Total Complexity | 104 |
Total Lines | 608 |
Duplicated Lines | 0 % |
Changes | 4 | ||
Bugs | 0 | Features | 0 |
Complex classes like XoopsMediaUploader often do a lot of different things. To break such a class down, we need to identify a cohesive component within that class. A common approach to find such a component is to look for fields/methods that share the same prefixes, or suffixes.
Once you have determined the fields that belong together, you can apply the Extract Class refactoring. If the component makes sense as a sub-class, Extract Subclass is also a candidate, and is often faster.
While breaking up the class, it is a good idea to analyze how other classes use XoopsMediaUploader, and based on these observations, apply Extract Interface, too.
1 | <?php |
||
72 | class XoopsMediaUploader |
||
73 | { |
||
74 | /** |
||
75 | * Flag indicating if unrecognized mimetypes should be allowed (use with precaution ! may lead to security issues ) |
||
76 | */ |
||
77 | |||
78 | public $allowUnknownTypes = false; |
||
79 | public $mediaName; |
||
80 | public $mediaType; |
||
81 | public $mediaSize; |
||
82 | public $mediaTmpName; |
||
83 | public $mediaError; |
||
84 | public $mediaRealType = ''; |
||
85 | public $uploadDir = ''; |
||
86 | public $allowedMimeTypes = array(); |
||
87 | public $deniedMimeTypes = array( |
||
88 | 'application/x-httpd-php'); |
||
89 | public $maxFileSize = 0; |
||
90 | public $maxWidth; |
||
91 | public $maxHeight; |
||
92 | public $targetFileName; |
||
93 | public $prefix; |
||
94 | public $errors = array(); |
||
95 | public $savedDestination; |
||
96 | public $savedFileName; |
||
97 | public $extensionToMime = array(); |
||
98 | public $checkImageType = true; |
||
99 | public $extensionsToBeSanitized = array( |
||
100 | 'php', |
||
101 | 'phtml', |
||
102 | 'phtm', |
||
103 | 'php3', |
||
104 | 'php4', |
||
105 | 'cgi', |
||
106 | 'pl', |
||
107 | 'asp', |
||
108 | 'php5', |
||
109 | 'php7', |
||
110 | ); |
||
111 | // extensions needed image check (anti-IE Content-Type XSS) |
||
112 | public $imageExtensions = array( |
||
113 | 1 => 'gif', |
||
114 | 2 => 'jpg', |
||
115 | 3 => 'png', |
||
116 | 4 => 'swf', |
||
117 | 5 => 'psd', |
||
118 | 6 => 'bmp', |
||
119 | 7 => 'tif', |
||
120 | 8 => 'tif', |
||
121 | 9 => 'jpc', |
||
122 | 10 => 'jp2', |
||
123 | 11 => 'jpx', |
||
124 | 12 => 'jb2', |
||
125 | 13 => 'swc', |
||
126 | 14 => 'iff', |
||
127 | 15 => 'wbmp', |
||
128 | 16 => 'xbm'); |
||
129 | public $randomFilename = false; |
||
130 | |||
131 | /** |
||
132 | * Constructor |
||
133 | * |
||
134 | * @param string $uploadDir |
||
135 | * @param array $allowedMimeTypes |
||
136 | * @param int $maxFileSize |
||
137 | * @param int $maxWidth |
||
138 | * @param int $maxHeight |
||
139 | * @param bool $randomFilename |
||
140 | */ |
||
141 | |||
142 | public function __construct($uploadDir, $allowedMimeTypes, $maxFileSize = 0, $maxWidth = null, $maxHeight = null, $randomFilename = false) |
||
143 | { |
||
144 | $this->extensionToMime = include $GLOBALS['xoops']->path('include/mimetypes.inc.php'); |
||
145 | if (!is_array($this->extensionToMime)) { |
||
146 | $this->extensionToMime = array(); |
||
147 | |||
148 | return false; |
||
149 | } |
||
150 | if (is_array($allowedMimeTypes)) { |
||
|
|||
151 | $this->allowedMimeTypes =& $allowedMimeTypes; |
||
152 | } |
||
153 | $this->uploadDir = $uploadDir; |
||
154 | |||
155 | $limits = array(); |
||
156 | $limits = $this->arrayPushIfPositive($limits, $maxFileSize); |
||
157 | $limits = $this->arrayPushIfPositive($limits, $this->return_bytes(ini_get('upload_max_filesize'))); |
||
158 | $limits = $this->arrayPushIfPositive($limits, $this->return_bytes(ini_get('post_max_size'))); |
||
159 | $limits = $this->arrayPushIfPositive($limits, $this->return_bytes(ini_get('memory_limit'))); |
||
160 | $this->maxFileSize = min($limits); |
||
161 | |||
162 | if (isset($maxWidth)) { |
||
163 | $this->maxWidth = (int)$maxWidth; |
||
164 | } |
||
165 | if (isset($maxHeight)) { |
||
166 | $this->maxHeight = (int)$maxHeight; |
||
167 | } |
||
168 | if (isset($randomFilename)) { |
||
169 | $this->randomFilename = $randomFilename; |
||
170 | } |
||
171 | if (!include_once $GLOBALS['xoops']->path('language/' . $GLOBALS['xoopsConfig']['language'] . '/uploader.php')) { |
||
172 | include_once $GLOBALS['xoops']->path('language/english/uploader.php'); |
||
173 | } |
||
174 | } |
||
175 | |||
176 | /** |
||
177 | * converts memory/file sizes as defined in php.ini to bytes |
||
178 | * |
||
179 | * @param $size_str |
||
180 | * |
||
181 | * @return int |
||
182 | */ |
||
183 | public function return_bytes($size_str) |
||
184 | { |
||
185 | switch (substr($size_str, -1)) { |
||
186 | case 'K': |
||
187 | case 'k': |
||
188 | return (int)$size_str * 1024; |
||
189 | case 'M': |
||
190 | case 'm': |
||
191 | return (int)$size_str * 1048576; |
||
192 | case 'G': |
||
193 | case 'g': |
||
194 | return (int)$size_str * 1073741824; |
||
195 | default: |
||
196 | return $size_str; |
||
197 | } |
||
198 | } |
||
199 | |||
200 | /** |
||
201 | * Count the uploaded files (in case of miltiple upload) |
||
202 | * |
||
203 | * @param string $media_name Name of the file field |
||
204 | * @return int |
||
205 | */ |
||
206 | public function countMedia($media_name) { |
||
207 | if (!isset($_FILES[$media_name])) { |
||
208 | $this->setErrors(_ER_UP_FILENOTFOUND); |
||
209 | return false; |
||
210 | } |
||
211 | return count($_FILES[$media_name]['name']); |
||
212 | } |
||
213 | |||
214 | /** |
||
215 | * Fetch the uploaded file |
||
216 | * |
||
217 | * @param string $media_name Name of the file field |
||
218 | * @param int $index Index of the file (if more than one uploaded under that name) |
||
219 | * @return bool |
||
220 | */ |
||
221 | public function fetchMedia($media_name, $index = null) |
||
222 | { |
||
223 | if (empty($this->extensionToMime)) { |
||
224 | $this->setErrors(_ER_UP_MIMETYPELOAD); |
||
225 | |||
226 | return false; |
||
227 | } |
||
228 | if (!isset($_FILES[$media_name])) { |
||
229 | $this->setErrors(_ER_UP_FILENOTFOUND); |
||
230 | |||
231 | return false; |
||
232 | } elseif (is_array($_FILES[$media_name]['name']) && isset($index)) { |
||
233 | $index = (int)$index; |
||
234 | $this->mediaName = get_magic_quotes_gpc() ? stripslashes($_FILES[$media_name]['name'][$index]) : $_FILES[$media_name]['name'][$index]; |
||
235 | if ($this->randomFilename) { |
||
236 | $unique = uniqid(); |
||
237 | $this->targetFileName = '' . $unique . '--' . $this->mediaName; |
||
238 | } |
||
239 | $this->mediaType = $_FILES[$media_name]['type'][$index]; |
||
240 | $this->mediaSize = $_FILES[$media_name]['size'][$index]; |
||
241 | $this->mediaTmpName = $_FILES[$media_name]['tmp_name'][$index]; |
||
242 | $this->mediaError = !empty($_FILES[$media_name]['error'][$index]) ? $_FILES[$media_name]['error'][$index] : 0; |
||
243 | } elseif (is_array($_FILES[$media_name]['name']) && !isset($index)) { |
||
244 | $this->setErrors(_ER_UP_INDEXNOTSET); |
||
245 | |||
246 | return false; |
||
247 | } else { |
||
248 | $media_name =& $_FILES[$media_name]; |
||
249 | $this->mediaName = get_magic_quotes_gpc() ? stripslashes($media_name['name']) : $media_name['name']; |
||
250 | if ($this->randomFilename) { |
||
251 | $unique = uniqid(); |
||
252 | $this->targetFileName = '' . $unique . '--' . $this->mediaName; |
||
253 | } |
||
254 | $this->mediaType = $media_name['type']; |
||
255 | $this->mediaSize = $media_name['size']; |
||
256 | $this->mediaTmpName = $media_name['tmp_name']; |
||
257 | $this->mediaError = !empty($media_name['error']) ? $media_name['error'] : 0; |
||
258 | } |
||
259 | |||
260 | if (($ext = strrpos($this->mediaName, '.')) !== false) { |
||
261 | $ext = strtolower(substr($this->mediaName, $ext + 1)); |
||
262 | if (isset($this->extensionToMime[$ext])) { |
||
263 | $this->mediaRealType = $this->extensionToMime[$ext]; |
||
264 | } |
||
265 | } |
||
266 | $this->errors = array(); |
||
267 | if ($this->mediaError > 0) { |
||
268 | switch($this->mediaError){ |
||
269 | case UPLOAD_ERR_INI_SIZE: |
||
270 | $this->setErrors(_ER_UP_INISIZE); |
||
271 | return false; |
||
272 | break; |
||
273 | case UPLOAD_ERR_FORM_SIZE: |
||
274 | $this->setErrors(_ER_UP_FORMSIZE); |
||
275 | return false; |
||
276 | break; |
||
277 | case UPLOAD_ERR_PARTIAL: |
||
278 | $this->setErrors(_ER_UP_PARTIAL); |
||
279 | return false; |
||
280 | break; |
||
281 | case UPLOAD_ERR_NO_FILE: |
||
282 | $this->setErrors(_ER_UP_NOFILE); |
||
283 | return false; |
||
284 | break; |
||
285 | case UPLOAD_ERR_NO_TMP_DIR: |
||
286 | $this->setErrors(_ER_UP_NOTMPDIR); |
||
287 | return false; |
||
288 | break; |
||
289 | case UPLOAD_ERR_CANT_WRITE: |
||
290 | $this->setErrors(_ER_UP_CANTWRITE); |
||
291 | return false; |
||
292 | break; |
||
293 | case UPLOAD_ERR_EXTENSION: |
||
294 | $this->setErrors(_ER_UP_EXTENSION); |
||
295 | return false; |
||
296 | break; |
||
297 | default: |
||
298 | $this->setErrors(_ER_UP_UNKNOWN); |
||
299 | return false; |
||
300 | break; |
||
301 | } |
||
302 | } |
||
303 | |||
304 | if ((int)$this->mediaSize < 0) { |
||
305 | $this->setErrors(_ER_UP_INVALIDFILESIZE); |
||
306 | |||
307 | return false; |
||
308 | } |
||
309 | if ($this->mediaName == '') { |
||
310 | $this->setErrors(_ER_UP_FILENAMEEMPTY); |
||
311 | |||
312 | return false; |
||
313 | } |
||
314 | if ($this->mediaTmpName === 'none' || !is_uploaded_file($this->mediaTmpName)) { |
||
315 | $this->setErrors(_ER_UP_NOFILEUPLOADED); |
||
316 | |||
317 | return false; |
||
318 | } |
||
319 | |||
320 | return true; |
||
321 | } |
||
322 | |||
323 | /** |
||
324 | * Set the target filename |
||
325 | * |
||
326 | * @param string $value |
||
327 | */ |
||
328 | public function setTargetFileName($value) |
||
331 | } |
||
332 | |||
333 | /** |
||
334 | * Set the prefix |
||
335 | * |
||
336 | * @param string $value |
||
337 | */ |
||
338 | public function setPrefix($value) |
||
339 | { |
||
340 | $this->prefix = (string)trim($value); |
||
341 | } |
||
342 | |||
343 | /** |
||
344 | * Get the uploaded filename |
||
345 | * |
||
346 | * @return string |
||
347 | */ |
||
348 | public function getMediaName() |
||
349 | { |
||
350 | return $this->mediaName; |
||
351 | } |
||
352 | |||
353 | /** |
||
354 | * Get the type of the uploaded file |
||
355 | * |
||
356 | * @return string |
||
357 | */ |
||
358 | public function getMediaType() |
||
361 | } |
||
362 | |||
363 | /** |
||
364 | * Get the size of the uploaded file |
||
365 | * |
||
366 | * @return int |
||
367 | */ |
||
368 | public function getMediaSize() |
||
369 | { |
||
370 | return $this->mediaSize; |
||
371 | } |
||
372 | |||
373 | /** |
||
374 | * Get the temporary name that the uploaded file was stored under |
||
375 | * |
||
376 | * @return string |
||
377 | */ |
||
378 | public function getMediaTmpName() |
||
379 | { |
||
380 | return $this->mediaTmpName; |
||
381 | } |
||
382 | |||
383 | /** |
||
384 | * Get the saved filename |
||
385 | * |
||
386 | * @return string |
||
387 | */ |
||
388 | public function getSavedFileName() |
||
389 | { |
||
390 | return $this->savedFileName; |
||
391 | } |
||
392 | |||
393 | /** |
||
394 | * Get the destination the file is saved to |
||
395 | * |
||
396 | * @return string |
||
397 | */ |
||
398 | public function getSavedDestination() |
||
399 | { |
||
400 | return $this->savedDestination; |
||
401 | } |
||
402 | |||
403 | /** |
||
404 | * Check the file and copy it to the destination |
||
405 | * |
||
406 | * @param int $chmod |
||
407 | * @return bool |
||
408 | */ |
||
409 | public function upload($chmod = 0644) |
||
448 | } |
||
449 | |||
450 | /** |
||
451 | * Copy the file to its destination |
||
452 | * |
||
453 | * @param $chmod |
||
454 | * @return bool |
||
455 | */ |
||
456 | public function _copyFile($chmod) |
||
457 | { |
||
458 | $matched = array(); |
||
459 | if (!preg_match("/\.([a-zA-Z0-9]+)$/", $this->mediaName, $matched)) { |
||
460 | $this->setErrors(_ER_UP_INVALIDFILENAME); |
||
461 | |||
462 | return false; |
||
463 | } |
||
464 | if (isset($this->targetFileName)) { |
||
465 | $this->savedFileName = $this->targetFileName; |
||
466 | } elseif (isset($this->prefix)) { |
||
467 | $this->savedFileName = uniqid($this->prefix) . '.' . strtolower($matched[1]); |
||
468 | } else { |
||
469 | $this->savedFileName = strtolower($this->mediaName); |
||
470 | } |
||
471 | |||
472 | $this->savedFileName = iconv('UTF-8', 'ASCII//TRANSLIT', $this->savedFileName); |
||
473 | $this->savedFileName = preg_replace('!\s+!', '_', $this->savedFileName); |
||
474 | $this->savedFileName = preg_replace("/[^a-zA-Z0-9\._-]/", '', $this->savedFileName); |
||
475 | |||
476 | $this->savedDestination = $this->uploadDir . '/' . $this->savedFileName; |
||
477 | if (!move_uploaded_file($this->mediaTmpName, $this->savedDestination)) { |
||
478 | $this->setErrors(sprintf(_ER_UP_FAILEDSAVEFILE, $this->savedDestination)); |
||
479 | |||
480 | return false; |
||
481 | } |
||
482 | // Check IE XSS before returning success |
||
483 | $ext = strtolower(substr(strrchr($this->savedDestination, '.'), 1)); |
||
484 | if (in_array($ext, $this->imageExtensions)) { |
||
485 | $info = @getimagesize($this->savedDestination); |
||
486 | if ($info === false || $this->imageExtensions[(int)$info[2]] != $ext) { |
||
487 | $this->setErrors(_ER_UP_SUSPICIOUSREFUSED); |
||
488 | @unlink($this->savedDestination); |
||
489 | |||
490 | return false; |
||
491 | } |
||
492 | } |
||
493 | @chmod($this->savedDestination, $chmod); |
||
494 | |||
495 | return true; |
||
496 | } |
||
497 | |||
498 | /** |
||
499 | * Is the file the right size? |
||
500 | * |
||
501 | * @return bool |
||
502 | */ |
||
503 | public function checkMaxFileSize() |
||
504 | { |
||
505 | if (!isset($this->maxFileSize)) { |
||
506 | return true; |
||
507 | } |
||
508 | if ($this->mediaSize > $this->maxFileSize) { |
||
509 | $this->setErrors(sprintf(_ER_UP_FILESIZETOOLARGE, $this->maxFileSize, $this->mediaSize)); |
||
510 | |||
511 | return false; |
||
512 | } |
||
513 | |||
514 | return true; |
||
515 | } |
||
516 | |||
517 | /** |
||
518 | * Is the picture the right width? |
||
519 | * |
||
520 | * @return bool |
||
521 | */ |
||
522 | public function checkMaxWidth() |
||
523 | { |
||
524 | if (!isset($this->maxWidth)) { |
||
525 | return true; |
||
526 | } |
||
527 | if (false !== $dimension = getimagesize($this->mediaTmpName)) { |
||
528 | if ($dimension[0] > $this->maxWidth) { |
||
529 | $this->setErrors(sprintf(_ER_UP_FILEWIDTHTOOLARGE, $this->maxWidth, $dimension[0])); |
||
530 | |||
531 | return false; |
||
532 | } |
||
533 | } else { |
||
534 | trigger_error(sprintf(_ER_UP_FAILEDFETCHIMAGESIZE, $this->mediaTmpName), E_USER_WARNING); |
||
535 | } |
||
536 | |||
537 | return true; |
||
538 | } |
||
539 | |||
540 | /** |
||
541 | * Is the picture the right height? |
||
542 | * |
||
543 | * @return bool |
||
544 | */ |
||
545 | public function checkMaxHeight() |
||
546 | { |
||
547 | if (!isset($this->maxHeight)) { |
||
548 | return true; |
||
549 | } |
||
550 | if (false !== $dimension = getimagesize($this->mediaTmpName)) { |
||
551 | if ($dimension[1] > $this->maxHeight) { |
||
552 | $this->setErrors(sprintf(_ER_UP_FILEHEIGHTTOOLARGE, $this->maxHeight, $dimension[1])); |
||
553 | |||
554 | return false; |
||
555 | } |
||
556 | } else { |
||
557 | trigger_error(sprintf(_ER_UP_FAILEDFETCHIMAGESIZE, $this->mediaTmpName), E_USER_WARNING); |
||
558 | } |
||
559 | |||
560 | return true; |
||
561 | } |
||
562 | |||
563 | /** |
||
564 | * Check whether or not the uploaded file type is allowed |
||
565 | * |
||
566 | * @return bool |
||
567 | */ |
||
568 | public function checkMimeType() |
||
569 | { |
||
570 | // if the browser supplied mime type looks suspicious, refuse it |
||
571 | $structureCheck = (bool) preg_match('/^\w+\/[-+.\w]+$/', $this->mediaType); |
||
572 | if (false === $structureCheck) { |
||
573 | $this->mediaType = 'invalid'; |
||
574 | $this->setErrors(_ER_UP_UNKNOWNFILETYPEREJECTED); |
||
575 | return false; |
||
576 | } |
||
577 | |||
578 | if (empty($this->mediaRealType) && empty($this->allowUnknownTypes)) { |
||
579 | $this->setErrors(_ER_UP_UNKNOWNFILETYPEREJECTED); |
||
580 | |||
581 | return false; |
||
582 | } |
||
583 | |||
584 | if ((!empty($this->allowedMimeTypes) && !in_array($this->mediaRealType, $this->allowedMimeTypes)) || (!empty($this->deniedMimeTypes) && in_array($this->mediaRealType, $this->deniedMimeTypes))) { |
||
585 | $this->setErrors(sprintf(_ER_UP_MIMETYPENOTALLOWED, htmlspecialchars($this->mediaRealType, ENT_QUOTES))); |
||
586 | |||
587 | return false; |
||
588 | } |
||
589 | |||
590 | return true; |
||
591 | } |
||
592 | |||
593 | /** |
||
594 | * Check whether or not the uploaded image type is valid |
||
595 | * |
||
596 | * @return bool |
||
597 | */ |
||
598 | public function checkImageType() |
||
599 | { |
||
600 | if (empty($this->checkImageType)) { |
||
601 | return true; |
||
602 | } |
||
603 | |||
604 | if (('image' === substr($this->mediaType, 0, strpos($this->mediaType, '/'))) || (!empty($this->mediaRealType) && 'image' === substr($this->mediaRealType, 0, strpos($this->mediaRealType, '/')))) { |
||
605 | if (!($info = @getimagesize($this->mediaTmpName))) { |
||
606 | $this->setErrors(_ER_UP_INVALIDIMAGEFILE); |
||
607 | |||
608 | return false; |
||
609 | } |
||
610 | } |
||
611 | |||
612 | return true; |
||
613 | } |
||
614 | |||
615 | /** |
||
616 | * Sanitize executable filename with multiple extensions |
||
617 | */ |
||
618 | public function sanitizeMultipleExtensions() |
||
619 | { |
||
620 | if (empty($this->extensionsToBeSanitized)) { |
||
621 | return null; |
||
622 | } |
||
623 | |||
624 | $patterns = array(); |
||
625 | $replaces = array(); |
||
626 | foreach ($this->extensionsToBeSanitized as $ext) { |
||
627 | $patterns[] = "/\." . preg_quote($ext) . "\./i"; |
||
628 | $replaces[] = '_' . $ext . '.'; |
||
629 | } |
||
630 | $this->mediaName = preg_replace($patterns, $replaces, $this->mediaName); |
||
631 | } |
||
632 | |||
633 | /** |
||
634 | * Add an error |
||
635 | * |
||
636 | * @param string $error |
||
637 | */ |
||
638 | public function setErrors($error) |
||
639 | { |
||
640 | $this->errors[] = trim($error); |
||
641 | } |
||
642 | |||
643 | /** |
||
644 | * Get generated errors |
||
645 | * |
||
646 | * @param bool $ashtml Format using HTML? |
||
647 | * @return array |string Array of array messages OR HTML string |
||
648 | */ |
||
649 | public function &getErrors($ashtml = true) |
||
663 | } |
||
664 | } |
||
665 | |||
666 | /** |
||
667 | * Push value onto set. |
||
668 | * Used in max file size calculation to eliminate -1 (unlimited) ini values |
||
669 | * |
||
670 | * @param array $set array of values |
||
671 | * @param int $value value to push |
||
672 | * |
||
673 | * @return mixed |
||
674 | */ |
||
675 | protected function arrayPushIfPositive($set, $value) { |
||
680 | } |
||
681 | } |
||
682 |