enwikipedia-acc / waca

includes/Security/TokenManager.php

Indentation +87 added lines, -87 removed lines

@@ -13,91 +13,91 @@
 
 class TokenManager
 {
-    /**
-     * Validates a CSRF token
-     *
-     * @param string      $data    The token data string itself
-     * @param string|null $context Token context for extra validation
-     *
-     * @return bool
-     */
-    public function validateToken($data, $context = null)
-    {
-        if (!is_string($data) || strlen($data) === 0) {
-            // Nothing to validate
-            return false;
-        }
-
-        $tokens = WebRequest::getSessionTokenData();
-
-        // if the token doesn't exist, then it's not valid
-        if (!array_key_exists($data, $tokens)) {
-            return false;
-        }
-
-        /** @var Token $token */
-        $token = unserialize($tokens[$data]);
-
-        if ($token->getTokenData() !== $data) {
-            return false;
-        }
-
-        if ($token->getContext() !== $context) {
-            return false;
-        }
-
-        if ($token->isUsed()) {
-            return false;
-        }
-
-        // mark the token as used, and save it back to the session
-        $token->markAsUsed();
-        $this->storeToken($token);
-
-        return true;
-    }
-
-    /**
-     * @param string|null $context An optional context for extra validation
-     *
-     * @return Token
-     */
-    public function getNewToken($context = null)
-    {
-        $token = new Token($this->generateTokenData(), $context);
-        $this->storeToken($token);
-
-        return $token;
-    }
-
-    /**
-     * Stores a token in the session data
-     *
-     * @param Token $token
-     */
-    private function storeToken(Token $token)
-    {
-        $tokens = WebRequest::getSessionTokenData();
-        $tokens[$token->getTokenData()] = serialize($token);
-        WebRequest::setSessionTokenData($tokens);
-    }
-
-    /**
-     * Generates a security token
-     *
-     * @return string
-     * @throws Exception
-     *
-     * @category Security-Critical
-     */
-    private function generateTokenData()
-    {
-        $genBytes = openssl_random_pseudo_bytes(33);
-
-        if ($genBytes !== false) {
-            return base64_encode($genBytes);
-        }
-
-        throw new Exception('Unable to generate secure token.');
-    }
+	/**
+	 * Validates a CSRF token
+	 *
+	 * @param string      $data    The token data string itself
+	 * @param string|null $context Token context for extra validation
+	 *
+	 * @return bool
+	 */
+	public function validateToken($data, $context = null)
+	{
+		if (!is_string($data) || strlen($data) === 0) {
+			// Nothing to validate
+			return false;
+		}
+
+		$tokens = WebRequest::getSessionTokenData();
+
+		// if the token doesn't exist, then it's not valid
+		if (!array_key_exists($data, $tokens)) {
+			return false;
+		}
+
+		/** @var Token $token */
+		$token = unserialize($tokens[$data]);
+
+		if ($token->getTokenData() !== $data) {
+			return false;
+		}
+
+		if ($token->getContext() !== $context) {
+			return false;
+		}
+
+		if ($token->isUsed()) {
+			return false;
+		}
+
+		// mark the token as used, and save it back to the session
+		$token->markAsUsed();
+		$this->storeToken($token);
+
+		return true;
+	}
+
+	/**
+	 * @param string|null $context An optional context for extra validation
+	 *
+	 * @return Token
+	 */
+	public function getNewToken($context = null)
+	{
+		$token = new Token($this->generateTokenData(), $context);
+		$this->storeToken($token);
+
+		return $token;
+	}
+
+	/**
+	 * Stores a token in the session data
+	 *
+	 * @param Token $token
+	 */
+	private function storeToken(Token $token)
+	{
+		$tokens = WebRequest::getSessionTokenData();
+		$tokens[$token->getTokenData()] = serialize($token);
+		WebRequest::setSessionTokenData($tokens);
+	}
+
+	/**
+	 * Generates a security token
+	 *
+	 * @return string
+	 * @throws Exception
+	 *
+	 * @category Security-Critical
+	 */
+	private function generateTokenData()
+	{
+		$genBytes = openssl_random_pseudo_bytes(33);
+
+		if ($genBytes !== false) {
+			return base64_encode($genBytes);
+		}
+
+		throw new Exception('Unable to generate secure token.');
+	}
 }
\ No newline at end of file

includes/Security/SecurityConfigurationFactory.php

Indentation +148 added lines, -148 removed lines

@@ -10,152 +10,152 @@
 
 final class SecurityConfigurationFactory
 {
-    /**
-     * @var bool
-     */
-    private $forceIdentified;
-
-    /**
-     * Security constructor.
-     *
-     * @param bool $forceIdentified
-     */
-    public function __construct($forceIdentified)
-    {
-        $this->forceIdentified = $forceIdentified;
-    }
-
-    /**
-     * Returns a pre-built security configuration for an internal page.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asInternalPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW)
-            ->setUser(SecurityConfiguration::ALLOW);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * Returns a pre-built security configuration for a tool admin only page.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asAdminPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * Returns a pre-built security configuration for a page accessible to *ALL* logged in users, including suspended
-     * and new users. This probably isn't the setting you want.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asAllLoggedInUsersPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW)
-            ->setUser(SecurityConfiguration::ALLOW)
-            ->setDeclined(SecurityConfiguration::ALLOW)
-            ->setNew(SecurityConfiguration::ALLOW)
-            ->setSuspended(SecurityConfiguration::ALLOW);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * @return SecurityConfiguration
-     * @category Security-Critical
-     */
-    public function asCheckUserData()
-    {
-        $config = new SecurityConfiguration();
-        $config->setCheckuser(SecurityConfiguration::ALLOW)
-            ->setCommunity(SecurityConfiguration::DENY)
-            ->setSuspended(SecurityConfiguration::DENY)
-            ->setDeclined(SecurityConfiguration::DENY)
-            ->setNew(SecurityConfiguration::DENY);
-
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * Returns a pre-built security configuration for a public page.
-     *
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asPublicPage()
-    {
-        $config = new SecurityConfiguration();
-        $config->setAdmin(SecurityConfiguration::ALLOW)
-            ->setUser(SecurityConfiguration::ALLOW)
-            ->setCheckuser(SecurityConfiguration::ALLOW)
-            ->setCommunity(SecurityConfiguration::ALLOW)
-            ->setSuspended(SecurityConfiguration::ALLOW)
-            ->setDeclined(SecurityConfiguration::ALLOW)
-            ->setNew(SecurityConfiguration::ALLOW);
-
-        // Public pages shouldn't be inaccessible to logged-in, unidentified users.
-        // Otherwise, logged in but unidentified users can't even log out.
-        $config->setRequireIdentified(false);
-
-        return $config;
-    }
-
-    /**
-     * Special case for zoom page private data.
-     *
-     * This will only return true if you are either a checkuser or a tool admin, taking special note of disabled
-     * accounts which happen to be check users
-     *
-     * @return SecurityConfiguration
-     */
-    public function asGeneralPrivateDataAccess()
-    {
-        $config = new SecurityConfiguration();
-        $config
-            // Basic configuration, admins and check users allowed
-            ->setAdmin(SecurityConfiguration::ALLOW)
-            ->setCheckuser(SecurityConfiguration::ALLOW)
-            // Deny these, even if they were allowed by the above
-            ->setCommunity(SecurityConfiguration::DENY)
-            ->setSuspended(SecurityConfiguration::DENY)
-            ->setDeclined(SecurityConfiguration::DENY)
-            ->setNew(SecurityConfiguration::DENY);
-
-        // You must also be identified to access this data
-        $config->setRequireIdentified($this->forceIdentified);
-
-        return $config;
-    }
-
-    /**
-     * @category Security-Critical
-     * @return SecurityConfiguration
-     */
-    public function asNone()
-    {
-        $config = new SecurityConfiguration();
-
-        return $config;
-    }
+	/**
+	 * @var bool
+	 */
+	private $forceIdentified;
+
+	/**
+	 * Security constructor.
+	 *
+	 * @param bool $forceIdentified
+	 */
+	public function __construct($forceIdentified)
+	{
+		$this->forceIdentified = $forceIdentified;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for an internal page.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asInternalPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW)
+			->setUser(SecurityConfiguration::ALLOW);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for a tool admin only page.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asAdminPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for a page accessible to *ALL* logged in users, including suspended
+	 * and new users. This probably isn't the setting you want.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asAllLoggedInUsersPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW)
+			->setUser(SecurityConfiguration::ALLOW)
+			->setDeclined(SecurityConfiguration::ALLOW)
+			->setNew(SecurityConfiguration::ALLOW)
+			->setSuspended(SecurityConfiguration::ALLOW);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * @return SecurityConfiguration
+	 * @category Security-Critical
+	 */
+	public function asCheckUserData()
+	{
+		$config = new SecurityConfiguration();
+		$config->setCheckuser(SecurityConfiguration::ALLOW)
+			->setCommunity(SecurityConfiguration::DENY)
+			->setSuspended(SecurityConfiguration::DENY)
+			->setDeclined(SecurityConfiguration::DENY)
+			->setNew(SecurityConfiguration::DENY);
+
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * Returns a pre-built security configuration for a public page.
+	 *
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asPublicPage()
+	{
+		$config = new SecurityConfiguration();
+		$config->setAdmin(SecurityConfiguration::ALLOW)
+			->setUser(SecurityConfiguration::ALLOW)
+			->setCheckuser(SecurityConfiguration::ALLOW)
+			->setCommunity(SecurityConfiguration::ALLOW)
+			->setSuspended(SecurityConfiguration::ALLOW)
+			->setDeclined(SecurityConfiguration::ALLOW)
+			->setNew(SecurityConfiguration::ALLOW);
+
+		// Public pages shouldn't be inaccessible to logged-in, unidentified users.
+		// Otherwise, logged in but unidentified users can't even log out.
+		$config->setRequireIdentified(false);
+
+		return $config;
+	}
+
+	/**
+	 * Special case for zoom page private data.
+	 *
+	 * This will only return true if you are either a checkuser or a tool admin, taking special note of disabled
+	 * accounts which happen to be check users
+	 *
+	 * @return SecurityConfiguration
+	 */
+	public function asGeneralPrivateDataAccess()
+	{
+		$config = new SecurityConfiguration();
+		$config
+			// Basic configuration, admins and check users allowed
+			->setAdmin(SecurityConfiguration::ALLOW)
+			->setCheckuser(SecurityConfiguration::ALLOW)
+			// Deny these, even if they were allowed by the above
+			->setCommunity(SecurityConfiguration::DENY)
+			->setSuspended(SecurityConfiguration::DENY)
+			->setDeclined(SecurityConfiguration::DENY)
+			->setNew(SecurityConfiguration::DENY);
+
+		// You must also be identified to access this data
+		$config->setRequireIdentified($this->forceIdentified);
+
+		return $config;
+	}
+
+	/**
+	 * @category Security-Critical
+	 * @return SecurityConfiguration
+	 */
+	public function asNone()
+	{
+		$config = new SecurityConfiguration();
+
+		return $config;
+	}
 }
\ No newline at end of file

includes/Router/ApiRequestRouter.php

Indentation +36 added lines, -36 removed lines

@@ -20,43 +20,43 @@
 
 class ApiRequestRouter implements IRequestRouter
 {
-    /**
-     * @return string[]
-     */
-    public static function getActionList()
-    {
-        return array("count", "status", "stats", "help", "monitor");
-    }
+	/**
+	 * @return string[]
+	 */
+	public static function getActionList()
+	{
+		return array("count", "status", "stats", "help", "monitor");
+	}
 
-    /**
-     * @return IRoutedTask
-     * @throws Exception
-     */
-    public function route()
-    {
-        $requestAction = WebRequest::getString('action');
+	/**
+	 * @return IRoutedTask
+	 * @throws Exception
+	 */
+	public function route()
+	{
+		$requestAction = WebRequest::getString('action');
 
-        switch ($requestAction) {
-            case "count":
-                $result = new CountAction();
-                break;
-            case "status":
-                $result = new StatusAction();
-                break;
-            case "stats":
-                $result = new StatsAction();
-                break;
-            case "help":
-                $result = new HelpAction();
-                break;
-            case "monitor":
-                $result = new MonitorAction();
-                break;
-            default:
-                $result = new UnknownAction();
-                break;
-        }
+		switch ($requestAction) {
+			case "count":
+				$result = new CountAction();
+				break;
+			case "status":
+				$result = new StatusAction();
+				break;
+			case "stats":
+				$result = new StatsAction();
+				break;
+			case "help":
+				$result = new HelpAction();
+				break;
+			case "monitor":
+				$result = new MonitorAction();
+				break;
+			default:
+				$result = new UnknownAction();
+				break;
+		}
 
-        return $result;
-    }
+		return $result;
+	}
 }
\ No newline at end of file

includes/Router/RequestRouter.php

Indentation +387 added lines, -387 removed lines

@@ -54,391 +54,391 @@
  */
 class RequestRouter implements IRequestRouter
 {
-    /**
-     * This is the core routing table for the application. The basic idea is:
-     *
-     *      array(
-     *          "foo" =>
-     *              array(
-     *                  "class"   => PageFoo::class,
-     *                  "actions" => array("bar", "other")
-     *              ),
-     * );
-     *
-     * Things to note:
-     *     - If no page is requested, we go to PageMain. PageMain can't have actions defined.
-     *
-     *     - If a page is defined and requested, but no action is requested, go to that page's main() method
-     *     - If a page is defined and requested, and an action is defined and requested, go to that action's method.
-     *     - If a page is defined and requested, and an action NOT defined and requested, go to Page404 and it's main()
-     *       method.
-     *     - If a page is NOT defined and requested, go to Page404 and it's main() method.
-     *
-     *     - Query parameters are ignored.
-     *
-     * The key point here is request routing with validation that this is allowed, before we start hitting the
-     * filesystem through the AutoLoader, and opening random files. Also, so that we validate the action requested
-     * before we start calling random methods through the web UI.
-     *
-     * Examples:
-     * /internal.php                => returns instance of PageMain, routed to main()
-     * /internal.php?query          => returns instance of PageMain, routed to main()
-     * /internal.php/foo            => returns instance of PageFoo, routed to main()
-     * /internal.php/foo?query      => returns instance of PageFoo, routed to main()
-     * /internal.php/foo/bar        => returns instance of PageFoo, routed to bar()
-     * /internal.php/foo/bar?query  => returns instance of PageFoo, routed to bar()
-     * /internal.php/foo/baz        => returns instance of Page404, routed to main()
-     * /internal.php/foo/baz?query  => returns instance of Page404, routed to main()
-     * /internal.php/bar            => returns instance of Page404, routed to main()
-     * /internal.php/bar?query      => returns instance of Page404, routed to main()
-     * /internal.php/bar/baz        => returns instance of Page404, routed to main()
-     * /internal.php/bar/baz?query  => returns instance of Page404, routed to main()
-     *
-     * Take care when changing this - a lot of places rely on the array key for redirects and other links. If you need
-     * to change the key, then you'll likely have to update a lot of files.
-     *
-     * @var array
-     */
-    private $routeMap = array(
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Login and registration
-        'logout'                      =>
-            array(
-                'class'   => PageLogout::class,
-                'actions' => array(),
-            ),
-        'login'                       =>
-            array(
-                'class'   => PageLogin::class,
-                'actions' => array(),
-            ),
-        'forgotPassword'              =>
-            array(
-                'class'   => PageForgotPassword::class,
-                'actions' => array('reset'),
-            ),
-        'register'                    =>
-            array(
-                'class'   => PageRegister::class,
-                'actions' => array('done'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Discovery
-        'search'                      =>
-            array(
-                'class'   => PageSearch::class,
-                'actions' => array(),
-            ),
-        'logs'                        =>
-            array(
-                'class'   => PageLog::class,
-                'actions' => array(),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Administration
-        'bans'                        =>
-            array(
-                'class'   => PageBan::class,
-                'actions' => array('set', 'remove'),
-            ),
-        'userManagement'              =>
-            array(
-                'class'   => PageUserManagement::class,
-                'actions' => array(
-                    'approve',
-                    'decline',
-                    'rename',
-                    'editUser',
-                    'suspend',
-                    'promote',
-                    'demote',
-                ),
-            ),
-        'siteNotice'                  =>
-            array(
-                'class'   => PageSiteNotice::class,
-                'actions' => array(),
-            ),
-        'emailManagement'             =>
-            array(
-                'class'   => PageEmailManagement::class,
-                'actions' => array('create', 'edit', 'view'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Personal preferences
-        'preferences'                 =>
-            array(
-                'class'   => PagePreferences::class,
-                'actions' => array('changePassword'),
-            ),
-        'oauth'                       =>
-            array(
-                'class'   => PageOAuth::class,
-                'actions' => array('detach', 'attach'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Welcomer configuration
-        'welcomeTemplates'            =>
-            array(
-                'class'   => PageWelcomeTemplateManagement::class,
-                'actions' => array('select', 'edit', 'delete', 'add', 'view'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Statistics
-        'statistics'                  =>
-            array(
-                'class'   => StatsMain::class,
-                'actions' => array(),
-            ),
-        'statistics/fastCloses'       =>
-            array(
-                'class'   => StatsFastCloses::class,
-                'actions' => array(),
-            ),
-        'statistics/inactiveUsers'    =>
-            array(
-                'class'   => StatsInactiveUsers::class,
-                'actions' => array(),
-            ),
-        'statistics/monthlyStats'     =>
-            array(
-                'class'   => StatsMonthlyStats::class,
-                'actions' => array(),
-            ),
-        'statistics/reservedRequests' =>
-            array(
-                'class'   => StatsReservedRequests::class,
-                'actions' => array(),
-            ),
-        'statistics/templateStats'    =>
-            array(
-                'class'   => StatsTemplateStats::class,
-                'actions' => array(),
-            ),
-        'statistics/topCreators'      =>
-            array(
-                'class'   => StatsTopCreators::class,
-                'actions' => array(),
-            ),
-        'statistics/users'            =>
-            array(
-                'class'   => StatsUsers::class,
-                'actions' => array('detail'),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Zoom page
-        'viewRequest'                 =>
-            array(
-                'class'   => PageViewRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/reserve'         =>
-            array(
-                'class'   => PageReservation::class,
-                'actions' => array(),
-            ),
-        'viewRequest/breakReserve'    =>
-            array(
-                'class'   => PageBreakReservation::class,
-                'actions' => array(),
-            ),
-        'viewRequest/defer'           =>
-            array(
-                'class'   => PageDeferRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/comment'         =>
-            array(
-                'class'   => PageComment::class,
-                'actions' => array(),
-            ),
-        'viewRequest/sendToUser'      =>
-            array(
-                'class'   => PageSendToUser::class,
-                'actions' => array(),
-            ),
-        'viewRequest/close'           =>
-            array(
-                'class'   => PageCloseRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/drop'            =>
-            array(
-                'class'   => PageDropRequest::class,
-                'actions' => array(),
-            ),
-        'viewRequest/custom'          =>
-            array(
-                'class'   => PageCustomClose::class,
-                'actions' => array(),
-            ),
-        'editComment'                 =>
-            array(
-                'class'   => PageEditComment::class,
-                'actions' => array(),
-            ),
-
-        //////////////////////////////////////////////////////////////////////////////////////////////////
-        // Misc stuff
-        'team'                        =>
-            array(
-                'class'   => PageTeam::class,
-                'actions' => array(),
-            ),
-        'requestList'                 =>
-            array(
-                'class'   => PageExpandedRequestList::class,
-                'actions' => array(),
-            ),
-    );
-
-    /**
-     * @return IRoutedTask
-     * @throws Exception
-     */
-    final public function route()
-    {
-        $pathInfo = WebRequest::pathInfo();
-
-        list($pageClass, $action) = $this->getRouteFromPath($pathInfo);
-
-        /** @var IRoutedTask $page */
-        $page = new $pageClass();
-
-        // Dynamic creation, so we've got to be careful here. We can't use built-in language type protection, so
-        // let's use our own.
-        if (!($page instanceof IRoutedTask)) {
-            throw new Exception('Expected a page, but this is not a page.');
-        }
-
-        // OK, I'm happy at this point that we know we're running a page, and we know it's probably what we want if it
-        // inherits PageBase and has been created from the routing map.
-        $page->setRoute($action);
-
-        return $page;
-    }
-
-    /**
-     * @param $pathInfo
-     *
-     * @return array
-     */
-    protected function getRouteFromPath($pathInfo)
-    {
-        if (count($pathInfo) === 0) {
-            // No pathInfo, so no page to load. Load the main page.
-            return $this->getDefaultRoute();
-        }
-        elseif (count($pathInfo) === 1) {
-            // Exactly one path info segment, it's got to be a page.
-            $classSegment = $pathInfo[0];
-
-            return $this->routeSinglePathSegment($classSegment);
-        }
-
-        // OK, we have two or more segments now.
-        if (count($pathInfo) > 2) {
-            // Let's handle more than two, and collapse it down into two.
-            $requestedAction = array_pop($pathInfo);
-            $classSegment = implode('/', $pathInfo);
-        }
-        else {
-            // Two path info segments.
-            $classSegment = $pathInfo[0];
-            $requestedAction = $pathInfo[1];
-        }
-
-        $routeMap = $this->routePathSegments($classSegment, $requestedAction);
-
-        if ($routeMap[0] === Page404::class) {
-            $routeMap = $this->routeSinglePathSegment($classSegment . '/' . $requestedAction);
-        }
-
-        return $routeMap;
-    }
-
-    /**
-     * @param $classSegment
-     *
-     * @return array
-     */
-    final protected function routeSinglePathSegment($classSegment)
-    {
-        $routeMap = $this->getRouteMap();
-        if (array_key_exists($classSegment, $routeMap)) {
-            // Route exists, but we don't have an action in path info, so default to main.
-            $pageClass = $routeMap[$classSegment]['class'];
-            $action = 'main';
-
-            return array($pageClass, $action);
-        }
-        else {
-            // Doesn't exist in map. Fall back to 404
-            $pageClass = Page404::class;
-            $action = "main";
-
-            return array($pageClass, $action);
-        }
-    }
-
-    /**
-     * @param $classSegment
-     * @param $requestedAction
-     *
-     * @return array
-     */
-    final protected function routePathSegments($classSegment, $requestedAction)
-    {
-        $routeMap = $this->getRouteMap();
-        if (array_key_exists($classSegment, $routeMap)) {
-            // Route exists, but we don't have an action in path info, so default to main.
-
-            if (isset($routeMap[$classSegment]['actions'])
-                && array_search($requestedAction, $routeMap[$classSegment]['actions']) !== false
-            ) {
-                // Action exists in allowed action list. Allow both the page and the action
-                $pageClass = $routeMap[$classSegment]['class'];
-                $action = $requestedAction;
-
-                return array($pageClass, $action);
-            }
-            else {
-                // Valid page, invalid action. 404 our way out.
-                $pageClass = Page404::class;
-                $action = 'main';
-
-                return array($pageClass, $action);
-            }
-        }
-        else {
-            // Class doesn't exist in map. Fall back to 404
-            $pageClass = Page404::class;
-            $action = 'main';
-
-            return array($pageClass, $action);
-        }
-    }
-
-    /**
-     * @return array
-     */
-    protected function getRouteMap()
-    {
-        return $this->routeMap;
-    }
-
-    /**
-     * @return callable
-     */
-    protected function getDefaultRoute()
-    {
-        return array(PageMain::class, "main");
-    }
+	/**
+	 * This is the core routing table for the application. The basic idea is:
+	 *
+	 *      array(
+	 *          "foo" =>
+	 *              array(
+	 *                  "class"   => PageFoo::class,
+	 *                  "actions" => array("bar", "other")
+	 *              ),
+	 * );
+	 *
+	 * Things to note:
+	 *     - If no page is requested, we go to PageMain. PageMain can't have actions defined.
+	 *
+	 *     - If a page is defined and requested, but no action is requested, go to that page's main() method
+	 *     - If a page is defined and requested, and an action is defined and requested, go to that action's method.
+	 *     - If a page is defined and requested, and an action NOT defined and requested, go to Page404 and it's main()
+	 *       method.
+	 *     - If a page is NOT defined and requested, go to Page404 and it's main() method.
+	 *
+	 *     - Query parameters are ignored.
+	 *
+	 * The key point here is request routing with validation that this is allowed, before we start hitting the
+	 * filesystem through the AutoLoader, and opening random files. Also, so that we validate the action requested
+	 * before we start calling random methods through the web UI.
+	 *
+	 * Examples:
+	 * /internal.php                => returns instance of PageMain, routed to main()
+	 * /internal.php?query          => returns instance of PageMain, routed to main()
+	 * /internal.php/foo            => returns instance of PageFoo, routed to main()
+	 * /internal.php/foo?query      => returns instance of PageFoo, routed to main()
+	 * /internal.php/foo/bar        => returns instance of PageFoo, routed to bar()
+	 * /internal.php/foo/bar?query  => returns instance of PageFoo, routed to bar()
+	 * /internal.php/foo/baz        => returns instance of Page404, routed to main()
+	 * /internal.php/foo/baz?query  => returns instance of Page404, routed to main()
+	 * /internal.php/bar            => returns instance of Page404, routed to main()
+	 * /internal.php/bar?query      => returns instance of Page404, routed to main()
+	 * /internal.php/bar/baz        => returns instance of Page404, routed to main()
+	 * /internal.php/bar/baz?query  => returns instance of Page404, routed to main()
+	 *
+	 * Take care when changing this - a lot of places rely on the array key for redirects and other links. If you need
+	 * to change the key, then you'll likely have to update a lot of files.
+	 *
+	 * @var array
+	 */
+	private $routeMap = array(
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Login and registration
+		'logout'                      =>
+			array(
+				'class'   => PageLogout::class,
+				'actions' => array(),
+			),
+		'login'                       =>
+			array(
+				'class'   => PageLogin::class,
+				'actions' => array(),
+			),
+		'forgotPassword'              =>
+			array(
+				'class'   => PageForgotPassword::class,
+				'actions' => array('reset'),
+			),
+		'register'                    =>
+			array(
+				'class'   => PageRegister::class,
+				'actions' => array('done'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Discovery
+		'search'                      =>
+			array(
+				'class'   => PageSearch::class,
+				'actions' => array(),
+			),
+		'logs'                        =>
+			array(
+				'class'   => PageLog::class,
+				'actions' => array(),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Administration
+		'bans'                        =>
+			array(
+				'class'   => PageBan::class,
+				'actions' => array('set', 'remove'),
+			),
+		'userManagement'              =>
+			array(
+				'class'   => PageUserManagement::class,
+				'actions' => array(
+					'approve',
+					'decline',
+					'rename',
+					'editUser',
+					'suspend',
+					'promote',
+					'demote',
+				),
+			),
+		'siteNotice'                  =>
+			array(
+				'class'   => PageSiteNotice::class,
+				'actions' => array(),
+			),
+		'emailManagement'             =>
+			array(
+				'class'   => PageEmailManagement::class,
+				'actions' => array('create', 'edit', 'view'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Personal preferences
+		'preferences'                 =>
+			array(
+				'class'   => PagePreferences::class,
+				'actions' => array('changePassword'),
+			),
+		'oauth'                       =>
+			array(
+				'class'   => PageOAuth::class,
+				'actions' => array('detach', 'attach'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Welcomer configuration
+		'welcomeTemplates'            =>
+			array(
+				'class'   => PageWelcomeTemplateManagement::class,
+				'actions' => array('select', 'edit', 'delete', 'add', 'view'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Statistics
+		'statistics'                  =>
+			array(
+				'class'   => StatsMain::class,
+				'actions' => array(),
+			),
+		'statistics/fastCloses'       =>
+			array(
+				'class'   => StatsFastCloses::class,
+				'actions' => array(),
+			),
+		'statistics/inactiveUsers'    =>
+			array(
+				'class'   => StatsInactiveUsers::class,
+				'actions' => array(),
+			),
+		'statistics/monthlyStats'     =>
+			array(
+				'class'   => StatsMonthlyStats::class,
+				'actions' => array(),
+			),
+		'statistics/reservedRequests' =>
+			array(
+				'class'   => StatsReservedRequests::class,
+				'actions' => array(),
+			),
+		'statistics/templateStats'    =>
+			array(
+				'class'   => StatsTemplateStats::class,
+				'actions' => array(),
+			),
+		'statistics/topCreators'      =>
+			array(
+				'class'   => StatsTopCreators::class,
+				'actions' => array(),
+			),
+		'statistics/users'            =>
+			array(
+				'class'   => StatsUsers::class,
+				'actions' => array('detail'),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Zoom page
+		'viewRequest'                 =>
+			array(
+				'class'   => PageViewRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/reserve'         =>
+			array(
+				'class'   => PageReservation::class,
+				'actions' => array(),
+			),
+		'viewRequest/breakReserve'    =>
+			array(
+				'class'   => PageBreakReservation::class,
+				'actions' => array(),
+			),
+		'viewRequest/defer'           =>
+			array(
+				'class'   => PageDeferRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/comment'         =>
+			array(
+				'class'   => PageComment::class,
+				'actions' => array(),
+			),
+		'viewRequest/sendToUser'      =>
+			array(
+				'class'   => PageSendToUser::class,
+				'actions' => array(),
+			),
+		'viewRequest/close'           =>
+			array(
+				'class'   => PageCloseRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/drop'            =>
+			array(
+				'class'   => PageDropRequest::class,
+				'actions' => array(),
+			),
+		'viewRequest/custom'          =>
+			array(
+				'class'   => PageCustomClose::class,
+				'actions' => array(),
+			),
+		'editComment'                 =>
+			array(
+				'class'   => PageEditComment::class,
+				'actions' => array(),
+			),
+
+		//////////////////////////////////////////////////////////////////////////////////////////////////
+		// Misc stuff
+		'team'                        =>
+			array(
+				'class'   => PageTeam::class,
+				'actions' => array(),
+			),
+		'requestList'                 =>
+			array(
+				'class'   => PageExpandedRequestList::class,
+				'actions' => array(),
+			),
+	);
+
+	/**
+	 * @return IRoutedTask
+	 * @throws Exception
+	 */
+	final public function route()
+	{
+		$pathInfo = WebRequest::pathInfo();
+
+		list($pageClass, $action) = $this->getRouteFromPath($pathInfo);
+
+		/** @var IRoutedTask $page */
+		$page = new $pageClass();
+
+		// Dynamic creation, so we've got to be careful here. We can't use built-in language type protection, so
+		// let's use our own.
+		if (!($page instanceof IRoutedTask)) {
+			throw new Exception('Expected a page, but this is not a page.');
+		}
+
+		// OK, I'm happy at this point that we know we're running a page, and we know it's probably what we want if it
+		// inherits PageBase and has been created from the routing map.
+		$page->setRoute($action);
+
+		return $page;
+	}
+
+	/**
+	 * @param $pathInfo
+	 *
+	 * @return array
+	 */
+	protected function getRouteFromPath($pathInfo)
+	{
+		if (count($pathInfo) === 0) {
+			// No pathInfo, so no page to load. Load the main page.
+			return $this->getDefaultRoute();
+		}
+		elseif (count($pathInfo) === 1) {
+			// Exactly one path info segment, it's got to be a page.
+			$classSegment = $pathInfo[0];
+
+			return $this->routeSinglePathSegment($classSegment);
+		}
+
+		// OK, we have two or more segments now.
+		if (count($pathInfo) > 2) {
+			// Let's handle more than two, and collapse it down into two.
+			$requestedAction = array_pop($pathInfo);
+			$classSegment = implode('/', $pathInfo);
+		}
+		else {
+			// Two path info segments.
+			$classSegment = $pathInfo[0];
+			$requestedAction = $pathInfo[1];
+		}
+
+		$routeMap = $this->routePathSegments($classSegment, $requestedAction);
+
+		if ($routeMap[0] === Page404::class) {
+			$routeMap = $this->routeSinglePathSegment($classSegment . '/' . $requestedAction);
+		}
+
+		return $routeMap;
+	}
+
+	/**
+	 * @param $classSegment
+	 *
+	 * @return array
+	 */
+	final protected function routeSinglePathSegment($classSegment)
+	{
+		$routeMap = $this->getRouteMap();
+		if (array_key_exists($classSegment, $routeMap)) {
+			// Route exists, but we don't have an action in path info, so default to main.
+			$pageClass = $routeMap[$classSegment]['class'];
+			$action = 'main';
+
+			return array($pageClass, $action);
+		}
+		else {
+			// Doesn't exist in map. Fall back to 404
+			$pageClass = Page404::class;
+			$action = "main";
+
+			return array($pageClass, $action);
+		}
+	}
+
+	/**
+	 * @param $classSegment
+	 * @param $requestedAction
+	 *
+	 * @return array
+	 */
+	final protected function routePathSegments($classSegment, $requestedAction)
+	{
+		$routeMap = $this->getRouteMap();
+		if (array_key_exists($classSegment, $routeMap)) {
+			// Route exists, but we don't have an action in path info, so default to main.
+
+			if (isset($routeMap[$classSegment]['actions'])
+				&& array_search($requestedAction, $routeMap[$classSegment]['actions']) !== false
+			) {
+				// Action exists in allowed action list. Allow both the page and the action
+				$pageClass = $routeMap[$classSegment]['class'];
+				$action = $requestedAction;
+
+				return array($pageClass, $action);
+			}
+			else {
+				// Valid page, invalid action. 404 our way out.
+				$pageClass = Page404::class;
+				$action = 'main';
+
+				return array($pageClass, $action);
+			}
+		}
+		else {
+			// Class doesn't exist in map. Fall back to 404
+			$pageClass = Page404::class;
+			$action = 'main';
+
+			return array($pageClass, $action);
+		}
+	}
+
+	/**
+	 * @return array
+	 */
+	protected function getRouteMap()
+	{
+		return $this->routeMap;
+	}
+
+	/**
+	 * @return callable
+	 */
+	protected function getDefaultRoute()
+	{
+		return array(PageMain::class, "main");
+	}
 }
\ No newline at end of file

includes/Router/PublicRequestRouter.php

Indentation +37 added lines, -37 removed lines

@@ -15,42 +15,42 @@
 
 class PublicRequestRouter extends RequestRouter
 {
-    /**
-     * Gets the route map to be used by this request router.
-     *
-     * @return array
-     */
-    protected function getRouteMap()
-    {
-        return array(
-            // Page showing a message stating the request has been submitted to our internal queues
-            'requestSubmitted'          =>
-                array(
-                    'class'   => PageRequestSubmitted::class,
-                    'actions' => array(),
-                ),
-            // Page showing a message stating that email confirmation is required to continue
-            'emailConfirmationRequired' =>
-                array(
-                    'class'   => PageEmailConfirmationRequired::class,
-                    'actions' => array(),
-                ),
-            // Action page which handles email confirmation
-            'confirmEmail'              =>
-                array(
-                    'class'   => PageConfirmEmail::class,
-                    'actions' => array(),
-                ),
-        );
-    }
+	/**
+	 * Gets the route map to be used by this request router.
+	 *
+	 * @return array
+	 */
+	protected function getRouteMap()
+	{
+		return array(
+			// Page showing a message stating the request has been submitted to our internal queues
+			'requestSubmitted'          =>
+				array(
+					'class'   => PageRequestSubmitted::class,
+					'actions' => array(),
+				),
+			// Page showing a message stating that email confirmation is required to continue
+			'emailConfirmationRequired' =>
+				array(
+					'class'   => PageEmailConfirmationRequired::class,
+					'actions' => array(),
+				),
+			// Action page which handles email confirmation
+			'confirmEmail'              =>
+				array(
+					'class'   => PageConfirmEmail::class,
+					'actions' => array(),
+				),
+		);
+	}
 
-    /**
-     * Gets the default route if no explicit route is requested.
-     *
-     * @return callable
-     */
-    protected function getDefaultRoute()
-    {
-        return array(PageRequestAccount::class, 'main');
-    }
+	/**
+	 * Gets the default route if no explicit route is requested.
+	 *
+	 * @return callable
+	 */
+	protected function getDefaultRoute()
+	{
+		return array(PageRequestAccount::class, 'main');
+	}
 }
\ No newline at end of file

includes/Router/OAuthRequestRouter.php

Indentation +5 added lines, -5 removed lines

@@ -17,9 +17,9 @@
  */
 class OAuthRequestRouter extends RequestRouter
 {
-    protected function getRouteFromPath($pathInfo)
-    {
-        // Hardcode the route for this entry point
-        return array(PageOAuth::class, 'callback');
-    }
+	protected function getRouteFromPath($pathInfo)
+	{
+		// Hardcode the route for this entry point
+		return array(PageOAuth::class, 'callback');
+	}
 }
\ No newline at end of file

includes/Router/IRequestRouter.php

Indentation +5 added lines, -5 removed lines

@@ -18,9 +18,9 @@
  */
 interface IRequestRouter
 {
-    /**
-     * @return IRoutedTask
-     * @throws Exception
-     */
-    public function route();
+	/**
+	 * @return IRoutedTask
+	 * @throws Exception
+	 */
+	public function route();
 }
\ No newline at end of file

includes/AutoLoader.php

Indentation +28 added lines, -28 removed lines

@@ -13,36 +13,36 @@
  */
 class AutoLoader
 {
-    public static function load($class)
-    {
-        // handle namespaces sensibly
-        if (strpos($class, "Waca") !== false) {
-            // strip off the initial namespace
-            $class = str_replace("Waca\\", "", $class);
+	public static function load($class)
+	{
+		// handle namespaces sensibly
+		if (strpos($class, "Waca") !== false) {
+			// strip off the initial namespace
+			$class = str_replace("Waca\\", "", $class);
 
-            // swap backslashes for forward slashes to map to directory names
-            $class = str_replace("\\", "/", $class);
-        }
+			// swap backslashes for forward slashes to map to directory names
+			$class = str_replace("\\", "/", $class);
+		}
 
-        $paths = array(
-            __DIR__ . '/' . $class . ".php",
-            __DIR__ . '/DataObjects/' . $class . ".php",
-            __DIR__ . '/Providers/' . $class . ".php",
-            __DIR__ . '/Providers/Interfaces/' . $class . ".php",
-            __DIR__ . '/Validation/' . $class . ".php",
-            __DIR__ . '/Helpers/' . $class . ".php",
-            __DIR__ . '/Helpers/Interfaces/' . $class . ".php",
-            __DIR__ . '/' . $class . ".php",
-        );
+		$paths = array(
+			__DIR__ . '/' . $class . ".php",
+			__DIR__ . '/DataObjects/' . $class . ".php",
+			__DIR__ . '/Providers/' . $class . ".php",
+			__DIR__ . '/Providers/Interfaces/' . $class . ".php",
+			__DIR__ . '/Validation/' . $class . ".php",
+			__DIR__ . '/Helpers/' . $class . ".php",
+			__DIR__ . '/Helpers/Interfaces/' . $class . ".php",
+			__DIR__ . '/' . $class . ".php",
+		);
 
-        foreach ($paths as $file) {
-            if (file_exists($file)) {
-                require_once($file);
-            }
+		foreach ($paths as $file) {
+			if (file_exists($file)) {
+				require_once($file);
+			}
 
-            if (class_exists($class)) {
-                return;
-            }
-        }
-    }
+			if (class_exists($class)) {
+				return;
+			}
+		}
+	}
 }

includes/StringFunctions.php

Indentation +64 added lines, -64 removed lines

@@ -10,77 +10,77 @@
 
 class StringFunctions
 {
-    /**
-     * Formats a string to be used as a username.
-     *
-     * @param $username
-     *
-     * @return string
-     */
-    public function formatAsUsername($username)
-    {
-        // trim whitespace from the ends
-        $uname = mb_ereg_replace("^[ \t]+|[ \t]+$", "", $username);
+	/**
+	 * Formats a string to be used as a username.
+	 *
+	 * @param $username
+	 *
+	 * @return string
+	 */
+	public function formatAsUsername($username)
+	{
+		// trim whitespace from the ends
+		$uname = mb_ereg_replace("^[ \t]+|[ \t]+$", "", $username);
 
-        // convert first char to uppercase
-        $uname = $this->ucfirst($uname);
+		// convert first char to uppercase
+		$uname = $this->ucfirst($uname);
 
-        // replace spaces with underscores
-        $uname = mb_ereg_replace("[ ]+", "_", $uname);
+		// replace spaces with underscores
+		$uname = mb_ereg_replace("[ ]+", "_", $uname);
 
-        // trim underscores from the end
-        $uname = mb_ereg_replace("[_]+$", "", $uname);
+		// trim underscores from the end
+		$uname = mb_ereg_replace("[_]+$", "", $uname);
 
-        return $uname;
-    }
+		return $uname;
+	}
 
-    /**
-     * Formats a string to be used as an email (specifically strips whitespace
-     * from the beginning/end of the Email, as well as immediately before/after
-     * the @ in the Email).
-     *
-     * @param $email
-     *
-     * @return string
-     */
-    public static function formatAsEmail($email)
-    {
-        // trim whitespace from the ends
-        $newemail = mb_ereg_replace("^[ \t]+|[ \t]+$", "", $email);
+	/**
+	 * Formats a string to be used as an email (specifically strips whitespace
+	 * from the beginning/end of the Email, as well as immediately before/after
+	 * the @ in the Email).
+	 *
+	 * @param $email
+	 *
+	 * @return string
+	 */
+	public static function formatAsEmail($email)
+	{
+		// trim whitespace from the ends
+		$newemail = mb_ereg_replace("^[ \t]+|[ \t]+$", "", $email);
 
-        // trim whitespace from around the email address
-        $newemail = mb_ereg_replace("[ \t]+@", "@", $newemail);
-        $newemail = mb_ereg_replace("@[ \t]+", "@", $newemail);
+		// trim whitespace from around the email address
+		$newemail = mb_ereg_replace("[ \t]+@", "@", $newemail);
+		$newemail = mb_ereg_replace("@[ \t]+", "@", $newemail);
 
-        return $newemail;
-    }
+		return $newemail;
+	}
 
-    /**
-     * Returns true if a string is a multibyte string
-     *
-     * @param string $string
-     *
-     * @return bool
-     */
-    public function isMultibyte($string)
-    {
-        return strlen($string) !== mb_strlen($string);
-    }
+	/**
+	 * Returns true if a string is a multibyte string
+	 *
+	 * @param string $string
+	 *
+	 * @return bool
+	 */
+	public function isMultibyte($string)
+	{
+		return strlen($string) !== mb_strlen($string);
+	}
 
-    /**
-     * Make a string's first character uppercase
-     *
-     * @param string $string
-     *
-     * @return string
-     */
-    public function ucfirst($string)
-    {
-        if (ord($string) < 128) {
-            return ucfirst($string);
-        }
-        else {
-            return mb_strtoupper(mb_substr($string, 0, 1)) . mb_substr($string, 1);
-        }
-    }
+	/**
+	 * Make a string's first character uppercase
+	 *
+	 * @param string $string
+	 *
+	 * @return string
+	 */
+	public function ucfirst($string)
+	{
+		if (ord($string) < 128) {
+			return ucfirst($string);
+		}
+		else {
+			return mb_strtoupper(mb_substr($string, 0, 1)) . mb_substr($string, 1);
+		}
+	}
 }