extremely thorough, designed to prevent even the - * most obscure XSS attempts. Nothing is ever 100% foolproof, - * of course, but I haven't been able to get anything passed - * the filter. - * - * Note: Should only be used to deal with data upon submission. - * It's not something that should be used for general - * runtime processing. - * - * @link http://channel.bitflux.ch/wiki/XSS_Prevention - * Based in part on some code and ideas from Bitflux. - * - * @link http://ha.ckers.org/xss.html - * To help develop this script I used this great list of - * vulnerabilities along with a few other hacks I've - * harvested from examining vulnerabilities in other programs. - * - * @param string|string[] $str Input data - * @param bool $is_image Whether the input is an image - * @return string - */ - public function xss_clean($str, $is_image = FALSE) - { - // Is the string an array? - if (is_array($str)) - { - foreach ($str as $key => &$value) - { - $str[$key] = $this->xss_clean($value); - } - - return $str; - } - - // Remove Invisible Characters - $str = remove_invisible_characters($str); - - // URL Decode - // Just in case stuff like this is submitted: - // Google - // NOTE: Use rawurldecode() so it does not remove plus signs - if (stripos($str, '%') !== false) - { - do - { - $oldstr = $str; - $str = rawurldecode($str); - $str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', array($this, '_urldecodespaces'), $str); - } - while ($oldstr !== $str); - unset($oldstr); - } - - // Convert character entities to ASCII - // --- - // This permits our tests below to work reliably. - // We only convert entities that are within tags since - // these are the ones that will pose security problems. - $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str); - $str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str); - - // Remove Invisible Characters Again! - $str = remove_invisible_characters($str); - - - // Convert all tabs to spaces - // --- - // This prevents strings like this: ja vascript - // NOTE: we deal with spaces between characters later. - // NOTE: preg_replace was found to be amazingly slow here on - // large blocks of data, so we use str_replace. - $str = str_replace("\t", ' ', $str); - - // Capture converted string for later comparison - $converted_string = $str; - - // Remove Strings that are never allowed - $str = $this->_do_never_allowed($str); - - - // Makes PHP tags safe - // NOTE: XML tags are inadvertently replaced too: - // '), array('<?', '?>'), $str); - } - - // Compact any exploded words - // --- - // This corrects words like: j a v a s c r i p t - // These words are compacted back to their correct state. - $words = array( - 'javascript', 'expression', 'vbscript', 'jscript', 'wscript', - 'vbs', 'script', 'base64', 'applet', 'alert', 'document', - 'write', 'cookie', 'window', 'confirm', 'prompt', 'eval' - ); - - foreach ($words as $word) - { - $word = implode('\s*', str_split($word)).'\s*'; - - // We only want to do this when it is followed by a non-word character - // That way valid stuff like "dealer to" does not become "dealerto" - $str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str); - } - - - // Remove disallowed Javascript in links or img tags - // We used to do some version comparisons and use of stripos(), - // but it is dog slow compared to these simplified non-capturing - // preg_match(), especially if the pattern exists in the string - // - // Note: It was reported that not only space characters, but all in - // the following pattern can be parsed as separators between a tag name - // and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C] - // ... however, remove_invisible_characters() above already strips the - // hex-encoded ones, so we'll skip them below. - do - { - $original = $str; - - if (preg_match('/]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str); - } - - if (preg_match('/]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str); - } - - if (preg_match('/script|xss/i', $str)) - { - $str = preg_replace('##si', '[removed]', $str); - } - } - while ($original !== $str); - unset($original); - - - // Sanitize naughty HTML elements - // --- - // If a tag containing any of the words in the list - // below is found, the tag gets converted to entities. - // So this: - // Becomes: <blink> - $pattern = '#' - .'<((?/*\s*)((?[a-z0-9]+)(?=[^a-z0-9]|$)|.+)' // tag start and name, followed by a non-tag character - .'[^\s\042\047a-z0-9>/=]*' // a valid attribute character immediately after the tag would count as a separator - // optional attributes - .'(?(?:[\s\042\047/=]*' // non-attribute characters, excluding > (tag close) for obvious reasons - .'[^\s\042\047>/=]+' // attribute characters - // optional attribute-value - .'(?:\s*=' // attribute-value separator - .'(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))' // single, double or non-quoted value - .')?' // end optional attribute-value group - .')*)' // end optional attributes group - .'[^>]*)(?\>)?#isS'; - - // Note: It would be nice to optimize this for speed, BUT - // only matching the naughty elements here results in - // false positives and in turn - vulnerabilities! - do - { - $old_str = $str; - $str = preg_replace_callback($pattern, array($this, '_sanitize_naughty_html'), $str); - } - while ($old_str !== $str); - unset($old_str); - - // Sanitize naughty scripting elements - // --- - // Similar to above, only instead of looking for - // tags it looks for PHP and JavaScript commands - // that are disallowed. Rather than removing the - // code, it simply converts the parenthesis to entities - // rendering the code un-executable. - // * For example: eval('some code') - // ... Becomes: eval('some code') - $str = preg_replace( - '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', - '\\1\\2(\\3)', - $str - ); - - // Same thing, but for "tag functions" (e.g. eval`some code`) - // See https://github.com/bcit-ci/CodeIgniter/issues/5420 - $str = preg_replace( - '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si', - '\\1\\2`\\3`', - $str - ); - - // Final clean up - // This adds a bit of extra precaution in case - // something got through the above filters - $str = $this->_do_never_allowed($str); - - // Images are Handled in a Special Way - // - Essentially, we want to know that after all of the character - // conversion is done whether any unwanted, likely XSS, code was found. - // If not, we return TRUE, as the image is clean. - // However, if the string post-conversion does not matched the - // string post-removal of XSS, then it fails, as there was unwanted XSS - // code found and removed/changed during processing. - if ($is_image === TRUE) - { - return ($str === $converted_string); - } - - return $str; - } - - - /** XSS Hash - * --- - * Generates the XSS hash if needed and returns it. - * @see CI_Security::$_xss_hash - * @return string XSS hash - */ - public function xss_hash() - { - if ($this->_xss_hash === NULL) - { - $rand = $this->get_random_bytes(16); - $this->_xss_hash = ($rand === FALSE) - ? md5(uniqid(mt_rand(), TRUE)) - : bin2hex($rand); - } - - return $this->_xss_hash; - } - - - /** Get random bytes - * --- - * @param int $length Output length - * @return string - */ - public function get_random_bytes($length) - { - if (empty($length) OR ! ctype_digit((string) $length)) - { - return FALSE; - } - - if (function_exists('random_bytes')) - { - try - { - // The cast is required to avoid TypeError - return random_bytes((int) $length); - } - catch (Exception $e) - { - // If random_bytes() can't do the job, we can't either ... - // There's no point in using fallbacks. - log_message('error', $e->getMessage()); - return FALSE; - } - } - - // Unfortunately, none of the following PRNGs is guaranteed to exist ... - if (defined('MCRYPT_DEV_URANDOM') && ($output = mcrypt_create_iv($length, MCRYPT_DEV_URANDOM)) !== FALSE) - { - return $output; - } - - if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE) - { - // Try not to waste entropy ... - stream_set_chunk_size($fp, $length); - $output = fread($fp, $length); - fclose($fp); - if ($output !== FALSE) - { - return $output; - } - } - - if (function_exists('openssl_random_pseudo_bytes')) - { - return openssl_random_pseudo_bytes($length); - } - - return FALSE; - } - - - /** HTML Entities Decode - * --- - * A replacement for html_entity_decode() - * - * The reason we are not using html_entity_decode() by itself is because - * while it is not technically correct to leave out the semicolon - * at the end of an entity most browsers will still interpret the entity - * correctly. html_entity_decode() does not convert entities without - * semicolons, so we are left with our own little solution here. Bummer. - * - * @link https://secure.php.net/html-entity-decode - * - * @param string $str Input - * @param string $charset Character set - * @return string - */ - public function entity_decode($str, $charset = NULL) - { - if (strpos($str, '&') === FALSE) - { - return $str; - } - - static $_entities; - - isset($charset) OR $charset = $this->charset; - isset($_entities) OR $_entities = array_map('strtolower', get_html_translation_table(HTML_ENTITIES, ENT_COMPAT | ENT_HTML5, $charset)); - - do - { - $str_compare = $str; - - // Decode standard entities, avoiding false positives - if (preg_match_all('/&[a-z]{2,}(?![a-z;])/i', $str, $matches)) - { - $replace = array(); - $matches = array_unique(array_map('strtolower', $matches[0])); - foreach ($matches as &$match) - { - if (($char = array_search($match.';', $_entities, TRUE)) !== FALSE) - { - $replace[$match] = $char; - } - } - - $str = str_replace(array_keys($replace), array_values($replace), $str); - } - - // Decode numeric & UTF16 two byte entities - $str = html_entity_decode( - preg_replace('/(&#(?:x0*[0-9a-f]{2,5}(?![0-9a-f;])|(?:0*\d{2,4}(?![0-9;]))))/iS', '$1;', $str), - ENT_COMPAT | ENT_HTML5, - $charset - ); - } - while ($str_compare !== $str); - return $str; - } - - - /** Sanitize Filename - * --- - * @param string $str Input file name - * @param bool $relative_path Whether to preserve paths - * @return string - */ - public function sanitize_filename($str, $relative_path = FALSE) - { - $bad = $this->filename_bad_chars; - - if ( ! $relative_path) - { - $bad[] = './'; - $bad[] = '/'; - } - - $str = remove_invisible_characters($str, FALSE); - - do - { - $old = $str; - $str = str_replace($bad, '', $str); - } - while ($old !== $str); - - return stripslashes($str); - } - - - /** Strip Image Tags - * --- - * @param string $str - * @return string - */ - public function strip_image_tags($str) - { - return preg_replace( - array( - '##i', - '#`]+)).*?\>#i' - ), - '\\2', - $str - ); - } - - - /** URL-decode taking spaces into account - * --- - * @see https://github.com/bcit-ci/CodeIgniter/issues/4877 - * @param array $matches - * @return string - */ - protected function _urldecodespaces($matches) - { - $input = $matches[0]; - $nospaces = preg_replace('#\s+#', '', $input); - return ($nospaces === $input) - ? $input - : rawurldecode($nospaces); - } - - - /** Compact Exploded Words - * --- - * Callback method for xss_clean() to remove whitespace from - * things like 'j a v a s c r i p t'. - * - * @used-by Security::xss_clean() - * @param array $matches - * @return string - */ - protected function _compact_exploded_words($matches) - { - return preg_replace('/\s+/s', '', $matches[1]).$matches[2]; - } - - - /** Sanitize Naughty HTML - * --- - * Callback method for xss_clean() to remove naughty HTML elements. - * @used-by Security::xss_clean() - * @param array $matches - * @return string - */ - protected function _sanitize_naughty_html($matches) - { - static $naughty_tags = array( - 'alert', 'area', 'prompt', 'confirm', 'applet', 'audio', 'basefont', 'base', 'behavior', 'bgsound', - 'blink', 'body', 'embed', 'expression', 'form', 'frameset', 'frame', 'head', 'html', 'ilayer', - 'iframe', 'input', 'button', 'select', 'isindex', 'layer', 'link', 'meta', 'keygen', 'object', - 'plaintext', 'style', 'script', 'textarea', 'title', 'math', 'video', 'svg', 'xml', 'xss' - ); - - static $evil_attributes = array( - 'on\w+', 'style', 'xmlns', 'formaction', 'form', 'xlink:href', 'FSCommand', 'seekSegmentTime' - ); - - // First, escape unclosed tags - if (empty($matches['closeTag'])) - { - return '<'.$matches[1]; - } - // Is the element that we caught naughty? If so, escape it - elseif (in_array(strtolower($matches['tagName']), $naughty_tags, TRUE)) - { - return '<'.$matches[1].'>'; - } - // For other tags, see if their attributes are "evil" and strip those - elseif (isset($matches['attributes'])) - { - // We'll store the already filtered attributes here - $attributes = array(); - - // Attribute-catching pattern - $attributes_pattern = '#' - .'(?[^\s\042\047>/=]+)' // attribute characters - // optional attribute-value - .'(?:\s*=(?[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*)))' // attribute-value separator - .'#i'; - - // Blacklist pattern for evil attribute names - $is_evil_pattern = '#^('.implode('|', $evil_attributes).')$#i'; - - // Each iteration filters a single attribute - do - { - // Strip any non-alpha characters that may precede an attribute. - // Browsers often parse these incorrectly and that has been a - // of numerous XSS issues we've had. - $matches['attributes'] = preg_replace('#^[^a-z]+#i', '', $matches['attributes']); - - if ( ! preg_match($attributes_pattern, $matches['attributes'], $attribute, PREG_OFFSET_CAPTURE)) - { - // No (valid) attribute found? Discard everything else inside the tag - break; - } - - if ( - // Is it indeed an "evil" attribute? - preg_match($is_evil_pattern, $attribute['name'][0]) - // Or does it have an equals sign, but no value and not quoted? Strip that too! - OR (trim($attribute['value'][0]) === '') - ) - { - $attributes[] = 'xss=removed'; - } - else - { - $attributes[] = $attribute[0][0]; - } - - $matches['attributes'] = substr($matches['attributes'], $attribute[0][1] + strlen($attribute[0][0])); - } - while ($matches['attributes'] !== ''); - - $attributes = empty($attributes) - ? '' - : ' '.implode(' ', $attributes); - return '<'.$matches['slash'].$matches['tagName'].$attributes.'>'; - } - - return $matches[0]; - } - - - /** JS Link Removal - * --- - * Callback method for xss_clean() to sanitize links. - * - * This limits the PCRE backtracks, making it more performance friendly - * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in - * PHP 5.2+ on link-heavy strings. - * - * @used-by CI_Security::xss_clean() - * @param array $match - * @return string - */ - protected function _js_link_removal($match) - { - return str_replace( - $match[1], - preg_replace( - '#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|_filter_attributes($match[1]) - ), - $match[0] - ); - } - - - /** JS Image Removal - * --- - * Callback method for xss_clean() to sanitize image tags. - * - * This limits the PCRE backtracks, making it more performance friendly - * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in - * PHP 5.2+ on image tag heavy strings. - * - * @used-by Security::xss_clean() - * @param array $match - * @return string - */ - protected function _js_img_removal($match) - { - return str_replace( - $match[1], - preg_replace( - '#src=.*?(?:(?:alert|prompt|confirm|eval)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|_filter_attributes($match[1]) - ), - $match[0] - ); - } - - - /** Attribute Conversion - * --- - * @used-by CI_Security::xss_clean() - * @param array $match - * @return string - */ - protected function _convert_attribute($match) - { - return str_replace(array('>', '<', '\\'), array('>', '<', '\\\\'), $match[0]); - } - - - /** Filter Attributes - * --- - * Filters tag attributes for consistency and safety. - * @used-by CI_Security::_js_img_removal() - * @used-by CI_Security::_js_link_removal() - * @param string $str - * @return string - */ - protected function _filter_attributes($str) - { - $out = ''; - if (preg_match_all('#\s*[a-z\-]+\s*=\s*(\042|\047)([^\\1]*?)\\1#is', $str, $matches)) - { - foreach ($matches[0] as $match) - { - $out .= preg_replace('#/\*.*?\*/#s', '', $match); - } - } - - return $out; - } - - - /** HTML Entity Decode Callback - * --- - * @used-by CI_Security::xss_clean() - * @param array $match - * @return string - */ - protected function _decode_entity($match) - { - // Protect GET variables in URLs - // 901119URL5918AMP18930PROTECT8198 - $match = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-/]+)|i', $this->xss_hash().'\\1=\\2', $match[0]); - - // Decode, then un-protect URL GET vars - return str_replace( - $this->xss_hash(), - '&', - $this->entity_decode($match, $this->charset) - ); - } - - - /** Do Never Allowed - * --- - * @used-by CI_Security::xss_clean() - * @param string - * @return string - */ - protected function _do_never_allowed($str) - { - $str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str); - - foreach ($this->_never_allowed_regex as $regex) - { - $str = preg_replace('#'.$regex.'#is', '[removed]', $str); - } - - return $str; - } - - - /** Set CSRF Hash and Cookie - * --- - * @return string - */ - protected function _csrf_set_hash() - { - if ($this->_csrf_hash === NULL) - { - // If the cookie exists we will use its value. - // We don't necessarily want to regenerate it with - // each page load since a page could contain embedded - // sub-pages causing this feature to fail - if (isset($_COOKIE[$this->_csrf_cookie_name]) && is_string($_COOKIE[$this->_csrf_cookie_name]) - && preg_match('#^[0-9a-f]{32}$#iS', $_COOKIE[$this->_csrf_cookie_name]) === 1) - { - return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name]; - } - - $rand = $this->get_random_bytes(16); - $this->_csrf_hash = ($rand === FALSE) - ? md5(uniqid(mt_rand(), TRUE)) - : bin2hex($rand); - } - - return $this->_csrf_hash; - } -} diff --git a/classes/User.php b/classes/User.php deleted file mode 100644 index 65b5018..0000000 --- a/classes/User.php +++ /dev/null @@ -1,111 +0,0 @@ - '', - 'name' => '', - 'middle'=> '', - 'surname' =>'', - 'email' => '' - ); - - private $addresses = Array(); - - - - /** METHODS - * ------------------------------------------------------------------------- - */ - - - public function create() - { - - } - - - public function setDefaultAddress($id) - { - - } - - - public function addAddress() - { - // update session data - // update user record - } - - - public function changePassword() - { - - } - - - public function confirmEmail() - { - - } - - - public function sendEmail() - { - - } - - /** sendOTP() - * sent One-Time-Password - * - */ - public function sendOTP($ttl) - { - $to = $this->who; - $otp = rand(10000,99999); - $expire = time() + $ttl; - - $mail = new PHPMailer(true); - try { - //Server settings - // ... - - //Recipients - $mail->setFrom('from@example.com', 'Mailer'); - $mail->addAddress($to['email'], $to['surname'] .' '. $to['name']); //Add a recipient - $mail->addReplyTo('info@example.com', 'Information'); - - //Attachments - $mail->addAttachment('/var/tmp/file.tar.gz'); //Add attachments - $mail->addAttachment('/tmp/image.jpg', 'new.jpg'); //Optional name - - //Content - $mail->isHTML(true); //Set email format to HTML - $mail->Subject = 'Your OTP'; - $mail->Body = 'This is the HTML message body in bold!'; - $mail->AltBody = 'This is the body in plain text for non-HTML mail clients'; - - $mail->send(); - echo 'Message has been sent'; - } catch (Exception $e) { - echo "Message could not be sent. Mailer Error: {$mail->ErrorInfo}"; - } - - } - - /** updateSession() - * regenerates session - */ - public function updateSession() - { - - } - -} diff --git a/classes/authenticator/PasswordTrait.php b/classes/authenticator/PasswordTrait.php deleted file mode 100644 index 22976d8..0000000 --- a/classes/authenticator/PasswordTrait.php +++ /dev/null @@ -1,40 +0,0 @@ - $this->cost] - ); - } - - public function isPasswordValid(UserInterface $user, string $plainPassword): bool - { - return password_verify( - $plainPassword, - $user->getPassword() - ); - } - - public function setCost(int $cost): void - { - if ($cost < 4 || $cost > 12) { - throw new \InvalidArgumentException('Cost must be in the range of 4-31.'); - } - $this->cost = $cost; - } -} diff --git a/classes/authenticator/User.php b/classes/authenticator/User.php deleted file mode 100644 index b99fa70..0000000 --- a/classes/authenticator/User.php +++ /dev/null @@ -1,102 +0,0 @@ -userName; - } - - /** getPassword - * @return null|string - */ - public function getPassword(): ?string - { - return $this->password; - } - - /** getRoles - * @return array - */ - public function getRoles(): array - { - return $this->roles; - } - - /** isEnabled - * @return bool - */ - public function isEnabled(): bool - { - return $this->enabled; - } - - - /** SETs - * ------------------------------------------------------------------------- - */ - - /** setUserName - * @param string $userName - * @return User - */ - public function setUserName(string $userName): self - { - $this->userName = $userName; - return $this; - } - - /** setPassword - * @param string $password - * @return User - */ - public function setPassword(string $password): self - { - $this->password = $password; - return $this; - } - - /** setRoles - * @param array $roles - * @return User - */ - public function setRoles(array $roles): self - { - $this->roles = $roles; - return $this; - } - - /** - * @param bool $enabled - * @return User - */ - public function setEnabled(bool $enabled): self - { - $this->enabled = $enabled; - return $this; - } -} diff --git a/classes/authenticator/UserInterface.php b/classes/authenticator/UserInterface.php deleted file mode 100644 index 5cc6d2d..0000000 --- a/classes/authenticator/UserInterface.php +++ /dev/null @@ -1,15 +0,0 @@ -hasUserToken()) { - $userToken = unserialize($_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY]); - } - - return $userToken; - } - - public function hasUserToken(): bool - { - $key = UserTokenInterface::DEFAULT_PREFIX_KEY; - return (array_key_exists($key, $_SESSION) && unserialize($_SESSION[$key]) !== false); - } - - public function isGranted(array $roles): bool - { - if (!is_null($userToken = $this->getUserToken())) { - return false; - } - - if ($userToken->getUser() instanceof UserInterface) { - return (!empty(array_intersect($roles, $userToken->getUser()->getRoles()))); - } - - return false; - } - - public function createUserToken(UserInterface $user): UserTokenInterface - { - $userToken = new UserToken($user); - $_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY] = $userToken->serialize(); - - return $userToken; - } - - public function logout(): void - { - if ($this->hasUserToken()) { - unset($_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY]); - } - } -} - diff --git a/classes/authenticator/UserManagerInterface.php b/classes/authenticator/UserManagerInterface.php deleted file mode 100644 index ef120c1..0000000 --- a/classes/authenticator/UserManagerInterface.php +++ /dev/null @@ -1,21 +0,0 @@ -user = $user; - } - - public function getUser(): UserInterface - { - return $this->user; - } - - public function serialize(): string - { - return serialize($this); - } -} diff --git a/classes/authenticator/UserTokenInterface.php b/classes/authenticator/UserTokenInterface.php deleted file mode 100644 index 2a21d8f..0000000 --- a/classes/authenticator/UserTokenInterface.php +++ /dev/null @@ -1,13 +0,0 @@ -cryptPassword($req->POST['password']); - - $user = (new User()) - ->setUserName($req->POST['username']) - ->setPassword($password) - ->setRoles(['ROLE_USER']); - - $userManager->createUserToken($user); - - // check Token in Session - var_dump($userManager->getUserToken()); - // object(DevCoder\Authentication\Token\UserToken)[4] - // private 'user' => - // object(DevCoder\Authentication\User)[5] - // private 'userName' => string 'username' (length=8) - // private 'password' => string '$2y$10$iWdcmebmikUFlgKMqW7/rOmUp1DjFAuWKqdUHBhL08FZ7LL6bwRey' (length=60) - // private 'roles' => - // array (size=1) - // 0 => string 'ROLE_USER' (length=9) - // private 'enabled' => boolean true - - -## Connected or not - - hasUserToken()) { - // connected - - $token = $userManager->getUserToken(); - $user = $token->getUser(); - var_dump($user); - // object(DevCoder\Authentication\User)[5] - // private 'userName' => string 'username' (length=8) - // private 'password' => string '$2y$10$OBobeLhdvdiftuedlv1a6e4.qF6sCG/usq5WEV4E3uB.UiS1egv/m' (length=60) - // private 'roles' => - // array (size=1) - // 0 => string 'ROLE_USER' (length=9) - // private 'enabled' => boolean true - - } else { - // not connected - } - - -## Access management - - $userManager = new UserManager(); - if ($userManager->isGranted(['ROLE_ADMIN'])) { - //is admin - // return Response 200 - }else { - //is not admin - // return Response 403 - } - - Logout - - $userManager = new UserManager(); - $userManager->logout(); - - -## Login - - prepare("SELECT * FROM users WHERE username=?"); - $stmt->execute([$_POST['username']]); - $userFromDataBase = $stmt->fetch(); - /** - * Hydration - */ - $user = (new \Test\DevCoder\Authentication\User()) - ->setUserName($userFromDataBase['username']) - ->setPassword($userFromDataBase['password']) - ->setRoles(json_decode($userFromDataBase['roles'])) - ->setEnabled($userFromDataBase['active']); - - $userManager = new UserManager(); - if ($userManager->isPasswordValid($user, $_POST['password'])) { - - // login OK, set Token in session - $userManager->createUserToken($user); - - } else { - // login failed , return error - } diff --git a/classes/cache/Cache_interface.php b/classes/cache/Cache_interface.php deleted file mode 100644 index 7c49789..0000000 --- a/classes/cache/Cache_interface.php +++ /dev/null @@ -1,34 +0,0 @@ - $data[0]) { - - // Unlinking - unlink($filename); - return false; - - } - - return $data[1]; - } - - - public function flush(int $olderThan = 0) - { - return false; // reply false until implementation - } - -} diff --git a/classes/cache/MemcachedCache.php b/classes/cache/MemcachedCache.php deleted file mode 100644 index c89d86a..0000000 --- a/classes/cache/MemcachedCache.php +++ /dev/null @@ -1,37 +0,0 @@ -addServer(\MEMCACHE_HOST, 11211); - - $mc->set($hashkey, $data, $ttl); - } - - - public function get($key) - { - $hashkey = md5($key); - - $mc = new Memcached(); - $mc->addServer(\MEMCACHE_HOST, 11211); - - return $mc->get($hashkey); - - } - - public function flush($olderThan = 0) - { - return false; - } - -} \ No newline at end of file diff --git a/classes/cache/RedisCache.php b/classes/cache/RedisCache.php deleted file mode 100644 index ec50f08..0000000 --- a/classes/cache/RedisCache.php +++ /dev/null @@ -1,69 +0,0 @@ - \REDIS_HOST - ]); - return $redis->set($key, $serialized, 'EX', $ttl); - - } catch (Exception $e) { - // ... - } - } - - - /** get - * fetch previously stored $data under label $key - * return $data (or false) - */ - public function get($key) - { - - try { - - $redis = new \Predis\Client([ - 'host' => \REDIS_HOST - ]); - - if ($redis->exists($key)) { - return unserialize($redis->get($key)); - - } else { - return false; - } - - } catch (Exception $e) { - // ... - } - - } - - - /** flush - * --- not umplemented yet; may not needed - */ - public function flush($olderThan = 0) - { - return false; // until implementation - } - -} \ No newline at end of file diff --git a/classes/session/DatabaseSession.php b/classes/session/DatabaseSession.php deleted file mode 100644 index aa31b62..0000000 --- a/classes/session/DatabaseSession.php +++ /dev/null @@ -1,138 +0,0 @@ -db = Registry::use('database'); - - // Set handler to overide SESSION - session_set_save_handler( - array($this, "open"), - array($this, "close"), - array($this, "read"), - array($this, "write"), - array($this, "destroy"), - array($this, "gc") - ); - - // Start the session - session_name(SESSION_NAME); - session_start(); - } - - // public function open(string $path, string $name) : bool - // NOTE: $path and $name are unsued - public function open() : bool - { - if ($this->db) { - return true; - } - else { - // database connection may be closed from another class - // (ex. from some user class); in this case... - // create a new database connection, then recheck. - $conn = new Database(); - // $this->db = $conn->connect(); - - if ($conn) { - $this->db = $conn; - return true; - } - } - return false; - } - - - public function close() : bool - { - // depricated: the database object is shared (don;t clode it!) - // // Close the database connection - // if ($this->db = null) { return true; } - // else return false; - - return true; - } - - - public function read(string $id) : string|false - { - $exist = $this->db->runQuery( - "SELECT data FROM sessions WHERE id = :id", - [':id', $id] - ); - - if (($exist === false) || (count($exist) == 0)) { - return false; - - } else { - $data = $exist[0]; - } - - if (is_null($row['data'])) { - return ''; - } - return $row['data']; - } - - - public function write(string $id, string $data) : bool - { - // Create timestamp - $access = time(); - $check = $this->db->runQuery( - "REPLACE INTO sessions VALUES (:id, :access, :data)", - [':id' => $id, ':access' => $access, ':data' => $data ] - ); - return ($check == false) ? false : true; - } - - - public function destroy(string $sassionID) : bool - { - $check = $this->db->runQuery( - 'DELETE FROM sessions WHERE id = :id', - [':id' => $sassionID] - ); - return ($check == false) ? false : true; - } - - - public function gc(int $max) - { - // Calculate what is to be deemed old - $old = time() - $max; - $check = $this->db->runQuery( - 'DELETE FROM sessions WHERE access < :old', - [':old' => $old] - ); - return ($check == false) ? false : 1; - // check garbage-collector probability to run - // echo "probability: ". ini_get("session.gc_probability") ." / ". ini_get("session.gc_divisor") . ", ttl: ". ini_get("session.gc_maxlifetime"); die(); - - } - - # callable $create_sid = ?, - # callable $validate_sid = ?, - # callable $update_timestamp = ? -} diff --git a/classes/session/DefaultSession.php b/classes/session/DefaultSession.php deleted file mode 100644 index d3099a5..0000000 --- a/classes/session/DefaultSession.php +++ /dev/null @@ -1,35 +0,0 @@ -sess_filename = $path; - $this->minutes = $minutes; - - // Set handler to overide SESSION - session_set_save_handler( - array($this, "open"), - array($this, "close"), - array($this, "read"), - array($this, "write"), - array($this, "destroy"), - array($this, "gc") - ); - - // Start the session - session_name(SESSION_NAME); - session_start(); - } - - /** open - * set filename; - * no need to touch the filesystem yet - * return true (always) - */ - public function open($savePath, $sessionName): bool - { - $this->sess_filename = $this->$path .'/'. $sessionName; - return true; - } - - /** close - * nothing needs to be closed; - * return true (always) - */ - public function close(): bool - { - return true; - } - - /** read - * chech if file exists; if not return false - * read data - */ - public function read($sessionId): string|false - { - if (!file_exists($filename) || !is_readable($filename)) return false; - return file_get_contents($filename); - - # if ($this->files->isFile($path = $this->path.'/'.$sessionId) && - # $this->files->lastModified($path) >= Carbon::now()->subMinutes($this->minutes)->getTimestamp()) { - # return $this->files->sharedGet($path); - # } - - # depricated? return ''; - } - - /** write - * data serielized already by php's internal session engine - */ - public function write($sessionId, $data): bool - { - $h = fopen($filename, 'w'); - if (fwrite($h,$data) === false) { - throw new Exception('Could not write session data'); - return false; - } - fclose($h); - - return true; - } - - /** - * {@inheritdoc} - * - * @return bool - */ - public function destroy($sassionID): bool - { - unlink($this->sassionID); - - return true; - } - - /** - * {@inheritdoc} - * - * @return int - */ - public function gc($lifetime) : int - { - $files = Finder::create() - ->in($this->path) - ->files() - ->ignoreDotFiles(true) - ->date('<= now - '.$lifetime.' seconds'); - - $deletedSessions = 0; - - foreach ($files as $file) { - $this->files->delete($file->getRealPath()); - $deletedSessions++; - } - - return $deletedSessions; - } -} diff --git a/classes/session/SessionHandlerInterface.php b/classes/session/SessionHandlerInterface.php deleted file mode 100644 index cf6efac..0000000 --- a/classes/session/SessionHandlerInterface.php +++ /dev/null @@ -1,169 +0,0 @@ - someone visits website through server A - * -> server A creates a new session-id for the visitor and a shared-session-id - * -> saves both into database - * - * later... - * - * #2 - * -> the same device is connected (via loadbalancer) into server B - * -> server B don't have the session-id (send by the client) but gets it from db - * (is session-id do not exist on the db, then this is a new session) - * - * = now both server A and B have the same session-id localy - * - * later... - * - * #3 - * -> some server (let's say B) regenerates the visitors session-id - * -> if later the visitor falls into server A, the A will retrieve the new - * session id through the #2 scenario - * - * this way - * + any server can update/regenerate the visitor's session-id - * + the visitor can be served from both servers randomly - * + all session variables exist on the database (always) - * + all session variables exist on all servers synced-on-demand - * - * - * stucture of session: - * --- - * - shared-session-id: (secret + persistent); exposed between servers **primary - * - session-id: (may change/regenerate/update); exposed to the client **indexed - * - data: serialized array - * - creation_timestamp: - * - last_touched_timestamp: - * - expiration_timestamp: should point to the future or session has expired - * - csrf_token: - * - JWT_token - * - AES-key (this way private data can be kept in browser) - * - * - * what will kept on browser/client (via cookie) - * --- - * - session-name => session-id - * - user info => AES_ectypted(serialized[t=>csfr_token, u=> user_id, s=>SIGNATURE]) - * - * - * Writable file-system shall change - * (local writable file-system tree) - * --- - * /html/storage - * | - * |-- cache : query-caches - * | - * `-- session : FS\sessions - * | - * `-- indexes : share-session-id indexes - * - * - * - * NOTE: Session life-cycle - * - * session_start() * firsts time - * --- - * ::open(path,PHPSESSID) -> (session_id not exist) -> false - * ::create_sid -> '123def' - * ::read('123def') ?-or/and- ::close() - * - * - * session_start() * next times - * --- - * ::open(path, PHPSESSID) -> (session_id exist) -> true - * ::read('123def') -> return data -> will fill $_SESSION[*] - * - * - * $_SESSION['foo'] = 'bar'; - * --- - * ::write('123def', 'foo|s:3:"bar";') -> ['foo' => "bar"] - * ::close() - * - * - * session_regenerate_id(); - * --- - * ::create_sid() -> def123 - * - * - * session_reset() - * --- - * ::open() - * ::read('def123') - * - * - * session_write_close() - * --- - * ::write('123def', 'foo|s:3:"bar";') - * ::close() - * - * - * session_destroy() - * --- - * ::destroy('def123') - * ::close() - * - */ -- cgit v1.2.3