GitHub Access Token became invalid

It seems like the GitHub access token used for retrieving details about this repository from GitHub became invalid. This might prevent certain types of inspections from being run (in particular, everything related to pull requests).
Please ask an admin of your repository to re-new the access token on this website.
Completed
Pull Request — master (#833)
by
unknown
03:15
created

Path::calculate_path()   B

Complexity

Conditions 6
Paths 6

Size

Total Lines 22
Code Lines 9

Duplication

Lines 0
Ratio 0 %

Importance

Changes 2
Bugs 0 Features 0
Metric Value
cc 6
eloc 9
c 2
b 0
f 0
nc 6
nop 0
dl 0
loc 22
rs 8.6737
1
<?php
2
3
namespace HM\BackUpWordPress;
4
5
/**
6
 * Manages both the backup path and site root
7
 *
8
 * Handles calculating & protecting the directory that backups will be stored in
9
 * as well as the directory that is being backed up
10
 */
11
class Path {
12
13
	/**
14
	 * The path to the directory that backup files are stored in
15
	 *
16
	 * @var string $this->path
17
	 */
18
	private $path;
19
20
	/**
21
	 * The path to the directory that will be backed up
22
	 *
23
	 * @var string $this->root
24
	 */
25
	private $root;
26
27
	/**
28
	 * The path to the directory that backup files are stored in
29
	 *
30
	 * @var string $this->path
31
	 */
32
	private $custom_path;
33
34
	/**
35
	 * Contains the instantiated Path instance
36
	 *
37
	 * @var Path $this->instance
38
	 */
39
	private static $instance;
40
41
	/**
42
	 * Protected constructor to prevent creating a new instance of the
43
	 * *Singleton* via the `new` operator from outside of this class.
44
	 */
45
	protected function __construct() {}
46
47
	/**
48
	 * Private clone method to prevent cloning of the instance of the
49
	 * *Singleton* instance.
50
	 */
51
	private function __clone() {}
52
53
	/**
54
	 * Private unserialize method to prevent unserializing of the *Singleton*
55
	 * instance.
56
	 */
57
	private function __wakeup() {}
58
59
	/**
60
	 * Returns the *Singleton* instance of this class.
61
	 *
62
	 * @staticvar Path $instance The *Singleton* instances of this class.
63
	 *
64
	 * @return Path The *Singleton* instance.
65
	 */
66
	public static function get_instance() {
67
68
		if ( ! ( self::$instance instanceof Path ) ) {
69
			self::$instance = new Path();
70
		}
71
72
		return self::$instance;
73
	}
74
75
	/**
76
	 * Convenience method for quickly grabbing the path
77
	 */
78
	public static function get_path() {
0 ignored issues
show
Documentation introduced by
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
79
		return self::get_instance()->get_calculated_path();
80
	}
81
82
	/**
83
	 * Convenience method for quickly grabbing the root
84
	 */
85
	public static function get_root() {
0 ignored issues
show
Documentation introduced by
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
86
		return self::get_instance()->get_calculated_root();
87
	}
88
89
	/**
90
	 * Calculate the path to the site "home" directory.
91
	 *
92
	 * The home directory is the path equivalent to the home_url. That is,
93
	 * the path to the true root of the website. In situations where WordPress is
94
	 * installed in a subdirectory the home path is different to ABSPATH
95
	 *
96
	 * @param string $site_path The site_path to use when calculating the home path, defaults to ABSPATH
97
	 */
98
	public static function get_home_path( $site_path = ABSPATH ) {
0 ignored issues
show
Documentation introduced by
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
99
100
		if ( defined( 'HMBKP_ROOT' ) && HMBKP_ROOT ) {
101
			return wp_normalize_path( HMBKP_ROOT );
102
		}
103
104
		$home_path = wp_normalize_path( $site_path );
105
106
		if ( path_in_php_open_basedir( dirname( $site_path ) ) ) {
107
108
			$home    = set_url_scheme( get_option( 'home' ), 'http' );
109
			$siteurl = set_url_scheme( get_option( 'siteurl' ), 'http' );
110
			if ( ! empty( $home ) && 0 !== strcasecmp( $home, $siteurl ) ) {
111
				$wp_path_rel_to_home = str_ireplace( $home, '', $siteurl ); /* $siteurl - $home */
112
				$pos = strripos( wp_normalize_path( $_SERVER['SCRIPT_FILENAME'] ), trailingslashit( $wp_path_rel_to_home ) );
113
				$home_path = substr( wp_normalize_path( $_SERVER['SCRIPT_FILENAME'] ), 0, $pos );
114
				$home_path = trailingslashit( $home_path );
115
			}
116
117
			if ( is_multisite() ) {
118
				$slashed_home      = trailingslashit( get_option( 'home' ) );
119
				$base              = parse_url( $slashed_home, PHP_URL_PATH );
120
				$document_root_fix = wp_normalize_path( realpath( $_SERVER['DOCUMENT_ROOT'] ) );
121
				$abspath_fix       = wp_normalize_path( ABSPATH );
122
				$home_path         = strpos( $abspath_fix, $document_root_fix ) === 0 ? $document_root_fix . $base : $home_path;
123
			}
124
		}
125
126
		return wp_normalize_path( untrailingslashit( $home_path ) );
127
128
	}
129
130
	/**
131
	 * get the calculated path to the directory where backups will be stored
132
	 */
133
	private function get_calculated_path() {
0 ignored issues
show
Documentation introduced by
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
134
135
		// Calculate the path if needed
136
		if ( empty( $this->path ) || ! wp_is_writable( $this->path ) ) {
137
			$this->calculate_path();
138
		}
139
140
		// Ensure the backup directory is protected
141
		$this->protect_path();
142
143
		return wp_normalize_path( $this->path );
144
145
	}
146
147
	/**
148
	 * Set the path directly, overriding the default
149
	 *
150
	 * @param $path
151
	 */
152
	public function set_path( $path ) {
153
154
		$this->custom_path = $path;
155
156
		// Re-calculate the backup path
157
		$this->calculate_path();
158
159
	}
160
161
	/**
162
	 * get the calculated path to the directory that will be backed up
163
	 */
164
	private function get_calculated_root() {
0 ignored issues
show
Documentation introduced by
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
165
166
		$root = self::get_home_path();
167
168
		if ( defined( 'HMBKP_ROOT' ) && HMBKP_ROOT ) {
169
			$root = HMBKP_ROOT;
170
		}
171
172
		if ( $this->root ) {
173
			$root = $this->root;
174
		}
175
176
		return wp_normalize_path( $root );
177
178
	}
179
180
	/**
181
	 * Set the root path directly, overriding the default
182
	 *
183
	 * @param $root
184
	 */
185
	public function set_root( $root ) {
186
		$this->root = $root;
187
	}
188
189
	public function reset_path() {
190
		$this->path = $this->custom_path = '';
191
	}
192
193
	/**
194
	 * Get the path to the default backup location in wp-content
195
	 */
196
	public function get_default_path() {
197
		return trailingslashit( wp_normalize_path( WP_CONTENT_DIR ) ) . 'backupwordpress-' . substr( HMBKP_SECURE_KEY, 0, 10 ) . '-backups';
198
	}
199
200
	/**
201
	 * Get the path to the fallback backup location in uploads
202
	 */
203
	public function get_fallback_path() {
204
205
		$upload_dir = wp_upload_dir();
206
207
		return trailingslashit( wp_normalize_path( $upload_dir['basedir'] ) ) . 'backupwordpress-' . substr( HMBKP_SECURE_KEY, 0, 10 ) . '-backups';
208
209
	}
210
211
	/**
212
	 * Get the path to the custom backup location if it's been set
213
	 */
214
	public function get_custom_path() {
0 ignored issues
show
Documentation introduced by
The return type could not be reliably inferred; please add a @return annotation.

Our type inference engine in quite powerful, but sometimes the code does not provide enough clues to go by. In these cases we request you to add a @return annotation as described here.

Loading history...
215
216
		if ( $this->custom_path ) {
217
			return $this->custom_path;
218
		}
219
220
		if ( defined( 'HMBKP_PATH' ) && wp_is_writable( HMBKP_PATH ) ) {
221
			return HMBKP_PATH;
222
		}
223
224
		return '';
225
226
	}
227
228
	/**
229
	 * Builds an array containing existing backups folders.
230
	 *
231
	 * @return array
232
	 */
233
	public function get_existing_paths() {
234
235
		if ( false === $default = glob( WP_CONTENT_DIR . '/backupwordpress-*-backups', GLOB_ONLYDIR ) ) {
236
			$default = array();
237
		}
238
239
		$upload_dir = wp_upload_dir();
240
241
		if ( false === $fallback = glob( $upload_dir['basedir'] . '/backupwordpress-*-backups', GLOB_ONLYDIR ) ) {
242
			$fallback = array();
243
		}
244
245
		$paths = array_merge( $default, $fallback );
246
		$paths = array_map( 'wp_normalize_path', $paths );
247
248
		return $paths;
249
250
	}
251
252
	/**
253
	 * Returns the first existing path if there is one
254
	 *
255
	 * @return string Backup path if found empty string if not
256
	 */
257
	public function get_existing_path() {
258
259
		$paths = $this->get_existing_paths();
260
261
		if ( ! empty( $paths[0] ) ) {
262
			return $paths[0];
263
		}
264
265
		return '';
266
267
	}
268
269
	/**
270
	 * Calculate the backup path and create the directory if it doesn't exist.
271
	 *
272
	 * Tries all possible locations and uses the first one possible
273
	 *
274
	 * @return
275
	 */
276
	public function calculate_path() {
277
278
		$paths = $this->get_possible_paths();
279
280
		// Loop through possible paths, use the first one that exists/can be created and is writable.
281
		foreach ( $paths as $path ) {
282
			// Also handles fixing perms / directory already exists.
283
			if ( wp_mkdir_p( $path ) && wp_is_writable( $path ) ) {
284
				break;
285
			}
286
		}
287
288
		/**
289
		 * If we managed to create a writable path then use that,
290
		 * otherwise just return the unwritable path.
291
		 */
292
		if ( file_exists( $path ) && wp_is_writable( $path ) ) {
293
			$this->path = $path;
0 ignored issues
show
Bug introduced by
The variable $path seems to be defined by a foreach iteration on line 281. Are you sure the iterator is never empty, otherwise this variable is not defined?

It seems like you are relying on a variable being defined by an iteration:

foreach ($a as $b) {
}

// $b is defined here only if $a has elements, for example if $a is array()
// then $b would not be defined here. To avoid that, we recommend to set a
// default value for $b.


// Better
$b = 0; // or whatever default makes sense in your context
foreach ($a as $b) {
}

// $b is now guaranteed to be defined here.
Loading history...
294
		} else {
295
			$this->path = reset( $paths );
0 ignored issues
show
Documentation Bug introduced by
It seems like reset($paths) can also be of type false. However, the property $path is declared as type string. Maybe add an additional type check?

Our type inference engine has found a suspicous assignment of a value to a property. This check raises an issue when a value that can be of a mixed type is assigned to a property that is type hinted more strictly.

For example, imagine you have a variable $accountId that can either hold an Id object or false (if there is no account id yet). Your code now assigns that value to the id property of an instance of the Account class. This class holds a proper account, so the id value must no longer be false.

Either this assignment is in error or a type check should be added for that assignment.

class Id
{
    public $id;

    public function __construct($id)
    {
        $this->id = $id;
    }

}

class Account
{
    /** @var  Id $id */
    public $id;
}

$account_id = false;

if (starsAreRight()) {
    $account_id = new Id(42);
}

$account = new Account();
if ($account instanceof Id)
{
    $account->id = $account_id;
}
Loading history...
296
		}
297
	}
298
299
	public function get_possible_paths() {
300
301
		$paths = array();
302
303
		// If we have a custom path then try to use it
304
		if ( $this->get_custom_path() ) {
305
			$paths[] = $this->get_custom_path();
306
		}
307
308
		// If there is already a backups directory then try to use that
309
		if ( $this->get_existing_path() ) {
310
			$paths[] = $this->get_existing_path();
311
		}
312
313
		// If not then default to a new directory in wp-content
314
		$paths[] = $this->get_default_path();
315
316
		// If that didn't work then fallback to a new directory in uploads
317
		$paths[] = $this->get_fallback_path();
318
319
		return $paths;
320
321
	}
322
323
	/**
324
	 * Protect the directory that backups are stored in
325
	 *
326
	 * - Adds an index.html file in an attempt to disable directory browsing
327
	 * - Adds a .httaccess file to deny direct access if on Apache
328
	 *
329
	 * @param string $reset
330
	 */
331
	public function protect_path( $reset = 'no' ) {
332
333
		global $is_apache;
334
335
		// Protect against directory browsing by including an index.html file
336
		$index = $this->path . '/index.html';
337
338
		if ( 'reset' === $reset && file_exists( $index ) ) {
339
			@unlink( $index );
0 ignored issues
show
Security Best Practice introduced by
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

If you suppress an error, we recommend checking for the error condition explicitly:

// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
Loading history...
340
		}
341
342
		if ( ! file_exists( $index ) && wp_is_writable( $this->path ) ) {
343
			file_put_contents( $index, '' );
344
		}
345
346
		$htaccess = $this->path . '/.htaccess';
347
348
		if ( ( 'reset' === $reset ) && file_exists( $htaccess ) ) {
349
			@unlink( $htaccess );
0 ignored issues
show
Security Best Practice introduced by
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

If you suppress an error, we recommend checking for the error condition explicitly:

// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
Loading history...
350
		}
351
352
		// Protect the directory with a .htaccess file on Apache servers
353
		if ( $is_apache && function_exists( 'insert_with_markers' ) && ! file_exists( $htaccess ) && wp_is_writable( $this->path ) ) {
354
355
			$contents[] = '# ' . sprintf( __( 'This %s file ensures that other people cannot download your backup files.', 'backupwordpress' ), '.htaccess' );
0 ignored issues
show
Coding Style Comprehensibility introduced by
$contents was never initialized. Although not strictly required by PHP, it is generally a good practice to add $contents = array(); before regardless.

Adding an explicit array definition is generally preferable to implicit array definition as it guarantees a stable state of the code.

Let’s take a look at an example:

foreach ($collection as $item) {
    $myArray['foo'] = $item->getFoo();

    if ($item->hasBar()) {
        $myArray['bar'] = $item->getBar();
    }

    // do something with $myArray
}

As you can see in this example, the array $myArray is initialized the first time when the foreach loop is entered. You can also see that the value of the bar key is only written conditionally; thus, its value might result from a previous iteration.

This might or might not be intended. To make your intention clear, your code more readible and to avoid accidental bugs, we recommend to add an explicit initialization $myArray = array() either outside or inside the foreach loop.

Loading history...
356
			$contents[] = '';
357
			$contents[] = '<IfModule mod_rewrite.c>';
358
			$contents[] = 'RewriteEngine On';
359
			$contents[] = 'RewriteCond %{QUERY_STRING} !key=' . HMBKP_SECURE_KEY;
360
			$contents[] = 'RewriteRule (.*) - [F]';
361
			$contents[] = '</IfModule>';
362
			$contents[] = '';
363
364
			file_put_contents( $htaccess, '' );
365
366
			insert_with_markers( $htaccess, 'BackUpWordPress', $contents );
367
368
		}
369
370
	}
371
372
	/**
373
	 * If we have more than one path then move any existing backups to the current path and remove them
374
	 */
375
	public function merge_existing_paths() {
376
377
		$paths = $this->get_existing_paths();
378
379
		if ( ( $paths && $this->get_custom_path() ) || count( $paths ) > 1 ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $paths of type array is implicitly converted to a boolean; are you sure this is intended? If so, consider using ! empty($expr) instead to make it clear that you intend to check for an array without elements.

This check marks implicit conversions of arrays to boolean values in a comparison. While in PHP an empty array is considered to be equal (but not identical) to false, this is not always apparent.

Consider making the comparison explicit by using empty(..) or ! empty(...) instead.

