|
1
|
|
|
<?php |
|
2
|
|
|
/** |
|
3
|
|
|
* @author Bart Visscher <[email protected]> |
|
4
|
|
|
* @author Bernhard Posselt <[email protected]> |
|
5
|
|
|
* @author Joas Schilling <[email protected]> |
|
6
|
|
|
* @author Jörn Friedrich Dreyer <[email protected]> |
|
7
|
|
|
* @author Lukas Reschke <[email protected]> |
|
8
|
|
|
* @author Morris Jobke <[email protected]> |
|
9
|
|
|
* @author Robin McCorkell <[email protected]> |
|
10
|
|
|
* @author Thomas Müller <[email protected]> |
|
11
|
|
|
* @author Thomas Tanghus <[email protected]> |
|
12
|
|
|
* @author Vincent Petry <[email protected]> |
|
13
|
|
|
* |
|
14
|
|
|
* @copyright Copyright (c) 2015, ownCloud, Inc. |
|
15
|
|
|
* @license AGPL-3.0 |
|
16
|
|
|
* |
|
17
|
|
|
* This code is free software: you can redistribute it and/or modify |
|
18
|
|
|
* it under the terms of the GNU Affero General Public License, version 3, |
|
19
|
|
|
* as published by the Free Software Foundation. |
|
20
|
|
|
* |
|
21
|
|
|
* This program is distributed in the hope that it will be useful, |
|
22
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of |
|
23
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the |
|
24
|
|
|
* GNU Affero General Public License for more details. |
|
25
|
|
|
* |
|
26
|
|
|
* You should have received a copy of the GNU Affero General Public License, version 3, |
|
27
|
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/> |
|
28
|
|
|
* |
|
29
|
|
|
*/ |
|
30
|
|
|
|
|
31
|
|
|
namespace OC\AppFramework\Http; |
|
32
|
|
|
|
|
33
|
|
|
use OC\Security\TrustedDomainHelper; |
|
34
|
|
|
use OCP\IConfig; |
|
35
|
|
|
use OCP\IRequest; |
|
36
|
|
|
use OCP\Security\ICrypto; |
|
37
|
|
|
use OCP\Security\ISecureRandom; |
|
38
|
|
|
|
|
39
|
|
|
/** |
|
40
|
|
|
* Class for accessing variables in the request. |
|
41
|
|
|
* This class provides an immutable object with request variables. |
|
42
|
|
|
*/ |
|
43
|
|
|
class Request implements \ArrayAccess, \Countable, IRequest { |
|
44
|
|
|
|
|
45
|
|
|
const USER_AGENT_IE = '/MSIE/'; |
|
46
|
|
|
const USER_AGENT_IE_8 = '/MSIE 8.0/'; |
|
47
|
|
|
// Android Chrome user agent: https://developers.google.com/chrome/mobile/docs/user-agent |
|
48
|
|
|
const USER_AGENT_ANDROID_MOBILE_CHROME = '#Android.*Chrome/[.0-9]*#'; |
|
49
|
|
|
const USER_AGENT_FREEBOX = '#^Mozilla/5\.0$#'; |
|
50
|
|
|
const REGEX_LOCALHOST = '/^(127\.0\.0\.1|localhost)$/'; |
|
51
|
|
|
|
|
52
|
|
|
protected $inputStream; |
|
53
|
|
|
protected $content; |
|
54
|
|
|
protected $items = array(); |
|
55
|
|
|
protected $allowedKeys = array( |
|
56
|
|
|
'get', |
|
57
|
|
|
'post', |
|
58
|
|
|
'files', |
|
59
|
|
|
'server', |
|
60
|
|
|
'env', |
|
61
|
|
|
'cookies', |
|
62
|
|
|
'urlParams', |
|
63
|
|
|
'parameters', |
|
64
|
|
|
'method', |
|
65
|
|
|
'requesttoken', |
|
66
|
|
|
); |
|
67
|
|
|
/** @var ISecureRandom */ |
|
68
|
|
|
protected $secureRandom; |
|
69
|
|
|
/** @var IConfig */ |
|
70
|
|
|
protected $config; |
|
71
|
|
|
/** @var string */ |
|
72
|
|
|
protected $requestId = ''; |
|
73
|
|
|
/** @var ICrypto */ |
|
74
|
|
|
protected $crypto; |
|
75
|
|
|
|
|
76
|
|
|
/** @var bool */ |
|
77
|
|
|
protected $contentDecoded = false; |
|
78
|
|
|
|
|
79
|
|
|
/** |
|
80
|
|
|
* @param array $vars An associative array with the following optional values: |
|
81
|
|
|
* - array 'urlParams' the parameters which were matched from the URL |
