1
|
|
|
<?php |
2
|
|
|
|
3
|
|
|
namespace PhpXmlRpc; |
4
|
|
|
|
5
|
|
|
use PhpXmlRpc\Helper\XMLParser; |
6
|
|
|
|
7
|
|
|
/** |
8
|
|
|
* A helper class to easily convert between Value objects and php native values |
9
|
|
|
* @todo implement an interface |
10
|
|
|
*/ |
11
|
|
|
class Encoder |
12
|
|
|
{ |
13
|
|
|
/** |
14
|
|
|
* Takes an xmlrpc value in object format and translates it into native PHP types. |
15
|
|
|
* |
16
|
|
|
* Works with xmlrpc requests objects as input, too. |
17
|
|
|
* |
18
|
|
|
* Given proper options parameter, can rebuild generic php object instances (provided those have been encoded to |
19
|
|
|
* xmlrpc format using a corresponding option in php_xmlrpc_encode()) |
20
|
|
|
* PLEASE NOTE that rebuilding php objects involves calling their constructor function. |
21
|
|
|
* This means that the remote communication end can decide which php code will get executed on your server, leaving |
22
|
|
|
* the door possibly open to 'php-injection' style of attacks (provided you have some classes defined on your server |
23
|
|
|
* that might wreak havoc if instances are built outside an appropriate context). |
24
|
|
|
* Make sure you trust the remote server/client before eanbling this! |
25
|
|
|
* |
26
|
|
|
* @author Dan Libby ([email protected]) |
27
|
|
|
* |
28
|
|
|
* @param Value|Request $xmlrpcVal |
29
|
|
|
* @param array $options if 'decode_php_objs' is set in the options array, xmlrpc structs can be decoded into php |
30
|
|
|
* objects; if 'dates_as_objects' is set xmlrpc datetimes are decoded as php DateTime objects |
31
|
|
|
* |
32
|
|
|
* @return mixed |
33
|
|
|
*/ |
34
|
230 |
|
public function decode($xmlrpcVal, $options = array()) |
35
|
|
|
{ |
36
|
230 |
|
switch ($xmlrpcVal->kindOf()) { |
37
|
230 |
|
case 'scalar': |
38
|
230 |
|
if (in_array('extension_api', $options)) { |
39
|
|
|
$val = reset($xmlrpcVal->me); |
40
|
|
|
$typ = key($xmlrpcVal->me); |
41
|
|
|
switch ($typ) { |
42
|
|
|
case 'dateTime.iso8601': |
43
|
|
|
$xmlrpcVal->scalar = $val; |
44
|
|
|
$xmlrpcVal->type = 'datetime'; |
45
|
|
|
$xmlrpcVal->timestamp = \PhpXmlRpc\Helper\Date::iso8601Decode($val); |
46
|
|
|
|
47
|
|
|
return $xmlrpcVal; |
48
|
|
|
case 'base64': |
49
|
|
|
$xmlrpcVal->scalar = $val; |
50
|
|
|
$xmlrpcVal->type = $typ; |
51
|
|
|
|
52
|
|
|
return $xmlrpcVal; |
53
|
|
|
default: |
54
|
|
|
return $xmlrpcVal->scalarval(); |
|
|
|
|
55
|
|
|
} |
56
|
|
|
} |
57
|
230 |
|
if (in_array('dates_as_objects', $options) && $xmlrpcVal->scalartyp() == 'dateTime.iso8601') { |
|
|
|
|
58
|
|
|
// we return a Datetime object instead of a string since now the constructor of xmlrpc value accepts |
59
|
|
|
// safely strings, ints and datetimes, we cater to all 3 cases here |
60
|
|
|
$out = $xmlrpcVal->scalarval(); |
61
|
|
|
if (is_string($out)) { |
62
|
|
|
$out = strtotime($out); |
63
|
|
|
} |
64
|
|
|
if (is_int($out)) { |
65
|
|
|
$result = new \DateTime(); |
66
|
|
|
$result->setTimestamp($out); |
67
|
|
|
|
68
|
|
|
return $result; |
69
|
|
|
} elseif (is_a($out, 'DateTimeInterface')) { |
70
|
|
|
return $out; |
71
|
|
|
} |
72
|
|
|
} |
73
|
|
|
|
74
|
230 |
|
return $xmlrpcVal->scalarval(); |
75
|
230 |
|
case 'array': |
76
|
95 |
|
$arr = array(); |
77
|
95 |
|
foreach($xmlrpcVal as $value) { |
|
|
|
|
78
|
95 |
|
$arr[] = $this->decode($value, $options); |
79
|
|
|
} |
80
|
|
|
|
81
|
95 |
|
return $arr; |
82
|
173 |
|
case 'struct': |
83
|
|
|
// If user said so, try to rebuild php objects for specific struct vals. |
84
|
|
|
/// @todo should we raise a warning for class not found? |
85
|
|
|
// shall we check for proper subclass of xmlrpc value instead of presence of _php_class to detect |
86
|
|
|
// what we can do? |
87
|
57 |
|
if (in_array('decode_php_objs', $options) && $xmlrpcVal->_php_class != '' |
88
|
38 |
|
&& class_exists($xmlrpcVal->_php_class) |
89
|
|
|
) { |
90
|
19 |
|
$obj = @new $xmlrpcVal->_php_class(); |
91
|
19 |
|
foreach ($xmlrpcVal as $key => $value) { |
|
|
|
|
92
|
19 |
|
$obj->$key = $this->decode($value, $options); |
93
|
|
|
} |
94
|
|
|
|
95
|
19 |
|
return $obj; |
96
|
|
|
} else { |
97
|
38 |
|
$arr = array(); |
98
|
38 |
|
foreach ($xmlrpcVal as $key => $value) { |
|
|
|
|
99
|
38 |
|
$arr[$key] = $this->decode($value, $options); |
100
|
|
|
} |
101
|
|
|
|
102
|
38 |
|
return $arr; |
103
|
|
|
} |
104
|
116 |
|
case 'msg': |
105
|
116 |
|
$paramCount = $xmlrpcVal->getNumParams(); |
|
|
|
|
106
|
116 |
|
$arr = array(); |
107
|
116 |
|
for ($i = 0; $i < $paramCount; $i++) { |
108
|
116 |
|
$arr[] = $this->decode($xmlrpcVal->getParam($i), $options); |
|
|
|
|
109
|
|
|
} |
110
|
|
|
|
111
|
116 |
|
return $arr; |
112
|
|
|
} |
113
|
|
|
} |
114
|
|
|
|
115
|
|
|
/** |
116
|
|
|
* Takes native php types and encodes them into xmlrpc PHP object format. |
117
|
|
|
* It will not re-encode xmlrpc value objects. |
118
|
|
|
* |
119
|
|
|
* Feature creep -- could support more types via optional type argument |
120
|
|
|
* (string => datetime support has been added, ??? => base64 not yet) |
121
|
|
|
* |
122
|
|
|
* If given a proper options parameter, php object instances will be encoded into 'special' xmlrpc values, that can |
123
|
|
|
* later be decoded into php objects by calling php_xmlrpc_decode() with a corresponding option |
124
|
|
|
* |
125
|
|
|
* @author Dan Libby ([email protected]) |
126
|
|
|
* |
127
|
|
|
* @param mixed $phpVal the value to be converted into an xmlrpc value object |
128
|
|
|
* @param array $options can include 'encode_php_objs', 'auto_dates', 'null_extension' or 'extension_api' |
129
|
|
|
* |
130
|
|
|
* @return \PhpXmlrpc\Value |
131
|
|
|
*/ |
132
|
217 |
|
public function encode($phpVal, $options = array()) |
133
|
|
|
{ |
134
|
217 |
|
$type = gettype($phpVal); |
135
|
217 |
|
switch ($type) { |
136
|
217 |
|
case 'string': |
137
|
214 |
|
if (in_array('auto_dates', $options) && preg_match('/^[0-9]{8}T[0-9]{2}:[0-9]{2}:[0-9]{2}$/', $phpVal)) { |
138
|
1 |
|
$xmlrpcVal = new Value($phpVal, Value::$xmlrpcDateTime); |
139
|
|
|
} else { |
140
|
214 |
|
$xmlrpcVal = new Value($phpVal, Value::$xmlrpcString); |
141
|
|
|
} |
142
|
214 |
|
break; |
143
|
103 |
|
case 'integer': |
144
|
98 |
|
$xmlrpcVal = new Value($phpVal, Value::$xmlrpcInt); |
145
|
98 |
|
break; |
146
|
26 |
|
case 'double': |
147
|
1 |
|
$xmlrpcVal = new Value($phpVal, Value::$xmlrpcDouble); |
148
|
1 |
|
break; |
149
|
|
|
// Add support for encoding/decoding of booleans, since they are supported in PHP |
150
|
26 |
|
case 'boolean': |
151
|
1 |
|
$xmlrpcVal = new Value($phpVal, Value::$xmlrpcBoolean); |
152
|
1 |
|
break; |
153
|
26 |
|
case 'array': |
154
|
|
|
// PHP arrays can be encoded to either xmlrpc structs or arrays, depending on whether they are hashes |
155
|
|
|
// or plain 0..n integer indexed |
156
|
|
|
// A shorter one-liner would be |
157
|
|
|
// $tmp = array_diff(array_keys($phpVal), range(0, count($phpVal)-1)); |
158
|
|
|
// but execution time skyrockets! |
159
|
23 |
|
$j = 0; |
160
|
23 |
|
$arr = array(); |
161
|
23 |
|
$ko = false; |
162
|
23 |
|
foreach ($phpVal as $key => $val) { |
163
|
23 |
|
$arr[$key] = $this->encode($val, $options); |
164
|
23 |
|
if (!$ko && $key !== $j) { |
165
|
21 |
|
$ko = true; |
166
|
|
|
} |
167
|
23 |
|
$j++; |
168
|
|
|
} |
169
|
23 |
|
if ($ko) { |
170
|
21 |
|
$xmlrpcVal = new Value($arr, Value::$xmlrpcStruct); |
|
|
|
|
171
|
|
|
} else { |
172
|
3 |
|
$xmlrpcVal = new Value($arr, Value::$xmlrpcArray); |
|
|
|
|
173
|
|
|
} |
174
|
23 |
|
break; |
175
|
3 |
|
case 'object': |
176
|
1 |
|
if (is_a($phpVal, 'PhpXmlRpc\Value')) { |
177
|
1 |
|
$xmlrpcVal = $phpVal; |
178
|
|
|
} elseif (is_a($phpVal, 'DateTimeInterface')) { |
179
|
|
|
$xmlrpcVal = new Value($phpVal->format('Ymd\TH:i:s'), Value::$xmlrpcStruct); |
180
|
|
|
} else { |
181
|
|
|
$arr = array(); |
182
|
|
|
foreach($phpVal as $k => $v) { |
183
|
|
|
$arr[$k] = $this->encode($v, $options); |
184
|
|
|
} |
185
|
|
|
$xmlrpcVal = new Value($arr, Value::$xmlrpcStruct); |
|
|
|
|
186
|
|
|
if (in_array('encode_php_objs', $options)) { |
187
|
|
|
// let's save original class name into xmlrpc value: |
188
|
|
|
// might be useful later on... |
189
|
|
|
$xmlrpcVal->_php_class = get_class($phpVal); |
190
|
|
|
} |
191
|
|
|
} |
192
|
1 |
|
break; |
193
|
2 |
|
case 'NULL': |
194
|
2 |
|
if (in_array('extension_api', $options)) { |
195
|
|
|
$xmlrpcVal = new Value('', Value::$xmlrpcString); |
196
|
2 |
|
} elseif (in_array('null_extension', $options)) { |
197
|
|
|
$xmlrpcVal = new Value('', Value::$xmlrpcNull); |
198
|
|
|
} else { |
199
|
2 |
|
$xmlrpcVal = new Value(); |
200
|
|
|
} |
201
|
2 |
|
break; |
202
|
|
|
case 'resource': |
203
|
|
|
if (in_array('extension_api', $options)) { |
204
|
|
|
$xmlrpcVal = new Value((int)$phpVal, Value::$xmlrpcInt); |
205
|
|
|
} else { |
206
|
|
|
$xmlrpcVal = new Value(); |
207
|
|
|
} |
208
|
|
|
break; |
209
|
|
|
// catch "user function", "unknown type" |
210
|
|
|
default: |
211
|
|
|
// giancarlo pinerolo <[email protected]> |
212
|
|
|
// it has to return an empty object in case, not a boolean. |
213
|
|
|
$xmlrpcVal = new Value(); |
214
|
|
|
break; |
215
|
|
|
} |
216
|
|
|
|
217
|
217 |
|
return $xmlrpcVal; |
218
|
|
|
} |
219
|
|
|
|
220
|
|
|
/** |
221
|
|
|
* Convert the xml representation of a method response, method request or single |
222
|
|
|
* xmlrpc value into the appropriate object (a.k.a. deserialize). |
223
|
|
|
* |
224
|
|
|
* Q: is this a good name for this method? It does something quite different from 'decode' after all |
225
|
|
|
* (returning objects vs returns plain php values)... |
226
|
|
|
* |
227
|
|
|
* @param string $xmlVal |
228
|
|
|
* @param array $options |
229
|
|
|
* |
230
|
|
|
* @return mixed false on error, or an instance of either Value, Request or Response |
231
|
|
|
*/ |
232
|
3 |
|
public function decodeXml($xmlVal, $options = array()) |
|
|
|
|
233
|
|
|
{ |
234
|
|
|
// 'guestimate' encoding |
235
|
3 |
|
$valEncoding = XMLParser::guessEncoding('', $xmlVal); |
236
|
3 |
View Code Duplication |
if ($valEncoding != '') { |
|
|
|
|
237
|
|
|
|
238
|
|
|
// Since parsing will fail if charset is not specified in the xml prologue, |
239
|
|
|
// the encoding is not UTF8 and there are non-ascii chars in the text, we try to work round that... |
240
|
|
|
// The following code might be better for mb_string enabled installs, but makes the lib about 200% slower... |
241
|
|
|
//if (!is_valid_charset($valEncoding, array('UTF-8')) |
242
|
3 |
|
if (!in_array($valEncoding, array('UTF-8', 'US-ASCII')) && !XMLParser::hasEncoding($xmlVal)) { |
243
|
|
|
if ($valEncoding == 'ISO-8859-1') { |
244
|
|
|
$xmlVal = utf8_encode($xmlVal); |
245
|
|
|
} else { |
246
|
|
|
if (extension_loaded('mbstring')) { |
247
|
|
|
$xmlVal = mb_convert_encoding($xmlVal, 'UTF-8', $valEncoding); |
248
|
|
|
} else { |
249
|
|
|
Logger::instance()->errorLog('XML-RPC: ' . __METHOD__ . ': invalid charset encoding of xml text: ' . $valEncoding); |
250
|
|
|
} |
251
|
|
|
} |
252
|
|
|
} |
253
|
|
|
} |
254
|
|
|
|
255
|
|
|
// What if internal encoding is not in one of the 3 allowed? We use the broadest one, ie. utf8! |
256
|
3 |
View Code Duplication |
if (!in_array(PhpXmlRpc::$xmlrpc_internalencoding, array('UTF-8', 'ISO-8859-1', 'US-ASCII'))) { |
|
|
|
|
257
|
|
|
$options = array(XML_OPTION_TARGET_ENCODING => 'UTF-8'); |
258
|
|
|
} else { |
259
|
3 |
|
$options = array(XML_OPTION_TARGET_ENCODING => PhpXmlRpc::$xmlrpc_internalencoding); |
260
|
|
|
} |
261
|
|
|
|
262
|
3 |
|
$xmlRpcParser = new XMLParser($options); |
263
|
3 |
|
$xmlRpcParser->parse($xmlVal, XMLParser::RETURN_XMLRPCVALS, XMLParser::ACCEPT_REQUEST | XMLParser::ACCEPT_RESPONSE | XMLParser::ACCEPT_VALUE); |
264
|
|
|
|
265
|
3 |
|
if ($xmlRpcParser->_xh['isf'] > 1) { |
266
|
|
|
// test that $xmlrpc->_xh['value'] is an obj, too??? |
267
|
|
|
|
268
|
|
|
Logger::instance()->errorLog($xmlRpcParser->_xh['isf_reason']); |
269
|
|
|
|
270
|
|
|
return false; |
271
|
|
|
} |
272
|
|
|
|
273
|
3 |
|
switch ($xmlRpcParser->_xh['rt']) { |
274
|
3 |
|
case 'methodresponse': |
275
|
3 |
|
$v = $xmlRpcParser->_xh['value']; |
276
|
3 |
|
if ($xmlRpcParser->_xh['isf'] == 1) { |
277
|
|
|
/** @var Value $vc */ |
278
|
|
|
$vc = $v['faultCode']; |
279
|
|
|
/** @var Value $vs */ |
280
|
|
|
$vs = $v['faultString']; |
281
|
|
|
$r = new Response(0, $vc->scalarval(), $vs->scalarval()); |
282
|
|
|
} else { |
283
|
3 |
|
$r = new Response($v); |
284
|
|
|
} |
285
|
|
|
|
286
|
3 |
|
return $r; |
287
|
1 |
|
case 'methodcall': |
288
|
1 |
|
$req = new Request($xmlRpcParser->_xh['method']); |
289
|
1 |
View Code Duplication |
for ($i = 0; $i < count($xmlRpcParser->_xh['params']); $i++) { |
|
|
|
|
290
|
1 |
|
$req->addParam($xmlRpcParser->_xh['params'][$i]); |
291
|
|
|
} |
292
|
|
|
|
293
|
1 |
|
return $req; |
294
|
1 |
|
case 'value': |
295
|
1 |
|
return $xmlRpcParser->_xh['value']; |
296
|
|
|
default: |
297
|
|
|
return false; |
298
|
|
|
} |
299
|
|
|
} |
300
|
|
|
|
301
|
|
|
} |
302
|
|
|
|
It seems like the method you are trying to call exists only in some of the possible types.
Let’s take a look at an example:
Available Fixes
Add an additional type-check:
Only allow a single type to be passed if the variable comes from a parameter: