Vtiger_WebUI::process()

Complexity

Conditions	52
Paths	> 20000

Size

Total Lines	135
Code Lines	104

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	2756

Importance

Changes	1
Bugs	0	Features	0

<?php
	public function process(App\Request $request)
	{
		if (\Config\Security::$forceHttpsRedirection && !\App\RequestUtil::isHttps()) {
			header("location: https://$_SERVER[HTTP_HOST]$_SERVER[REQUEST_URI]", true, 301);
		}
		if (\Config\Security::$forceUrlRedirection) {
			$requestUrl = (\App\RequestUtil::isHttps() ? 'https' : 'http') . '://' . $request->getServer('HTTP_HOST') . $request->getServer('REQUEST_URI');

Are you sure $request->getServer('HTTP_HOST') of type false can be used in concatenation?

Are you sure $request->getServer('REQUEST_URI') of type false can be used in concatenation?

			if (0 !== stripos($requestUrl, App\Config::main('site_URL'))) {
				header('location: ' . App\Config::main('site_URL'), true, 301);
			}
		}
		try {
			App\Session::init();
			App\Process::init();
			// common utils api called, depend on this variable right now
			$this->getLogin();
			App\Debuger::initConsole();
			$hasLogin = $this->hasLogin();
			$moduleName = $request->getModule();
			$qualifiedModuleName = $request->getModule(false);
			$view = $request->getByType('view', 2);
			$action = $request->getByType('action', 2);
			$response = false;
			if (!$hasLogin && 'GET' === $_SERVER['REQUEST_METHOD'] && 'Users' !== $moduleName && ($returnUrl = $request->getServer('QUERY_STRING')) && !\App\Session::has('return_params')) {

$hasLogin is of type Users, thus it always evaluated to true.

				//Take the url that user would like to redirect after they have successfully logged in.
				\App\Session::set('return_params', str_replace('&', '&', $returnUrl));
			}
			if (empty($moduleName)) {
				if ($hasLogin) {

$hasLogin is of type Users, thus it always evaluated to true.

					$defaultModule = App\Config::main('default_module');
					if (!empty($defaultModule) && 'Home' !== $defaultModule && \App\Privilege::isPermitted($defaultModule)) {
						$moduleName = $defaultModule;
						$qualifiedModuleName = $defaultModule;
						if (empty($view = Vtiger_Module_Model::getInstance($moduleName)->getDefaultViewName())) {
							$view = 'List';
						}
					} else {
						$qualifiedModuleName = $moduleName = 'Home';
						$view = 'DashBoard';
					}
				} else {
					$qualifiedModuleName = $moduleName = 'Users';
					$view = 'Login';
				}
				$request->set('module', $moduleName);
				$request->set('view', $view);
			}
			if (!empty($action)) {
				$componentType = 'Action';
				$componentName = $action;
				\App\Config::setJsEnv('action', $action);
			} else {
				$componentType = 'View';
				if (empty($view)) {
					$view = 'Index';
				}
				$componentName = $view;
				\App\Config::setJsEnv('view', $view);
			}
			if ('Login' === $view && 'Users' === $moduleName) {
				if (!\App\Session::has('CSP_TOKEN')) {
					\App\Controller\Headers::generateCspToken();
				}
				if ($hasLogin) {

$hasLogin is of type Users, thus it always evaluated to true.

					header('location: index.php');
					return false;
				}
			}
			\App\Process::$processName = $componentName;

It seems like $componentName can also be of type boolean. However, the property $processName is declared as type string. Maybe add an additional type check?

			\App\Process::$processType = $componentType;
			\App\Config::setJsEnv('module', $moduleName);
			\App\Config::setJsEnv('mode', $request->getMode());
			if ($qualifiedModuleName && 0 === stripos($qualifiedModuleName, 'Settings') && empty(\App\User::getCurrentUserId())) {
				header('location: ' . App\Config::main('site_URL'), true);
			}
			if ('AppComponents' === $moduleName) {
				$handlerClass = "App\\Controller\\Components\\{$componentType}\\{$componentName}";
			} else {
				$handlerClass = Vtiger_Loader::getComponentClassName($componentType, $componentName, $qualifiedModuleName);
			}
			$handler = new $handlerClass();
			if (!$handler) {

$handler is of type object, thus it always evaluated to true.

				\App\Log::error("HandlerClass: $handlerClass", 'Loader');
				throw new \App\Exceptions\AppException('LBL_HANDLER_NOT_FOUND', 405);
			}
			$handler->validateRequest($request);
			if ($handler->loginRequired() && $this->checkLogin($request)) {
				return true;
			}
			if ($handler->isSessionExtend($request)) {
				\App\Session::set('last_activity', \App\Process::$startTime);
			}
			if ('ModComments' === $moduleName && 'List' === $view) {
				header('location: index.php?module=Home&view=DashBoard');
			}
			$skipList = ['Users', 'Home', 'CustomView', 'Import', 'Export', 'Install', 'ModTracker', 'AppComponents'];
			if ($handler->loginRequired() && !\in_array($moduleName, $skipList) && false === stripos($qualifiedModuleName, 'Settings')) {
				$this->triggerCheckPermission($handler, $request);
			} elseif (0 === stripos($qualifiedModuleName, 'Settings') || \in_array($moduleName, $skipList) || !$handler->loginRequired()) {
				$handler->checkPermission($request);
			}
			$this->triggerPreProcess($handler, $request);
			$response = $handler->process($request);
			$this->triggerPostProcess($handler, $request);
		} catch (Throwable $e) {
			\App\Log::error($e->getMessage() . PHP_EOL . $e->__toString());
			$messageHeader = 'LBL_ERROR';
			if ($e instanceof \App\Exceptions\NoPermittedToRecord || $e instanceof WebServiceException) {
				$messageHeader = 'LBL_PERMISSION_DENIED';
			} elseif ($e instanceof \App\Exceptions\Security) {
				$messageHeader = 'LBL_BAD_REQUEST';
			} elseif ($e instanceof \yii\db\Exception) {
				$messageHeader = 'LBL_ERROR';
			}
			\vtlib\Functions::throwNewException($e, false, $messageHeader);
			if (!($request->isAjax() && $request->isJSON())) {
				if (App\Config::debug('DISPLAY_EXCEPTION_BACKTRACE')) {
					echo '<pre class="my-5 mx-auto card p-3 u-w-fit shadow js-exception-backtrace">' . App\Purifier::encodeHtml(str_replace(ROOT_DIRECTORY . DIRECTORY_SEPARATOR, '', $e->__toString())) . '</pre>';
					$response = false;
				}
				if (App\Config::debug('DISPLAY_EXCEPTION_LOGS')) {
					echo '<pre class="my-5 mx-auto card p-3 u-w-fit shadow js-exception-logs">' . App\Purifier::encodeHtml(str_replace(ROOT_DIRECTORY . DIRECTORY_SEPARATOR, '', \App\Log::getlastLogs())) . '</pre>';
					$response = false;
				}
			}
			if ('test' === App\Config::main('systemMode')) {
				file_put_contents('cache/logs/request.log', print_r($request->getAll(), true));
				if (\function_exists('apache_request_headers')) {
					file_put_contents('cache/logs/request.log', print_r(apache_request_headers(), true));
				}
				throw $e;
			}
		}
		if (isset($response) && \is_object($response)) {
			$response->emit();
		}