owncloud /
contacts
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | /** |
||
| 3 | * ownCloud - Addressbook |
||
| 4 | * |
||
| 5 | * @author Thomas Tanghus |
||
| 6 | * @copyright 2013-2014 Thomas Tanghus ([email protected]) |
||
| 7 | * |
||
| 8 | * This library is free software; you can redistribute it and/or |
||
| 9 | * modify it under the terms of the GNU AFFERO GENERAL PUBLIC LICENSE |
||
| 10 | * License as published by the Free Software Foundation; either |
||
| 11 | * version 3 of the License, or any later version. |
||
| 12 | * |
||
| 13 | * This library is distributed in the hope that it will be useful, |
||
| 14 | * but WITHOUT ANY WARRANTY; without even the implied warranty of |
||
| 15 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
||
| 16 | * GNU AFFERO GENERAL PUBLIC LICENSE for more details. |
||
| 17 | * |
||
| 18 | * You should have received a copy of the GNU Affero General Public |
||
| 19 | * License along with this library. If not, see <http://www.gnu.org/licenses/>. |
||
| 20 | * |
||
| 21 | */ |
||
| 22 | |||
| 23 | namespace OCA\Contacts; |
||
| 24 | |||
| 25 | use OC_L10N; |
||
| 26 | use OCA\Contacts\Backend\AbstractBackend; |
||
| 27 | use OCP\AppFramework\Http; |
||
| 28 | |||
| 29 | /** |
||
| 30 | * This class manages our addressbooks. |
||
| 31 | */ |
||
| 32 | |||
| 33 | class Addressbook extends AbstractPIMCollection { |
||
| 34 | |||
| 35 | /** |
||
| 36 | * @brief language object |
||
| 37 | * |
||
| 38 | * @var OC_L10N |
||
| 39 | */ |
||
| 40 | public static $l10n; |
||
| 41 | |||
| 42 | protected $_count; |
||
| 43 | |||
| 44 | /** |
||
| 45 | * @var Backend\AbstractBackend |
||
| 46 | */ |
||
| 47 | protected $backend; |
||
| 48 | |||
| 49 | /** |
||
| 50 | * An array containing the mandatory: |
||
| 51 | * 'displayname' |
||
| 52 | * 'discription' |
||
| 53 | * 'permissions' |
||
| 54 | * |
||
| 55 | * And the optional: |
||
| 56 | * 'Etag' |
||
| 57 | * 'lastModified' |
||
| 58 | * |
||
| 59 | * @var array |
||
| 60 | */ |
||
| 61 | protected $addressBookInfo; |
||
| 62 | |||
| 63 | /** |
||
| 64 | * @param AbstractBackend $backend The storage backend |
||
| 65 | * @param array $addressBookInfo |
||
| 66 | * @throws \Exception |
||
| 67 | */ |
||
| 68 | 18 | public function __construct(Backend\AbstractBackend $backend, array $addressBookInfo) { |
|
| 69 | 18 | self::$l10n = \OCP\Util::getL10N('contacts'); |
|
| 70 | 18 | $this->backend = $backend; |
|
| 71 | 18 | $this->addressBookInfo = $addressBookInfo; |
|
| 72 | 18 | if (is_null($this->getId())) { |
|
| 73 | 2 | $id = $this->backend->createAddressBook($addressBookInfo); |
|
| 74 | 2 | if ($id === false) { |
|
| 75 | throw new \Exception('Error creating address book.', Http::STATUS_INTERNAL_SERVER_ERROR); |
||
| 76 | } |
||
| 77 | |||
| 78 | 2 | $this->addressBookInfo = $this->backend->getAddressBook($id); |
|
| 79 | 2 | } |
|
| 80 | |||
| 81 | //\OCP\Util::writeLog('contacts', __METHOD__.' backend: ' . print_r($this->backend, true), \OCP\Util::DEBUG); |
||
| 82 | 18 | } |
|
| 83 | |||
| 84 | /** |
||
| 85 | * @return AbstractBackend |
||
| 86 | */ |
||
| 87 | 8 | public function getBackend() { |
|
| 88 | 8 | return $this->backend; |
|
| 89 | } |
||
| 90 | |||
| 91 | /** |
||
| 92 | * @return string|null |
||
| 93 | */ |
||
| 94 | 18 | public function getId() { |
|
| 95 | 18 | return isset($this->addressBookInfo['id']) |
|
| 96 | 18 | ? $this->addressBookInfo['id'] |
|
| 97 | 18 | : null; |
|
| 98 | } |
||
| 99 | |||
| 100 | /** |
||
| 101 | * @return array |
||
| 102 | */ |
||
| 103 | 8 | public function getMetaData() { |
|
| 104 | 4 | $metadata = $this->addressBookInfo; |
|
| 105 | 4 | $metadata['lastmodified'] = $this->lastModified(); |
|
| 106 | 4 | $metadata['active'] = $this->isActive(); |
|
| 107 | 8 | $metadata['backend'] = $this->getBackend()->name; |
|
| 108 | 4 | $metadata['owner'] = $this->getOwner(); |
|
| 109 | 4 | return $metadata; |
|
| 110 | } |
||
| 111 | |||
| 112 | /** |
||
| 113 | * @return string |
||
| 114 | */ |
||
| 115 | 1 | public function getDisplayName() { |
|
| 116 | 1 | return $this->addressBookInfo['displayname']; |
|
| 117 | } |
||
| 118 | |||
| 119 | /** |
||
| 120 | * @return string |
||
| 121 | */ |
||
| 122 | public function getURI() { |
||
| 123 | return $this->addressBookInfo['uri']; |
||
| 124 | } |
||
| 125 | |||
| 126 | /** |
||
| 127 | * @return string |
||
| 128 | */ |
||
| 129 | 4 | public function getOwner() { |
|
| 130 | 4 | return isset($this->addressBookInfo['owner']) |
|
| 131 | 4 | ? $this->addressBookInfo['owner'] |
|
| 132 | 4 | : \OC::$server->getUserSession()->getUser()->getUId(); |
|
| 133 | } |
||
| 134 | |||
| 135 | /** |
||
| 136 | * Returns the lowest permission of what the backend allows and what it supports. |
||
| 137 | * @return int |
||
| 138 | */ |
||
| 139 | 12 | public function getPermissions() { |
|
| 140 | 12 | return $this->addressBookInfo['permissions']; |
|
| 141 | } |
||
| 142 | |||
| 143 | /** |
||
| 144 | * @brief Query whether an address book is active |
||
| 145 | * @return boolean |
||
| 146 | */ |
||
| 147 | 4 | public function isActive() { |
|
| 148 | 4 | return $this->backend->isActive($this->getId()); |
|
| 149 | } |
||
| 150 | |||
| 151 | /** |
||
| 152 | * @brief Activate an address book |
||
| 153 | * @param bool $active |
||
| 154 | * @return void |
||
| 155 | */ |
||
| 156 | public function setActive($active) { |
||
| 157 | $this->backend->setActive($active, $this->getId()); |
||
| 158 | } |
||
| 159 | |||
| 160 | /** |
||
| 161 | * Returns a specific child node, referenced by its id |
||
| 162 | * |
||
| 163 | * @param string $id |
||
| 164 | * @return Contact|null |
||
| 165 | * @throws \Exception On not found |
||
| 166 | */ |
||
| 167 | 6 | public function getChild($id) { |
|
| 168 | //\OCP\Util::writeLog('contacts', __METHOD__.' id: '.$id, \OCP\Util::DEBUG); |
||
| 169 | 6 | if (!$this->hasPermission(\OCP\PERMISSION_READ)) { |
|
| 170 | throw new \Exception( |
||
| 171 | self::$l10n->t('You do not have permissions to see this contact'), |
||
| 172 | Http::STATUS_FORBIDDEN |
||
| 173 | ); |
||
| 174 | } |
||
| 175 | |||
| 176 | 6 | if (!isset($this->objects[(string)$id])) { |
|
| 177 | 6 | $contact = $this->backend->getContact($this->getId(), $id); |
|
| 178 | 6 | if ($contact) { |
|
| 179 | 5 | $this->objects[(string)$id] = new Contact($this, $this->backend, $contact); |
|
| 180 | 5 | } else { |
|
| 181 | 3 | throw new \Exception( |
|
| 182 | 3 | self::$l10n->t('Contact not found'), |
|
| 183 | Http::STATUS_NOT_FOUND |
||
| 184 | 3 | ); |
|
| 185 | } |
||
| 186 | 5 | } |
|
| 187 | |||
| 188 | // When requesting a single contact we preparse it |
||
| 189 | 5 | if (isset($this->objects[(string)$id])) { |
|
| 190 | 5 | $this->objects[(string)$id]->retrieve(); |
|
| 191 | 5 | return $this->objects[(string)$id]; |
|
| 192 | } |
||
| 193 | } |
||
| 194 | |||
| 195 | /** |
||
| 196 | * Checks if a child-node with the specified id exists |
||
| 197 | * |
||
| 198 | * @param string $id |
||
| 199 | * @return bool |
||
| 200 | */ |
||
| 201 | 1 | public function childExists($id) { |
|
| 202 | 1 | if(isset($this->objects[$id])) { |
|
| 203 | return true; |
||
| 204 | } |
||
| 205 | try { |
||
| 206 | 1 | return ($this->getChild($id) !== null); |
|
| 207 | 1 | } catch (\Exception $e) { |
|
| 208 | 1 | return false; |
|
| 209 | } |
||
| 210 | } |
||
| 211 | |||
| 212 | /** |
||
| 213 | * Returns an array with all the child nodes |
||
| 214 | * |
||
| 215 | * @param int $limit |
||
| 216 | * @param int $offset |
||
| 217 | * @param bool $omitdata |
||
| 218 | * @return Contact[] |
||
| 219 | */ |
||
| 220 | 2 | public function getChildren($limit = null, $offset = null, $omitdata = false) { |
|
| 221 | 2 | if (!$this->hasPermission(\OCP\PERMISSION_READ)) { |
|
| 222 | throw new \Exception( |
||
| 223 | self::$l10n->t('You do not have permissions to see these contacts'), |
||
| 224 | Http::STATUS_FORBIDDEN |
||
| 225 | ); |
||
| 226 | } |
||
| 227 | |||
| 228 | 2 | $contacts = array(); |
|
| 229 | |||
| 230 | 2 | $options = array('limit' => $limit, 'offset' => $offset, 'omitdata' => $omitdata); |
|
| 231 | 2 | foreach ($this->backend->getContacts($this->getId(), $options) as $contact) { |
|
| 232 | //\OCP\Util::writeLog('contacts', __METHOD__.' id: '.$contact['id'], \OCP\Util::DEBUG); |
||
| 233 | 1 | if (!isset($this->objects[$contact['id']])) { |
|
| 234 | 1 | $this->objects[$contact['id']] = new Contact($this, $this->backend, $contact); |
|
| 235 | 1 | } |
|
| 236 | |||
| 237 | 1 | $contacts[] = $this->objects[$contact['id']]; |
|
| 238 | 2 | } |
|
| 239 | |||
| 240 | //\OCP\Util::writeLog('contacts', __METHOD__.' children: '.count($contacts), \OCP\Util::DEBUG); |
||
| 241 | 2 | return $contacts; |
|
| 242 | } |
||
| 243 | |||
| 244 | /** |
||
| 245 | * Add a contact to the address book |
||
| 246 | * This takes an array or a VCard|Contact and return |
||
| 247 | * the ID or false. |
||
| 248 | * |
||
| 249 | * @param array|VObject\VCard $data |
||
| 250 | * @return int|bool |
||
| 251 | * @throws \Exception on missing permissions |
||
| 252 | */ |
||
| 253 | 3 | public function addChild($data = null) { |
|
| 254 | 3 | if (!$this->hasPermission(\OCP\PERMISSION_CREATE)) { |
|
| 255 | throw new \Exception( |
||
| 256 | self::$l10n->t('You do not have permissions add contacts to the address book'), |
||
| 257 | Http::STATUS_FORBIDDEN |
||
| 258 | ); |
||
| 259 | } |
||
| 260 | |||
| 261 | 3 | View Code Duplication | if (!$this->getBackend()->hasContactMethodFor(\OCP\PERMISSION_CREATE)) { |
| 262 | throw new \Exception( |
||
| 263 | self::$l10n->t('The backend for this address book does not support adding contacts'), |
||
| 264 | Http::STATUS_NOT_IMPLEMENTED |
||
| 265 | ); |
||
| 266 | } |
||
| 267 | |||
| 268 | 3 | $contact = new Contact($this, $this->backend, $data); |
|
| 269 | |||
| 270 | 3 | if (is_null($data)) { |
|
| 271 | // A new Contact, don't try to load from backend |
||
| 272 | $contact->setRetrieved(true); |
||
| 273 | } |
||
| 274 | |||
| 275 | 3 | if ($contact->save() === false) { |
|
| 276 | return false; |
||
| 277 | } |
||
| 278 | |||
| 279 | 3 | $id = $contact->getId(); |
|
| 280 | |||
| 281 | // If this method is called directly the index isn't set. |
||
| 282 | 3 | if (!isset($this->objects[$id])) { |
|
| 283 | 3 | $this->objects[$id] = $contact; |
|
| 284 | 3 | } |
|
| 285 | |||
| 286 | /* If count() hasn't been called yet don't _count hasn't been initialized |
||
| 287 | * so incrementing it would give a misleading value. |
||
| 288 | */ |
||
| 289 | 3 | if (isset($this->_count)) { |
|
| 290 | $this->_count += 1; |
||
| 291 | } |
||
| 292 | |||
| 293 | //\OCP\Util::writeLog('contacts', __METHOD__.' id: ' . $id, \OCP\Util::DEBUG); |
||
| 294 | 3 | return $id; |
|
| 295 | } |
||
| 296 | |||
| 297 | /** |
||
| 298 | * Delete a contact from the address book |
||
| 299 | * |
||
| 300 | * @param string $id |
||
| 301 | * @param array $options |
||
| 302 | * @return bool |
||
| 303 | * @throws \Exception on missing permissions |
||
| 304 | */ |
||
| 305 | 2 | public function deleteChild($id, $options = array()) { |
|
| 306 | 2 | if (!$this->hasPermission(\OCP\PERMISSION_DELETE)) { |
|
| 307 | throw new \Exception( |
||
| 308 | self::$l10n->t('You do not have permissions to delete this contact'), |
||
| 309 | Http::STATUS_FORBIDDEN |
||
| 310 | ); |
||
| 311 | } |
||
| 312 | |||
| 313 | 2 | View Code Duplication | if (!$this->getBackend()->hasContactMethodFor(\OCP\PERMISSION_DELETE)) { |
| 314 | throw new \Exception( |
||
| 315 | self::$l10n->t('The backend for this address book does not support deleting contacts'), |
||
| 316 | Http::STATUS_NOT_IMPLEMENTED |
||
| 317 | ); |
||
| 318 | } |
||
| 319 | |||
| 320 | 2 | if ($this->backend->deleteContact($this->getId(), $id, $options)) { |
|
| 321 | 2 | if (isset($this->objects[$id])) { |
|
| 322 | 1 | unset($this->objects[$id]); |
|
| 323 | 1 | } |
|
| 324 | |||
| 325 | /* If count() hasn't been called yet don't _count hasn't been initialized |
||
| 326 | * so decrementing it would give a misleading value. |
||
| 327 | */ |
||
| 328 | 2 | if (isset($this->_count)) { |
|
| 329 | $this->_count -= 1; |
||
| 330 | } |
||
| 331 | |||
| 332 | 2 | return true; |
|
| 333 | } |
||
| 334 | |||
| 335 | return false; |
||
| 336 | } |
||
| 337 | |||
| 338 | /** |
||
| 339 | * Delete a list of contacts from the address book |
||
| 340 | * |
||
| 341 | * @param array $ids |
||
| 342 | * @return array containing the status |
||
| 343 | * @throws \Exception on missing permissions |
||
| 344 | */ |
||
| 345 | public function deleteChildren($ids) { |
||
| 346 | if (!$this->hasPermission(\OCP\PERMISSION_DELETE)) { |
||
| 347 | throw new \Exception( |
||
| 348 | self::$l10n->t('You do not have permissions to delete this contact'), |
||
| 349 | Http::STATUS_FORBIDDEN |
||
| 350 | ); |
||
| 351 | } |
||
| 352 | |||
| 353 | View Code Duplication | if (!$this->getBackend()->hasContactMethodFor(\OCP\PERMISSION_DELETE)) { |
|
| 354 | throw new \Exception( |
||
| 355 | self::$l10n->t('The backend for this address book does not support deleting contacts'), |
||
| 356 | Http::STATUS_NOT_IMPLEMENTED |
||
| 357 | ); |
||
| 358 | } |
||
| 359 | |||
| 360 | $response = array(); |
||
| 361 | |||
| 362 | \OCP\Util::emitHook('OCA\Contacts', 'pre_deleteContact', |
||
| 363 | array('id' => $ids) |
||
| 364 | ); |
||
| 365 | |||
| 366 | foreach ($ids as $id) { |
||
| 367 | try { |
||
| 368 | if (!$this->deleteChild($id, array('isBatch' => true))) { |
||
| 369 | \OCP\Util::writeLog( |
||
| 370 | 'contacts', __METHOD__.' Error deleting contact: ' |
||
| 371 | . $this->getBackend()->name . '::' |
||
| 372 | . $this->getId() . '::' . $id, |
||
| 373 | \OCP\Util::ERROR |
||
| 374 | ); |
||
| 375 | $response[] = array( |
||
| 376 | 'id' => (string)$id, |
||
| 377 | 'status' => 'error', |
||
| 378 | 'message' => self::$l10n->t('Unknown error') |
||
| 379 | ); |
||
| 380 | } else { |
||
| 381 | $response[] = array( |
||
| 382 | 'id' => (string)$id, |
||
| 383 | 'status' => 'success' |
||
| 384 | ); |
||
| 385 | } |
||
| 386 | } catch(\Exception $e) { |
||
| 387 | $response[] = array( |
||
| 388 | 'id' => (string)$id, |
||
| 389 | 'status' => 'error', |
||
| 390 | 'message' => $e->getMessage() |
||
| 391 | ); |
||
| 392 | } |
||
| 393 | } |
||
| 394 | return $response; |
||
| 395 | } |
||
| 396 | |||
| 397 | /** |
||
| 398 | * @internal implements Countable |
||
| 399 | * @return int|null |
||
| 400 | */ |
||
| 401 | 1 | public function count() { |
|
| 402 | 1 | if (!isset($this->_count)) { |
|
| 403 | 1 | $this->_count = $this->backend->numContacts($this->getId()); |
|
| 404 | 1 | } |
|
| 405 | |||
| 406 | 1 | return $this->_count; |
|
| 407 | } |
||
| 408 | |||
| 409 | /** |
||
| 410 | * Update and save the address book data to backend |
||
| 411 | * NOTE: @see IPIMObject::update for consistency considerations. |
||
| 412 | * |
||
| 413 | * @param array $data |
||
| 414 | * @return bool |
||
| 415 | */ |
||
| 416 | 1 | public function update(array $data) { |
|
| 417 | 1 | if (!$this->hasPermission(\OCP\PERMISSION_UPDATE)) { |
|
| 418 | throw new \Exception( |
||
| 419 | self::$l10n->t('Access denied'), |
||
| 420 | Http::STATUS_FORBIDDEN |
||
| 421 | ); |
||
| 422 | } |
||
| 423 | |||
| 424 | 1 | View Code Duplication | if (!$this->getBackend()->hasContactMethodFor(\OCP\PERMISSION_UPDATE)) { |
| 425 | throw new \Exception( |
||
| 426 | self::$l10n->t('The backend for this address book does not support updating'), |
||
| 427 | Http::STATUS_NOT_IMPLEMENTED |
||
| 428 | ); |
||
| 429 | } |
||
| 430 | |||
| 431 | 1 | if (count($data) === 0) { |
|
| 432 | return false; |
||
| 433 | } |
||
| 434 | |||
| 435 | 1 | foreach ($data as $key => $value) { |
|
| 436 | switch ($key) { |
||
| 437 | 1 | case 'displayname': |
|
| 438 | 1 | $this->addressBookInfo['displayname'] = $value; |
|
| 439 | 1 | break; |
|
| 440 | case 'description': |
||
| 441 | $this->addressBookInfo['description'] = $value; |
||
| 442 | break; |
||
| 443 | } |
||
| 444 | 1 | } |
|
| 445 | |||
| 446 | 1 | return $this->backend->updateAddressBook($this->getId(), $data); |
|
| 447 | } |
||
| 448 | |||
| 449 | /** |
||
| 450 | * Delete the address book from backend |
||
| 451 | * |
||
| 452 | * @return bool |
||
| 453 | */ |
||
| 454 | 1 | public function delete() { |
|
| 455 | 1 | if (!$this->hasPermission(\OCP\PERMISSION_DELETE)) { |
|
| 456 | throw new \Exception( |
||
| 457 | self::$l10n->t('You don\'t have permissions to delete the address book.'), |
||
| 458 | Http::STATUS_FORBIDDEN |
||
| 459 | ); |
||
| 460 | } |
||
| 461 | |||
| 462 | 1 | return $this->backend->deleteAddressBook($this->getId()); |
|
| 463 | } |
||
| 464 | |||
| 465 | /** |
||
| 466 | * @brief Get the last modification time for the object. |
||
| 467 | * |
||
| 468 | * Must return a UNIX time stamp or null if the backend |
||
| 469 | * doesn't support it. |
||
| 470 | * |
||
| 471 | * @return int | null |
||
| 472 | */ |
||
| 473 | 5 | public function lastModified() { |
|
| 474 | 5 | return $this->backend->lastModifiedAddressBook($this->getId()); |
|
| 475 | } |
||
| 476 | |||
| 477 | /** |
||
| 478 | * Get an array of birthday events for contacts in this address book. |
||
| 479 | * |
||
| 480 | * @return \Sabre\VObject\Component\VEvent[] |
||
| 481 | */ |
||
| 482 | public function getBirthdayEvents() { |
||
| 483 | |||
| 484 | $events = array(); |
||
| 485 | |||
| 486 | foreach ($this->getChildren() as $contact) { |
||
| 487 | if ($event = $contact->getBirthdayEvent()) { |
||
| 488 | $events[] = $event; |
||
| 489 | } |
||
| 490 | } |
||
| 491 | |||
| 492 | return $events; |
||
| 493 | } |
||
| 494 | |||
| 495 | /** |
||
| 496 | * Returns the searchProvider for a specific backend. |
||
| 497 | * |
||
| 498 | * @return \OCP\IAddressBook |
||
| 499 | */ |
||
| 500 | public function getSearchProvider() { |
||
| 501 | return $this->backend->getSearchProvider($this); |
||
|
0 ignored issues
–
show
|
|||
| 502 | } |
||
| 503 | } |
||
| 504 |
Let’s take a look at an example:
In the above example, the authenticate() method works fine as long as you just pass instances of MyUser. However, if you now also want to pass a different sub-classes of User which does not have a getDisplayName() method, the code will break.
Available Fixes
Change the type-hint for the parameter:
Add an additional type-check:
Add the method to the parent class: