validateTriggers()

Complexity

Conditions	22
Paths	66

Size

Total Lines	162
Code Lines	72

Duplication

Lines	0
Ratio	0 %

Code Coverage

Tests	0
CRAP Score	506

Importance

Changes

0

<?php
function validateTriggers(&$triggers)
{
	$db = database();

	$ban_errors = ErrorContext::context('ban', 1);
	if (empty($triggers))
	{
		$ban_errors->addError('ban_empty_triggers');
	}

	$ban_triggers = [];
	$log_info = [];

	// Go through each trigger and make sure its valid
	foreach ($triggers as $key => $value)
	{
		if (!empty($value))
		{
			if ($key === 'member')
			{
				continue;
			}

			if ($key === 'main_ip')
			{
				$value = trim($value);
				$ip_parts = ip2range($value);
				$ban_trigger = validateIPBan($ip_parts, $value);
				if (empty($ban_trigger['error']))
				{
					$ban_triggers['main_ip'] = $ban_trigger;
				}
				else
				{
					$ban_errors->addError($ban_trigger['error']);
				}
			}
			elseif ($key === 'hostname')
			{
				if (preg_match('/[^\w.\-*]/', $value) == 1)
				{
					$ban_errors->addError('invalid_hostname');
				}
				else
				{
					// Replace the * wildcard by a MySQL wildcard %.
					$value = substr(str_replace('*', '%', $value), 0, 255);

					$ban_triggers['hostname']['hostname'] = $value;
				}
			}
			elseif ($key === 'email')
			{
				if (preg_match('/[^\w.\-\+*@]/', $value) == 1)
				{
					$ban_errors->addError('invalid_email');
				}

				// Check the user is not banning an admin.
				$request = $db->query('', '
					SELECT 
						id_member
					FROM {db_prefix}members
					WHERE (id_group = {int:admin_group} OR FIND_IN_SET({int:admin_group}, additional_groups) != 0)
						AND email_address LIKE {string:email}
					LIMIT 1',
					[
						'admin_group' => 1,
						'email' => $value,
					]
				);
				if ($request->num_rows() !== 0)
				{
					$ban_errors->addError('no_ban_admin');
				}
				$request->free_result();

				$value = substr(strtolower(str_replace('*', '%', $value)), 0, 255);

				$ban_triggers['email']['email_address'] = $value;
			}
			elseif ($key == 'user')
			{
				$user = preg_replace('~&amp;#(\d{4,5}|[2-9]\d{2,4}|1[2-9]\d);~', '&#$1;', Util::htmlspecialchars($value, ENT_QUOTES));

				$request = $db->query('', '
					SELECT 
						id_member, (id_group = {int:admin_group} OR FIND_IN_SET({int:admin_group}, additional_groups) != 0) AS isAdmin
					FROM {db_prefix}members
					WHERE member_name = {string:username} OR real_name = {string:username}
					LIMIT 1',
					[
						'admin_group' => 1,
						'username' => $user,
					]
				);
				if ($request->num_rows() === 0)
				{
					$ban_errors->addError('invalid_username');
				}
				list ($value, $isAdmin) = $request->fetch_row();
				$request->free_result();

				if ($isAdmin && strtolower($isAdmin) !== 'f')
				{
					unset($value);
					$ban_errors->addError('no_ban_admin');
				}
				else
				{
					$ban_triggers['user']['id_member'] = $value;
				}
			}
			elseif (in_array($key, ['ips_in_messages', 'ips_in_errors']))
			{
				// Special case, those two are arrays themselves
				$values = array_unique($value);

				// Don't add the main IP again.
				if (isset($triggers['main_ip']))
				{
					$values = array_diff($values, [$triggers['main_ip']]);
				}

				unset($value);
				foreach ($values as $val)
				{
					$val = trim($val);
					$ip_parts = ip2range($val);
					$ban_trigger = validateIPBan($ip_parts, $val);

					if (empty($ban_trigger['error']))
					{
						$ban_triggers[$key][] = $ban_trigger;

						$log_info[] = [
							'value' => $val,
							'bantype' => 'ip_range',
						];
					}
					else
					{
						$ban_errors->addError($ban_trigger['error']);
					}
				}
			}
			else
			{
				$ban_errors->addError('no_bantype_selected');
			}

			if (isset($value) && !is_array($value))
			{
				$log_info[] = [
					'value' => $value,
					'bantype' => $key,
				];
			}
		}
	}

	return ['ban_triggers' => $ban_triggers, 'log_info' => $log_info];
}