alxarafe /
alixar
| Conditions | 141 |
| Paths | > 20000 |
| Total Lines | 324 |
| Code Lines | 227 |
| Lines | 0 |
| Ratio | 0 % |
| Changes | 0 | ||
Small methods make your code easier to understand, in particular if combined with a good name. Besides, if your method is small, finding a good name is usually much easier.
For example, if you find yourself adding comments to a method's body, this is usually a good sign to extract the commented part to a new method, and use the comment as a starting point when coming up with a good name for this new method.
Commonly applied refactorings include:
If many parameters/temporary variables are present:
| 1 | <?php |
||
| 171 | function GETPOST($paramname, $check = 'none', $method = 0, $filter = null, $options = null, $noreplace = 0) |
||
| 172 | { |
||
| 173 | global $mysoc, $user, $conf; |
||
| 174 | |||
| 175 | Debug::addMessage('Deprecated', 'Using GETPOST of functions.lib.php instead of Request library'); |
||
| 176 | |||
| 177 | if (empty($paramname)) |
||
| 178 | return 'BadFirstParameterForGETPOST'; |
||
| 179 | if (empty($check)) { |
||
| 180 | dol_syslog("Deprecated use of GETPOST, called with 1st param = " . $paramname . " and 2nd param is '', when calling page " . $_SERVER["PHP_SELF"], LOG_WARNING); |
||
| 181 | // Enable this line to know who call the GETPOST with '' $check parameter. |
||
| 182 | //var_dump(debug_backtrace()[0]); |
||
| 183 | } |
||
| 184 | |||
| 185 | if (empty($method)) |
||
| 186 | $out = isset($_GET[$paramname]) ? $_GET[$paramname] : (isset($_POST[$paramname]) ? $_POST[$paramname] : ''); |
||
| 187 | elseif ($method == 1) |
||
| 188 | $out = isset($_GET[$paramname]) ? $_GET[$paramname] : ''; |
||
| 189 | elseif ($method == 2) |
||
| 190 | $out = isset($_POST[$paramname]) ? $_POST[$paramname] : ''; |
||
| 191 | elseif ($method == 3) |
||
| 192 | $out = isset($_POST[$paramname]) ? $_POST[$paramname] : (isset($_GET[$paramname]) ? $_GET[$paramname] : ''); |
||
| 193 | elseif ($method == 4) |
||
| 194 | $out = isset($_POST[$paramname]) ? $_POST[$paramname] : (isset($_GET[$paramname]) ? $_GET[$paramname] : (isset($_COOKIE[$paramname]) ? $_COOKIE[$paramname] : '')); |
||
| 195 | else |
||
| 196 | return 'BadThirdParameterForGETPOST'; |
||
| 197 | |||
| 198 | if (empty($method) || $method == 3 || $method == 4) { |
||
| 199 | $relativepathstring = $_SERVER["PHP_SELF"]; |
||
| 200 | // Clean $relativepathstring |
||
| 201 | if (constant('DOL_URL_ROOT')) |
||
| 202 | $relativepathstring = preg_replace('/^' . preg_quote(constant('DOL_URL_ROOT'), '/') . '/', '', $relativepathstring); |
||
| 203 | $relativepathstring = preg_replace('/^\//', '', $relativepathstring); |
||
| 204 | $relativepathstring = preg_replace('/^custom\//', '', $relativepathstring); |
||
| 205 | //var_dump($relativepathstring); |
||
| 206 | //var_dump($user->default_values); |
||
| 207 | // Code for search criteria persistence. |
||
| 208 | // Retrieve values if restore_lastsearch_values |
||
| 209 | if (!empty($_GET['restore_lastsearch_values'])) { // Use $_GET here and not GETPOST |
||
| 210 | if (!empty($_SESSION['lastsearch_values_' . $relativepathstring])) { // If there is saved values |
||
| 211 | $tmp = json_decode($_SESSION['lastsearch_values_' . $relativepathstring], true); |
||
| 212 | if (is_array($tmp)) { |
||
| 213 | foreach ($tmp as $key => $val) { |
||
| 214 | if ($key == $paramname) { // We are on the requested parameter |
||
| 215 | $out = $val; |
||
| 216 | break; |
||
| 217 | } |
||
| 218 | } |
||
| 219 | } |
||
| 220 | } |
||
