From 059e0d95d0c28bc5060e87e146eaf7411f51bf90 Mon Sep 17 00:00:00 2001 From: George Halkiadakis Date: Thu, 27 Apr 2023 03:47:30 +0300 Subject: skeleton commit; based on an anom project --- core/README.md | 266 ++++++ core/auth/.gitkeep | 0 core/auth/env.example | 36 + core/classes/Benchmark.php | 150 ++++ core/classes/Cart.php | 71 ++ core/classes/Database.php | 333 ++++++++ core/classes/Registry.php | 135 +++ core/classes/Render.php | 358 ++++++++ core/classes/Repository.php | 43 + core/classes/Request.php | 161 ++++ core/classes/Route.php | 97 +++ core/classes/Security.php | 923 +++++++++++++++++++++ core/classes/authentication/Core/PasswordTrait.php | 38 + core/classes/authentication/Core/UserManager.php | 101 +++ .../authentication/Core/UserManagerInterface.php | 25 + core/classes/authentication/Token/UserToken.php | 44 + .../authentication/Token/UserTokenInterface.php | 18 + core/classes/authentication/User.php | 116 +++ core/classes/authentication/UserInterface.php | 19 + core/classes/authentication/info.md | 114 +++ core/classes/cache/Cache_interface.php | 34 + core/classes/cache/FileCache.php | 93 +++ core/classes/cache/MemcachedCache.php | 37 + core/classes/cache/RedisCache.php | 69 ++ core/classes/session/DatabaseSession.php | 138 +++ core/classes/session/DefaultSession.php | 42 + core/classes/session/FilesSession.php | 138 +++ core/classes/session/SessionHandlerInterface.php | 169 ++++ core/cli/cli-cache.php | 65 ++ core/cli/curl-cache.php | 155 ++++ core/cli/info.md | 23 + core/cli/micro/setup.php | 120 +++ core/cli/micro/term_utilities.php | 44 + core/config/anom_settings.php | 325 ++++++++ core/config/constants.php | 28 + core/config/init.php | 64 ++ core/helpers/autoload.php | 43 + core/helpers/design_patterns.php | 104 +++ core/helpers/error_handling.php | 119 +++ 39 files changed, 4858 insertions(+) create mode 100644 core/README.md create mode 100644 core/auth/.gitkeep create mode 100644 core/auth/env.example create mode 100644 core/classes/Benchmark.php create mode 100644 core/classes/Cart.php create mode 100644 core/classes/Database.php create mode 100644 core/classes/Registry.php create mode 100644 core/classes/Render.php create mode 100644 core/classes/Repository.php create mode 100644 core/classes/Request.php create mode 100644 core/classes/Route.php create mode 100644 core/classes/Security.php create mode 100644 core/classes/authentication/Core/PasswordTrait.php create mode 100644 core/classes/authentication/Core/UserManager.php create mode 100644 core/classes/authentication/Core/UserManagerInterface.php create mode 100644 core/classes/authentication/Token/UserToken.php create mode 100644 core/classes/authentication/Token/UserTokenInterface.php create mode 100644 core/classes/authentication/User.php create mode 100644 core/classes/authentication/UserInterface.php create mode 100644 core/classes/authentication/info.md create mode 100644 core/classes/cache/Cache_interface.php create mode 100644 core/classes/cache/FileCache.php create mode 100644 core/classes/cache/MemcachedCache.php create mode 100644 core/classes/cache/RedisCache.php create mode 100644 core/classes/session/DatabaseSession.php create mode 100644 core/classes/session/DefaultSession.php create mode 100644 core/classes/session/FilesSession.php create mode 100644 core/classes/session/SessionHandlerInterface.php create mode 100644 core/cli/cli-cache.php create mode 100755 core/cli/curl-cache.php create mode 100644 core/cli/info.md create mode 100644 core/cli/micro/setup.php create mode 100644 core/cli/micro/term_utilities.php create mode 100644 core/config/anom_settings.php create mode 100644 core/config/constants.php create mode 100644 core/config/init.php create mode 100644 core/helpers/autoload.php create mode 100644 core/helpers/design_patterns.php create mode 100644 core/helpers/error_handling.php (limited to 'core') diff --git a/core/README.md b/core/README.md new file mode 100644 index 0000000..8dee940 --- /dev/null +++ b/core/README.md @@ -0,0 +1,266 @@ +## x-anom +### X is ANOther Mvc + +x-anom is an Object-Oriented MVC php-framework. + +Main advantages of the framework: + +* It is super-light and fast; +* Core has almost zero dependences and contains almost anything you need to start and optimize a server-based web-application. +* It is extensible especialy if you use Composer (which is recommended, though not required) +* Handles security; and as long as you write code using secure practices, it will be secure +* It's easy to configure, easy to code, easy to use + + + +### Requirements + +* PHP 8+ +* Some webserver (Apache/Nginx) +* Some SQL server (MySQL/MariaDB/Postgress) +* Basic knowledge of php and SQL + + + + +### What is included + +Core components: + + +#### Router + +Routes request to the appropriate Controller +- matches static paths +- matches dynamic paths through regex expressions +- takes care of request-method + + +#### Controller and Model + +(just write your Controller and Model classes) + + +#### View (rendering engine) + +Usually you just need to call the render_view(template, data) function. +For templating we use the php short-tag syntax. + +main functions: + +* load_template( template, data) + +* render_view( view_file , data ) + +* load_asset( type, assets_array ) + +* set_headers( content_type, ttl, more_array ) + +* render_text( data, content_type, ttl ) + +* reply_json( data, ttl ) + + +#### Class autoloader + +Composer is recomende; +but if is not available this one will do the job + + +#### Caching + +* File Caching mechanism + +* Redis Cache + +* Memcached Caching + + +#### Session Management + +* DefaultSession: psevdo-handler with passthrough methods + +* FileSession: custom file-based session handler + +* DatabaseSession: database session handler + + + +#### More + +* Proxy design pattern + +* Error handling + +* Repository + +* Cli interface (*summarizes anom*) + + + + + +### Other features + +* Docker ready + +You can run the framework as is in a Docker environment; +Also. you can edit just a bit the configuration files to customize the project +to support various technologies; Check the README file in the project's root +folder to find out more. + + + +### What is not included + +* It lacks a query builder (SQL is easy and very powerful); do not forget to use prepared statements for all your SQL queries. + +* TODO: User-Role based administration class. + +* TODO: Shoping-Cart class. + + + +## Life (and death) of a Client_Request–Server_reply session + +1. THE REQUEST: client makes a request -> request arives to the server -> .htaccess sends the request to the index.php + +2. index loads Configuration (constants.php + config.php) and AUTOLOADER in order load classes easily + +3. index loads init.php -> after initialization the APP is READY -> index loads the routes; Route::run() -> the APP is RUNNING + +4. Router resolves the request pattern and calls a Controller + +5. (if needed) Controller asks data from the Model; then responds a reply to the client using **render** functions -> APP dies + + + +## Direcrtory structure + +NOTE: directory structure needs updata, but the main structure ramains untouched. + + . + |-- container * for docker/container configuration + | |-- bin * scripts + | `-- config * settings + | + |-- core * core code + | |-- auth * authentication and credentials + | | + | |-- config * application parametres + | | |-- config.php + | | |-- constants.php + | | |-- credentials.php + | | `-- init.php + | | + | |-- classes * core classes + | | |-- cacher + | | |-- Benchmark.php + | | |-- Database.php + | | |-- Route.php + | | |-- Security.php + | | `-- Session.php + | | + | `-- helpers * core helpers + | |-- autoload.php + | |-- error-handling.php + | `-- render.php + | + |-- data * folder for batch data-imports to database + | + |-- public ** PUBLIC directory + | |-- app * APP + | | |-- Controllers * Controllers + | | | |-- Art.php + | | | `-- ... + | | | + | | |-- Models * Models + | | | |-- Art_model.php + | | | `-- ... + | | | + | | |-- Views * Views + | | | |-- group.php + | | | `-- item.php + | | | + | | `-- routes.php * application routes + | | + | `-- cache * Caching folder + | + `-- vendor * Vendor classes and autoloader + |-- composer + `-- ... + + + + +## Naming Conventions and good practices + +1. Keep Controllers, Models, Views in their folders + +2. Organize View elements in subfolders + +3. Controller and Model names shall be camelcased; + - fist letter should be Uppercase; + - classes shall be named exactly as their filenames + +4. Model names shall be suffixed with _model + +5. Comment every-single Controller/Model/class and comment every method + +6. On Views (php templates) use php short-tags when possible + - Views are about rendering data; avoid complex-logic + - [if/else], [foreach] and some flag/temp [variables] sould be fair enough + +7. All of the above rules are strongly recommended (although not obligatory); + + + +## Notes and brainstorming + +### for template system check + https://css-tricks.com/php-is-a-ok-for-templating/ + +### for rendering system you may check volt too + https://docs.phalcon.io/4.0/en/volt + + + +## Brainstorming + +* take care of various hacks + chk: https://stackoverflow.com/questions/1996122/how-to-prevent-xss-with-html-php + +* HTML to MarkDown! + chk: https://github.com/thephpleague/html-to-markdown + + + + + +VIEW data + +-> ceo -> title + -> description + -> keywords + -> ... + +-> content -> view : view_filename + -> key : some_variable_name + -> data : the_data + + + + +## Knowledge Requirements + +## Tools of work + +None of the following tools is necessary, but they will help very very-much. + +- Composer + +- Docker + +- Code editor + +- Coffee + Nicotine diff --git a/core/auth/.gitkeep b/core/auth/.gitkeep new file mode 100644 index 0000000..e69de29 diff --git a/core/auth/env.example b/core/auth/env.example new file mode 100644 index 0000000..fd47dd8 --- /dev/null +++ b/core/auth/env.example @@ -0,0 +1,36 @@ +ENVIRONMENT='development' + +# MySQL connection +# --- -- -- - - - +DB_NAME= +DB_USER= +DB_PASS= +PDO_HOST= + +# mailhog +# == testting/fake email service +# --- -- -- - - - +# MAIL_HOST=mailhog_server +# MAIL_PORT=1025 +# MAIL_USERNAME= +# MAIL_PASSWORD= +# MAIL_ENCRYPTION= + +# SMTP setup +# == read mail server +# --- -- -- - - - +MAIL_MAILER=smtp +MAIL_HOST= +MAIL_PORT=465 +MAIL_USERNAME= +MAIL_PASSWORD= +MAIL_ENCRYPTION=ssl +NO_REPLY_EMAIL=noreply@... +REPLY_TO_EMAIL=webmaster@r... +MAIL_FROM_NAME=Classroom + +# redis cache server +# --- -- -- - - - +# REDIS_HOST=redis +# REDIS_PASSWORD= +# REDIS_PORT=6379 \ No newline at end of file diff --git a/core/classes/Benchmark.php b/core/classes/Benchmark.php new file mode 100644 index 0000000..a7e93ea --- /dev/null +++ b/core/classes/Benchmark.php @@ -0,0 +1,150 @@ +'; + $close = '