Loading history...
380
			foreach ( $paths as $old_path ) {
381
				$this->move_old_backups( $old_path );
382
			}
383
		}
384
385
	}
386
387
	/**
388
	 * Move backup files from an existing directory and the new
389
	 * location
390
	 *
391
	 * @param string $path 	The path to move the backups from
0 ignored issues
show
Bug introduced by
There is no parameter named $path. Was it maybe removed?

This check looks for PHPDoc comments describing methods or function parameters that do not exist on the corresponding method or function.

Consider the following example. The parameter $italy is not defined by the method finale(...).

/**
 * @param array $germany
 * @param array $island
 * @param array $italy
 */
function finale($germany, $island) {
    return "2:1";
}

The most likely cause is that the parameter was removed, but the annotation was not.

Loading history...
392
	 */
393
	public function move_old_backups( $from ) {
394
395
		if ( ! is_readable( $from ) ) {
396
			return;
397
		}
398
399
		if ( ! wp_is_writable( Path::get_path() ) ) {
400
			return;
401
		}
402
403
		// Move any existing backups
404
		if ( $handle = opendir( $from ) ) {
405
406
			// Loop through the backup directory
407
			while ( false !== ( $file = readdir( $handle ) ) ) {
408
409
				// Find all zips
410
				if ( 'zip' === pathinfo( $file, PATHINFO_EXTENSION ) ) {
411
412
					// Try to move them
413
					if ( ! @rename( trailingslashit( $from ) . $file, trailingslashit( Path::get_path() ) . $file ) ) {
414
415
						// If we can't move them then try to copy them
416
						copy( trailingslashit( $from ) . $file, trailingslashit( Path::get_path() ) . $file );
417
418
					}
419
				}
420
			}
421
422
			closedir( $handle );
423
424
		}
425
426
		// Delete the old directory if it's inside WP_CONTENT_DIR
427
		if ( false !== strpos( $from, WP_CONTENT_DIR ) &&  Path::get_path() !== $from ) {
428
			rmdirtree( $from );
429
		}
430
	}
431
432
	/**
433
	 * Clean any temporary / incomplete backups from the backups directory
434
	 */
435
	public function cleanup() {
436
437
		// Don't cleanup a custom path, who knows what other stuff is there
438
		if ( Path::get_path() === $this->get_custom_path() ) {
439
			return;
440
		}
441
442
		foreach ( new CleanUpIterator( new \DirectoryIterator( Path::get_path() ) ) as $file ) {
443
444
			if ( $file->isDot() || ! $file->isReadable() || ! $file->isFile() ) {
445
				continue;
446
			}
447
448
			@unlink( $file->getPathname() );
0 ignored issues
show
Security Best Practice introduced by
It seems like you do not handle an error condition here. This can introduce security issues, and is generally not recommended.

If you suppress an error, we recommend checking for the error condition explicitly:

// For example instead of
@mkdir($dir);

// Better use
if (@mkdir($dir) === false) {
    throw new \RuntimeException('The directory '.$dir.' could not be created.');
}
Loading history...
449
450
		}
451
	}
452
}
453
454
class CleanUpIterator extends \FilterIterator {
0 ignored issues
show
Coding Style Compatibility introduced by
PSR1 recommends that each class should be in its own file to aid autoloaders.

Having each class in a dedicated file usually plays nice with PSR autoloaders and is therefore a well established practice. If you use other autoloaders, you might not want to follow this rule.

Loading history...
455
456
	// Don't match index.html, files with zip extension or status logfiles.
457
	public function accept() {
458
459
		// Don't remove existing backups
460
		if ( 'zip' === pathinfo( $this->current()->getFilename(), PATHINFO_EXTENSION ) ) {
461
			return false;
462
		}
463
464
		// Don't remove the index.html file
465
		if ( 'index.html' === $this->current()->getBasename() ) {
466
			return false;
467
		}
468
469
		// Don't remove the file manifest
470
		if ( '.files' === $this->current()->getBasename() ) {
471
			return false;
472
		}
473
474
		// Don't cleanup the backup running file
475
		return ! preg_match( '/(.*-running)/', $this->current() );
476
477
	}
478
}
479