Nickbur / Sunrise-CMS

administration/controller/extension/installer.php

<?php

/* 	Divine CMS - Open source CMS for widespread use.
    Copyright (c) 2019 Mykola Burakov (burakov.work@gmail.com)

    See SOURCE.txt for other and additional information.

    This file is part of Divine CMS.

    This program is free software: you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
    the Free Software Foundation, either version 3 of the License, or
    (at your option) any later version.

    This program is distributed in the hope that it will be useful,
    but WITHOUT ANY WARRANTY; without even the implied warranty of
    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
    GNU General Public License for more details.

    You should have received a copy of the GNU General Public License
    along with this program. If not, see <http://www.gnu.org/licenses/>. */

class ControllerExtensionInstaller extends \Divine\Engine\Core\Controller

PSR1 recommends that each class must be in a namespace of at least one level to avoid collisions.

{
    public function index()

Expected 2 blank lines before function; 0 found

    {
        $this->load->language('extension/installer');

        $this->document->setTitle($this->language->get('heading_title'));

        $data['breadcrumbs'] = array();

$data was never initialized. Although not strictly required by PHP, it is generally a good practice to add $data = array(); before regardless.

        $data['breadcrumbs'][] = array(
            'text' => $this->language->get('text_home'),
            'href' => $this->url->link('common/dashboard', 'token=' . $this->session->data['token'], true)
        );

        $data['breadcrumbs'][] = array(
            'text' => $this->language->get('heading_title'),
            'href' => $this->url->link('extension/installer', 'token=' . $this->session->data['token'], true)
        );





        $data['heading_title'] = $this->language->get('heading_title');

        $data['text_upload'] = $this->language->get('text_upload');
        $data['text_loading'] = $this->language->get('text_loading');

        $data['entry_upload'] = $this->language->get('entry_upload');
        $data['entry_overwrite'] = $this->language->get('entry_overwrite');
        $data['entry_progress'] = $this->language->get('entry_progress');

        $data['help_upload'] = $this->language->get('help_upload');

        $data['button_upload'] = $this->language->get('button_upload');
        $data['button_clear'] = $this->language->get('button_clear');
        $data['button_continue'] = $this->language->get('button_continue');




        $data['token'] = $this->session->data['token'];

        $directories = glob($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . 'temp-*', GLOB_ONLYDIR);

        if ($directories) {
            $data['error_warning'] = $this->language->get('error_temporary');
        } else {
            $data['error_warning'] = '';
        }



        $data['header'] = $this->load->controller('common/header');
        $data['column'] = $this->load->controller('common/column_left');
        $data['footer'] = $this->load->controller('common/footer');

        $this->response->setOutput($this->load->view('extension/installer', $data));
    }

    public function upload()
    {
        $this->load->language('extension/installer');

        $json = array();

        // Check user has permission
        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        if (!$json) {
            if (!empty($this->request->files['file']['name'])) {
                if (substr($this->request->files['file']['name'], -10) != '.srmod.zip' && substr($this->request->files['file']['name'], -10) != '.srmod.xml') {
                    $json['error'] = $this->language->get('error_filetype');
                }

                if ($this->request->files['file']['error'] != UPLOAD_ERR_OK) {
                    $json['error'] = $this->language->get('error_upload_' . $this->request->files['file']['error']);
                }
            } else {
                $json['error'] = $this->language->get('error_upload');
            }
        }

        if (!$json) {
            // If no temp directory exists create it
            $path = 'temp-' . (new \Tokenly\TokenGenerator\TokenGenerator())->generateToken(32, 'SR');

            if (!is_dir($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $path)) {
                mkdir($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $path, 0777);
            }

            // Set the steps required for installation
            $json['step'] = array();
            $json['overwrite'] = array();

            if (strrchr($this->request->files['file']['name'], '.') == '.xml') {
                $file = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $path . '/install.xml';

                // If xml file copy it to the temporary directory
                move_uploaded_file($this->request->files['file']['tmp_name'], $file);

                if (file_exists($file)) {
                    $json['step'][] = array(
                        'text' => $this->language->get('text_xml'),
                        'url'  => str_replace('&', '&', $this->url->link('extension/installer/xml', 'token=' . $this->session->data['token'], true)),
                        'path' => $path
                    );

                    // Clear temporary files
                    $json['step'][] = array(
                        'text' => $this->language->get('text_remove'),
                        'url'  => str_replace('&', '&', $this->url->link('extension/installer/remove', 'token=' . $this->session->data['token'], true)),
                        'path' => $path
                    );
                } else {
                    $json['error'] = $this->language->get('error_file');
                }
            }

            // If zip file copy it to the temp directory
            if (strrchr($this->request->files['file']['name'], '.') == '.zip') {
                $file = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $path . '/upload.zip';

                move_uploaded_file($this->request->files['file']['tmp_name'], $file);

                if (file_exists($file)) {
                    $zip = zip_open($file);

                    if ($zip) {

$zip is of type resource, thus it always evaluated to false.

                        // Zip
                        $json['step'][] = array(
                            'text' => $this->language->get('text_unzip'),
                            'url'  => str_replace('&', '&', $this->url->link('extension/installer/unzip', 'token=' . $this->session->data['token'], true)),
                            'path' => $path
                        );

                        // FTP
                        $json['step'][] = array(
                            'text' => $this->language->get('text_ftp'),
                            'url'  => str_replace('&', '&', $this->url->link('extension/installer/ftp', 'token=' . $this->session->data['token'], true)),
                            'path' => $path
                        );

                        // Send make and array of actions to carry out
                        while ($entry = zip_read($zip)) {
                            $zip_name = zip_entry_name($entry);

                            // SQL
                            if (substr($zip_name, 0, 11) == 'install.sql') {
                                $json['step'][] = array(
                                    'text' => $this->language->get('text_sql'),
                                    'url'  => str_replace('&', '&', $this->url->link('extension/installer/sql', 'token=' . $this->session->data['token'], true)),
                                    'path' => $path
                                );
                            }

                            // XML
                            if (substr($zip_name, 0, 11) == 'install.xml') {
                                $json['step'][] = array(
                                    'text' => $this->language->get('text_xml'),
                                    'url'  => str_replace('&', '&', $this->url->link('extension/installer/xml', 'token=' . $this->session->data['token'], true)),
                                    'path' => $path
                                );
                            }

                            // PHP
                            if (substr($zip_name, 0, 11) == 'install.php') {
                                $json['step'][] = array(
                                    'text' => $this->language->get('text_php'),
                                    'url'  => str_replace('&', '&', $this->url->link('extension/installer/php', 'token=' . $this->session->data['token'], true)),
                                    'path' => $path
                                );
                            }

                            // Compare admin files
                            $file = SR_APPLICATION . substr($zip_name, 13);

                            if (is_file($file) && substr($zip_name, 0, 13) == 'upload/administration/') {
                                $json['overwrite'][] = substr($zip_name, 7);
                            }

                            // Compare catalog files
                            $file = $_SERVER['DOCUMENT_ROOT'] . '/application/' . substr($zip_name, 15);

                            if (is_file($file) && substr($zip_name, 0, 15) == 'upload/application/') {
                                $json['overwrite'][] = substr($zip_name, 7);
                            }

                            // Compare image files
                            $file = $_SERVER['DOCUMENT_ROOT'] . '/public_html/assets/images/' . substr($zip_name, 13);

                            if (is_file($file) && substr($zip_name, 0, 13) == 'upload/image/') {
                                $json['overwrite'][] = substr($zip_name, 7);
                            }

                            // Compare system files
                            $file = $_SERVER['DOCUMENT_ROOT'] . '/engine/' . substr($zip_name, 14);

                            if (is_file($file) && substr($zip_name, 0, 14) == 'upload/engine/') {
                                $json['overwrite'][] = substr($zip_name, 7);
                            }
                        }

                        // Clear temporary files
                        $json['step'][] = array(
                            'text' => $this->language->get('text_remove'),
                            'url'  => str_replace('&', '&', $this->url->link('extension/installer/remove', 'token=' . $this->session->data['token'], true)),
                            'path' => $path
                        );

                        zip_close($zip);
                    } else {
                        $json['error'] = $this->language->get('error_unzip');
                    }
                } else {
                    $json['error'] = $this->language->get('error_file');
                }
            }
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }

    public function unzip()
    {
        $this->load->language('extension/installer');

        $json = array();

        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        // Sanitize the filename
        $file = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $this->request->post['path'] . '/upload.zip';

        if (!is_file($file) || substr(str_replace('\\', '/', realpath($file)), 0, strlen($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/')) != $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/') {
            $json['error'] = $this->language->get('error_file');
        }

        if (!$json) {
            // Unzip the files
            $zip = new ZipArchive();

            if ($zip->open($file)) {
                $zip->extractTo($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $this->request->post['path']);
                $zip->close();
            } else {
                $json['error'] = $this->language->get('error_unzip');
            }

            // Remove Zip
            unlink($file);
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }

    public function sql()
    {
        $this->load->language('extension/installer');

        $json = array();

        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        $file = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $this->request->post['path'] . '/install.sql';

        if (!is_file($file) || substr(str_replace('\\', '/', realpath($file)), 0, strlen($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/')) != $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/') {
            $json['error'] = $this->language->get('error_file');
        }

        if (!$json) {
            $lines = file($file);

            if ($lines) {
                try {
                    $sql = '';

                    foreach ($lines as $line) {
                        if ($line && (substr($line, 0, 2) != '--') && (substr($line, 0, 1) != '#')) {
                            $sql .= $line;

                            if (preg_match('/;\s*$/', $line)) {
                                // $sql = str_replace(" `oc_", " `" . DB_PREFIX, $sql);

                                $this->db->query($sql);

                                $sql = '';
                            }
                        }
                    }
                } catch (Exception $exception) {
                    $json['error'] = sprintf($this->language->get('error_exception'), $exception->getCode(), $exception->getMessage(), $exception->getFile(), $exception->getLine());
                }
            }
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }

    public function xml()
    {
        $this->load->language('extension/installer');

        $json = array();

        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        $file = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $this->request->post['path'] . '/install.xml';

        if (!is_file($file) || substr(str_replace('\\', '/', realpath($file)), 0, strlen($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/')) != $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/') {
            $json['error'] = $this->language->get('error_file');
        }

        if (!$json) {

Blank line found at start of control structure

            // If xml file just put it straight into the DB
            $xml = file_get_contents($file);

            if ($xml) {
                try {
                    $dom = new \DOMDocument('1.0', 'UTF-8');
                    $dom->loadXml($xml);

                    $name = $dom->getElementsByTagName('name')->item(0);

                    if ($name) {
                        $name = $name->nodeValue;
                    } else {
                        $name = '';
                    }

                    $code = $dom->getElementsByTagName('code')->item(0);

                    $author = $dom->getElementsByTagName('author')->item(0);

                    if ($author) {
                        $author = $author->nodeValue;
                    } else {
                        $author = '';
                    }

                    $version = $dom->getElementsByTagName('version')->item(0);

                    if ($version) {
                        $version = $version->nodeValue;
                    } else {
                        $version = '';
                    }

                    $link = $dom->getElementsByTagName('link')->item(0);

                    if ($link) {
                        $link = $link->nodeValue;
                    } else {
                        $link = '';
                    }

                    $modification_data = array(

The assignment to $modification_data is dead and can be removed.

                        'name'    => $name,
                        'code'    => $code,
                        'author'  => $author,
                        'version' => $version,
                        'link'    => $link,
                        'xml'     => $xml,
                        'status'  => 1
                    );
                } catch (Exception $exception) {
                    $json['error'] = sprintf($this->language->get('error_exception'), $exception->getCode(), $exception->getMessage(), $exception->getFile(), $exception->getLine());
                }
            }
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }

    public function php()
    {
        $this->load->language('extension/installer');

        $json = array();

        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        $file = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $this->request->post['path'] . '/install.php';

        if (!is_file($file) || substr(str_replace('\\', '/', realpath($file)), 0, strlen($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/')) != $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/') {
            $json['error'] = $this->language->get('error_file');
        }

        if (!$json) {
            try {
                include($file);
            } catch (Exception $exception) {
                $json['error'] = sprintf($this->language->get('error_exception'), $exception->getCode(), $exception->getMessage(), $exception->getFile(), $exception->getLine());
            }
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }

    public function remove()
    {
        $this->load->language('extension/installer');

        $json = array();

        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        $directory = $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . $this->request->post['path'];

        if (!is_dir($directory) || substr(str_replace('\\', '/', realpath($directory)), 0, strlen($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/')) != $_SERVER['DOCUMENT_ROOT'] . '/storage/upload/') {
            $json['error'] = $this->language->get('error_directory');
        }

        if (!$json) {
            // Get a list of files ready to upload
            $files = array();

            $path = array($directory);

            while (count($path) != 0) {
                $next = array_shift($path);

                // We have to use scandir function because glob will not pick up dot files.
                foreach (array_diff(scandir($next), array('.', '..')) as $file) {

It seems like scandir($next) can also be of type false; however, parameter $array1 of array_diff() does only seem to accept array, maybe add an additional type check?

                    $file = $next . '/' . $file;

                    if (is_dir($file)) {
                        $path[] = $file;
                    }

                    $files[] = $file;
                }
            }

            rsort($files);

            foreach ($files as $file) {
                if (is_file($file)) {
                    unlink($file);
                } elseif (is_dir($file)) {
                    rmdir($file);
                }
            }

            if (file_exists($directory)) {
                rmdir($directory);
            }

            $json['success'] = $this->language->get('text_success');
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }

    public function clear()
    {
        $this->load->language('extension/installer');

        $json = array();

        if (!$this->user->hasPermission('modify', 'extension/installer')) {
            $json['error'] = $this->language->get('error_permission');
        }

        if (!$json) {
            $directories = glob($_SERVER['DOCUMENT_ROOT'] . '/storage/upload/' . 'temp-*', GLOB_ONLYDIR);

            if ($directories) {
                foreach ($directories as $directory) {
                    // Get a list of files ready to upload
                    $files = array();

                    $path = array($directory);

                    while (count($path) != 0) {
                        $next = array_shift($path);

                        // We have to use scandir function because glob will not pick up dot files.
                        foreach (array_diff(scandir($next), array('.', '..')) as $file) {

It seems like scandir($next) can also be of type false; however, parameter $array1 of array_diff() does only seem to accept array, maybe add an additional type check?

                            $file = $next . '/' . $file;

                            if (is_dir($file)) {
                                $path[] = $file;
                            }

                            $files[] = $file;
                        }
                    }

                    rsort($files);

                    foreach ($files as $file) {
                        if (is_file($file)) {
                            unlink($file);
                        } elseif (is_dir($file)) {
                            rmdir($file);
                        }
                    }

                    if (file_exists($directory)) {
                        rmdir($directory);
                    }
                }
            }

            $json['success'] = $this->language->get('text_clear');
        }

        $this->response->addHeader('Content-Type: application/json');
        $this->response->setOutput(json_encode($json));
    }
}