FoxyCart_Helper

Complexity

Total Complexity

66

Size/Duplication

Total Lines	496
Duplicated Lines	0 %

Importance

Changes	2
Bugs	0	Features	0

8 Methods

Rating	Name	Duplication	Size	Complexity
A	getCartUrl()	0	3	1
A	getSecret()	0	3	1
F	fc_hash_querystring()	0	89	14
F	fc_hash_html()	0	273	38
A	__construct()	0	4	1
A	setCartUrl()	0	3	1
A	setSecret()	0	3	1
B	fc_hash_value()	0	30	9

<?php

use Dynamic\Foxy\Model\Foxy;

/**
 * FoxyCart_Helper
 *
 * @author FoxyCart.com
 * @copyright FoxyCart.com LLC, 2011
 * @version 2.0.0.20171024
 * @license MIT http://opensource.org/licenses/MIT
 * @example http://wiki.foxycart.com/docs/cart/validation
 *
 * Requirements:
 *   - Form "code" values should not have leading or trailing whitespace.
 *   - Cannot use double-pipes in an input's name
 *   - Empty textareas are assumed to be "open"
 */
class FoxyCart_Helper
{

    /**
     * API Key (Secret)
     *
     * @var string
     **/
    private static $secret;

    public static function setSecret($secret)
    {
        self::$secret = $secret;
    }
    public static function getSecret()
    {
        return self::$secret;
    }

    /**
     * Cart URL
     *
     * @var string
     * Notes: Could be 'https://yourdomain.foxycart.com/cart' or 'https://secure.yourdomain.com/cart'
     **/
    protected static $cart_url;

    public static function setCartUrl($cart_url)
    {
        self::$cart_url = $cart_url;
    }
    public static function getCartUrl()
    {
        return self::$cart_url;
    }

    public function __construct()
    {
        self::setCartURL(Foxy::getStoreDomain());
        self::setSecret(Foxy::getStoreKey());
    }

    /**
     * Cart Excludes
     *
     * Arrays of values and prefixes that should be ignored when signing links and forms.
     * @var array
     */
    protected static $cart_excludes = array(
        // Analytics values
        '_', '_ga', '_ke',
        // Cart values
        'cart', 'fcsid', 'empty', 'coupon', 'output', 'sub_token', 'redirect', 'callback', 'locale', 'template_set',
        // Checkout pre-population values
        'customer_email', 'customer_first_name', 'customer_last_name', 'customer_address1', 'customer_address2',
        'customer_city', 'customer_state', 'customer_postal_code', 'customer_country', 'customer_phone',
        'customer_company',
        'billing_first_name', 'billing_last_name', 'billing_address1', 'billing_address2',
        'billing_city', 'billing_postal_code', 'billing_region', 'billing_phone', 'billing_company',
        'shipping_first_name', 'shipping_last_name', 'shipping_address1', 'shipping_address2',
        'shipping_city', 'shipping_state', 'shipping_country', 'shipping_postal_code', 'shipping_region',
        'shipping_phone', 'shipping_company',
    );
    protected static $cart_excludes_prefixes = array(
        'h:', 'x:', '__', 'utm_'
    );

    /**
     * Debugging
     *
     * Set to $debug to TRUE to enable debug logging.
     *
     */
    protected static $debug = false;
    protected static $log = array();


    /**
     * "Link Method": Generate HMAC SHA256 for GET Query Strings
     *
     * Notes: Can't parse_str because PHP doesn't support non-alphanumeric characters as array keys.
     * @return string
     **/
    public static function fc_hash_querystring($qs, $output = true)
    {
        self::$log[] = '<strong>Signing link</strong> with data: '.htmlspecialchars(substr($qs, 0, 1500)).
            '...';
        $fail = self::$cart_url.'?'.$qs;

        // If the link appears to be hashed already, don't bother
        if (strpos($qs, '||')) {
            self::$log[] = '<strong>Link appears to be signed already</strong>: '.htmlspecialchars($code[0]);

The variable $code does not exist. Did you maybe mean $codes?

            return $fail;
        }

        // Stick an ampersand on the beginning of the querystring to make matching the first element a little easier
        $qs = '&'.$qs;

        // Get all the prefixes, codes, and name=value pairs
        preg_match_all(
            '%(?P<amp>&(?:amp;)?)(?P<prefix>[a-z0-9]{1,3}:)?(?P<name>[^=]+)=(?P<value>[^&]+)%',
            $qs,
            $pairs,
            PREG_SET_ORDER
        );
        self::$log[] = 'Found the following pairs to sign:<pre>'.htmlspecialchars(print_r($pairs, true)).'</pre>';

        // Get all the "code" values, set the matches in $codes
        $codes = array();
        foreach ($pairs as $pair) {
            if ($pair['name'] == 'code') {
                $codes[$pair['prefix']] = $pair['value'];
            }
        }
        foreach ($pairs as $pair) {
            if ($pair['name'] == 'parent_code') {
                $codes[$pair['prefix']] .= $pair['value'];
            }
        }
        if (! count($codes)) {
            self::$log[] = '<strong style="color:#600;">No code found</strong> for the above link.';
            return $fail;
        }
        self::$log[] = '<strong style="color:orange;">CODES found:</strong> '.
            htmlspecialchars(print_r($codes, true));

        // Sign the name/value pairs
        foreach ($pairs as $pair) {
            // Skip the cart excludes
            $include_pair = true;
            if (in_array($pair['name'], self::$cart_excludes)) {
                $include_pair = false;
            }
            foreach (self::$cart_excludes_prefixes as $exclude_prefix) {
                if (substr(
                    strtolower($pair['prefix'].$pair['name']),
                    0,
                    strlen($exclude_prefix)
                ) == $exclude_prefix
                ) {
                    $include_pair = false;
                }
            }
            if (!$include_pair) {
                self::$log[] = '<strong style="color:purple;">Skipping</strong> the reserved parameter or prefix "'.
                    $pair['prefix'].$pair['name'].'" = '.$pair['value'];
                continue;
            }
            // Continue to sign the value and replace the name=value in the querystring with name=value||hash
            $value = self::fc_hash_value(
                $codes[$pair['prefix']],
                urldecode($pair['name']),
                urldecode($pair['value']),
                'value',
                false,
                'urlencode'
            );
            if (urldecode($pair['value']) == '--OPEN--') {
                $replacement = $pair['amp'].$value.'=';
            } else {
                $replacement = $pair['amp'].$pair['prefix'].urlencode($pair['name']).'='.$value;
            }
            $qs = str_replace($pair[0], $replacement, $qs);
            self::$log[] = 'Signed <strong>'.$pair['name'].'</strong> = <strong>'.$pair['value'].'</strong> with '.
                $replacement.'.<br />Replacing: '.$pair[0].'<br />With... '.$replacement;
        }
        $qs = ltrim($qs, '&'); // Get rid of that leading ampersand we added earlier

        if ($output) {
            echo self::$cart_url.'?'.$qs;
        } else {
            return self::$cart_url.'?'.$qs;
        }
    }


    /**
     * "Form Method": Generate HMAC SHA256 for form elements or individual <input />s
     *
     * @return string
     **/
    public static function fc_hash_value(
        $product_code,
        $option_name,
        $option_value = '',
        $method = 'name',
        $output = true,
        $urlencode = false
    ) {
        if (!$product_code || !$option_name) {
            return false;

The expression return false returns the type false which is incompatible with the documented return type string.

        }
        $option_name = str_replace(' ', '_', $option_name);
        if ($option_value == '--OPEN--') {
            $hash = hash_hmac('sha256', $product_code.$option_name.$option_value, self::$secret);
            $value = ($urlencode) ? urlencode($option_name).'||'.$hash.'||open' : $option_name.'||'.$hash.'||open';
        } else {
            $hash = hash_hmac('sha256', $product_code.$option_name.$option_value, self::$secret);
            self::$log[] = '<strong>Challenge: </strong><span style="font-family:monospace; color:blue"><code>'.
                $product_code.$option_name.$option_value.'</code></span>';
            if ($method == 'name') {
                $value = ($urlencode) ? urlencode($option_name).'||'.$hash : $option_name.'||'.$hash;
            } else {
                $value = ($urlencode) ? urlencode($option_value).'||'.$hash : $option_value.'||'.$hash;
            }
        }

        if ($output) {
            echo $value;
        } else {
            return $value;
        }
    }

    /**
     * Raw HTML Signing: Sign all links and form elements in a block of HTML
     *
     * Accepts a string of HTML and signs all links and forms.
     * Requires link 'href' and form 'action' attributes to use 'https' and not 'http'.
     * Requires a 'code' to be set in every form.
     *
     * @return string
     **/
    public static function fc_hash_html($html)
    {
        // Initialize some counting
        $count['temp'] = 0; // temp counter

$count was never initialized. Although not strictly required by PHP, it is generally a good practice to add $count = array(); before regardless.

        $count['links'] = 0;
        $count['forms'] = 0;
        $count['inputs'] = 0;
        $count['lists'] = 0;
        $count['textareas'] = 0;

        // Find and sign all the links
        preg_match_all(
            '%<a .*?href=([\'"])'.preg_quote(self::$cart_url).'(?:\.php)?\?(.+?)\1.*?>%i',
            $html,
            $querystrings
        );
        self::$log[] = '<strong>Querystrings: </strong><pre>' . htmlspecialchars(print_r($querystrings, true)) .
            '</pre>';
        // print_r($querystrings);
        foreach ($querystrings[2] as $querystring) {
            // If it's already signed, skip it.
            if (strpos($querystring, '||')) {
                continue;
            }
            $pattern = '%(href=([\'"]))'.preg_quote(self::$cart_url, '%').'(?:\.php)?\?'.
                preg_quote($querystring, '%').'\2%i';
            $signed = self::fc_hash_querystring($querystring, false);
            $html = preg_replace($pattern, '$1'.$signed.'$2', $html, -1, $count['temp']);
            $count['links'] += $count['temp'];
        }
        unset($querystrings);

        // Find and sign all form values
        preg_match_all(
            '%<form [^>]*?action=[\'"]'.preg_quote(self::$cart_url).'(?:\.php)?[\'"].*?>(.+?)</form>%is',
            $html,
            $forms
        );
        foreach ($forms[1] as $form) {
            $count['forms']++;
            self::$log[] = '<strong>Signing form</strong> with data: '.
                htmlspecialchars(substr($form, 0, 150)).'...';

            // Store the original form so we can replace it when we're done
            $form_original = $form;

            // Check for the "code" input, set the matches in $codes
            if (!preg_match_all(
                '%<[^>]*?name=([\'"])([0-9]{1,3}:)?code\1[^>]*?>%i',
                $form,
                $codes,
                PREG_SET_ORDER
            )) {
                self::$log[] = '<strong style="color:#600;">No code found</strong> for the above form.';
                continue;
            }
            // For each code found, sign the appropriate inputs
            foreach ($codes as $code) {
                // If the form appears to be hashed already, don't bother
                if (strpos($code[0], '||')) {
                    self::$log[] = '<strong>Form appears to be signed already</strong>: '.htmlspecialchars($code[0]);
                    continue;
                }
                // Get the code and the prefix
                $prefix = (isset($code[2])) ? $code[2] : '';
                preg_match('%<[^>]*?value=([\'"])(.+?)\1[^>]*?>%i', $code[0], $code);
                $code = trim($code[2]);
                self::$log[] = '<strong>Prefix for '.htmlspecialchars($code).'</strong>: '.htmlspecialchars($prefix);
                if (!$code) { // If the code is empty, skip this form or specific prefixed elements
                    continue;
                }

                // Sign all <input /> elements with matching prefix
                preg_match_all(
                    '%<input [^>]*?name=([\'"])'.preg_quote($prefix).'(?![0-9]{1,3})(?:.+?)\1[^>]*>%i',
                    $form,
                    $inputs
                );

                // get parent codes if they exist and append them to our code
                $parent_code_index = false;
                foreach ($inputs[0] as $key => $item) {
                    if (strpos($item, 'parent_code') !== false) {
                        $parent_code_index = $key;
                    }
                }
                if ($parent_code_index !== false) {
                    if (preg_match('%value=([\'"])(.*?)\1%i', $inputs[0][$parent_code_index], $value)) {
                        $code .= $value[2];
                    }
                }

                foreach ($inputs[0] as $input) {
                    $count['inputs']++;
                    // Test to make sure both name and value attributes are found
                    if (preg_match(
                        '%name=([\'"])'.preg_quote($prefix).'(?![0-9]{1,3})(.+?)\1%i',
                        $input,
                        $name
                    ) > 0) {
                        preg_match('%value=([\'"])(.*?)\1%i', $input, $value);
                        $value = (count($value) > 0) ? $value : array('', '', '');
                        preg_match('%type=([\'"])(.*?)\1%i', $input, $type);
                        $type = (count($type) > 0) ? $type : array('', '', '');
                        // Skip the cart excludes
                        $include_input = true;
                        if (in_array($prefix.$name[2], self::$cart_excludes)) {
                            $include_input = false;
                        }
                        foreach (self::$cart_excludes_prefixes as $exclude_prefix) {
                            if (substr(strtolower($prefix.$name[2]), 0, strlen($exclude_prefix)) == $exclude_prefix) {
                                $include_input = false;
                            }
                        }
                        if (!$include_input) {
                            self::$log[] = '<strong style="color:purple;">Skipping</strong> the reserved parameter or 
                                prefix "'.$prefix.$name[2].'" = '.$value[2];
                            continue;
                        }
                        self::$log[] = '<strong>INPUT['.$type[2].']:</strong> Name: <strong>'.$prefix.
                            htmlspecialchars(preg_quote($name[2])).'</strong>';
                        $value[2] = ($value[2] == '') ? '--OPEN--' : $value[2];
                        if ($type[2] == 'radio') {
                            self::$log[] = '<strong>Replacement Pattern:</strong> ([\'"])'.
                                $prefix.preg_quote($value[2]).'\1';
                            $input_signed = preg_replace(
                                '%([\'"])'.preg_quote($value[2]).'\1%',
                                '${1}'.self::fc_hash_value($code, $name[2], $value[2], 'value', false).
                                "$1",
                                $input
                            );
                        } else {
                            self::$log[] = '<strong>Replacement Pattern:</strong> name=([\'"])'.
                                $prefix.preg_quote($name[2]).'\1';
                            $input_signed = preg_replace(
                                '%name=([\'"])'.$prefix.preg_quote($name[2]).'\1%',
                                'name=${1}'.$prefix.self::fc_hash_value(
                                    $code,
                                    $name[2],
                                    $value[2],
                                    'name',
                                    false
                                )."$1",
                                $input
                            );
                        }
                        self::$log[] = '<strong>INPUT:</strong> Code: <strong>'.htmlspecialchars($prefix.$code).
                            '</strong> :: Name: <strong>'.htmlspecialchars($prefix.$name[2]).
                            '</strong> :: Value: <strong>'.htmlspecialchars($value[2]).
                            '</strong><br />Initial input: '.htmlspecialchars($input).
                            '<br />Signed: <span style="color:#060;">'.htmlspecialchars($input_signed).'</span>';
                        $form = str_replace($input, $input_signed, $form);
                    }
                }
                self::$log[] = '<strong>FORM after INPUTS:</strong> <pre>'.htmlspecialchars($form).'</pre>';

                // Sign all <option /> elements
                preg_match_all(
                    '%<select [^>]*name=([\'"])'.preg_quote($prefix).'(?![0-9]{1,3})(.+?)\1[^>]*>(.+?)</select>%is',
                    $form,
                    $lists,
                    PREG_SET_ORDER
                );
                foreach ($lists as $list) {
                    $count['lists']++;
                    // Skip the cart excludes
                    $include_input = true;
                    if (in_array($prefix.$list[2], self::$cart_excludes)) {
                        $include_input = false;
                    }
                    foreach (self::$cart_excludes_prefixes as $exclude_prefix) {
                        if (substr(strtolower($prefix.$list[2]), 0, strlen($exclude_prefix)) == $exclude_prefix) {
                            $include_input = false;
                        }
                    }
                    if (!$include_input) {
                        self::$log[] = '<strong style="color:purple;">Skipping</strong> the reserved parameter or 
                            prefix "'.$prefix.$list[2];
                        continue;
                    }
                    preg_match_all(
                        '%<option [^>]*value=([\'"])(.+?)\1[^>]*>(?:.*?)</option>%i',
                        $list[0],
                        $options,
                        PREG_SET_ORDER
                    );
                    self::$log[] = '<strong>Options:</strong> <pre>'.htmlspecialchars(print_r($options, true)).'</pre>';
                    unset($form_part_signed);
                    foreach ($options as $option) {
                        if (!isset($form_part_signed)) {
                            $form_part_signed = $list[0];
                        }
                        $option_signed = preg_replace(
                            '%'.preg_quote($option[1]).preg_quote($option[2]).preg_quote($option[1]).'%',
                            $option[1].self::fc_hash_value($code, $list[2], $option[2], 'value', false).
                                $option[1],
                            $option[0]
                        );
                        $form_part_signed = str_replace($option[0], $option_signed, $form_part_signed);
                        self::$log[] = '<strong>OPTION:</strong> Code: <strong>'.htmlspecialchars($prefix.$code).
                            '</strong> :: Name: <strong>'.htmlspecialchars($prefix.$list[2]).
                            '</strong> :: Value: <strong>'.htmlspecialchars($option[2]).
                            '</strong><br />Initial option: '.htmlspecialchars($option[0]).
                            '<br />Signed: <span style="color:#060;">'.htmlspecialchars($option_signed).'</span>';
                    }
                    $form = str_replace($list[0], $form_part_signed, $form);

The variable $form_part_signed does not seem to be defined for all execution paths leading up to this point.

                }
                self::$log[] = '<strong>FORM after OPTIONS:</strong> <pre>'.htmlspecialchars($form).'</pre>';

                // Sign all <textarea /> elements
                preg_match_all('%<textarea [^>]*name=([\'"])'.preg_quote($prefix).
                    '(?![0-9]{1,3})(.+?)\1[^>]*>(.*?)</textarea>%is', $form, $textareas, PREG_SET_ORDER);
                // echo "\n\nTextareas: ".print_r($textareas, true);
                foreach ($textareas as $textarea) {
                    $count['textareas']++;
                    // Skip the cart excludes
                    $include_input = true;
                    if (in_array($prefix.$textarea[2], self::$cart_excludes)) {
                        $include_input = false;
                    }
                    foreach (self::$cart_excludes_prefixes as $exclude_prefix) {
                        if (substr(strtolower($prefix.$textarea[2]), 0, strlen($exclude_prefix)) == $exclude_prefix) {
                            $include_input = false;
                        }
                    }
                    if (!$include_input) {
                        self::$log[] = '<strong style="color:purple;">Skipping</strong> the reserved parameter or 
                            prefix "'. $prefix.$textarea[2];
                        continue;
                    }
                    // Tackle implied "--OPEN--" first, if textarea is empty
                    $textarea[3] = ($textarea[3] == '') ? '--OPEN--' : $textarea[3];
                    $textarea_signed = preg_replace(
                        '%name=([\'"])'.preg_quote($prefix.$textarea[2]).'\1%',
                        "name=$1".self::fc_hash_value($code, $textarea[2], $textarea[3], 'name', false)."$1",
                        $textarea[0]
                    );
                    $form = str_replace($textarea[0], $textarea_signed, $form);
                    self::$log[] = '<strong>TEXTAREA:</strong> Code: <strong>'.htmlspecialchars($prefix.$code).
                        '</strong> :: Name: <strong>'.htmlspecialchars($prefix.$textarea[2]).
                        '</strong> :: Value: <strong>'.htmlspecialchars($textarea[3]).
                        '</strong><br />Initial textarea: '.htmlspecialchars($textarea[0]).
                        '<br />Signed: <span style="color:#060;">'.htmlspecialchars($textarea_signed).'</span>';
                }
                self::$log[] = '<strong>FORM after TEXTAREAS:</strong> <pre>'.htmlspecialchars($form).'</pre>';

                // Exclude all <button> elements
                $form = preg_replace(
                    '%<button ([^>]*)name=([\'"])(.*?)\1([^>]*>.*?</button>)%i',
                    "<button $1name=$2x:$3$4",
                    $form
                );
            }
            // Replace the entire form
            self::$log[] = '<strong>FORM after ALL:</strong> <pre>'.htmlspecialchars($form).'</pre>'.'replacing <pre>'.
                htmlspecialchars($form_original).'</pre>';
            $html = str_replace($form_original, $form, $html);
            self::$log[] = '<strong>FORM end</strong><hr />';
        }

        // Return the signed output
        $output = '';
        if (self::$debug) {
            self::$log['Summary'] = $count['links'].' links signed. '.$count['forms'].' forms signed. '.
                $count['inputs'].' inputs signed. '.$count['lists'].' lists signed. '.$count['textareas'].
                ' textareas signed.';
            $output .= '<div style="background:#fff;"><h3>FoxyCart HMAC Debugging:</h3><ul>';
            foreach (self::$log as $name => $value) {
                $output .= '<li><strong>'.$name.':</strong> '.$value.'</li>'."\n";
            }
            $output .= '</ul><hr />';
        }
        return $output.$html;
    }
}