This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | namespace Alpha\Controller; |
||
4 | |||
5 | use Alpha\Util\Logging\Logger; |
||
6 | use Alpha\Util\Config\ConfigProvider; |
||
7 | use Alpha\Util\File\FileUtils; |
||
8 | use Alpha\Util\Security\SecurityUtils; |
||
9 | use Alpha\Util\Http\Response; |
||
10 | use Alpha\Util\Service\ServiceFactory; |
||
11 | use Alpha\Exception\IllegalArguementException; |
||
12 | use Alpha\Exception\SecurityException; |
||
13 | use Alpha\Exception\AlphaException; |
||
14 | use Alpha\View\View; |
||
15 | use Alpha\View\Widget\Button; |
||
16 | |||
17 | /** |
||
18 | * Controller used to clear out the CMS cache when required. |
||
19 | * |
||
20 | * @since 1.0 |
||
21 | * |
||
22 | * @author John Collins <[email protected]> |
||
23 | * @license http://www.opensource.org/licenses/bsd-license.php The BSD License |
||
24 | * @copyright Copyright (c) 2018, John Collins (founder of Alpha Framework). |
||
25 | * All rights reserved. |
||
26 | * |
||
27 | * <pre> |
||
28 | * Redistribution and use in source and binary forms, with or |
||
29 | * without modification, are permitted provided that the |
||
30 | * following conditions are met: |
||
31 | * |
||
32 | * * Redistributions of source code must retain the above |
||
33 | * copyright notice, this list of conditions and the |
||
34 | * following disclaimer. |
||
35 | * * Redistributions in binary form must reproduce the above |
||
36 | * copyright notice, this list of conditions and the |
||
37 | * following disclaimer in the documentation and/or other |
||
38 | * materials provided with the distribution. |
||
39 | * * Neither the name of the Alpha Framework nor the names |
||
40 | * of its contributors may be used to endorse or promote |
||
41 | * products derived from this software without specific |
||
42 | * prior written permission. |
||
43 | * |
||
44 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND |
||
45 | * CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, |
||
46 | * INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF |
||
47 | * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE |
||
48 | * DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR |
||
49 | * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
||
50 | * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT |
||
51 | * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; |
||
52 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
||
53 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN |
||
54 | * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE |
||
55 | * OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS |
||
56 | * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
||
57 | * </pre> |
||
58 | */ |
||
59 | class CacheController extends Controller implements ControllerInterface |
||
60 | { |
||
61 | /** |
||
62 | * The root of the cache directory. |
||
63 | * |
||
64 | * @var string |
||
65 | * |
||
66 | * @since 1.0 |
||
67 | */ |
||
68 | private $dataDir; |
||
69 | |||
70 | /** |
||
71 | * Trace logger. |
||
72 | * |
||
73 | * @var \Alpha\Util\Logging\Logger |
||
74 | * |
||
75 | * @since 1.0 |
||
76 | */ |
||
77 | private static $logger = null; |
||
0 ignored issues
–
show
Comprehensibility
introduced
by
![]() |
|||
78 | |||
79 | /** |
||
80 | * constructor to set up the object. |
||
81 | * |
||
82 | * @since 1.0 |
||
83 | */ |
||
84 | public function __construct() |
||
85 | { |
||
86 | self::$logger = new Logger('CacheManager'); |
||
87 | self::$logger->debug('>>__construct()'); |
||
88 | |||
89 | $config = ConfigProvider::getInstance(); |
||
90 | |||
91 | // ensure that the super class constructor is called, indicating the rights group |
||
92 | parent::__construct('Admin'); |
||
93 | |||
94 | $this->setTitle('Cache Manager'); |
||
95 | $this->dataDir = $config->get('app.file.store.dir').'cache/'; |
||
96 | |||
97 | self::$logger->debug('<<__construct'); |
||
98 | } |
||
99 | |||
100 | /** |
||
101 | * Handle GET requests. |
||
102 | * |
||
103 | * @param \Alpha\Util\Http\Request $request |
||
104 | * |
||
105 | * @throws \Alpha\Exception\IllegalArguementException |
||
106 | * |
||
107 | * @return \Alpha\Util\Http\Response |
||
108 | * |
||
109 | * @since 1.0 |
||
110 | */ |
||
111 | public function doGET($request) |
||
112 | { |
||
113 | self::$logger->debug('>>doGET($request=['.var_export($request, true).'])'); |
||
114 | |||
115 | $params = $request->getParams(); |
||
116 | |||
117 | $config = ConfigProvider::getInstance(); |
||
118 | |||
119 | if (!is_array($params)) { |
||
120 | throw new IllegalArguementException('Bad $params ['.var_export($params, true).'] passed to doGET method!'); |
||
121 | } |
||
122 | |||
123 | $body = View::displayPageHead($this); |
||
124 | |||
125 | $message = $this->getStatusMessage(); |
||
126 | if (!empty($message)) { |
||
127 | $body .= $message; |
||
128 | } |
||
129 | |||
130 | $body .= '<h3>Listing contents of cache directory: '.$this->dataDir.'</h3>'; |
||
131 | |||
132 | $fileList = ''; |
||
133 | $fileCount = FileUtils::listDirectoryContents($this->dataDir, $fileList, 0, array('.htaccess')); |
||
134 | $body .= $fileList; |
||
135 | |||
136 | $body .= '<h3>Total of '.$fileCount.' files in the cache.</h3>'; |
||
137 | |||
138 | $body .= '<form action="'.$request->getURI().'" method="post" name="clearForm" id="clearForm">'; |
||
139 | $fieldname = ($config->get('security.encrypt.http.fieldnames') ? base64_encode(SecurityUtils::encrypt('clearCache')) : 'clearCache'); |
||
140 | $body .= '<input type="hidden" name="'.$fieldname.'" id="'.$fieldname.'" value="false"/>'; |
||
141 | |||
142 | $js = View::loadTemplateFragment('html', 'bootstrapconfirmokay.phtml', array('prompt' => 'Are you sure you want to delete all files in the cache?', 'formFieldId' => $fieldname, 'formFieldValue' => 'true', 'formId' => 'clearForm')); |
||
143 | |||
144 | $button = new Button($js, 'Clear cache', 'clearBut'); |
||
145 | $body .= $button->render(); |
||
146 | |||
147 | $body .= View::renderSecurityFields(); |
||
148 | $body .= '</form>'; |
||
149 | |||
150 | $body .= View::displayPageFoot($this); |
||
151 | |||
152 | self::$logger->debug('<<doGET'); |
||
153 | |||
154 | return new Response(200, $body, array('Content-Type' => 'text/html')); |
||
155 | } |
||
156 | |||
157 | /** |
||
158 | * Handle POST requests. |
||
159 | * |
||
160 | * @param \Alpha\Util\Http\Request $request |
||
161 | * |
||
162 | * @throws \Alpha\Exception\SecurityException |
||
163 | * @throws \Alpha\Exception\IllegalArguementException |
||
164 | * |
||
165 | * @return \Alpha\Util\Http\Response |
||
166 | * |
||
167 | * @since 1.0 |
||
168 | */ |
||
169 | public function doPOST($request) |
||
170 | { |
||
171 | self::$logger->debug('>>doPOST($request=['.var_export($request, true).'])'); |
||
172 | |||
173 | $params = $request->getParams(); |
||
174 | |||
175 | try { |
||
176 | // check the hidden security fields before accepting the form POST data |
||
177 | if (!$this->checkSecurityFields()) { |
||
178 | throw new SecurityException('This page cannot accept post data from remote servers!'); |
||
179 | } |
||
180 | |||
181 | if (!is_array($params)) { |
||
182 | throw new IllegalArguementException('Bad $params ['.var_export($params, true).'] passed to doPOST method!'); |
||
183 | } |
||
184 | |||
185 | if (isset($params['clearCache']) && $params['clearCache'] == 'true') { |
||
186 | try { |
||
187 | FileUtils::deleteDirectoryContents($this->dataDir, array('.htaccess', 'html', 'images', 'pdf', 'xls')); |
||
188 | |||
189 | $this->setStatusMessage(View::displayUpdateMessage('Cache contents deleted successfully.')); |
||
190 | |||
191 | $config = ConfigProvider::getInstance(); |
||
192 | $sessionProvider = $config->get('session.provider.name'); |
||
193 | $session = ServiceFactory::getInstance($sessionProvider, 'Alpha\Util\Http\Session\SessionProviderInterface'); |
||
194 | |||
195 | self::$logger->info('Cache contents deleted successfully by user ['.$session->get('currentUser')->get('username').'].'); |
||
196 | } catch (AlphaException $e) { |
||
197 | self::$logger->error($e->getMessage()); |
||
198 | $this->setStatusMessage(View::displayErrorMessage($e->getMessage())); |
||
199 | } |
||
200 | } |
||
201 | |||
202 | return $this->doGET($request); |
||
203 | } catch (SecurityException $e) { |
||
204 | $this->setStatusMessage(View::displayErrorMessage($e->getMessage())); |
||
205 | |||
206 | self::$logger->warn($e->getMessage()); |
||
207 | } catch (IllegalArguementException $e) { |
||
208 | self::$logger->error($e->getMessage()); |
||
209 | $this->setStatusMessage(View::displayErrorMessage($e->getMessage())); |
||
210 | } |
||
211 | |||
212 | $body = View::displayPageHead($this); |
||
213 | |||
214 | $message = $this->getStatusMessage(); |
||
215 | if (!empty($message)) { |
||
216 | $body .= $message; |
||
217 | } |
||
218 | |||
219 | $body .= View::displayPageFoot($this); |
||
220 | self::$logger->debug('<<doPOST'); |
||
221 | |||
222 | return new Response(200, $body, array('Content-Type' => 'text/html')); |
||
223 | } |
||
224 | } |
||
225 |