| 221 | // If there is saved contextpage, page or limit |
||
| 222 | if ($paramname == 'contextpage' && !empty($_SESSION['lastsearch_contextpage_' . $relativepathstring])) { |
||
| 223 | $out = $_SESSION['lastsearch_contextpage_' . $relativepathstring]; |
||
| 224 | } elseif ($paramname == 'page' && !empty($_SESSION['lastsearch_page_' . $relativepathstring])) { |
||
| 225 | $out = $_SESSION['lastsearch_page_' . $relativepathstring]; |
||
| 226 | } elseif ($paramname == 'limit' && !empty($_SESSION['lastsearch_limit_' . $relativepathstring])) { |
||
| 227 | $out = $_SESSION['lastsearch_limit_' . $relativepathstring]; |
||
| 228 | } |
||
| 229 | } |
||
| 230 | // Else, retreive default values if we are not doing a sort |
||
| 231 | elseif (!isset($_GET['sortfield'])) { // If we did a click on a field to sort, we do no apply default values. Same if option MAIN_ENABLE_DEFAULT_VALUES is not set |
||
| 232 | if (!empty($_GET['action']) && $_GET['action'] == 'create' && !isset($_GET[$paramname]) && !isset($_POST[$paramname])) { |
||
| 233 | // Search default value from $object->field |
||
| 234 | global $object; |
||
| 235 | if (is_object($object) && isset($object->fields[$paramname]['default'])) { |
||
| 236 | $out = $object->fields[$paramname]['default']; |
||
| 237 | } |
||
| 238 | } |
||
| 239 | if (!empty($conf->global->MAIN_ENABLE_DEFAULT_VALUES)) { |
||
| 240 | if (!empty($_GET['action']) && $_GET['action'] == 'create' && !isset($_GET[$paramname]) && !isset($_POST[$paramname])) { |
||
| 241 | // Now search in setup to overwrite default values |
||
| 242 | if (!empty($user->default_values)) { // $user->default_values defined from menu 'Setup - Default values' |
||
| 243 | if (isset($user->default_values[$relativepathstring]['createform'])) { |
||
| 244 | foreach ($user->default_values[$relativepathstring]['createform'] as $defkey => $defval) { |
||
| 245 | $qualified = 0; |
||
| 246 | if ($defkey != '_noquery_') { |
||
| 247 | $tmpqueryarraytohave = explode('&', $defkey); |
||
| 248 | $tmpqueryarraywehave = explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING'])); |
||
| 249 | $foundintru = 0; |
||
| 250 | foreach ($tmpqueryarraytohave as $tmpquerytohave) { |
||
| 251 | if (!in_array($tmpquerytohave, $tmpqueryarraywehave)) |
||
| 252 | $foundintru = 1; |
||
| 253 | } |
||
| 254 | if (!$foundintru) |
||
| 255 | $qualified = 1; |
||
| 256 | //var_dump($defkey.'-'.$qualified); |
||
| 257 | } else |
||
| 258 | $qualified = 1; |
||
| 259 | |||
| 260 | if ($qualified) { |
||
| 261 | //var_dump($user->default_values[$relativepathstring][$defkey]['createform']); |
||
| 262 | if (isset($user->default_values[$relativepathstring]['createform'][$defkey][$paramname])) { |
||
| 263 | $out = $user->default_values[$relativepathstring]['createform'][$defkey][$paramname]; |
||
| 264 | break; |
||
| 265 | } |
||
| 266 | } |
||
| 267 | } |
||
| 268 | } |
||
| 269 | } |
||
| 270 | } |
||
| 271 | // Management of default search_filters and sort order |
||
| 272 | //elseif (preg_match('/list.php$/', $_SERVER["PHP_SELF"]) && ! empty($paramname) && ! isset($_GET[$paramname]) && ! isset($_POST[$paramname])) |
||
| 273 | elseif (!empty($paramname) && !isset($_GET[$paramname]) && !isset($_POST[$paramname])) { |
||
| 274 | if (!empty($user->default_values)) { // $user->default_values defined from menu 'Setup - Default values' |
||
| 275 | //var_dump($user->default_values[$relativepathstring]); |
||
| 276 | if ($paramname == 'sortfield' || $paramname == 'sortorder') { // Sorted on which fields ? ASC or DESC ? |
||
| 277 | if (isset($user->default_values[$relativepathstring]['sortorder'])) { // Even if paramname is sortfield, data are stored into ['sortorder...'] |
||
| 278 | foreach ($user->default_values[$relativepathstring]['sortorder'] as $defkey => $defval) { |
||
| 279 | $qualified = 0; |
||
| 280 | if ($defkey != '_noquery_') { |
||
| 281 | $tmpqueryarraytohave = explode('&', $defkey); |
||
| 282 | $tmpqueryarraywehave = explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING'])); |
||
| 283 | $foundintru = 0; |
||
| 284 | foreach ($tmpqueryarraytohave as $tmpquerytohave) { |
||
| 285 | if (!in_array($tmpquerytohave, $tmpqueryarraywehave)) |
||
| 286 | $foundintru = 1; |
||
| 287 | } |
||
| 288 | if (!$foundintru) |
||
| 289 | $qualified = 1; |
||
| 290 | //var_dump($defkey.'-'.$qualified); |
||
| 291 | } else |
||
| 292 | $qualified = 1; |
||
| 293 | |||
| 294 | if ($qualified) { |
||
| 295 | $forbidden_chars_to_replace = array(" ", "'", "/", "\\", ":", "*", "?", "\"", "<", ">", "|", "[", "]", ";", "="); // we accept _, -, . and , |
||
| 296 | foreach ($user->default_values[$relativepathstring]['sortorder'][$defkey] as $key => $val) { |
||
| 297 | if ($out) |
||
| 298 | $out .= ', '; |
||
| 299 | if ($paramname == 'sortfield') { |
||
| 300 | $out .= dol_string_nospecial($key, '', $forbidden_chars_to_replace); |
||
| 301 | } |
||
| 302 | if ($paramname == 'sortorder') { |
||
| 303 | $out .= dol_string_nospecial($val, '', $forbidden_chars_to_replace); |
||
| 304 | } |
||
| 305 | } |
||
| 306 | //break; // No break for sortfield and sortorder so we can cumulate fields (is it realy usefull ?) |
||
| 307 | } |
||
| 308 | } |
||
| 309 | } |
||
| 310 | } elseif (isset($user->default_values[$relativepathstring]['filters'])) { |
||
| 311 | foreach ($user->default_values[$relativepathstring]['filters'] as $defkey => $defval) { // $defkey is a querystring like 'a=b&c=d', $defval is key of user |
||
| 312 | $qualified = 0; |
||
| 313 | if ($defkey != '_noquery_') { |
||
| 314 | $tmpqueryarraytohave = explode('&', $defkey); |
||
| 315 | $tmpqueryarraywehave = explode('&', dol_string_nohtmltag($_SERVER['QUERY_STRING'])); |
||
| 316 | $foundintru = 0; |
||
| 317 | foreach ($tmpqueryarraytohave as $tmpquerytohave) { |
||
| 318 | if (!in_array($tmpquerytohave, $tmpqueryarraywehave)) |
||
| 319 | $foundintru = 1; |
||
| 320 | } |
||
| 321 | if (!$foundintru) |
||
| 322 | $qualified = 1; |
||
| 323 | //var_dump($defkey.'-'.$qualified); |
||
| 324 | } else |
||
| 325 | $qualified = 1; |
||
| 326 | |||
| 327 | if ($qualified) { |
||
| 328 | if (isset($_POST['sall']) || isset($_POST['search_all']) || isset($_GET['sall']) || isset($_GET['search_all'])) { |
||
| 329 | // We made a search from quick search menu, do we still use default filter ? |
||
| 330 | if (empty($conf->global->MAIN_DISABLE_DEFAULT_FILTER_FOR_QUICK_SEARCH)) { |
||
| 331 | $forbidden_chars_to_replace = array(" ", "'", "/", "\\", ":", "*", "?", "\"", "<", ">", "|", "[", "]", ";", "="); // we accept _, -, . and , |
||
| 332 | $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$defkey][$paramname], '', $forbidden_chars_to_replace); |
||
| 333 | } |
||
| 334 | } else { |
||
| 335 | $forbidden_chars_to_replace = array(" ", "'", "/", "\\", ":", "*", "?", "\"", "<", ">", "|", "[", "]", ";", "="); // we accept _, -, . and , |
||
| 336 | $out = dol_string_nospecial($user->default_values[$relativepathstring]['filters'][$defkey][$paramname], '', $forbidden_chars_to_replace); |
||
| 337 | } |
||
| 338 | break; |
||
| 339 | } |
||
| 340 | } |
||
| 341 | } |
||
| 342 | } |
||
| 343 | } |
||
| 344 | } |
||
| 345 | } |
||
| 346 | } |
||
| 347 | |||
| 348 | // Substitution variables for GETPOST (used to get final url with variable parameters or final default value with variable paramaters) |
||
| 349 | // Example of variables: __DAY__, __MONTH__, __YEAR__, __MYCOMPANY_COUNTRY_ID__, __USER_ID__, ... |
||
| 350 | // We do this only if var is a GET. If it is a POST, may be we want to post the text with vars as the setup text. |
||
| 351 | if (!is_array($out) && empty($_POST[$paramname]) && empty($noreplace)) { |
||
| 352 | $maxloop = 20; |
||
| 353 | $loopnb = 0; // Protection against infinite loop |
||
| 354 | while (preg_match('/__([A-Z0-9]+_?[A-Z0-9]+)__/i', $out, $reg) && ($loopnb < $maxloop)) { // Detect '__ABCDEF__' as key 'ABCDEF' and '__ABC_DEF__' as key 'ABC_DEF'. Detection is also correct when 2 vars are side by side. |
||
| 355 | $loopnb++; |
||
| 356 | $newout = ''; |
||
| 357 | |||
| 358 | if ($reg[1] == 'DAY') { |
||
| 359 | $tmp = dol_getdate(dol_now(), true); |
||
| 360 | $newout = $tmp['mday']; |
||
| 361 | } elseif ($reg[1] == 'MONTH') { |
||
| 362 | $tmp = dol_getdate(dol_now(), true); |
||
| 363 | $newout = $tmp['mon']; |
||
| 364 | } elseif ($reg[1] == 'YEAR') { |
||
| 365 | $tmp = dol_getdate(dol_now(), true); |
||
| 366 | $newout = $tmp['year']; |
||
| 367 | } elseif ($reg[1] == 'PREVIOUS_DAY') { |
||
| 368 | $tmp = dol_getdate(dol_now(), true); |
||
| 369 | $tmp2 = dol_get_prev_day($tmp['mday'], $tmp['mon'], $tmp['year']); |
||
| 370 | $newout = $tmp2['day']; |
||
| 371 | } elseif ($reg[1] == 'PREVIOUS_MONTH') { |
||
| 372 | $tmp = dol_getdate(dol_now(), true); |
||
| 373 | $tmp2 = dol_get_prev_month($tmp['mon'], $tmp['year']); |
||
| 374 | $newout = $tmp2['month']; |
||
| 375 | } elseif ($reg[1] == 'PREVIOUS_YEAR') { |
||
| 376 | $tmp = dol_getdate(dol_now(), true); |
||
| 377 | $newout = ($tmp['year'] - 1); |
||
| 378 | } elseif ($reg[1] == 'NEXT_DAY') { |
||
| 379 | $tmp = dol_getdate(dol_now(), true); |
||
| 380 | $tmp2 = dol_get_next_day($tmp['mday'], $tmp['mon'], $tmp['year']); |
||
| 381 | $newout = $tmp2['day']; |
||
| 382 | } elseif ($reg[1] == 'NEXT_MONTH') { |
||
| 383 | $tmp = dol_getdate(dol_now(), true); |
||
| 384 | $tmp2 = dol_get_next_month($tmp['mon'], $tmp['year']); |
||
| 385 | $newout = $tmp2['month']; |
||
| 386 | } elseif ($reg[1] == 'NEXT_YEAR') { |
||
| 387 | $tmp = dol_getdate(dol_now(), true); |
||
| 388 | $newout = ($tmp['year'] + 1); |
||
| 389 | } elseif ($reg[1] == 'MYCOMPANY_COUNTRY_ID' || $reg[1] == 'MYCOUNTRY_ID' || $reg[1] == 'MYCOUNTRYID') { |
||
| 390 | $newout = $mysoc->country_id; |
||
| 391 | } elseif ($reg[1] == 'USER_ID' || $reg[1] == 'USERID') { |
||
| 392 | $newout = $user->id; |
||
| 393 | } elseif ($reg[1] == 'USER_SUPERVISOR_ID' || $reg[1] == 'SUPERVISOR_ID' || $reg[1] == 'SUPERVISORID') { |
||
| 394 | $newout = $user->fk_user; |
||
| 395 | } elseif ($reg[1] == 'ENTITY_ID' || $reg[1] == 'ENTITYID') { |
||
| 396 | $newout = $conf->entity; |
||
| 397 | } else |
||
| 398 | $newout = ''; // Key not found, we replace with empty string |
||
| 399 | //var_dump('__'.$reg[1].'__ -> '.$newout); |
||
| 400 | $out = preg_replace('/__' . preg_quote($reg[1], '/') . '__/', $newout, $out); |
||
| 401 | } |
||
| 402 | } |
||
| 403 | |||
| 404 | // Check is done after replacement |
||
| 405 | switch ($check) { |
||
| 406 | case 'none': |
||
| 407 | break; |
||
| 408 | case 'int': |
||
| 409 | // Check param is a numeric value (integer but also float or hexadecimal) |
||
| 410 | if (!is_numeric($out)) { |
||
| 411 | $out = ''; |
||
| 412 | } |
||
| 413 | break; |
||
| 414 | case 'intcomma': |
||
| 415 | if (preg_match('/[^0-9,-]+/i', $out)) |
||
| 416 | $out = ''; |
||
| 417 | break; |
||
| 418 | case 'alpha': |
||
| 419 | if (!is_array($out)) { |
||
| 420 | $out = trim($out); |
||
| 421 | // '"' is dangerous because param in url can close the href= or src= and add javascript functions. |
||
| 422 | // '../' is dangerous because it allows dir transversals |
||
| 423 | if (preg_match('/"/', $out)) |
||
| 424 | $out = ''; |
||
| 425 | else if (preg_match('/\.\.\//', $out)) |
||
| 426 | $out = ''; |
||
| 427 | } |
||
| 428 | break; |
||
| 429 | case 'san_alpha': |
||
| 430 | $out = filter_var($out, FILTER_SANITIZE_STRING); |
||
| 431 | break; |
||
| 432 | case 'aZ': |
||
| 433 | if (!is_array($out)) { |
||
| 434 | $out = trim($out); |
||
| 435 | if (preg_match('/[^a-z]+/i', $out)) |
||
| 436 | $out = ''; |
||
| 437 | } |
||
| 438 | break; |
||
| 439 | case 'aZ09': |
||
| 440 | if (!is_array($out)) { |
||
| 441 | $out = trim($out); |
||
| 442 | if (preg_match('/[^a-z0-9_\-\.]+/i', $out)) |
||
| 443 | $out = ''; |
||
| 444 | } |
||
| 445 | break; |
||
| 446 | case 'aZ09comma': // great to sanitize sortfield or sortorder params that can be t.abc,t.def_gh |
||
| 447 | if (!is_array($out)) { |
||
| 448 | $out = trim($out); |
||
| 449 | if (preg_match('/[^a-z0-9_\-\.,]+/i', $out)) |
||
| 450 | $out = ''; |
||
| 451 | } |
||
| 452 | break; |
||
| 453 | case 'array': |
||
| 454 | if (!is_array($out) || empty($out)) |
||
| 455 | $out = array(); |
||
| 456 | break; |
||
| 457 | case 'nohtml': // Recommended for most scalar parameters |
||
| 458 | $out = dol_string_nohtmltag($out, 0); |
||
| 459 | break; |
||
| 460 | case 'alphanohtml': // Recommended for search parameters |
||
| 461 | if (!is_array($out)) { |
||
| 462 | $out = trim($out); |
||
| 463 | // '"' is dangerous because param in url can close the href= or src= and add javascript functions. |
||
| 464 | // '../' is dangerous because it allows dir transversals |
||
| 465 | if (preg_match('/"/', $out)) |
||
| 466 | $out = ''; |
||
| 467 | else if (preg_match('/\.\.\//', $out)) |
||
| 468 | $out = ''; |
||
| 469 | $out = dol_string_nohtmltag($out); |
||
| 470 | } |
||
| 471 | break; |
||
| 472 | case 'custom': |
||
| 473 | if (empty($filter)) |
||
| 474 | return 'BadFourthParameterForGETPOST'; |
||
| 475 | $out = filter_var($out, $filter, $options); |
||
| 476 | break; |
||
| 477 | } |
||
| 478 | |||
| 479 | // Code for search criteria persistence. |
||
| 480 | // Save data into session if key start with 'search_' or is 'smonth', 'syear', 'month', 'year' |
||
| 481 | if (empty($method) || $method == 3 || $method == 4) { |
||
| 482 | if (preg_match('/^search_/', $paramname) || in_array($paramname, array('sortorder', 'sortfield'))) { |
||
| 483 | //var_dump($paramname.' - '.$out.' '.$user->default_values[$relativepathstring]['filters'][$paramname]); |
||
| 484 | // We save search key only if $out not empty that means: |
||
| 485 | // - posted value not empty, or |
||
| 486 | // - if posted value is empty and a default value exists that is not empty (it means we did a filter to an empty value when default was not). |
||
| 487 | |||
| 488 | if ($out != '') { // $out = '0' or 'abc', it is a search criteria to keep |
||
| 489 | $user->lastsearch_values_tmp[$relativepathstring][$paramname] = $out; |
||
| 490 | } |
||
| 491 | } |
||
| 492 | } |
||
| 493 | |||
| 494 | return $out; |
||
| 495 | } |
||
| 497 |
