Chamilo\CourseBundle\Component\CourseCopy\CourseArchiver::readCourse()

Complexity

Conditions	28
Paths	5940

Size

Total Lines	155
Code Lines	94

Duplication

Lines	0
Ratio	0 %

Importance

Changes

0

<?php
    public static function readCourse(string $filename, bool $delete = false): false|Course
    {
        self::cleanBackupDir();
        self::createBackupDir();

        $backupDir = rtrim(self::getBackupDir(), '/') . '/';
        $zipPath = $backupDir . $filename;

        if (!is_file($zipPath)) {
            throw new RuntimeException('Backup file not found: ' . $filename);
        }

        self::dlog('readCourse.begin', ['filename' => $filename, 'zipPath' => $zipPath]);

        // 1) Extract zip into a temp directory
        $tmp = $backupDir . 'CourseArchiver_' . uniqid('', true) . '/';
        (new Filesystem())->mkdir($tmp);

        $zip = new ZipArchive();
        if (true !== $zip->open($zipPath)) {
            throw new RuntimeException('Cannot open zip: ' . $filename);
        }
        if (!$zip->extractTo($tmp)) {
            $zip->close();
            throw new RuntimeException('Cannot extract zip: ' . $filename);
        }
        $zip->close();

        // 2) Read course_info.dat (search nested if necessary)
        $courseInfoDat = $tmp . 'course_info.dat';
        if (!is_file($courseInfoDat)) {
            $rii = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($tmp));
            foreach ($rii as $f) {
                if ($f->isFile() && $f->getFilename() === 'course_info.dat') {
                    $courseInfoDat = $f->getPathname();
                    break;
                }
            }
            if (!is_file($courseInfoDat)) {
                throw new RuntimeException('course_info.dat not found in backup');
            }
        }

        $raw = (string) @file_get_contents($courseInfoDat);
        if ($raw === '') {
            throw new RuntimeException('course_info.dat is empty');
        }

        self::dlog('readCourse.course_info', [
            'path' => $courseInfoDat,
            'size' => strlen($raw),
            'md5'  => md5($raw),
            'magic_ascii' => preg_replace('/[^\x20-\x7E]/', '.', substr($raw, 0, 16)),
            'magic_hex'   => bin2hex(substr($raw, 0, 8)),
        ]);

        // 3) Decode: prefer base64(serialize), else raw serialize
        $payload = base64_decode($raw, true);
        $encoding = 'base64(php-serialize)';

        if ($payload === false) {
            // Some very old backups stored raw serialize without base64
            $payload = $raw;
            $encoding = 'php-serialize';
        }

        // 4) Coerce numeric-string identifiers to int in serialized payload
        $payload = self::coerceNumericStringsInSerialized($payload);

        // 5) Register legacy aliases BEFORE unserialize
        self::registerLegacyAliases();

        // 6) Unserialize with robust fallbacks
        $course = null;
        $unserOk = false;
        $unserErr = null;
        $usedRelaxed = false;

        set_error_handler(static function () { /* suppress E_NOTICE/E_WARNING from unserialize */ });
        try {
            if (class_exists('UnserializeApi')) {
                /** @var Course $c */
                $c = UnserializeApi::unserialize('course', $payload);
                $course = $c;
                $unserOk = is_object($course);
            } else {
                /** @var Course|false $c */
                $c = @unserialize($payload, ['allowed_classes' => true]); // may throw TypeError with typed props
                if (is_object($c) || ($c === false && trim($payload) === 'b:0;')) {
                    $course = $c;
                    $unserOk = is_object($course);
                } else {
                    $unserOk = false;
                }

                // Relaxed fallback: do not instantiate classes; convert incomplete classes to stdClass
                if (!$unserOk) {
                    /** @var mixed $c2 */
                    $c2 = @unserialize($payload, ['allowed_classes' => false]);
                    if ($c2 !== false || trim($payload) === 'b:0;') {
                        $c2 = self::deincomplete($c2);
                        if (is_object($c2)) {
                            $course = $c2;
                            $unserOk = true;
                            $usedRelaxed = true;
                        }
                    }
                }
            }
        } catch (Throwable $e) {
            $unserErr = $e->getMessage();

            // Hard fallback inside catch as well
            try {
                $c2 = @unserialize($payload, ['allowed_classes' => false]);
                if ($c2 !== false || trim($payload) === 'b:0;') {
                    $c2 = self::deincomplete($c2);
                    if (is_object($c2)) {
                        $course = $c2;
                        $unserOk = true;
                        $usedRelaxed = true;
                        $unserErr = null;
                    }
                }
            } catch (Throwable $e2) {
                $unserErr = $unserErr . ' | relaxed: ' . $e2->getMessage();
            }
        } finally {
            restore_error_handler();
        }

        self::dlog('readCourse.unserialize', [
            'ok' => $unserOk,
            'encoding' => $encoding,
            'relaxed' => $usedRelaxed,
            'error' => $unserErr,
        ]);

        if (!$unserOk || !is_object($course)) {
            throw new RuntimeException('Could not unserialize legacy course');
        }

        // 7) Normalize numeric identifiers post-unserialize (safe)
        self::normalizeIds($course);

        // 8) Optionally delete uploaded file (compat with v1)
        if ($delete && is_file($zipPath)) {
            @unlink($zipPath);

It seems like you do not handle an error condition for unlink(). This can introduce security issues, and is generally not recommended.

            self::dlog('readCourse.deleted_zip', ['path' => $zipPath]);
        }

        self::dlog('readCourse.end', ['ok' => true]);

        // Keep temp dir; some restore flows need extracted files
        return $course;
    }