1
|
|
|
<?php |
2
|
|
|
require_once($this->store->get_config('code').'modules/mod_pinp.phtml'); |
3
|
|
|
|
4
|
|
|
class util { |
5
|
|
|
function getFileFromFTP($url, $fileName) { |
6
|
|
|
$context = pobject::getContext(); |
7
|
|
|
$me = $context["arCurrentObject"]; |
8
|
|
|
require_once($me->store->get_config("code")."modules/mod_mimemagic.php"); |
9
|
|
|
if (!$filename) { |
|
|
|
|
10
|
|
|
$filename = basename($url); |
|
|
|
|
11
|
|
|
} |
12
|
|
|
|
13
|
|
|
$result = false; |
14
|
|
|
preg_match('|([^:]+):([^@]+)@([^/]+).*$|i', $url,$matches); |
15
|
|
|
|
16
|
|
|
$file_artemp =tempnam($me->store->get_config("files")."temp","upload"); |
17
|
|
|
|
18
|
|
|
$ftpId = ftp_connect($matches[3]); |
19
|
|
|
ftp_login($ftpId, $matches[1], $matches[2]); |
20
|
|
|
ftp_get($ftpId, $file_artemp, $fileName, FTP_BINARY); |
21
|
|
|
|
22
|
|
|
readfile($file_artemp); |
23
|
|
|
|
24
|
|
|
return $result; |
25
|
|
|
} |
26
|
|
|
|
27
|
|
View Code Duplication |
function path_unescape($path) { |
28
|
|
|
$result = ""; |
29
|
|
|
if ($path) { |
30
|
|
|
debug("path_unescape: escaped path: $path"); |
31
|
|
|
$result = preg_replace_callback( |
32
|
|
|
'/(_[0-9a-fA-F][0-9a-fA-F]|__)/', |
33
|
|
|
function( $matches ) { |
34
|
|
|
// Two types of escaped characters can be here, the |
35
|
|
|
// underscore or other characters. Check for the |
36
|
|
|
// underscore first. |
37
|
|
|
|
38
|
|
|
$char = $matches[0]; |
39
|
|
|
if ($char[1] == "_") { |
40
|
|
|
// It is the underscore, return it as a character. |
41
|
|
|
return "_"; |
42
|
|
|
} |
43
|
|
|
|
44
|
|
|
// Assume it is an escaped character here. Find the |
45
|
|
|
// numbers in hex, turn them back to decimal, get |
46
|
|
|
// the corresponding character and return it. |
47
|
|
|
|
48
|
|
|
return chr(hexdec(substr($char, 1, 2))); |
49
|
|
|
}, |
50
|
|
|
$path |
51
|
|
|
); |
52
|
|
|
} |
53
|
|
|
debug("path_unescape: unescaped path: $result"); |
54
|
|
|
return $result; |
55
|
|
|
} |
56
|
|
|
|
57
|
|
|
|
58
|
|
View Code Duplication |
function path_escape($path) { |
59
|
|
|
// This function will return an escaped path. All the characters not supported by Ariadne will be encoded. |
60
|
|
|
// See also path_escape_callback |
61
|
|
|
|
62
|
|
|
// Returns an empty string if no path, or an empty path was given. |
63
|
|
|
$result = ""; |
64
|
|
|
if ($path) { |
65
|
|
|
debug("path_escape:files unescaped path: $path"); |
66
|
|
|
$result = preg_replace_callback( |
67
|
|
|
'/[^\/A-Za-z0-9.-]/', |
68
|
|
|
function ( $char ) { |
69
|
|
|
// Replaces characters in the path with their number. |
70
|
|
|
// Quite similar to " " -> "%20" for HTML escape, but we use _ instead of % |
71
|
|
|
// This function is to be used as a callback for preg_replace_callback |
72
|
|
|
if ($char[0]) { |
73
|
|
|
if ($char[0]=="_") { |
74
|
|
|
return "__"; |
75
|
|
|
} else { |
76
|
|
|
return "_".dechex(ord($char[0])); |
77
|
|
|
} |
78
|
|
|
} |
79
|
|
|
}, |
80
|
|
|
$path |
81
|
|
|
); |
82
|
|
|
} |
83
|
|
|
debug("path_escaspe:files escaped path: $result"); |
84
|
|
|
return $result; |
85
|
|
|
} |
86
|
|
|
} |
87
|
|
|
|
88
|
|
|
class pinp_util extends util { |
89
|
|
|
|
90
|
|
|
function is_callback($callback) { |
91
|
|
|
// lambda functions do begin with a null character |
92
|
|
|
// maybe there is a better check, but this will do it for now |
93
|
|
|
$result = ($callback[0] === "\000" && substr($callback, 1, strlen('lambda_')) == 'lambda_'); |
94
|
|
|
return $result; |
95
|
|
|
} |
96
|
|
|
|
97
|
|
|
|
98
|
|
|
function _create_function($args, $code) { |
99
|
|
|
global $AR; |
100
|
|
|
$pinp = new pinp($AR->PINP_Functions, 'var_', '$AR_this->_'); |
101
|
|
|
$safe_args = $pinp->compileFuncCallArgs("$args", "funcCallArgs"); |
102
|
|
|
$pinp = new pinp($AR->PINP_Functions, 'var_', '$AR_this->_'); |
103
|
|
|
$safe_code = substr($pinp->compile("<pinp>$code</pinp>"), 5, -2); |
104
|
|
|
return create_function($safe_args, $safe_code); |
105
|
|
|
} |
106
|
|
|
|
107
|
|
|
function _call_function($callback) { |
108
|
|
|
$args = array_slice(func_get_args(), 1); |
109
|
|
|
$context = pobject::getContext(); |
110
|
|
|
$me = $context["arCurrentObject"]; |
111
|
|
|
$result = null; |
112
|
|
|
if (pinp_util::is_callback($callback)) { |
113
|
|
|
$result = call_user_func_array($callback, $args); |
114
|
|
|
} else { |
115
|
|
|
$me->error = "'$callback' is not a callback function"; |
116
|
|
|
} |
117
|
|
|
return $result; |
118
|
|
|
} |
119
|
|
|
|
120
|
|
View Code Duplication |
function _preg_replace_callback($regExp,$callback,$haystack) { |
121
|
|
|
$context = pobject::getContext(); |
122
|
|
|
$me = $context["arCurrentObject"]; |
123
|
|
|
$result = false; |
124
|
|
|
if (pinp_util::is_callback($callback)) { |
125
|
|
|
$result = preg_replace_callback($regExp, $callback,$haystack); |
126
|
|
|
} else { |
127
|
|
|
$me->error = "'$callback' is not a valid callback function"; |
128
|
|
|
} |
129
|
|
|
return $result; |
130
|
|
|
} |
131
|
|
|
|
132
|
|
|
|
133
|
|
View Code Duplication |
function _usort(&$array, $callback) { |
134
|
|
|
$context = pobject::getContext(); |
135
|
|
|
$me = $context["arCurrentObject"]; |
136
|
|
|
$result = false; |
137
|
|
|
if (pinp_util::is_callback($callback)) { |
138
|
|
|
$result = usort($array, $callback); |
139
|
|
|
} else { |
140
|
|
|
$me->error = "'$callback' is not a valid callback function"; |
141
|
|
|
} |
142
|
|
|
return $result; |
143
|
|
|
} |
144
|
|
|
|
145
|
|
View Code Duplication |
function _uasort(&$array, $callback) { |
146
|
|
|
$context = pobject::getContext(); |
147
|
|
|
$me = $context["arCurrentObject"]; |
148
|
|
|
$result = false; |
149
|
|
|
if (pinp_util::is_callback($callback)) { |
150
|
|
|
$result = uasort($array, $callback); |
151
|
|
|
} else { |
152
|
|
|
$me->error = "'$callback' is not a valid callback function"; |
153
|
|
|
} |
154
|
|
|
return $result; |
155
|
|
|
} |
156
|
|
|
|
157
|
|
|
function _path_escape($path) { |
158
|
|
|
return parent::path_escape($path); |
159
|
|
|
} |
160
|
|
|
|
161
|
|
|
function _path_unescape($path) { |
162
|
|
|
return parent::path_unescape($path); |
163
|
|
|
} |
164
|
|
|
|
165
|
|
|
function _getFileFromFTP($url, $fileName) { |
166
|
|
|
return parent::getFileFromFTP($url, $fileName); |
167
|
|
|
} |
168
|
|
|
|
169
|
|
|
} |
170
|
|
|
|
This error can happen if you refactor code and forget to move the variable initialization.
Let’s take a look at a simple example:
The above code is perfectly fine. Now imagine that we re-order the statements:
In that case,
$x
would be read before it is initialized. This was a very basic example, however the principle is the same for the found issue.