CourseChatUtils::saveMessage()

Complexity

Conditions	20
Paths	> 20000

Size

Total Lines	164
Code Lines	118

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public function saveMessage($message, $friendId = 0)
    {
        $this->dbg('saveMessage.in', ['friendId' => (int)$friendId, 'rawLen' => strlen((string)$message)]);
        if (!is_string($message) || trim($message) === '') { return false; }

        // names (one file per day/scope)
        [$fileTitle, $slug] = $this->buildNames((int)$friendId);

        $em = Database::getManager();
        /** @var ResourceNodeRepository $nodeRepo */
        $nodeRepo = $em->getRepository(ResourceNode::class);
        $convRepo = $em->getRepository(CChatConversation::class);
        $rfRepo   = $em->getRepository(ResourceFile::class);

        // parent (chat root)
        $parent = $nodeRepo->find($this->resourceNode->getId());
        if (!$parent) { $this->dbg('saveMessage.error.noParent'); return false; }

        // serialize writers for the same daily file (parent+slug)
        $lockPath = sys_get_temp_dir().'/ch_chat_lock_'.$parent->getId().'_'.$slug.'.lock';
        $lockH = @fopen($lockPath, 'c');
        if ($lockH) { @flock($lockH, LOCK_EX); }

$lockH is of type false|resource, thus it always evaluated to false.

It seems like you do not handle an error condition for flock(). This can introduce security issues, and is generally not recommended.

        try {
            // latest node for this day/scope (title OR slug)
            $qb = $em->createQueryBuilder();
            $qb->select('n')
                ->from(ResourceNode::class, 'n')
                ->where('n.parent = :parent AND (n.title = :title OR n.slug = :slug)')
                ->setParameter('parent', $parent)
                ->setParameter('title', $fileTitle)
                ->setParameter('slug',  $slug)
                ->orderBy('n.createdAt', 'DESC')
                ->addOrderBy('n.id', 'DESC')
                ->setMaxResults(1);
            /** @var ResourceNode|null $node */
            $node = $qb->getQuery()->getOneOrNullResult();

            // create node + conversation once
            if (!$node) {
                $conversation = new CChatConversation();
                (method_exists($conversation, 'setTitle')
                    ? $conversation->setTitle($fileTitle)
                    : $conversation->setResourceName($fileTitle));
                $conversation->setParentResourceNode($parent->getId());

                $node = new ResourceNode();
                $node->setTitle($fileTitle);
                $node->setSlug($slug);
                $node->setResourceType($parent->getResourceType());
                $node->setCreator(api_get_user_entity(api_get_user_id()));
                $node->setParent($parent);

                if (method_exists($conversation, 'setResourceNode')) {
                    $conversation->setResourceNode($node);
                }

                $em->persist($node);
                $em->persist($conversation);

                $course  = api_get_course_entity();
                $session = api_get_session_entity();
                $group   = api_get_group_entity();
                $conversation->setParent($course);
                $conversation->addCourseLink(
                    $course, $session, $group
                );

                $em->flush();
            }

            // ensure conversation exists for node
            $conversation = $convRepo->findOneBy(['resourceNode' => $node]);
            if (!$conversation) {
                $conversation = new CChatConversation();
                (method_exists($conversation, 'setTitle')
                    ? $conversation->setTitle($fileTitle)
                    : $conversation->setResourceName($fileTitle));
                $conversation->setParentResourceNode($parent->getId());
                if (method_exists($conversation, 'setResourceNode')) {
                    $conversation->setResourceNode($node);
                }
                $em->persist($conversation);

                $course  = api_get_course_entity();
                $session = api_get_session_entity();
                $group   = api_get_group_entity();
                $conversation->setParent($course);
                $conversation->addCourseLink(
                    $course, $session, $group
                );

                $em->flush();
            }

            // build message bubble
            $user      = api_get_user_entity($this->userId);
            $isMaster  = api_is_course_admin();
            $timeNow   = date('d/m/y H:i:s');
            $userPhoto = \UserManager::getUserPicture($this->userId);
            $htmlMsg   = self::prepareMessage($message);

            $bubble = $isMaster
                ? '<div class="message-teacher"><div class="content-message"><div class="chat-message-block-name">'
                .\UserManager::formatUserFullName($user).'</div><div class="chat-message-block-content">'
                .$htmlMsg.'</div><div class="message-date">'.$timeNow
                .'</div></div><div class="icon-message"></div><img class="chat-image" src="'.$userPhoto.'"></div>'
                : '<div class="message-student"><img class="chat-image" src="'.$userPhoto.'"><div class="icon-message"></div>'
                .'<div class="content-message"><div class="chat-message-block-name">'.\UserManager::formatUserFullName($user)
                .'</div><div class="chat-message-block-content">'.$htmlMsg.'</div><div class="message-date">'
                .$timeNow.'</div></div></div>';

            // always target latest ResourceFile for today (by id desc)
            $rfQb = $em->createQueryBuilder();
            $rf   = $rfQb->select('rf')
                ->from(ResourceFile::class, 'rf')
                ->where('rf.resourceNode = :node AND rf.originalName = :name')
                ->setParameter('node', $node)
                ->setParameter('name', $fileTitle)
                ->orderBy('rf.id', 'DESC')
                ->setMaxResults(1)
                ->getQuery()
                ->getOneOrNullResult();

            // read current content and append
            $existing = '';
            if ($rf) {
                try { $existing = $nodeRepo->getResourceNodeFileContent($node, $rf) ?? ''; }
                catch (\Throwable $e) { $existing = ''; }
            }
            $newContent = $existing.$bubble;

            // write back (reuse same physical path)
            if ($rf) {
                $fs       = $nodeRepo->getFileSystem();
                $fileName = $nodeRepo->getFilename($rf);
                if ($fs->fileExists($fileName)) { $fs->delete($fileName); }
                $fs->write($fileName, $newContent);
                if (method_exists($rf, 'setSize')) { $rf->setSize(strlen($newContent)); $em->persist($rf); }
                $em->flush();
            } else {
                // first write of the day → create the ResourceFile with the whole content
                if (method_exists($this->repository, 'addFileFromString')) {
                    $this->repository->addFileFromString($conversation, $fileTitle, 'text/html', $newContent, true);
                    $em->flush();
                } else {
                    $h = tmpfile(); fwrite($h, $newContent);
                    $meta = stream_get_meta_data($h);
                    $uploaded = new UploadedFile(
                        $meta['uri'], $fileTitle, 'text/html', null, true
                    );
                    $this->repository->addFile($conversation, $uploaded);
                    $em->flush();
                }
            }

            $this->dbg('saveMessage.append.ok', ['nodeId' => $node->getId(), 'bytes' => strlen($newContent)]);
            return true;

        } catch (\Throwable $e) {
            $this->dbg('saveMessage.error', ['err' => $e->getMessage()]);
            return false;
        } finally {
            if ($lockH) { @flock($lockH, LOCK_UN); @fclose($lockH); }

It seems like you do not handle an error condition for fclose(). This can introduce security issues, and is generally not recommended.

$lockH is of type false|resource, thus it always evaluated to false.

        }