This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | /** |
||
3 | * @author Thomas Tanghus |
||
4 | * @copyright 2013-2014 Thomas Tanghus ([email protected]) |
||
5 | * |
||
6 | * This file is licensed under the Affero General Public License version 3 or |
||
7 | * later. |
||
8 | * See the COPYING-README file. |
||
9 | */ |
||
10 | |||
11 | namespace OCA\Contacts\Controller; |
||
12 | |||
13 | use OCA\Contacts\App; |
||
14 | use OCA\Contacts\JSONResponse; |
||
15 | use OCA\Contacts\Controller; |
||
16 | use OCA\Contacts\ImportManager; |
||
17 | use OCP\IRequest; |
||
18 | use OCP\ICache; |
||
19 | use OCP\ITags; |
||
20 | |||
21 | /** |
||
22 | * Controller importing contacts |
||
23 | */ |
||
24 | class ImportController extends Controller { |
||
25 | |||
26 | /** |
||
27 | * @param string $appName |
||
28 | */ |
||
29 | public function __construct($appName, IRequest $request, App $app, ICache $cache, ITags $tags) { |
||
30 | parent::__construct($appName, $request, $app); |
||
31 | $this->cache = $cache; |
||
32 | $this->tags = $tags; |
||
0 ignored issues
–
show
Coding Style
introduced
by
![]() |
|||
33 | } |
||
34 | |||
35 | /** |
||
36 | * @NoAdminRequired |
||
37 | */ |
||
38 | public function upload() { |
||
39 | $request = $this->request; |
||
40 | $params = $this->request->urlParams; |
||
41 | $addressBookId = $params['addressBookId']; |
||
0 ignored issues
–
show
$addressBookId is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
42 | $format = $params['importType']; |
||
43 | $response = new JSONResponse(); |
||
44 | |||
45 | $view = \OCP\Files::getStorage('contacts'); |
||
46 | if(!$view->file_exists('imports')) { |
||
47 | $view->mkdir('imports'); |
||
48 | } |
||
49 | |||
50 | if (!isset($request->files['file'])) { |
||
51 | $response->bailOut(App::$l10n->t('No file was uploaded. Unknown error')); |
||
52 | return $response; |
||
53 | } |
||
54 | |||
55 | $file=$request->files['file']; |
||
56 | |||
57 | if($file['error'] !== UPLOAD_ERR_OK) { |
||
58 | $error = $file['error']; |
||
59 | $errors = array( |
||
60 | UPLOAD_ERR_OK => App::$l10n->t("There is no error, the file uploaded with success"), |
||
61 | UPLOAD_ERR_INI_SIZE => App::$l10n->t("The uploaded file exceeds the upload_max_filesize directive in php.ini") |
||
62 | .ini_get('upload_max_filesize'), |
||
63 | UPLOAD_ERR_FORM_SIZE => App::$l10n->t("The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form"), |
||
64 | UPLOAD_ERR_PARTIAL => App::$l10n->t("The uploaded file was only partially uploaded"), |
||
65 | UPLOAD_ERR_NO_FILE => App::$l10n->t("No file was uploaded"), |
||
66 | UPLOAD_ERR_NO_TMP_DIR => App::$l10n->t('Missing a temporary folder'), |
||
67 | UPLOAD_ERR_CANT_WRITE => App::$l10n->t('Failed to write to disk'), |
||
68 | ); |
||
69 | $response->bailOut($errors[$error]); |
||
70 | return $response; |
||
71 | } |
||
72 | |||
73 | $maxUploadFilesize = \OCP\Util::maxUploadFilesize('/'); |
||
74 | $maxHumanFilesize = \OCP\Util::humanFileSize($maxUploadFilesize); |
||
0 ignored issues
–
show
$maxHumanFilesize is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
75 | |||
76 | $totalSize = $file['size']; |
||
77 | if ($maxUploadFilesize >= 0 and $totalSize > $maxUploadFilesize) { |
||
78 | $response->bailOut(App::$l10n->t('Not enough storage available')); |
||
79 | return $response; |
||
80 | } |
||
81 | |||
82 | $tmpname = $file['tmp_name']; |
||
83 | $filename = strtr($file['name'], array('/' => '', "\\" => '')); |
||
84 | if(is_uploaded_file($tmpname)) { |
||
85 | if(\OC\Files\Filesystem::isFileBlacklisted($filename)) { |
||
86 | $response->bailOut(App::$l10n->t('Attempt to upload blacklisted file:') . $filename); |
||
87 | return $response; |
||
88 | } |
||
89 | $content = file_get_contents($tmpname); |
||
90 | View Code Duplication | if($view->file_put_contents('/imports/'.$filename, $content)) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
91 | $progresskey = 'contacts-import-' . rand(); |
||
92 | $response->setParams( |
||
93 | array( |
||
94 | 'filename'=>$filename, |
||
95 | 'progresskey' => $progresskey, |
||
96 | 'backend' => $params['backend'], |
||
97 | 'addressBookId' => $params['addressBookId'], |
||
98 | 'importType' => $format |
||
99 | ) |
||
100 | ); |
||
101 | } else { |
||
102 | $response->bailOut(App::$l10n->t('Error uploading contacts to storage.')); |
||
103 | return $response; |
||
104 | } |
||
105 | } else { |
||
106 | $response->bailOut('Temporary file: \''.$tmpname.'\' has gone AWOL?'); |
||
107 | return $response; |
||
108 | } |
||
109 | return $response; |
||
110 | } |
||
111 | |||
112 | /** |
||
113 | * @NoAdminRequired |
||
114 | */ |
||
115 | public function prepare() { |
||
116 | $request = $this->request; |
||
117 | $params = $this->request->urlParams; |
||
118 | $addressBookId = $params['addressBookId']; |
||
0 ignored issues
–
show
$addressBookId is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
119 | $format = $params['importType']; |
||
0 ignored issues
–
show
$format is not used, you could remove the assignment.
This check looks for variable assignements that are either overwritten by other assignments or where the variable is not used subsequently. $myVar = 'Value';
$higher = false;
if (rand(1, 6) > 3) {
$higher = true;
} else {
$higher = false;
}
Both the ![]() |
|||
120 | $response = new JSONResponse(); |
||
121 | $filename = $request->post['filename']; |
||
122 | $path = $request->post['path']; |
||
123 | |||
124 | $view = \OCP\Files::getStorage('contacts'); |
||
125 | if(!$view->file_exists('imports')) { |
||
126 | $view->mkdir('imports'); |
||
127 | } |
||
128 | |||
129 | $content = \OC\Files\Filesystem::file_get_contents($path . '/' . $filename); |
||
130 | View Code Duplication | if($view->file_put_contents('/imports/' . $filename, $content)) { |
|
0 ignored issues
–
show
This code seems to be duplicated across your project.
Duplicated code is one of the most pungent code smells. If you need to duplicate the same code in three or more different places, we strongly encourage you to look into extracting the code into a single class or operation. You can also find more detailed suggestions in the “Code” section of your repository. ![]() |
|||
131 | $progresskey = 'contacts-import-' . rand(); |
||
132 | $response->setParams( |
||
133 | array( |
||
134 | 'filename'=>$filename, |
||
135 | 'progresskey' => $progresskey, |
||
136 | 'backend' => $params['backend'], |
||
137 | 'addressBookId' => $params['addressBookId'], |
||
138 | 'importType' => $params['importType'] |
||
139 | ) |
||
140 | ); |
||
141 | } else { |
||
142 | $response->bailOut(App::$l10n->t('Error moving file to imports folder.')); |
||
143 | } |
||
144 | return $response; |
||
145 | } |
||
146 | |||
147 | /** |
||
148 | * @NoAdminRequired |
||
149 | */ |
||
150 | public function start() { |
||
151 | $request = $this->request; |
||
152 | $response = new JSONResponse(); |
||
153 | $params = $this->request->urlParams; |
||
154 | $app = new App(\OC::$server->getUserSession()->getUser()->getUId()); |
||
155 | $addressBookId = $params['addressBookId']; |
||
156 | $format = $params['importType']; |
||
157 | |||
158 | $addressBook = $app->getAddressBook($params['backend'], $addressBookId); |
||
159 | if(!$addressBook->hasPermission(\OCP\PERMISSION_CREATE)) { |
||
160 | $response->setStatus('403'); |
||
161 | $response->bailOut(App::$l10n->t('You do not have permissions to import into this address book.')); |
||
162 | return $response; |
||
163 | } |
||
164 | |||
165 | $filename = isset($request->post['filename']) ? $request->post['filename'] : null; |
||
166 | $progresskey = isset($request->post['progresskey']) ? $request->post['progresskey'] : null; |
||
167 | |||
168 | if(is_null($filename)) { |
||
169 | $response->bailOut(App::$l10n->t('File name missing from request.')); |
||
170 | return $response; |
||
171 | } |
||
172 | |||
173 | if(is_null($progresskey)) { |
||
174 | $response->bailOut(App::$l10n->t('Progress key missing from request.')); |
||
175 | return $response; |
||
176 | } |
||
177 | |||
178 | $filename = strtr($filename, array('/' => '', "\\" => '')); |
||
179 | if(\OC\Files\Filesystem::isFileBlacklisted($filename)) { |
||
180 | $response->bailOut(App::$l10n->t('Attempt to access blacklisted file:') . $filename); |
||
181 | return $response; |
||
182 | } |
||
183 | $view = \OCP\Files::getStorage('contacts'); |
||
184 | |||
185 | $importManager = new ImportManager(); |
||
186 | |||
187 | $formatList = $importManager->getTypes(); |
||
188 | |||
189 | $found = false; |
||
190 | $parts = array(); |
||
191 | foreach ($formatList as $formatName => $formatDisplayName) { |
||
192 | if ($formatName == $format) { |
||
193 | $parts = $importManager->importFile($view->getLocalFile('/imports/' . $filename), $formatName); |
||
194 | $found = true; |
||
195 | } |
||
196 | } |
||
197 | |||
198 | if (!$found) { |
||
199 | // detect file type |
||
200 | $mostLikelyName = ""; |
||
201 | $mostLikelyValue = 0; |
||
202 | $probability = $importManager->detectFileType($view->getLocalFile('/imports/' . $filename)); |
||
203 | foreach ($probability as $probName => $probValue) { |
||
204 | if ($probValue > $mostLikelyValue) { |
||
205 | $mostLikelyName = $probName; |
||
206 | $mostLikelyValue = $probValue; |
||
207 | } |
||
208 | } |
||
209 | |||
210 | if ($mostLikelyValue > 0) { |
||
211 | // found one (most likely...) |
||
212 | $parts = $importManager->importFile($view->getLocalFile('/imports/' . $filename), $mostLikelyName); |
||
213 | } |
||
214 | } |
||
215 | |||
216 | if ($parts) { |
||
217 | //import the contacts |
||
218 | $imported = 0; |
||
219 | $failed = 0; |
||
220 | $processed = 0; |
||
221 | $total = count($parts); |
||
222 | |||
223 | foreach($parts as $part) { |
||
224 | /** |
||
225 | * TODO |
||
226 | * - Check if a contact with identical UID exists. |
||
227 | * - If so, fetch that contact and call $contact->mergeFromVCard($part); |
||
228 | * - Increment $updated var (not present yet.) |
||
229 | * - continue |
||
230 | */ |
||
231 | try { |
||
232 | $id = $addressBook->addChild($part); |
||
233 | if($id) { |
||
234 | $imported++; |
||
235 | $favourites = $part->select('X-FAVOURITES'); |
||
236 | foreach ($favourites as $favourite) { |
||
237 | if ($favourite->getValue() == 'yes') { |
||
238 | $tagMgr = \OC::$server->getTagManager()->load('contact'); |
||
239 | $tagMgr->addToFavorites($id); |
||
240 | } |
||
241 | } |
||
242 | } else { |
||
243 | $failed++; |
||
244 | } |
||
245 | } catch (\Exception $e) { |
||
246 | $response->debug('Error importing vcard: ' . $e->getMessage() . $nl . $part->serialize()); |
||
0 ignored issues
–
show
|
|||
247 | $failed++; |
||
248 | } |
||
249 | $processed++; |
||
250 | $this->writeProcess($processed, $total, $progresskey); |
||
251 | } |
||
252 | } else { |
||
253 | $imported = 0; |
||
254 | $failed = 0; |
||
255 | $processed = 0; |
||
256 | $total = 0; |
||
257 | } |
||
258 | |||
259 | $this->cleanup($view, $filename, $progresskey, $response); |
||
260 | //done the import |
||
261 | sleep(3); // Give client side a chance to read the progress. |
||
262 | $response->setParams( |
||
263 | array( |
||
264 | 'backend' => $params['backend'], |
||
265 | 'addressBookId' => $params['addressBookId'], |
||
266 | 'importType' => $params['importType'], |
||
267 | 'imported' => $imported, |
||
268 | 'count' => $processed, |
||
269 | 'total' => $total, |
||
270 | 'failed' => $failed, |
||
271 | ) |
||
272 | ); |
||
273 | return $response; |
||
274 | } |
||
275 | |||
276 | /** |
||
277 | * @param integer $pct |
||
278 | * @param integer $total |
||
279 | * @param $progresskey |
||
280 | */ |
||
281 | protected function writeProcess($pct, $total, $progresskey) { |
||
282 | $this->cache->set($progresskey, $pct, 300); |
||
283 | $this->cache->set($progresskey . '_total', $total, 300); |
||
284 | } |
||
285 | |||
286 | /** |
||
287 | * @param $view |
||
288 | * @param string $filename |
||
289 | * @param $progresskey |
||
290 | * @param JSONResponse $response |
||
291 | */ |
||
292 | protected function cleanup($view, $filename, $progresskey, $response) { |
||
293 | if (!$view->unlink('/imports/' . $filename)) { |
||
294 | $response->debug('Unable to unlink /imports/' . $filename); |
||
295 | } |
||
296 | $this->cache->remove($progresskey); |
||
297 | $this->cache->remove($progresskey . '_total'); |
||
298 | } |
||
299 | |||
300 | /** |
||
301 | * @NoAdminRequired |
||
302 | */ |
||
303 | public function status() { |
||
304 | $request = $this->request; |
||
305 | $response = new JSONResponse(); |
||
306 | |||
307 | $progresskey = isset($request->get['progresskey']) ? $request->get['progresskey'] : null; |
||
308 | if(is_null($progresskey)) { |
||
309 | $response->bailOut(App::$l10n->t('Progress key missing from request.')); |
||
310 | return $response; |
||
311 | } |
||
312 | |||
313 | $response->setParams(array('progress' => $this->cache->get($progresskey), 'total' => $this->cache->get($progresskey.'_total') )); |
||
314 | return $response; |
||
315 | } |
||
316 | } |
||
317 |