'; + $divider = ":"; + $prefix = '
'; + $suffix = '
'; + break; + case 'code': + $open = ''; + $close = ''; + $divider = ": "; + $prefix = '
';
+                    $suffix = '
'; + break; + case 'comment': + default: + $open = ''; + $divider = ":"; + $prefix = ''; + $suffix = ''; + break; + } + + echo $prefix; + + // TIME REPORT + // --------------------------------------------------------------------- + echo "\n\n{$open} Timings {$close}"; + + // valid from php 7.3 + // $start = self::$timeSpots[ array_key_first(self::$timespots) ]; + // $end = self::$timeSpots[ array_key_last(self::$timespots) ]; + $start = self::$timeSpots['start']; + $end = self::$timeSpots['end']; + $all_dt = number_format($end - $start , 4)*1000 ." ms"; + + + + // if more than 2 timespots + // echo dt between each spot + if (count(self::$timeSpots) > 2) { + + // calculate dt between spots + $time_results = array(); + $prev_key = ''; + $prev_time = 0; + foreach(self::$timeSpots as $key => $t) { + if (!$prev_time) { + $prev_time = $t; + $prev_key = $key; + } + else { + $dt = number_format($t - $prev_time , 4)*1000 ." ms"; + $time_results[] = array( + 'part' => "{$prev_key}[..{$key}]", ///$key, + 'dt' => $dt + ); + $prev_key = $key; //// "{$prev_key}[..{$key}]"; + $prev_time = $t; + } + } + + // echo timings + foreach ($time_results as $key => $val) { + echo "\n\t{$open} {$val['part']} {$divider} {$val['dt']} {$close}"; + } + } + + // echo total time + echo "\n\t{$open} total {$divider} {$all_dt} {$close}"; + + + // MEMORY REPORT + // --------------------------------------------------------------------- + echo "\n\n{$open} Memory Usage {$close}"; + + if (count(self::$memoryUse) > 2) { + + foreach (self::$memoryUse as $key => $val) { + echo "\n\t{$open} {$key} {$divider} {$val}MB {$close}"; + } + + } else { + echo "\n\t{$open} memory usage {$divider} ". round(memory_get_usage()/(1024*1024),2) ."MB {$close}"; + } + + echo $suffix; + + } + + } +} diff --git a/core/classes/Cart.php b/core/classes/Cart.php new file mode 100644 index 0000000..4e6f585 --- /dev/null +++ b/core/classes/Cart.php @@ -0,0 +1,71 @@ +uid], 10) + // + // oranize in results = [ + // { + // oid, + // prods: [ + // { + // pid, + // prodlabel, + // count + // }, + // ... + // ] + // }, + // ..., + // ] + // + // return $results + + } +} + + + +/* --- +orders: + : id + : uid (user id) + +order_products + : id + : oid (order id) + : pid (product id) + -- */ \ No newline at end of file diff --git a/core/classes/Database.php b/core/classes/Database.php new file mode 100644 index 0000000..8cac479 --- /dev/null +++ b/core/classes/Database.php @@ -0,0 +1,333 @@ +throw_errors = PRODUCTION ? false : true; + + if (null == $this->connection) { + try { + $this->connection = new PDO( + "mysql:" . PDO_HOST . ";" . "dbname=" . DB_NAME, + DB_USER, + DB_PASS, + array( + PDO::MYSQL_ATTR_INIT_COMMAND => "SET NAMES 'utf8'", + PDO::MYSQL_ATTR_LOCAL_INFILE => true + ) + ); + + // handle error reporting + if ($this->throw_errors) { + $this->connection->setAttribute(PDO::ATTR_ERRMODE, PDO::ERRMODE_EXCEPTION); + } + $this->setTimezone(); + + } catch (PDOException $exc) { handle_exception($exc); } + } + # return $this->connection; + } + + + /** disconnect + * CHECK: not sure if needed + */ + public function disconnect() + { + $this->connection = null; + } + + + /** set Timezone + * (Self-explanatory) + */ + public function setTimezone($timezone = DB_TIMEZONE) { + // $this->connection->prepare($timezone)->execute(); + } + + + /** lastInsertID + * returns the ID of last inserted record + */ + public function lastInsertID() + { + return $this->connection->lastInsertId(); + } + + + /** query + * --- + * set and execute a query safely; + * save results as associative array; DO NOT RETURN RESULTS + * + * @param $sql (string): SQL query + * @param $args (array): array of values to bind into SQL + * @param $pypass (boolean): flag to bypass security check + * + * @return $this (database handler) + */ + public function query($sql, $args=[]) + { + try { + + $stmt = $this->connection->prepare($sql); + + if ($args == []) { + $result = $stmt->execute(); + + } else { + $result = $stmt->execute($args); + + } + + $result = $stmt->fetchAll(PDO::FETCH_ASSOC); + + $this->result = $result; + + return $this; + + } catch (PDOException $exc) { handle_exception($exc); } + + } + + + /** getAll + * --- + * return all resulted records + * use it after db->query(); + */ + public function getAll() + { + return ($this->result === null) ? false : $this->result; + } + + + /** getFirst + * --- + * get first row of the resulted query; + * used when one row is expected + * ex. $db->query('SELECT * FROM users WHERE id = :id',['id'=>1])->getFirst(); + */ + public function getFirst() + { + if (($this->result === null) || ($this->result == [])) { + return false; + + } else { return $this->result[0]; } + } + + + /** getOnly + * --- + * return the first column value of the first row + * used when only one value is needed + * ex. $db->query('SELECT Count(id) FROM table',[])->getOnly(); + */ + public function getOnly() + { + if (($this->result === null) || ($this->result == [])) { + return false; + + } else { return array_values($this->result[0])[0]; } + } + + + /** runQuery + * --- (shortcut method) + * execute a query safely; + * return results as associative array + * @param $sql (string): SQL query + * @param $args (array): array of values to bind into SQL + * @param $pypass (boolean): flag to bypass security check + */ + public function runQuery($sql, $args=[]) + { + return $this->query($sql, $args)->getAll(); + } + + + /** runLimitQuery( sql, args, limit=100, offset = null ) + * set LIMIT / OFFSET clauses in a secure way + * @param $sql (string): SQL query + * @param $args (array): array of values to bind into SQL + * @param $limit (int): LIMIT number + * @param $offset (int): OFFSET number + */ + public function runLimitQuery($sql, $args, $limit = 100, $offset = null) + { + $limitStr = $offsetStr = ""; + + // construct LIMIT clause + if (is_int($limit)) { + $limitStr = " LIMIT {$limit}"; + + // construct OFFSET clause (when a LIMIT pre-exists) + if (is_int($offset)) { + $offsetStr =" OFFSET {$offset}"; + } + } + + $sql = $sql . $limitStr . $offsetStr; + + return $this->runQuery($sql, $args); + } + + + /** insert + * @param $table (string): name of table + * @param $values: an associative of (fieldName => value) pairs + * + * example call: + * --- + * $db->insert('products', + * [ + * 'title' => 'My Dark Chocolate 200g', + * 'text' => 'Lorem ipsum dolor sit amet, consectetur adipiscing elit ...', + * 'isFood' => 1, + * 'isToxic' => 0 + * ] + * ); + * + * ...which prepares the SQL query: + * INSERT INTO products (title, text, isFood, isToxic) + * VALUES (:title, :text, :isFood, :isToxic) + * + * ...and injects the values: [ :title => 'My Dark Chocolate 200g' , ... ] + */ + public function insert($table, array $values) + { + $fieldSets = []; + $valueSets = []; + $bindSets = []; + + foreach($values as $key => $val) { + $fieldSets[] = $key; + $valueSets[] =':'. $key; + $bindSets[':'. $key] = $val; + } + + $sql = "INSERT INTO {$table} (". implode(', ', $fieldSets) .") + VALUES (". implode(', ', $valueSets) .")"; + + return $this->runQuery($sql, $bindSets); + } + + + /** update + * @param $table (string): name of table + * @param $values: an associative of (fieldName => value) pairs + * @param $id: an associative of (fieldName => value) index fields + * + * example call: + * --- + * $db->update('products', + * [ 'title' => 'My Chocolate','isFood' => 1 ], + * [ 'id' => 123 ] + * ); + * + * ...which prepares the SQL query: + * UPDATE products SET `title` = :title, `isFood` = :isFood WHERE id = :id + * + * ...and injects: [':title'=> 'My Chocolate' , ':isFood'=> 1 , ':id'=> 123] + */ + public function update( $table, array $values, array $identity) + { + $fieldSets = []; // array of field names + $idSets = []; // array of data-holders + $bindSets = []; // array of data-bindings + + foreach($values as $key => $val) { + $fieldSets[] = "{$key} = :{$key}"; + $bindSets[':'. $key] = $val; + } + + foreach($identity as $key => $val) { + $idSets = "{$key} = :{$key}"; + $bindSets[':'. $key] = $val; + } + + $sql = "UPDATE {$table} SET ". implode(', ', $fieldSets) + ." WHERE ". implode(" AND ", $idSets); + + return $this->runQuery($sql, $bindsArray); + } + + + /** multiInsert( table, fields , values ) + * Construct a multiple-insert clause + * + * @param $table (string): name of table + * @param $fields (array): array with field-names + * @param $values (array): array of value-arrays + * + * example call: + * --- + * $db->multiInsert('order_products', + * [ 'orderID', 'productID', 'unitPrice', 'quantity', 'note' ], + * [ + * [ 124, 102030, 1.25, 5, '' ], + * [ 124, 102040, 10.50, 2, 'some note about product #102040' ], + * [ 124, 102050, 7.20, 3, '' ], + * [ 124, 102060, 3.25, 1, 'some other note' ] + * ] + * ); + */ + public function multiInsert($table, array $fieldsArray, array $valuesArray) + { + if (count($fieldsArray) != count($valuesArray[0])) { + throw new Exception('Fields and value arrays don\'t match.'); + } + + // setup fieldsSet + // ex. "(Title, Price, Status)" + $fieldsSet = ' (`'. implode( + '`, `', // make sure fieldnames are not SQL-bound terms + str_replace('`', '', $fieldsArray) // clean fieldnames + ) .'`) '; + + // setup holders array and bind-values array + // ex. "(:Title1, :Price1, :Status1), (:Title2, :Price2, :Status2), ...", + $holdersArray = []; + $bindsArray = []; + $counter = 1; + foreach($valuesArray as $key => $rowArray) { + $rowHolders = []; + + foreach($itemArray as $key => $val) { + $rowHolders = ':'. $fieldsArray[$key] . $counter; + $bindsArray[ ':'. $fieldsArray[$key] . $counter ] = $val; + } + $holdersArray[] = '('. implode(', ', $rowHolders ) .')'; + $counter++; + } + + $sql = "INSERT INTO {$table}" . $fieldsSet + . ' VALUES '. impload(', ', $holdersArray); + + return $this->runQuery($sql, $bindsArray); + } + +} diff --git a/core/classes/Registry.php b/core/classes/Registry.php new file mode 100644 index 0000000..047fd54 --- /dev/null +++ b/core/classes/Registry.php @@ -0,0 +1,135 @@ +"; + } + + } + + /** parse_sections + * --- + * parse a group of views (sections) + * @param $sections: an array of sections + * + * each section group is an array with view, key and data properties + * + view: defines the view template/file + * + key: the variable name that view uses to parse data OR empty-string* + * * if key is an empty then $data should be an array (which + * includes all [variable-name:data] pairs utilized by the view) + * + data: holds the actual data + */ + + public static function sections($sections) { + + foreach($sections as $sect) { + + if ($sect['key'] == '') { + self::view( $sect['view'], $sect['data'] ); + + } else { + self::view( $sect['view'], [ $sect['key'] => $sect['data']] ); + } + } + } + + + /** render function + * --- + * uses php's short-tag syntax for templating system + * extract data into template + * @param $view: view-template filename + * @param $data: data to embed into view-template + * @param $sanitize: of true then sanitize data. + * important NOTE: data is an array [key => value] + */ + public static function view($view, $data=[], $sanitize = false) { + + $file = VIEWS_DIRECTORY . $view . '.php'; + + if (file_exists($file)) { + if (!defined('OUTPUT_STARTED')) define('OUTPUT_STARTED', 1); + + extract( $sanitize ? self::sanitize_output($data) : $data ); + require( $file ); + + } else if (!PRODUCTION) { + + echo ""; + } + + } + + + /** render asap + * --- + * render_view then output code + * so that client will get html to render + * while server calculates next html + */ + public static function asap($view, $data, $sanitize = false) { + self::view($view, $data, $sanitize); + ob_flush(); + } + + + /** render text + * --- + * This function simply echoes text + * with Content-Type and Cache Headers + * @param $data : the text to echo + * @param $cType : Content-Type header + * @param $ttl : cache-contol headers; if false response is not-cached; else (int) chache for $ttl seconds + */ + public static function text( $data, $contentType = 'text/html; charset=UTF-8', $ttl = false ) { + header('Content-Type: '. $contentType); + if ($ttl) { + $ts = gmdate("D, d M Y H:i:s", time() + $ttl) . " GMT"; + header("Expires: {$ts}"); + header("Pragma: cache"); + header("Cache-Control: max-age={$ttl}"); + + } else { + $ts = gmdate("D, d M Y H:i:s") . " GMT"; + header("Expires: {$ts}"); + header("Last-Modified: {$ts}"); + header("Pragma: no-cache"); + header("Cache-Control: no-cache, must-revalidate"); + } + echo htmlspecialchars($data); + } + + + /** reply_json + * --- + * transform a php-array to json and echo to client + * Can be used for API calls + * + * @param $data : the php array) + * @param $ttl : cache-contol headers; if false response is not-cached; else chache for $ttl seconds + */ + public static function json( $data, $ttl = false ) { + header('Content-Type: application/json'); + if ($ttl) { + $ts = gmdate("D, d M Y H:i:s", time() + $ttl) . " GMT"; + header("Expires: {$ts}"); + header("Pragma: cache"); + header("Cache-Control: max-age={$ttl}"); + + } else { + $ts = gmdate("D, d M Y H:i:s") . " GMT"; + header("Expires: {$ts}"); + header("Last-Modified: {$ts}"); + header("Pragma: no-cache"); + header("Cache-Control: no-cache, must-revalidate"); + } + echo json_encode($data, JSON_UNESCAPED_UNICODE); + + // NOTE: + // after Rendering a JSON ... + // you probably do not need to export anything else; + die(); + } + + + + + // HELPER FUNCTIONS + // ----------------------------------------------------------------------------- + + + /** link asset + * --- + * the function defines the assets (css or js) + * to be loaded on the client (creates the HTML) + * @param $type : type of asset [css|js] + * @param $assetIDs : an array of ('assetID' => 'paramaters') + * + * example calls: + * load_asset('css', ['main' => 'media="all"', 'filters' => 'media="all"']); + * load_asset( 'js', ['jquery' => '', 'lazyloader' => 'async']); + */ + public static function asset( $type, $assetIDs, $paramatres = '' ) { + + $code = ""; // code to return + + // make sure $assetIDs is array (for coding simplicity) + if (!is_array($assetIDs)) { + $assetIDs = [ $assetIDs ]; + } + + // check asset type and construct all asset inserts + switch ($type) { + + case 'font': + foreach($assetIDs as $asset) { + $code .= "\n\t"; + } + break; + + case 'js': + foreach($assetIDs as $asset) { + $code .= "\n\t"; + } + break; + + case 'css': + default: + foreach($assetIDs as $asset) { + $code .= "\n\t"; + } + } + + echo $code; + } + + + /** sanitize_output (recursive) + * --- + * Sanitizes data that are about to rendered + * (usually when render_view() is called). + * + * NOTE: + * mitigates XSS attachs + * + * @param $data: (array) + */ + public static function sanitize_output($data) { + //// check https://stackoverflow.com/questions/2002710/php-how-to-perform-htmlspecialchar-on-an-array-of-arrays + + //// $output = array_map("myFunc", $data); + + global $secure; + + $output = array(); + foreach($data as $key => $val) { + + if (is_string($val)) { + $output[$key] = htmlspecialchars(self::remove_invisible_characters($val)); + + } else if (is_array($val)) { + $output[$key] = self::sanitize_output($val); + + } else { + $output[$key] = $val; + } + } + return $output; + } + + + /** remove_invisible_characters() + * --- + * @used by sanitize_output() + */ + public static function remove_invisible_characters($str, $url_encoded = TRUE) + { + $non_displayables = array(); + + // every control character except newline (dec 10), + // carriage return (dec 13) and horizontal tab (dec 09) + if ($url_encoded) { + $non_displayables[] = '/%0[0-8bcef]/i'; // url encoded 00-08, 11, 12, 14, 15 + $non_displayables[] = '/%1[0-9a-f]/i'; // url encoded 16-31 + $non_displayables[] = '/%7f/i'; // url encoded 127 + } + + $non_displayables[] = '/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]+/S'; // 00-08, 11, 12, 14-31, 127 + + do { + $str = preg_replace($non_displayables, '', $str, -1, $count); + } while ($count); + + return $str; + } + + + /** html + * --- + * outputs code as html + * + * @param $str (string) + * @return html5 (string) + */ + public static function html($str) { + if (!isset($str) || $str== null) return; + if (($str == '') || is_numeric($str)) return $str; + return htmlspecialchars_decode($str, ENT_QUOTES|ENT_HTML5); + } + + + /** set_headers + * --- + * set custom response-Headers + * + * @param $contentType + * @param $ttl: int or false) + * @param $more: array of (content-type => content-value) pairs + */ + public static function set_headers($contentType = 'text/html; charset=UTF-8', $ttl = false, $more = [] ) { + + // handle common content-type shorcuts + switch ($contentType) { + case 'text': + case 'html': + $contentType = 'text/html; charset=UTF-8'; + break; + case 'json': + $contentType = 'application/json; charset=utf-8'; + break; + case 'js': + $contentType = 'application/javascript; charset=utf-8'; + break; + case 'css': + $contentType = 'text/css'; + break; + default: + // $contentType stays as-is + break; + } + + // send headers + header('Content-Type: '. $contentType); + if ($ttl) { + $ts = gmdate("D, d M Y H:i:s", time() + $ttl) . " GMT"; + header("Expires: {$ts}"); + header("Pragma: cache"); + header("Cache-Control: max-age={$ttl}"); + + } else { + $ts = gmdate("D, d M Y H:i:s") . " GMT"; + header("Expires: {$ts}"); + header("Last-Modified: {$ts}"); + header("Pragma: no-cache"); + header("Cache-Control: no-cache, must-revalidate"); + } + + // send more headers + if ($more != []) { + foreach($more as $header => $value) { + header($header .': '. $value); + } + } + + } + + + /** render file + * + */ + public static function file($path, $madia_type) + { + $content = file_get_contents($path); + header("Content-Type: {$media_type}"); + echo $content; + } + + +} \ No newline at end of file diff --git a/core/classes/Repository.php b/core/classes/Repository.php new file mode 100644 index 0000000..c01d0c1 --- /dev/null +++ b/core/classes/Repository.php @@ -0,0 +1,43 @@ +URL = $_SERVER['REQUEST_URI']; + $this->PATH = (!empty($parsed['path'])) ? urldecode($parsed['path']) : ''; + $this->QUERY = (!empty($parsed['query'])) ? urldecode($parsed['query']) : false; + $this->HOST = $_SERVER['HTTP_HOST']; + $this->PORT = $_SERVER['SERVER_PORT']; + $this->TIME = $_SERVER['REQUEST_TIME']; + $this->IP = $_SERVER['REMOTE_ADDR']; + + $this->METHOD = strtolower($_SERVER['REQUEST_METHOD']); + + $this->GET = $_GET; // $_GET should only used + // to request data or specify options (never to perform + // system-changes) thus should not need any validation; + // * If (for any reason) you requide $_GET sanitization + // enable it later on the method's code + + $this->FILES = $_FILES; // TODO: sanitize the files array + + // $this->INTERFACE = php_sapi_name(); + + $this->AGENT = $_SERVER['HTTP_USER_AGENT'] ?? 'unknown'; + $this->SIGNATURE = sha1( + $_SERVER['HTTP_USER_AGENT'] ?? 'unknown' + . $_SERVER['HTTP_ACCEPT'] ?? '' + . $_SERVER['HTTP_ACCEPT_LANGUAGE'] ?? '' + . $_SERVER['HTTP_ACCEPT_ENCODING'] ?? '' + ); + + // sanitize user input + // if (isset($_GET)) { $this->GET = $this->sanitize($_GET); } + $this->GET = $this->sanitize($_GET); + if (isset($_POST)) { $this->POST = $this->sanitize($_POST); } + if (isset($_COOKIE)) { $this->COOKIE = $this->sanitize($_COOKIE); } + + // check anti-CSRF token if needed + // (again, GET requests should not need CSRF cheking) + if (in_array($this->METHOD, ['post', 'put', 'patch', 'delete'])) { + // TODO: only if CSRF protection enabled... + $this->checkCsrfToken(); + } + + } + + + /** + * Check: + * + * 1. + * https://dev.to/anastasionico/good-practices-how-to-sanitize-validate-and-escape-in-php-3-methods-139b + * + * 2. + * https://benhoyt.com/writings/dont-sanitize-do-escape/ + * + */ + private function sanitize($array) + { + // TODO: + // ... + return $array; + } + + + public function checkCsrfToken() + { + // TODO: + // ... + // if SCRF-token is not valideted, serve 403 + return true; + } + + + + + public function isAjax(): bool + { + // check headers 'XMLHttpRequest' == $this->headers->get('X-Requested-With'); + } + + + public function isSecure(): bool + { + // chech if HTTPS + } + + + public function hasSession(): bool + { + // chech if Session exist + } + + + /** + * Get the user making the request. + * + * @param string|null $guard + * @return mixed + */ + public function user($guard = null) + { + // return call_user_func($this->getUserResolver(), $guard); + } + + public function getUserResolver() + { + // return $this->userResolver ?: function () { + // + // }; + } + + /** + * Set the user resolver callback. + * + * @param \Closure $callback + * @return $this + */ + public function setUserResolver(Closure $callback) + { + // $this->userResolver = $callback; + // return $this; + } + + + +} + diff --git a/core/classes/Route.php b/core/classes/Route.php new file mode 100644 index 0000000..072723c --- /dev/null +++ b/core/classes/Route.php @@ -0,0 +1,97 @@ + $expression, + 'function' => $function, + 'method' => strtolower($method) + )); + } + + + /** notFound($function) + * --- + * @param $function : call back function to be executed + */ + public static function notFound($function) + { + self::$notFound = $function; + } + + + /** run() + * --- + * Parse request ; Find mathing route ; + * then call route's function + * usualy a Controller::method([poarametres]) + */ + public static function run(Request $request) + { + // $request = Registry::get('REQUEST'); + $path = $request->PATH; // request path + $method = $request->METHOD; // request method + + $path_match_found = false; + $route_match_found = false; + + foreach(self::$routes as $route) { + + // If method matched check the path + if ($route['method'] == $method || $method == 'any') { + + // Add 'find string start' automatically + $route['expression'] = '^'.$route['expression']; + + // Add 'find string end' automatically + $route['expression'] = $route['expression'].'$'; + + // Check path match + if (preg_match('#'. $route['expression'] .'#', $path, $matches)) { + + $route_match_found = true; + + array_shift($matches); // Always remove first element. This contains the whole string + + call_user_func_array($route['function'], $matches); + break; // Do not check other routes + + } + } + } + + // No matching route was found + if (!$route_match_found) { + header("HTTP/1.0 404 Not Found"); + if (self::$notFound) { + call_user_func_array(self::$notFound, []); + } + } + + } + +} diff --git a/core/classes/Security.php b/core/classes/Security.php new file mode 100644 index 0000000..61979db --- /dev/null +++ b/core/classes/Security.php @@ -0,0 +1,923 @@ +', '<', '>', + "'", '"', '&', '$', '#', + '{', '}', '[', ']', '=', + ';', '?', '%20', '%22', + '%3c', // < + '%253c', // < + '%3e', // > + '%0e', // > + '%28', // ( + '%29', // ) + '%2528', // ( + '%26', // & + '%24', // $ + '%3f', // ? + '%3b', // ; + '%3d' // = + ); + + public $charset = 'UTF-8'; // Character set @var (string) Will be overridden by the constructor. + + protected $_xss_hash; // XSS Hash: @var (string) Random Hash for protecting URLs. + + protected $_csrf_hash; // CSRF Hash: @var (string) Random hash for Cross Site Request Forgery protection cookie + + // CSRF Expire time @var (int) + // Expiration time for Cross Site Request Forgery protection cookie. + protected $_csrf_expire = 7200; // defaults to 2hours (=7200 seconds) + + // CSRF Token name: @var (string) Token name for Cross Site Request Forgery protection cookie. + protected $_csrf_token_name = 'pi_csrf_token'; + + // CSRF Cookie name: @var (string) Cookie name for Cross Site Request Forgery protection cookie. + protected $_csrf_cookie_name = 'pi_csrf_token'; + + // List of never allowed strings @var (array) + protected $_never_allowed_str = array( + 'document.cookie' => '[removed]', + '(document).cookie' => '[removed]', + 'document.write' => '[removed]', + '(document).write' => '[removed]', + '.parentNode' => '[removed]', + '.innerHTML' => '[removed]', + '-moz-binding' => '[removed]', + '' => '-->', + ' '<![CDATA[', + '' => '<comment>', + '<%' => '<%' + ); + + // List of never allowed regex replacements @var (array) + protected $_never_allowed_regex = array( + 'javascript\s*:', + '(\(?document\)?|\(?window\)?(\.document)?)\.(location|on\w*)', + 'expression\s*(\(|&\#40;)', // CSS and IE + 'vbscript\s*:', // IE, surprise! + 'wscript\s*:', // IE + 'jscript\s*:', // IE + 'vbs\s*:', // IE + 'Redirect\s+30\d', + "([\"'])?data\s*:[^\\1]*?base64[^\\1]*?,[^\\1]*?\\1?" + ); + + + /** Class constructor + * --- + * @return void + */ + public function __construct($charset = 'UTF-8') + { + $this->charset = $charset; + + /* --- + // Is CSRF protection enabled? + if (CSRF_PROTCTION') && ! is_cli()) + { --*/ + /************** + // CSRF config + foreach (array('csrf_expire', 'csrf_token_name', 'csrf_cookie_name') as $key) + { + //// if (NULL !== ($val = config_item($key))) + //// { + $this->{'_'.$key} = $val; + //// } + } + + // Append application specific cookie prefix + //// if ($cookie_prefix = config_item('cookie_prefix')) + //// { + $this->_csrf_cookie_name = $cookie_prefix . $this->_csrf_cookie_name; + //// } + + // Set the CSRF hash + $this->_csrf_set_hash(); + $this->csrf_verify(); + ***************/ + /* --- + } --*/ + + //// log_message('info', 'Security Class Initialized'); + } + + + /** CSRF Verify + * --- + * @return Security + */ + public function csrf_verify() + { + // If it's not a POST request we will set the CSRF cookie + if (strtoupper($_SERVER['REQUEST_METHOD']) !== 'POST') + { + return $this->csrf_set_cookie(); + } + + /// // Check if URI has been whitelisted from CSRF checks + /// if ($exclude_uris = config_item('csrf_exclude_uris')) + /// { + /// $uri = load_class('URI', 'core'); + /// foreach ($exclude_uris as $excluded) + /// { + /// if (preg_match('#^'.$excluded.'$#i'.(UTF8_ENABLED ? 'u' : ''), $uri->uri_string())) + /// { + /// return $this; + /// } + /// } + /// } + + // Check CSRF token validity, but don't error on mismatch just yet - we'll want to regenerate + $valid = isset($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]) + && is_string($_POST[$this->_csrf_token_name]) && is_string($_COOKIE[$this->_csrf_cookie_name]) + && hash_equals($_POST[$this->_csrf_token_name], $_COOKIE[$this->_csrf_cookie_name]); + + // We kill this since we're done and we don't want to pollute the _POST array + unset($_POST[$this->_csrf_token_name]); + + // Regenerate on every submission? + if (config_item('csrf_regenerate')) + { + // Nothing should last forever + unset($_COOKIE[$this->_csrf_cookie_name]); + $this->_csrf_hash = NULL; + } + + $this->_csrf_set_hash(); + $this->csrf_set_cookie(); + + if ($valid !== TRUE) + { + $this->csrf_show_error(); + } + + log_message('info', 'CSRF token verified'); + return $this; + } + + + /** CSRF Set Cookie + * --- + * @codeCoverageIgnore + * @return Security + */ + public function csrf_set_cookie() + { + $expire = time() + $this->_csrf_expire; + $secure_cookie = (bool) config_item('cookie_secure'); + + if ($secure_cookie && ! is_https()) + { + return FALSE; + } + + // php7.3+ + setcookie( + $this->_csrf_cookie_name, + $this->_csrf_hash, + array( + 'expires' => $expire, + 'path' => config_item('cookie_path'), + 'domain' => config_item('cookie_domain'), + 'secure' => $secure_cookie, + 'httponly' => config_item('cookie_httponly'), + 'samesite' => 'Strict' + ) + ); + + log_message('info', 'CSRF cookie sent'); + + return $this; + } + + + /** Show CSRF Error + * -- + * @return void + */ + public function csrf_show_error() + { + show_error('The action you have requested is not allowed.', 403); + } + + + /** Get CSRF Hash + * --- + * @see CI_Security::$_csrf_hash + * @return string CSRF hash + */ + public function get_csrf_hash() + { + return $this->_csrf_hash; + } + + + /** Get CSRF Token Name + * --- + * @see CI_Security::$_csrf_token_name + * @return string CSRF token name + */ + public function get_csrf_token_name() + { + return $this->_csrf_token_name; + } + + + /** XSS Clean + * --- + * Sanitizes data so that Cross Site Scripting Hacks can be + * prevented. This method does a fair amount of work but + * it is extremely thorough, designed to prevent even the + * most obscure XSS attempts. Nothing is ever 100% foolproof, + * of course, but I haven't been able to get anything passed + * the filter. + * + * Note: Should only be used to deal with data upon submission. + * It's not something that should be used for general + * runtime processing. + * + * @link http://channel.bitflux.ch/wiki/XSS_Prevention + * Based in part on some code and ideas from Bitflux. + * + * @link http://ha.ckers.org/xss.html + * To help develop this script I used this great list of + * vulnerabilities along with a few other hacks I've + * harvested from examining vulnerabilities in other programs. + * + * @param string|string[] $str Input data + * @param bool $is_image Whether the input is an image + * @return string + */ + public function xss_clean($str, $is_image = FALSE) + { + // Is the string an array? + if (is_array($str)) + { + foreach ($str as $key => &$value) + { + $str[$key] = $this->xss_clean($value); + } + + return $str; + } + + // Remove Invisible Characters + $str = remove_invisible_characters($str); + + // URL Decode + // Just in case stuff like this is submitted: + // Google + // NOTE: Use rawurldecode() so it does not remove plus signs + if (stripos($str, '%') !== false) + { + do + { + $oldstr = $str; + $str = rawurldecode($str); + $str = preg_replace_callback('#%(?:\s*[0-9a-f]){2,}#i', array($this, '_urldecodespaces'), $str); + } + while ($oldstr !== $str); + unset($oldstr); + } + + // Convert character entities to ASCII + // --- + // This permits our tests below to work reliably. + // We only convert entities that are within tags since + // these are the ones that will pose security problems. + $str = preg_replace_callback("/[^a-z0-9>]+[a-z0-9]+=([\'\"]).*?\\1/si", array($this, '_convert_attribute'), $str); + $str = preg_replace_callback('/<\w+.*/si', array($this, '_decode_entity'), $str); + + // Remove Invisible Characters Again! + $str = remove_invisible_characters($str); + + + // Convert all tabs to spaces + // --- + // This prevents strings like this: ja vascript + // NOTE: we deal with spaces between characters later. + // NOTE: preg_replace was found to be amazingly slow here on + // large blocks of data, so we use str_replace. + $str = str_replace("\t", ' ', $str); + + // Capture converted string for later comparison + $converted_string = $str; + + // Remove Strings that are never allowed + $str = $this->_do_never_allowed($str); + + + // Makes PHP tags safe + // NOTE: XML tags are inadvertently replaced too: + // '), array('<?', '?>'), $str); + } + + // Compact any exploded words + // --- + // This corrects words like: j a v a s c r i p t + // These words are compacted back to their correct state. + $words = array( + 'javascript', 'expression', 'vbscript', 'jscript', 'wscript', + 'vbs', 'script', 'base64', 'applet', 'alert', 'document', + 'write', 'cookie', 'window', 'confirm', 'prompt', 'eval' + ); + + foreach ($words as $word) + { + $word = implode('\s*', str_split($word)).'\s*'; + + // We only want to do this when it is followed by a non-word character + // That way valid stuff like "dealer to" does not become "dealerto" + $str = preg_replace_callback('#('.substr($word, 0, -3).')(\W)#is', array($this, '_compact_exploded_words'), $str); + } + + + // Remove disallowed Javascript in links or img tags + // We used to do some version comparisons and use of stripos(), + // but it is dog slow compared to these simplified non-capturing + // preg_match(), especially if the pattern exists in the string + // + // Note: It was reported that not only space characters, but all in + // the following pattern can be parsed as separators between a tag name + // and its attributes: [\d\s"\'`;,\/\=\(\x00\x0B\x09\x0C] + // ... however, remove_invisible_characters() above already strips the + // hex-encoded ones, so we'll skip them below. + do + { + $original = $str; + + if (preg_match('/]+([^>]*?)(?:>|$)#si', array($this, '_js_link_removal'), $str); + } + + if (preg_match('/]*?)(?:\s?/?>|$)#si', array($this, '_js_img_removal'), $str); + } + + if (preg_match('/script|xss/i', $str)) + { + $str = preg_replace('##si', '[removed]', $str); + } + } + while ($original !== $str); + unset($original); + + + // Sanitize naughty HTML elements + // --- + // If a tag containing any of the words in the list + // below is found, the tag gets converted to entities. + // So this: + // Becomes: <blink> + $pattern = '#' + .'<((?/*\s*)((?[a-z0-9]+)(?=[^a-z0-9]|$)|.+)' // tag start and name, followed by a non-tag character + .'[^\s\042\047a-z0-9>/=]*' // a valid attribute character immediately after the tag would count as a separator + // optional attributes + .'(?(?:[\s\042\047/=]*' // non-attribute characters, excluding > (tag close) for obvious reasons + .'[^\s\042\047>/=]+' // attribute characters + // optional attribute-value + .'(?:\s*=' // attribute-value separator + .'(?:[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*))' // single, double or non-quoted value + .')?' // end optional attribute-value group + .')*)' // end optional attributes group + .'[^>]*)(?\>)?#isS'; + + // Note: It would be nice to optimize this for speed, BUT + // only matching the naughty elements here results in + // false positives and in turn - vulnerabilities! + do + { + $old_str = $str; + $str = preg_replace_callback($pattern, array($this, '_sanitize_naughty_html'), $str); + } + while ($old_str !== $str); + unset($old_str); + + // Sanitize naughty scripting elements + // --- + // Similar to above, only instead of looking for + // tags it looks for PHP and JavaScript commands + // that are disallowed. Rather than removing the + // code, it simply converts the parenthesis to entities + // rendering the code un-executable. + // * For example: eval('some code') + // ... Becomes: eval('some code') + $str = preg_replace( + '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)\((.*?)\)#si', + '\\1\\2(\\3)', + $str + ); + + // Same thing, but for "tag functions" (e.g. eval`some code`) + // See https://github.com/bcit-ci/CodeIgniter/issues/5420 + $str = preg_replace( + '#(alert|prompt|confirm|cmd|passthru|eval|exec|expression|system|fopen|fsockopen|file|file_get_contents|readfile|unlink)(\s*)`(.*?)`#si', + '\\1\\2`\\3`', + $str + ); + + // Final clean up + // This adds a bit of extra precaution in case + // something got through the above filters + $str = $this->_do_never_allowed($str); + + // Images are Handled in a Special Way + // - Essentially, we want to know that after all of the character + // conversion is done whether any unwanted, likely XSS, code was found. + // If not, we return TRUE, as the image is clean. + // However, if the string post-conversion does not matched the + // string post-removal of XSS, then it fails, as there was unwanted XSS + // code found and removed/changed during processing. + if ($is_image === TRUE) + { + return ($str === $converted_string); + } + + return $str; + } + + + /** XSS Hash + * --- + * Generates the XSS hash if needed and returns it. + * @see CI_Security::$_xss_hash + * @return string XSS hash + */ + public function xss_hash() + { + if ($this->_xss_hash === NULL) + { + $rand = $this->get_random_bytes(16); + $this->_xss_hash = ($rand === FALSE) + ? md5(uniqid(mt_rand(), TRUE)) + : bin2hex($rand); + } + + return $this->_xss_hash; + } + + + /** Get random bytes + * --- + * @param int $length Output length + * @return string + */ + public function get_random_bytes($length) + { + if (empty($length) OR ! ctype_digit((string) $length)) + { + return FALSE; + } + + if (function_exists('random_bytes')) + { + try + { + // The cast is required to avoid TypeError + return random_bytes((int) $length); + } + catch (Exception $e) + { + // If random_bytes() can't do the job, we can't either ... + // There's no point in using fallbacks. + log_message('error', $e->getMessage()); + return FALSE; + } + } + + // Unfortunately, none of the following PRNGs is guaranteed to exist ... + if (defined('MCRYPT_DEV_URANDOM') && ($output = mcrypt_create_iv($length, MCRYPT_DEV_URANDOM)) !== FALSE) + { + return $output; + } + + if (is_readable('/dev/urandom') && ($fp = fopen('/dev/urandom', 'rb')) !== FALSE) + { + // Try not to waste entropy ... + stream_set_chunk_size($fp, $length); + $output = fread($fp, $length); + fclose($fp); + if ($output !== FALSE) + { + return $output; + } + } + + if (function_exists('openssl_random_pseudo_bytes')) + { + return openssl_random_pseudo_bytes($length); + } + + return FALSE; + } + + + /** HTML Entities Decode + * --- + * A replacement for html_entity_decode() + * + * The reason we are not using html_entity_decode() by itself is because + * while it is not technically correct to leave out the semicolon + * at the end of an entity most browsers will still interpret the entity + * correctly. html_entity_decode() does not convert entities without + * semicolons, so we are left with our own little solution here. Bummer. + * + * @link https://secure.php.net/html-entity-decode + * + * @param string $str Input + * @param string $charset Character set + * @return string + */ + public function entity_decode($str, $charset = NULL) + { + if (strpos($str, '&') === FALSE) + { + return $str; + } + + static $_entities; + + isset($charset) OR $charset = $this->charset; + isset($_entities) OR $_entities = array_map('strtolower', get_html_translation_table(HTML_ENTITIES, ENT_COMPAT | ENT_HTML5, $charset)); + + do + { + $str_compare = $str; + + // Decode standard entities, avoiding false positives + if (preg_match_all('/&[a-z]{2,}(?![a-z;])/i', $str, $matches)) + { + $replace = array(); + $matches = array_unique(array_map('strtolower', $matches[0])); + foreach ($matches as &$match) + { + if (($char = array_search($match.';', $_entities, TRUE)) !== FALSE) + { + $replace[$match] = $char; + } + } + + $str = str_replace(array_keys($replace), array_values($replace), $str); + } + + // Decode numeric & UTF16 two byte entities + $str = html_entity_decode( + preg_replace('/(&#(?:x0*[0-9a-f]{2,5}(?![0-9a-f;])|(?:0*\d{2,4}(?![0-9;]))))/iS', '$1;', $str), + ENT_COMPAT | ENT_HTML5, + $charset + ); + } + while ($str_compare !== $str); + return $str; + } + + + /** Sanitize Filename + * --- + * @param string $str Input file name + * @param bool $relative_path Whether to preserve paths + * @return string + */ + public function sanitize_filename($str, $relative_path = FALSE) + { + $bad = $this->filename_bad_chars; + + if ( ! $relative_path) + { + $bad[] = './'; + $bad[] = '/'; + } + + $str = remove_invisible_characters($str, FALSE); + + do + { + $old = $str; + $str = str_replace($bad, '', $str); + } + while ($old !== $str); + + return stripslashes($str); + } + + + /** Strip Image Tags + * --- + * @param string $str + * @return string + */ + public function strip_image_tags($str) + { + return preg_replace( + array( + '##i', + '#`]+)).*?\>#i' + ), + '\\2', + $str + ); + } + + + /** URL-decode taking spaces into account + * --- + * @see https://github.com/bcit-ci/CodeIgniter/issues/4877 + * @param array $matches + * @return string + */ + protected function _urldecodespaces($matches) + { + $input = $matches[0]; + $nospaces = preg_replace('#\s+#', '', $input); + return ($nospaces === $input) + ? $input + : rawurldecode($nospaces); + } + + + /** Compact Exploded Words + * --- + * Callback method for xss_clean() to remove whitespace from + * things like 'j a v a s c r i p t'. + * + * @used-by Security::xss_clean() + * @param array $matches + * @return string + */ + protected function _compact_exploded_words($matches) + { + return preg_replace('/\s+/s', '', $matches[1]).$matches[2]; + } + + + /** Sanitize Naughty HTML + * --- + * Callback method for xss_clean() to remove naughty HTML elements. + * @used-by Security::xss_clean() + * @param array $matches + * @return string + */ + protected function _sanitize_naughty_html($matches) + { + static $naughty_tags = array( + 'alert', 'area', 'prompt', 'confirm', 'applet', 'audio', 'basefont', 'base', 'behavior', 'bgsound', + 'blink', 'body', 'embed', 'expression', 'form', 'frameset', 'frame', 'head', 'html', 'ilayer', + 'iframe', 'input', 'button', 'select', 'isindex', 'layer', 'link', 'meta', 'keygen', 'object', + 'plaintext', 'style', 'script', 'textarea', 'title', 'math', 'video', 'svg', 'xml', 'xss' + ); + + static $evil_attributes = array( + 'on\w+', 'style', 'xmlns', 'formaction', 'form', 'xlink:href', 'FSCommand', 'seekSegmentTime' + ); + + // First, escape unclosed tags + if (empty($matches['closeTag'])) + { + return '<'.$matches[1]; + } + // Is the element that we caught naughty? If so, escape it + elseif (in_array(strtolower($matches['tagName']), $naughty_tags, TRUE)) + { + return '<'.$matches[1].'>'; + } + // For other tags, see if their attributes are "evil" and strip those + elseif (isset($matches['attributes'])) + { + // We'll store the already filtered attributes here + $attributes = array(); + + // Attribute-catching pattern + $attributes_pattern = '#' + .'(?[^\s\042\047>/=]+)' // attribute characters + // optional attribute-value + .'(?:\s*=(?[^\s\042\047=><`]+|\s*\042[^\042]*\042|\s*\047[^\047]*\047|\s*(?U:[^\s\042\047=><`]*)))' // attribute-value separator + .'#i'; + + // Blacklist pattern for evil attribute names + $is_evil_pattern = '#^('.implode('|', $evil_attributes).')$#i'; + + // Each iteration filters a single attribute + do + { + // Strip any non-alpha characters that may precede an attribute. + // Browsers often parse these incorrectly and that has been a + // of numerous XSS issues we've had. + $matches['attributes'] = preg_replace('#^[^a-z]+#i', '', $matches['attributes']); + + if ( ! preg_match($attributes_pattern, $matches['attributes'], $attribute, PREG_OFFSET_CAPTURE)) + { + // No (valid) attribute found? Discard everything else inside the tag + break; + } + + if ( + // Is it indeed an "evil" attribute? + preg_match($is_evil_pattern, $attribute['name'][0]) + // Or does it have an equals sign, but no value and not quoted? Strip that too! + OR (trim($attribute['value'][0]) === '') + ) + { + $attributes[] = 'xss=removed'; + } + else + { + $attributes[] = $attribute[0][0]; + } + + $matches['attributes'] = substr($matches['attributes'], $attribute[0][1] + strlen($attribute[0][0])); + } + while ($matches['attributes'] !== ''); + + $attributes = empty($attributes) + ? '' + : ' '.implode(' ', $attributes); + return '<'.$matches['slash'].$matches['tagName'].$attributes.'>'; + } + + return $matches[0]; + } + + + /** JS Link Removal + * --- + * Callback method for xss_clean() to sanitize links. + * + * This limits the PCRE backtracks, making it more performance friendly + * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in + * PHP 5.2+ on link-heavy strings. + * + * @used-by CI_Security::xss_clean() + * @param array $match + * @return string + */ + protected function _js_link_removal($match) + { + return str_replace( + $match[1], + preg_replace( + '#href=.*?(?:(?:alert|prompt|confirm)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|_filter_attributes($match[1]) + ), + $match[0] + ); + } + + + /** JS Image Removal + * --- + * Callback method for xss_clean() to sanitize image tags. + * + * This limits the PCRE backtracks, making it more performance friendly + * and prevents PREG_BACKTRACK_LIMIT_ERROR from being triggered in + * PHP 5.2+ on image tag heavy strings. + * + * @used-by Security::xss_clean() + * @param array $match + * @return string + */ + protected function _js_img_removal($match) + { + return str_replace( + $match[1], + preg_replace( + '#src=.*?(?:(?:alert|prompt|confirm|eval)(?:\(|&\#40;|`|&\#96;)|javascript:|livescript:|mocha:|charset=|window\.|\(?document\)?\.|\.cookie|_filter_attributes($match[1]) + ), + $match[0] + ); + } + + + /** Attribute Conversion + * --- + * @used-by CI_Security::xss_clean() + * @param array $match + * @return string + */ + protected function _convert_attribute($match) + { + return str_replace(array('>', '<', '\\'), array('>', '<', '\\\\'), $match[0]); + } + + + /** Filter Attributes + * --- + * Filters tag attributes for consistency and safety. + * @used-by CI_Security::_js_img_removal() + * @used-by CI_Security::_js_link_removal() + * @param string $str + * @return string + */ + protected function _filter_attributes($str) + { + $out = ''; + if (preg_match_all('#\s*[a-z\-]+\s*=\s*(\042|\047)([^\\1]*?)\\1#is', $str, $matches)) + { + foreach ($matches[0] as $match) + { + $out .= preg_replace('#/\*.*?\*/#s', '', $match); + } + } + + return $out; + } + + + /** HTML Entity Decode Callback + * --- + * @used-by CI_Security::xss_clean() + * @param array $match + * @return string + */ + protected function _decode_entity($match) + { + // Protect GET variables in URLs + // 901119URL5918AMP18930PROTECT8198 + $match = preg_replace('|\&([a-z\_0-9\-]+)\=([a-z\_0-9\-/]+)|i', $this->xss_hash().'\\1=\\2', $match[0]); + + // Decode, then un-protect URL GET vars + return str_replace( + $this->xss_hash(), + '&', + $this->entity_decode($match, $this->charset) + ); + } + + + /** Do Never Allowed + * --- + * @used-by CI_Security::xss_clean() + * @param string + * @return string + */ + protected function _do_never_allowed($str) + { + $str = str_replace(array_keys($this->_never_allowed_str), $this->_never_allowed_str, $str); + + foreach ($this->_never_allowed_regex as $regex) + { + $str = preg_replace('#'.$regex.'#is', '[removed]', $str); + } + + return $str; + } + + + /** Set CSRF Hash and Cookie + * --- + * @return string + */ + protected function _csrf_set_hash() + { + if ($this->_csrf_hash === NULL) + { + // If the cookie exists we will use its value. + // We don't necessarily want to regenerate it with + // each page load since a page could contain embedded + // sub-pages causing this feature to fail + if (isset($_COOKIE[$this->_csrf_cookie_name]) && is_string($_COOKIE[$this->_csrf_cookie_name]) + && preg_match('#^[0-9a-f]{32}$#iS', $_COOKIE[$this->_csrf_cookie_name]) === 1) + { + return $this->_csrf_hash = $_COOKIE[$this->_csrf_cookie_name]; + } + + $rand = $this->get_random_bytes(16); + $this->_csrf_hash = ($rand === FALSE) + ? md5(uniqid(mt_rand(), TRUE)) + : bin2hex($rand); + } + + return $this->_csrf_hash; + } +} diff --git a/core/classes/authentication/Core/PasswordTrait.php b/core/classes/authentication/Core/PasswordTrait.php new file mode 100644 index 0000000..40a7381 --- /dev/null +++ b/core/classes/authentication/Core/PasswordTrait.php @@ -0,0 +1,38 @@ + $this->cost]); + } + + + public function isPasswordValid(UserInterface $user, string $plainPassword): bool + { + return password_verify($plainPassword, $user->getPassword()); + } + + + public function setCost(int $cost): void + { + if ($cost < 4 || $cost > 31) { + throw new \InvalidArgumentException('Cost must be in the range of 4-31.'); + } + $this->cost = $cost; + } +} diff --git a/core/classes/authentication/Core/UserManager.php b/core/classes/authentication/Core/UserManager.php new file mode 100644 index 0000000..54cd2cb --- /dev/null +++ b/core/classes/authentication/Core/UserManager.php @@ -0,0 +1,101 @@ +hasUserToken()) { + $userToken = unserialize($_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY]); + } + + return $userToken; + } + + + /** hasUserToken() + * == is user loged in + * + */ + public function hasUserToken(): bool + { + $key = UserTokenInterface::DEFAULT_PREFIX_KEY; + return (array_key_exists($key, $_SESSION) && unserialize($_SESSION[$key]) !== false); + } + + + /** isGranted + * + * checks if user is granded some role(s) + * from the array of roles that are passed + * + * ex. $token->isGranted(['editor', 'designer']) ... + * returns true if the user is editor or designer (or both) + * + */ + public function isGranted(array $roles): bool + { + // if (!is_null($userToken = $this->getUserToken())) { + if (is_null($userToken = $this->getUserToken())) { + return false; + } + + if ($userToken->getUser() instanceof UserInterface) { + return (!empty(array_intersect($roles, $userToken->getUser()->getRoles()))); + } + + return false; + } + + + /** createUserToken() + * == serializes user and stores it into session + * so $_SESSION[DEFAULT_PREFIX_KEY] has the serialized representaion of user + */ + public function createUserToken(UserInterface $user): UserTokenInterface + { + $userToken = new UserToken($user); + $_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY] = $userToken->serialize(); + + return $userToken; + } + + + /** logout + * == clear session + * + */ + public function logout(): void + { + if ($this->hasUserToken()) { + unset($_SESSION[UserTokenInterface::DEFAULT_PREFIX_KEY]); + } + } + +} diff --git a/core/classes/authentication/Core/UserManagerInterface.php b/core/classes/authentication/Core/UserManagerInterface.php new file mode 100644 index 0000000..05110fb --- /dev/null +++ b/core/classes/authentication/Core/UserManagerInterface.php @@ -0,0 +1,25 @@ +user = $user; + } + + + /** getUser + * + */ + public function getUser(): UserInterface + { + return $this->user; + } + + + /** serialize() + * + * serializes the user structure (with user's property values) + * ... then it will be saved into session[DEFAULT_PREFIX_KEY] + * + */ + public function serialize(): string + { + return serialize($this); + } +} diff --git a/core/classes/authentication/Token/UserTokenInterface.php b/core/classes/authentication/Token/UserTokenInterface.php new file mode 100644 index 0000000..8e8b642 --- /dev/null +++ b/core/classes/authentication/Token/UserTokenInterface.php @@ -0,0 +1,18 @@ +userName; + } + + /** getPassword + * @return null|string + */ + public function getPassword(): ?string + { + return $this->password; + } + + /** getRoles + * @return array + */ + public function getRoles(): array + { + return $this->roles; + } + + /** isEnabled + * @return bool + */ + public function isEnabled(): bool + { + return $this->enabled; + } + + + /** SETs + * ------------------------------------------------------------------------- + */ + + /** setUserName() + * + * @param string $userName + * @return User + */ + public function setUserName(string $userName): self + { + $this->userName = $userName; + return $this; + } + + /** setPassword() + * + * @param string $password + * @return User + */ + public function setPassword(string $password): self + { + $this->password = $password; + return $this; + } + + /** setRoles() + * + * @param array $roles + * @return User + */ + public function setRoles(array $roles): self + { + $this->roles = $roles; + return $this; + } + + + /** setEnabled + * + * @param bool $enabled + * @return User + */ + public function setEnabled(bool $enabled): self + { + $this->enabled = $enabled; + return $this; + } +} diff --git a/core/classes/authentication/UserInterface.php b/core/classes/authentication/UserInterface.php new file mode 100644 index 0000000..b035215 --- /dev/null +++ b/core/classes/authentication/UserInterface.php @@ -0,0 +1,19 @@ +cryptPassword($req->POST['password']); + + $user = (new User()) + ->setUserName($req->POST['username']) + ->setPassword($password) + ->setRoles(['ROLE_USER']); + + $userManager->createUserToken($user); + + // check Token in Session + var_dump($userManager->getUserToken()); + // object(DevCoder\Authentication\Token\UserToken)[4] + // private 'user' => + // object(DevCoder\Authentication\User)[5] + // private 'userName' => string 'username' (length=8) + // private 'password' => string '$2y$10$iWdcmebmikUFlgKMqW7/rOmUp1DjFAuWKqdUHBhL08FZ7LL6bwRey' (length=60) + // private 'roles' => + // array (size=1) + // 0 => string 'ROLE_USER' (length=9) + // private 'enabled' => boolean true + + +## Connected or not + + hasUserToken()) { + // connected + + $token = $userManager->getUserToken(); + $user = $token->getUser(); + var_dump($user); + // object(DevCoder\Authentication\User)[5] + // private 'userName' => string 'username' (length=8) + // private 'password' => string '$2y$10$OBobeLhdvdiftuedlv1a6e4.qF6sCG/usq5WEV4E3uB.UiS1egv/m' (length=60) + // private 'roles' => + // array (size=1) + // 0 => string 'ROLE_USER' (length=9) + // private 'enabled' => boolean true + + } else { + // not connected + } + + +## Access management + + $userManager = new UserManager(); + if ($userManager->isGranted(['ROLE_ADMIN'])) { + //is admin + // return Response 200 + }else { + //is not admin + // return Response 403 + } + + Logout + + $userManager = new UserManager(); + $userManager->logout(); + + +## Login + + prepare("SELECT * FROM users WHERE username=?"); + $stmt->execute([$_POST['username']]); + $userFromDataBase = $stmt->fetch(); + /** + * Hydration + */ + $user = (new \Test\DevCoder\Authentication\User()) + ->setUserName($userFromDataBase['username']) + ->setPassword($userFromDataBase['password']) + ->setRoles(json_decode($userFromDataBase['roles'])) + ->setEnabled($userFromDataBase['active']); + + $userManager = new UserManager(); + if ($userManager->isPasswordValid($user, $_POST['password'])) { + + // login OK, set Token in session + $userManager->createUserToken($user); + + } else { + // login failed , return error + } diff --git a/core/classes/cache/Cache_interface.php b/core/classes/cache/Cache_interface.php new file mode 100644 index 0000000..7c49789 --- /dev/null +++ b/core/classes/cache/Cache_interface.php @@ -0,0 +1,34 @@ + $data[0]) { + + // Unlinking + unlink($filename); + return false; + + } + + return $data[1]; + } + + + public function flush(int $olderThan = 0) + { + return false; // reply false until implementation + } + +} diff --git a/core/classes/cache/MemcachedCache.php b/core/classes/cache/MemcachedCache.php new file mode 100644 index 0000000..c89d86a --- /dev/null +++ b/core/classes/cache/MemcachedCache.php @@ -0,0 +1,37 @@ +addServer(\MEMCACHE_HOST, 11211); + + $mc->set($hashkey, $data, $ttl); + } + + + public function get($key) + { + $hashkey = md5($key); + + $mc = new Memcached(); + $mc->addServer(\MEMCACHE_HOST, 11211); + + return $mc->get($hashkey); + + } + + public function flush($olderThan = 0) + { + return false; + } + +} \ No newline at end of file diff --git a/core/classes/cache/RedisCache.php b/core/classes/cache/RedisCache.php new file mode 100644 index 0000000..ec50f08 --- /dev/null +++ b/core/classes/cache/RedisCache.php @@ -0,0 +1,69 @@ + \REDIS_HOST + ]); + return $redis->set($key, $serialized, 'EX', $ttl); + + } catch (Exception $e) { + // ... + } + } + + + /** get + * fetch previously stored $data under label $key + * return $data (or false) + */ + public function get($key) + { + + try { + + $redis = new \Predis\Client([ + 'host' => \REDIS_HOST + ]); + + if ($redis->exists($key)) { + return unserialize($redis->get($key)); + + } else { + return false; + } + + } catch (Exception $e) { + // ... + } + + } + + + /** flush + * --- not umplemented yet; may not needed + */ + public function flush($olderThan = 0) + { + return false; // until implementation + } + +} \ No newline at end of file diff --git a/core/classes/session/DatabaseSession.php b/core/classes/session/DatabaseSession.php new file mode 100644 index 0000000..aa31b62 --- /dev/null +++ b/core/classes/session/DatabaseSession.php @@ -0,0 +1,138 @@ +db = Registry::use('database'); + + // Set handler to overide SESSION + session_set_save_handler( + array($this, "open"), + array($this, "close"), + array($this, "read"), + array($this, "write"), + array($this, "destroy"), + array($this, "gc") + ); + + // Start the session + session_name(SESSION_NAME); + session_start(); + } + + // public function open(string $path, string $name) : bool + // NOTE: $path and $name are unsued + public function open() : bool + { + if ($this->db) { + return true; + } + else { + // database connection may be closed from another class + // (ex. from some user class); in this case... + // create a new database connection, then recheck. + $conn = new Database(); + // $this->db = $conn->connect(); + + if ($conn) { + $this->db = $conn; + return true; + } + } + return false; + } + + + public function close() : bool + { + // depricated: the database object is shared (don;t clode it!) + // // Close the database connection + // if ($this->db = null) { return true; } + // else return false; + + return true; + } + + + public function read(string $id) : string|false + { + $exist = $this->db->runQuery( + "SELECT data FROM sessions WHERE id = :id", + [':id', $id] + ); + + if (($exist === false) || (count($exist) == 0)) { + return false; + + } else { + $data = $exist[0]; + } + + if (is_null($row['data'])) { + return ''; + } + return $row['data']; + } + + + public function write(string $id, string $data) : bool + { + // Create timestamp + $access = time(); + $check = $this->db->runQuery( + "REPLACE INTO sessions VALUES (:id, :access, :data)", + [':id' => $id, ':access' => $access, ':data' => $data ] + ); + return ($check == false) ? false : true; + } + + + public function destroy(string $sassionID) : bool + { + $check = $this->db->runQuery( + 'DELETE FROM sessions WHERE id = :id', + [':id' => $sassionID] + ); + return ($check == false) ? false : true; + } + + + public function gc(int $max) + { + // Calculate what is to be deemed old + $old = time() - $max; + $check = $this->db->runQuery( + 'DELETE FROM sessions WHERE access < :old', + [':old' => $old] + ); + return ($check == false) ? false : 1; + // check garbage-collector probability to run + // echo "probability: ". ini_get("session.gc_probability") ." / ". ini_get("session.gc_divisor") . ", ttl: ". ini_get("session.gc_maxlifetime"); die(); + + } + + # callable $create_sid = ?, + # callable $validate_sid = ?, + # callable $update_timestamp = ? +} diff --git a/core/classes/session/DefaultSession.php b/core/classes/session/DefaultSession.php new file mode 100644 index 0000000..079ab9d --- /dev/null +++ b/core/classes/session/DefaultSession.php @@ -0,0 +1,42 @@ +sessionName = SESSION_NAME; + $this->sess_filename = FILESESSION_PATH; + $this->minutes = $minutes; + + // Set handler to overide SESSION + session_set_save_handler( + array($this, "open"), + array($this, "close"), + array($this, "read"), + array($this, "write"), + array($this, "destroy"), + array($this, "gc") + ); + + // Start the session + session_name($this->sessionName); + session_start(); + } + + /** open + * set filename; + * no need to touch the filesystem yet + * return true (always) + */ + public function open($savePath, $sessionName): bool + { + $this->sess_filename = $this->$path .'/'. $sessionName; + return true; + } + + /** close + * nothing needs to be closed; + * return true (always) + */ + public function close(): bool + { + return true; + } + + /** read + * chech if file exists; if not return false + * read data + */ + public function read($sessionId): string|false + { + if (!file_exists($filename) || !is_readable($filename)) return false; + $data = file_get_contents($filename); + + return @unserialize($data); + } + + /** write + * data serielized already by php's internal session engine + */ + public function write($sessionId, $data): bool + { + $h = fopen($filename, 'w'); + if (fwrite($h, serialize($data)) === false) { + throw new Exception('Could not write session data'); + return false; + } + fclose($h); + + return true; + } + + /** + * {@inheritdoc} + * + * @return bool + */ + public function destroy($sassionID): bool + { + unlink($this->sassionID); + + return true; + } + + /** + * {@inheritdoc} + * + * @return int + */ + public function gc($lifetime) : int + { + $files = Finder::create() + ->in($this->path) + ->files() + ->ignoreDotFiles(true) + ->date('<= now - '. $lifetime .' seconds'); + + $deletedSessions = 0; + + foreach ($files as $file) { + $this->files->delete($file->getRealPath()); + $deletedSessions++; + } + + return $deletedSessions; + } +} diff --git a/core/classes/session/SessionHandlerInterface.php b/core/classes/session/SessionHandlerInterface.php new file mode 100644 index 0000000..cf6efac --- /dev/null +++ b/core/classes/session/SessionHandlerInterface.php @@ -0,0 +1,169 @@ + someone visits website through server A + * -> server A creates a new session-id for the visitor and a shared-session-id + * -> saves both into database + * + * later... + * + * #2 + * -> the same device is connected (via loadbalancer) into server B + * -> server B don't have the session-id (send by the client) but gets it from db + * (is session-id do not exist on the db, then this is a new session) + * + * = now both server A and B have the same session-id localy + * + * later... + * + * #3 + * -> some server (let's say B) regenerates the visitors session-id + * -> if later the visitor falls into server A, the A will retrieve the new + * session id through the #2 scenario + * + * this way + * + any server can update/regenerate the visitor's session-id + * + the visitor can be served from both servers randomly + * + all session variables exist on the database (always) + * + all session variables exist on all servers synced-on-demand + * + * + * stucture of session: + * --- + * - shared-session-id: (secret + persistent); exposed between servers **primary + * - session-id: (may change/regenerate/update); exposed to the client **indexed + * - data: serialized array + * - creation_timestamp: + * - last_touched_timestamp: + * - expiration_timestamp: should point to the future or session has expired + * - csrf_token: + * - JWT_token + * - AES-key (this way private data can be kept in browser) + * + * + * what will kept on browser/client (via cookie) + * --- + * - session-name => session-id + * - user info => AES_ectypted(serialized[t=>csfr_token, u=> user_id, s=>SIGNATURE]) + * + * + * Writable file-system shall change + * (local writable file-system tree) + * --- + * /html/storage + * | + * |-- cache : query-caches + * | + * `-- session : FS\sessions + * | + * `-- indexes : share-session-id indexes + * + * + * + * NOTE: Session life-cycle + * + * session_start() * firsts time + * --- + * ::open(path,PHPSESSID) -> (session_id not exist) -> false + * ::create_sid -> '123def' + * ::read('123def') ?-or/and- ::close() + * + * + * session_start() * next times + * --- + * ::open(path, PHPSESSID) -> (session_id exist) -> true + * ::read('123def') -> return data -> will fill $_SESSION[*] + * + * + * $_SESSION['foo'] = 'bar'; + * --- + * ::write('123def', 'foo|s:3:"bar";') -> ['foo' => "bar"] + * ::close() + * + * + * session_regenerate_id(); + * --- + * ::create_sid() -> def123 + * + * + * session_reset() + * --- + * ::open() + * ::read('def123') + * + * + * session_write_close() + * --- + * ::write('123def', 'foo|s:3:"bar";') + * ::close() + * + * + * session_destroy() + * --- + * ::destroy('def123') + * ::close() + * + */ diff --git a/core/cli/cli-cache.php b/core/cli/cli-cache.php new file mode 100644 index 0000000..57d8090 --- /dev/null +++ b/core/cli/cli-cache.php @@ -0,0 +1,65 @@ +#!/usr/local/bin/php + $category) { + + echo textColor( textWidth($category['Title'], 72), NORMAL); + app\controllers\cli\CliContoller::cacheCategoryByUrl($category['FullFriendlyUrl']); + } + + # end of script ------------------------------------------------------------ + +} catch(Exception $e) { // Basic error handling + echo 'Caught exception: ', textColor($e->getMessage(), ERROR), "\n"; + die(); +} + + +$dt = number_format( microtime(true) - $t0 , 0) ."sec"; + +// echo ending... +echo textColor("\nOperation Completed {$dt}\n\n", NORMAL); diff --git a/core/cli/curl-cache.php b/core/cli/curl-cache.php new file mode 100755 index 0000000..6ab2e93 --- /dev/null +++ b/core/cli/curl-cache.php @@ -0,0 +1,155 @@ +#!/usr/local/bin/php +success) { + echo "\033[91mError reading " . $call ."\n\033[39m"; + return false; + } + + return $json; +} + +/** multiple curl get calls + * + * @param $array: an array of urls to be called + * + */ +function multiCurl($array) { + + $multiCurl = array(); // array of curl handlers + $result = array(); // data to be returned + $mh = curl_multi_init(); // multi handler + $module = array(); // array of module names / 1:1 to $result array + + foreach ($array as $i => $category) { + $module[$i] = $category->ID; // guid (module name) + $fetchURL = API_ROOT .'url/'. $category->FullFriendlyUrl; + $multiCurl[$i] = curl_init(); + curl_setopt($multiCurl[$i], CURLOPT_URL,$fetchURL); + curl_setopt($multiCurl[$i], CURLOPT_HEADER,0); + curl_setopt($multiCurl[$i], CURLOPT_RETURNTRANSFER,1); + curl_multi_add_handle($mh, $multiCurl[$i]); + } + + $index=null; + + do { + curl_multi_exec($mh,$index); + } while($index > 0); + + foreach($multiCurl as $k => $ch) { + $result[$k] = curl_multi_getcontent($ch); + curl_multi_remove_handle($mh, $ch); + } + curl_multi_close($mh); // close multi-curl +} + +// force printing string with specified length +function forceLen($str, $len = 72) { + $space = " "; + for($i = 0 ; $i<$len ; $i++) $space .= "."; + return mb_substr($str.$space, 0, $len-1) ." "; +} + + +/** main procedure + * ----------------------------------------------------------------------------- + */ + +echo "\033[39mReading Tree of product categories...\n"; +$tree = singleCurl('tree'); // ask for categories tree + +if ($tree !==false) echo "\033[32mCategories tree is cached\033[39m\n\n"; + +$categories = singleCurl('category'); + +// request every category to create cache if not exist +// send requests in small batches to avoid enormous server-stress +echo "\033[39mRequesting re-Cache for every category\033[39m\n"; +echo "\033[33mPlease Wait...\n\n"; + +$buffer = []; // buffer array +$counter = 0; // counter to track items in buffer +foreach($categories->result as $category) { + + echo "\033[39m". forceLen($category->Title) ."\033[33m"."Sent.\n\033[39m"; + + $counter++; + + // try several batch lengths to establish the ideal one that produces + // results in a smooth quite fase rthm, without stressing the server; + // so that visitors can navigate the production site white the script + // is running; + // for my testing this number is 3-5. I set the cou 3 items give fast results without stressing the server + // so "if ($counter > 2) { ... " is the smoothest option + if ($counter > 2) { + multiCurl($buffer); + $counter = 0; + $buffer = []; + } + + $buffer[] = $category; + +} + +multiCurl($buffer); // run once more for the last non-filled buffer + +$dt = number_format( microtime(true) - $t0 , 1) ."sec"; + +// echo ending... +echo "\n\033[32mOperation Completed \033[39m({$dt})\n\n"; +echo "\033[39m"; // back to default color; + + +// check +// http://www.idein.it/joomla/14-docker-php-apache-with-crontab +?> \ No newline at end of file diff --git a/core/cli/info.md b/core/cli/info.md new file mode 100644 index 0000000..39f8c11 --- /dev/null +++ b/core/cli/info.md @@ -0,0 +1,23 @@ +# cli + +This section is used to setup an anom micro-framework for the cli-interface. +The cli interface is commonly used to support and optimize the whole app. + +A cli script may run manualy, for example using... + + php cli-cache.php + +although... + +it is recommended to run periodically using the cron service: + + 15 * * * * php path/to/cli-cache.php + +or ... + +when a docker instanse of the project fires up; for example including +the following line of code inside the docker/bin/docker-entrypoint.sh +(runs the script after 5 minutes delay to make sure that the instance +is up and running) + + at -f /var/www/core/cli/refresh-cache.php -t now +5 minutes diff --git a/core/cli/micro/setup.php b/core/cli/micro/setup.php new file mode 100644 index 0000000..ca2fd40 --- /dev/null +++ b/core/cli/micro/setup.php @@ -0,0 +1,120 @@ +getMessage(), "\n" +# } \ No newline at end of file diff --git a/core/cli/micro/term_utilities.php b/core/cli/micro/term_utilities.php new file mode 100644 index 0000000..971c36e --- /dev/null +++ b/core/cli/micro/term_utilities.php @@ -0,0 +1,44 @@ + 'text/html; charset=UTF-8', + 'html' => 'text/html; charset=UTF-8', + 'json' => 'application/json; charset=utf-8', + 'js' => 'application/javascript; charset=utf-8', + 'css' => 'text/css', + 'png' => 'image/png', + 'jpeg' => 'image/jpeg', + 'webp' => 'image/web' + ) +); + + +// PROXY_FLAGS +// ----------------------------------------------------------------------------- +// These options represend altered/non-default behaviour +// and will be resolved bitwise, so use powers of 2 +// ----------------------------------------------------------------------------- +define('PROXY_CACHE_ERRORS', 1); // cache result even if error +define('PROXY_IGNORE_CACHE', 2); // ignore cache if exist +define('PROXY_DO_NOT_CACHE', 4); // do not cache result diff --git a/core/config/init.php b/core/config/init.php new file mode 100644 index 0000000..589a486 --- /dev/null +++ b/core/config/init.php @@ -0,0 +1,64 @@ + $basePath) { + + $file = APP_ROOT . $basePath . $classPath .'.php'; + + // if class-file exist, include it + if (file_exists($file)) { + require_once $file; + break; + } + + } + + // // Feel free to extend the fanctionality + // // example: + // // custom (exception) namespaced classes loader + // $customNSclasses = array( + // '\\George\\Class' => 'path/to/George/Class', + // '\\Mary\\Class' => 'path/to/Marias/Class', + // ... + // ); + // if array_key_exists($className) { + // require_once $customNSclasses[$className]; + // } + } +); diff --git a/core/helpers/design_patterns.php b/core/helpers/design_patterns.php new file mode 100644 index 0000000..d66ffa9 --- /dev/null +++ b/core/helpers/design_patterns.php @@ -0,0 +1,104 @@ +get($key); + + } else { $data = false; } // ignore cache? pass false + + + if ($data !== false) { // if exists, serve cached data + + // if cashed data exist + // --------------------------------------------------------------------- + # if (!PRODUCTION) Benchmark::add_spot('proxy-cached'); + if ($data == '_ERROR_') return false; // previous cached error + else return $data; // previous cache () + + + } else { // else (not exist)... + + // no data on cache -> get data from Class::method( arguments ) + // --------------------------------------------------------------------- + $data = call_user_func_array($callable, $args); + + // handle newly created data + // --------------------------------------------------------------------- + + // if faulty data, return false + if ($data == false) { + + if ($cache_errors && !$do_not_cache) { // cache the error + $cache->set($key, '_ERROR_', $ttl); + } + + # if (!PRODUCTION) Benchmark::add_spot('proxy-new-error'); + return false; + } + + // store to cache + if (!$do_not_cache) { + $cache->set($key, $data, $ttl); + } + + # if (!PRODUCTION) Benchmark::add_spot('proxy-new'); + return $data; // serve data + } + +} diff --git a/core/helpers/error_handling.php b/core/helpers/error_handling.php new file mode 100644 index 0000000..95db98c --- /dev/null +++ b/core/helpers/error_handling.php @@ -0,0 +1,119 @@ +getMessage() + . " on file '". $e->getFile() . "' at line {$e->getLine()}"; + + $anom_ERRORS[] = $message; // store the error +} + + +/** + * Catch fatal error work-around + * (set_error_handler not working on fatal errors). + */ +function on_shutdown_check_for_fatal() +{ + global $anom_ERRORS; + + $error = error_get_last(); + + if ($error != null) { // ignore 'normal' system shutdowns [exit|die]() + + if ( $error["type"] == E_ERROR ) { // get as much error-info + handle_error( + $error["type"] ?? -1, + $error["message"] ?? 'unknown error', + $error["file"] ?? 'unknown file', + $error["line"] ?? -1 + ); + } + } + + if (($anom_ERRORS != [])) { + + // TODO: + // Implemetnig the design/layout of the error-messages + // output should not be an error's-handling task, thus + // shall be assigned to the Rendes/View level; + // Same about the log service channels + + // TODO: + // FORWARD ERRORS into LOG-SYSTEM + // ex. into some file... + // file_put_contents("logs/thowable.log", $message_template .PHP_EOL, FILE_APPEND); + // or ...some other channer (Email, Slack, Database etc). + // Channes can be decided according to error severity; + // a file-system error loggin for backup is recommended + // partitioniong of errors onto file-system can be useful + + // TODO: + // 1st: Log Errors + // 2nd: Show Errors + + if (PRODUCTION) { + if (!defined('OUTPUT_STARTED')) { + // throw a prety-error message + Render::view('error/general', ['message' => 'Please forgive me, I know not what I do']); + } + + } else { + + if (!defined('OUTPUT_STARTED')) { + // no template loaded; render erros in general-error template + Render::view('error/general', ['message' => implode("
And:
", $anom_ERRORS)]); + + } else { + echo '
+ Errors:
'. implode("
And:
", $anom_ERRORS) .'
'; + } + } + } +} + + +// register callback on shutdown +register_shutdown_function( "on_shutdown_check_for_fatal" ); + +// register custom error handler callback +set_error_handler( "handle_error" ); + +// set custom exception handler function +set_exception_handler( "handle_exception" ); + +// send errors to stderr (instead of stdout) +ini_set( "display_errors", "off" ); + +// thow out all errors +error_reporting( E_ALL ); + -- cgit v1.2.3