parseModification()

Complexity

Conditions	77
Paths	> 20000

Size

Total Lines	393
Code Lines	179

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	84
CRAP Score	950.2326

Importance

Changes	2
Bugs	0	Features	0

<?php
function parseModification($file, $testing = true, $undo = false, $theme_paths = [])
{
	global $txt, $modSettings;

	detectServer()->setTimeLimit(600);

	$xml = new XmlArray(strtr($file, ["\r" => '']));
	$actions = [];
	$everything_found = true;

	if (!$xml->exists('modification') || !$xml->exists('modification/file'))
	{
		$actions[] = [
			'type' => 'error',
			'filename' => '-',
			'debug' => $txt['package_modification_malformed']
		];

		return $actions;
	}

	// Get the XML data.
	$files = $xml->set('modification/file');

	// Use this for holding all the template changes in this mod.
	$template_changes = [];

	// This is needed to hold the long paths, as they can vary...
	$long_changes = [];

	// First, we need to build the list of all the files likely to get changed.
	foreach ($files as $file)

$file is overwriting one of the parameters of this function.

	{
		// What is the filename we're currently on?
		$filename = parse_path(trim($file->fetch('@name')));

		// Now, we need to work out whether this is even a template file...
		foreach ($theme_paths as $id => $theme)
		{
			// If this filename is relative, if so take a guess at what it should be.
			$real_filename = $filename;
			if (str_starts_with($filename, 'themes'))
			{
				$real_filename = BOARDDIR . '/' . $filename;
			}

			if (str_starts_with($real_filename, $theme['theme_dir']))
			{
				$template_changes[$id][] = substr($real_filename, strlen($theme['theme_dir']) + 1);
				$long_changes[$id][] = $filename;
			}
		}
	}

	// Custom themes to add.
	$custom_themes_add = [];

	// If we have some template changes, we need to build a master link of what new ones are required for the custom themes.
	if (!empty($template_changes[1]))
	{
		foreach ($theme_paths as $id => $theme)
		{
			// Default is getting done anyway, so no need for involvement here.
			if ($id == 1)
			{
				continue;
			}

			// For every template, do we want it? Yea, no, maybe?
			foreach ($template_changes[1] as $index => $template_file)
			{
				// What, it exists and we haven't already got it?! Lordy, get it in!
				if (file_exists($theme['theme_dir'] . '/' . $template_file) && (!isset($template_changes[$id]) || !in_array($template_file, $template_changes[$id])))
				{
					// Now let's add it to the "todo" list.
					$custom_themes_add[$long_changes[1][$index]][$id] = $theme['theme_dir'] . '/' . $template_file;
				}
			}
		}
	}

	foreach ($files as $file)

$file is overwriting one of the parameters of this function.

	{
		// This is the actual file referred to in the XML document...
		$files_to_change = [
			1 => parse_path(trim($file->fetch('@name'))),
		];

		// Sometimes though, we have some additional files for other themes, if we have add them to the mix.
		if (isset($custom_themes_add[$files_to_change[1]]))
		{
			$files_to_change += $custom_themes_add[$files_to_change[1]];
		}

		// Now, loop through all the files we're changing, and, well, change them ;)
		foreach ($files_to_change as $theme => $working_file)
		{
			if ($working_file[0] !== '/' && $working_file[1] !== ':')
			{
				trigger_error('parseModification(): The filename \'' . $working_file . '\' is not a full path!', E_USER_WARNING);

				$working_file = BOARDDIR . '/' . $working_file;
			}

			// Doesn't exist - give an error or what?
			if (!file_exists($working_file) && (!$file->exists('@error') || !in_array(trim($file->fetch('@error')), ['ignore', 'skip'])))
			{
				$actions[] = [
					'type' => 'missing',
					'filename' => $working_file,
					'debug' => $txt['package_modification_missing']
				];

				$everything_found = false;
				continue;
			}

			// Skip the file if it doesn't exist.
			if (!file_exists($working_file) && $file->exists('@error') && trim($file->fetch('@error')) === 'skip')
			{
				$actions[] = [
					'type' => 'skipping',
					'filename' => $working_file,
				];
				continue;
			}

			// Okay, we're creating this file then...?
			if (!file_exists($working_file))
			{
				$working_data = '';
			}
			// Phew, it exists!  Load 'er up!
			else
			{
				$working_data = str_replace("\r", '', package_get_contents($working_file));
			}

			$actions[] = [
				'type' => 'opened',
				'filename' => $working_file
			];

			$operations = $file->exists('operation') ? $file->set('operation') : [];
			foreach ($operations as $operation)
			{
				// Convert operation to an array.
				$actual_operation = [
					'searches' => [],
					'error' => $operation->exists('@error') && in_array(trim($operation->fetch('@error')), ['ignore', 'fatal', 'required']) ? trim($operation->fetch('@error')) : 'fatal',
				];

				// The 'add' parameter is used for all searches in this operation.
				$add = $operation->exists('add') ? $operation->fetch('add') : '';

				// Grab all search items of this operation (in most cases just 1).
				$searches = $operation->set('search');
				foreach ($searches as $i => $search)
				{
					$actual_operation['searches'][] = [
						'position' => $search->exists('@position') && in_array(trim($search->fetch('@position')), ['before', 'after', 'replace', 'end']) ? trim($search->fetch('@position')) : 'replace',
						'is_reg_exp' => $search->exists('@regexp') && trim($search->fetch('@regexp')) === 'true',
						'loose_whitespace' => $search->exists('@whitespace') && trim($search->fetch('@whitespace')) === 'loose',
						'search' => $search->fetch('.'),
						'add' => $add,
						'preg_search' => '',
						'preg_replace' => '',
					];
				}

				// At least one search should be defined.
				if (empty($actual_operation['searches']))
				{
					$actions[] = [
						'type' => 'failure',
						'filename' => $working_file,
						'search' => $search['search'],

The variable $search does not seem to be defined for all execution paths leading up to this point.

						'is_custom' => $theme > 1 ? $theme : 0,
					];

					// Skip to the next operation.
					continue;
				}

				// Reverse the operations in case of undoing stuff.
				if ($undo)
				{
					foreach ($actual_operation['searches'] as $i => $search)
					{
						// Reverse modification of regular expressions are not allowed.
						if ($search['is_reg_exp'])
						{
							if ($actual_operation['error'] === 'fatal')
							{
								$actions[] = [
									'type' => 'failure',
									'filename' => $working_file,
									'search' => $search['search'],
									'is_custom' => $theme > 1 ? $theme : 0,
								];
							}

							// Continue to the next operation.
							continue 2;
						}

						// The replacement is now the search subject...
						if ($search['position'] === 'replace' || $search['position'] === 'end')
						{
							$actual_operation['searches'][$i]['search'] = $search['add'];
						}
						else
						{
							// Reversing a before/after modification becomes a replacement.
							$actual_operation['searches'][$i]['position'] = 'replace';

							if ($search['position'] === 'before')
							{
								$actual_operation['searches'][$i]['search'] .= $search['add'];
							}
							elseif ($search['position'] === 'after')
							{
								$actual_operation['searches'][$i]['search'] = $search['add'] . $search['search'];
							}
						}

						// ...and the search subject is now the replacement.
						$actual_operation['searches'][$i]['add'] = $search['search'];
					}
				}

				// Sort the search list so the replaces come before the add before/after's.
				if (count($actual_operation['searches']) !== 1)
				{
					$replacements = [];

					foreach ($actual_operation['searches'] as $i => $search)
					{
						if ($search['position'] === 'replace')
						{
							$replacements[] = $search;
							unset($actual_operation['searches'][$i]);
						}
					}
					$actual_operation['searches'] = array_merge($replacements, $actual_operation['searches']);
				}

				// Create regular expression replacements from each search.
				foreach ($actual_operation['searches'] as $i => $search)
				{
					// Not much needed if the search subject is already a regexp.
					if ($search['is_reg_exp'])
					{
						$actual_operation['searches'][$i]['preg_search'] = $search['search'];
					}
					else
					{
						// Make the search subject fit into a regular expression.
						$actual_operation['searches'][$i]['preg_search'] = preg_quote($search['search'], '~');

						// Using 'loose', a random amount of tabs and spaces may be used.
						if ($search['loose_whitespace'])
						{
							$actual_operation['searches'][$i]['preg_search'] = preg_replace('~[ \t]+~', '[ \t]+', $actual_operation['searches'][$i]['preg_search']);
						}
					}

					// Shuzzup.  This is done so we can safely use a regular expression. ($0 is bad!!)
					$actual_operation['searches'][$i]['preg_replace'] = strtr($search['add'], ['$' => '[$PACKAGE1$]', '\\' => '[$PACKAGE2$]']);

					// Before, so the replacement comes after the search subject :P
					if ($search['position'] === 'before')
					{
						$actual_operation['searches'][$i]['preg_search'] = '(' . $actual_operation['searches'][$i]['preg_search'] . ')';
						$actual_operation['searches'][$i]['preg_replace'] = '$1' . $actual_operation['searches'][$i]['preg_replace'];
					}

					// After, after what?
					elseif ($search['position'] === 'after')
					{
						$actual_operation['searches'][$i]['preg_search'] = '(' . $actual_operation['searches'][$i]['preg_search'] . ')';
						$actual_operation['searches'][$i]['preg_replace'] .= '$1';
					}

					// Position the replacement at the end of the file (or just before the closing PHP tags).
					elseif ($search['position'] === 'end')
					{
						if ($undo)
						{
							$actual_operation['searches'][$i]['preg_replace'] = '';
						}
						else
						{
							$actual_operation['searches'][$i]['preg_search'] = '(\\n\\?\\>)?$';
							$actual_operation['searches'][$i]['preg_replace'] .= '$1';
						}
					}

					// Testing 1, 2, 3...
					$failed = preg_match('~' . $actual_operation['searches'][$i]['preg_search'] . '~s', $working_data) === 0;

					// Nope, search pattern not found, or Found, but in this case, that means failure!
					if (($failed && $actual_operation['error'] === 'fatal')
						|| (!$failed && $actual_operation['error'] === 'required'))
					{
						$actions[] = [
							'type' => 'failure',
							'filename' => $working_file,
							'search' => $actual_operation['searches'][$i]['preg_search'],
							'search_original' => $actual_operation['searches'][$i]['search'],
							'replace_original' => $actual_operation['searches'][$i]['add'],
							'position' => $search['position'],
							'is_custom' => $theme > 1 ? $theme : 0,
							'failed' => $failed,
						];

						$everything_found = false;
						continue;
					}

					// Replace it into nothing? That's not an option...unless it's an undoing end.
					if ($search['add'] === '' && ($search['position'] !== 'end' || !$undo))
					{
						continue;
					}

					// Finally, we're doing some replacements.
					$working_data = preg_replace('~' . $actual_operation['searches'][$i]['preg_search'] . '~s', $actual_operation['searches'][$i]['preg_replace'], $working_data, 1);

					$actions[] = [
						'type' => 'replace',
						'filename' => $working_file,
						'search' => $actual_operation['searches'][$i]['preg_search'],
						'replace' => $actual_operation['searches'][$i]['preg_replace'],
						'search_original' => $actual_operation['searches'][$i]['search'],
						'replace_original' => $actual_operation['searches'][$i]['add'],
						'position' => $search['position'],
						'failed' => $failed,
						'ignore_failure' => $failed && $actual_operation['error'] === 'ignore',
						'is_custom' => $theme > 1 ? $theme : 0,
					];
				}
			}

			// Fix any little helper symbols ;).
			$working_data = strtr($working_data, ['[$PACKAGE1$]' => '$', '[$PACKAGE2$]' => '\\']);

			$packageChmod = new PackageChmod();
			$packageChmod->pkgChmod($working_file);

			if ((file_exists($working_file) && !is_writable($working_file)) || (!file_exists($working_file) && !is_writable(dirname($working_file))))
			{
				$actions[] = [
					'type' => 'chmod',
					'filename' => $working_file
				];
			}

			if (basename($working_file) === 'Settings_bak.php')
			{
				continue;
			}

			if (!$testing && !empty($modSettings['package_make_backups']) && file_exists($working_file))
			{
				// No, no, not Settings.php!
				if (basename($working_file) === 'Settings.php')
				{
					@copy($working_file, dirname($working_file) . '/Settings_bak.php');

It seems like you do not handle an error condition for copy(). This can introduce security issues, and is generally not recommended.

				}
				else
				{
					@copy($working_file, $working_file . '~');
				}
			}

			// Always call this, even if in testing, because it won't really be written in testing mode.
			package_put_contents($working_file, $working_data, $testing);

			$actions[] = [
				'type' => 'saved',
				'filename' => $working_file,
				'is_custom' => $theme > 1 ? $theme : 0,
			];
		}
	}

	$actions[] = [
		'type' => 'result',
		'status' => $everything_found
	];

	return $actions;
}