|
82
|
|
|
* - array 'get' the $_GET array |
|
83
|
|
|
* - array|string 'post' the $_POST array or JSON string |
|
84
|
|
|
* - array 'files' the $_FILES array |
|
85
|
|
|
* - array 'server' the $_SERVER array |
|
86
|
|
|
* - array 'env' the $_ENV array |
|
87
|
|
|
* - array 'cookies' the $_COOKIE array |
|
88
|
|
|
* - string 'method' the request method (GET, POST etc) |
|
89
|
|
|
* - string|false 'requesttoken' the requesttoken or false when not available |
|
90
|
|
|
* @param ISecureRandom $secureRandom |
|
91
|
|
|
* @param IConfig $config |
|
92
|
|
|
* @param string $stream |
|
93
|
|
|
* @see http://www.php.net/manual/en/reserved.variables.php |
|
94
|
|
|
*/ |
|
95
|
161 |
|
public function __construct(array $vars=array(), |
|
96
|
|
|
ISecureRandom $secureRandom = null, |
|
97
|
|
|
IConfig $config, |
|
98
|
|
|
$stream='php://input') { |
|
99
|
161 |
|
$this->inputStream = $stream; |
|
100
|
161 |
|
$this->items['params'] = array(); |
|
101
|
161 |
|
$this->secureRandom = $secureRandom; |
|
102
|
161 |
|
$this->config = $config; |
|
103
|
|
|
|
|
104
|
161 |
|
if(!array_key_exists('method', $vars)) { |
|
105
|
108 |
|
$vars['method'] = 'GET'; |
|
106
|
108 |
|
} |
|
107
|
|
|
|
|
108
|
161 |
|
foreach($this->allowedKeys as $name) { |
|
109
|
161 |
|
$this->items[$name] = isset($vars[$name]) |
|
110
|
161 |
|
? $vars[$name] |
|
111
|
161 |
|
: array(); |
|
112
|
161 |
|
} |
|
113
|
|
|
|
|
114
|
161 |
|
$this->items['parameters'] = array_merge( |
|
115
|
161 |
|
$this->items['get'], |
|
116
|
161 |
|
$this->items['post'], |
|
117
|
161 |
|
$this->items['urlParams'], |
|
118
|
161 |
|
$this->items['params'] |
|
119
|
161 |
|
); |
|
120
|
|
|
|
|
121
|
161 |
|
} |
|
122
|
|
|
/** |
|
123
|
|
|
* @param array $parameters |
|
124
|
|
|
*/ |
|
125
|
4 |
|
public function setUrlParameters(array $parameters) { |
|
126
|
4 |
|
$this->items['urlParams'] = $parameters; |
|
127
|
4 |
|
$this->items['parameters'] = array_merge( |
|
128
|
4 |
|
$this->items['parameters'], |
|
129
|
4 |
|
$this->items['urlParams'] |
|
130
|
4 |
|
); |
|
131
|
4 |
|
} |
|
132
|
|
|
|
|
133
|
|
|
/** |
|
134
|
|
|
* Countable method |
|
135
|
|
|
* @return int |
|
136
|
|
|
*/ |
|
137
|
2 |
|
public function count() { |
|
138
|
2 |
|
return count(array_keys($this->items['parameters'])); |
|
139
|
|
|
} |
|
140
|
|
|
|
|
141
|
|
|
/** |
|
142
|
|
|
* ArrayAccess methods |
|
143
|
|
|
* |
|
144
|
|
|
* Gives access to the combined GET, POST and urlParams arrays |
|
145
|
|
|
* |
|
146
|
|
|
* Examples: |
|
147
|
|
|
* |
|
148
|
|
|
* $var = $request['myvar']; |
|
149
|
|
|
* |
|
150
|
|
|
* or |
|
151
|
|
|
* |
|
152
|
|
|
* if(!isset($request['myvar']) { |
|
153
|
|
|
* // Do something |
|
154
|
|
|
* } |
|
155
|
|
|
* |
|
156
|
|
|
* $request['myvar'] = 'something'; // This throws an exception. |
|
157
|
|
|
* |
|
158
|
|
|
* @param string $offset The key to lookup |
|
159
|
|
|
* @return boolean |
|
160
|
|
|
*/ |
|
161
|
2 |
|
public function offsetExists($offset) { |
|
162
|
2 |
|
return isset($this->items['parameters'][$offset]); |
|
163
|
|
|
} |
|
164
|
|
|
|
|
165
|
|
|
/** |
|
166
|
|
|
* @see offsetExists |
|
167
|
|
|
*/ |
|
168
|
3 |
|
public function offsetGet($offset) { |
|
169
|
3 |
|
return isset($this->items['parameters'][$offset]) |
|
170
|
3 |
|
? $this->items['parameters'][$offset] |
|
171
|
3 |
|
: null; |
|
172
|
|
|
} |
|
173
|
|
|
|
|
174
|
|
|
/** |
|
175
|
|
|
* @see offsetExists |
|
176
|
|
|
*/ |
|
177
|
1 |
|
public function offsetSet($offset, $value) { |
|
178
|
1 |
|
throw new \RuntimeException('You cannot change the contents of the request object'); |
|
179
|
|
|
} |
|
180
|
|
|
|
|
181
|
|
|
/** |
|
182
|
|
|
* @see offsetExists |
|
183
|
|
|
*/ |
|
184
|
|
|
public function offsetUnset($offset) { |
|
185
|
|
|
throw new \RuntimeException('You cannot change the contents of the request object'); |
|
186
|
|
|
} |
|
187
|
|
|
|
|
188
|
|
|
/** |
|
189
|
|
|
* Magic property accessors |
|
190
|
|
|
* @param string $name |
|
191
|
|
|
* @param mixed $value |
|
192
|
|
|
*/ |
|
193
|
1 |
|
public function __set($name, $value) { |
|
|
|
|
|
|
194
|
1 |
|
throw new \RuntimeException('You cannot change the contents of the request object'); |
|
195
|
|
|
} |
|
196
|
|
|
|
|
197
|
|
|
/** |
|
198
|
|
|
* Access request variables by method and name. |
|
199
|
|
|
* Examples: |
|
200
|
|
|
* |
|
201
|
|
|
* $request->post['myvar']; // Only look for POST variables |
|
202
|
|
|
* $request->myvar; or $request->{'myvar'}; or $request->{$myvar} |
|
203
|
|
|
* Looks in the combined GET, POST and urlParams array. |
|
204
|
|
|
* |
|
205
|
|
|
* If you access e.g. ->post but the current HTTP request method |
|
206
|
|
|
* is GET a \LogicException will be thrown. |
|
207
|
|
|
* |
|
208
|
|
|
* @param string $name The key to look for. |
|
209
|
|
|
* @throws \LogicException |
|
210
|
|
|
* @return mixed|null |
|
211
|
|
|
*/ |
|
212
|
297 |
|
public function __get($name) { |
|
213
|
|
|
switch($name) { |
|
214
|
297 |
|
case 'put': |
|
215
|
297 |
|
case 'patch': |
|
216
|
297 |
|
case 'get': |
|
217
|
297 |
|
case 'post': |
|
218
|
8 |
|
if($this->method !== strtoupper($name)) { |
|
|
|
|
|
|
219
|
1 |
|
throw new \LogicException(sprintf('%s cannot be accessed in a %s request.', $name, $this->method)); |
|
|
|
|
|
|
220
|
|
|
} |
|
221
|
7 |
|
return $this->getContent(); |
|
222
|
297 |
|
case 'files': |
|
223
|
297 |
|
case 'server': |
|
224
|
297 |
|
case 'env': |
|
225
|
297 |
|
case 'cookies': |
|
226
|
297 |
|
case 'urlParams': |
|
227
|
297 |
|
case 'method': |
|
228
|
296 |
|
return isset($this->items[$name]) |
|
229
|
296 |
|
? $this->items[$name] |
|
230
|
296 |
|
: null; |
|
231
|
15 |
|
case 'parameters': |
|
232
|
15 |
|
case 'params': |
|
233
|
13 |
|
return $this->getContent(); |
|
234
|
2 |
|
default; |
|
235
|
2 |
|
return isset($this[$name]) |
|
236
|
2 |
|
? $this[$name] |
|
237
|
2 |
|
: null; |
|
238
|
2 |
|
} |
|
239
|
|
|
} |
|
240
|
|
|
|
|
241
|
|
|
/** |
|
242
|
|
|
* @param string $name |
|
243
|
|
|
* @return bool |
|
244
|
|
|
*/ |
|
245
|
1 |
|
public function __isset($name) { |
|
246
|
1 |
|
return isset($this->items['parameters'][$name]); |
|
247
|
|
|
} |
|
248
|
|
|
|
|
249
|
|
|
/** |
|
250
|
|
|
* @param string $id |
|
251
|
|
|
*/ |
|
252
|
|
|
public function __unset($id) { |
|
|
|
|
|
|
253
|
|
|
throw new \RunTimeException('You cannot change the contents of the request object'); |
|
254
|
|
|
} |
|
255
|
|
|
|
|
256
|
|
|
/** |
|
257
|
|
|
* Returns the value for a specific http header. |
|
258
|
|
|
* |
|
259
|
|
|
* This method returns null if the header did not exist. |
|
260
|
|
|
* |
|
261
|
|
|
* @param string $name |
|
262
|
|
|
* @return string |
|
263
|
|
|
*/ |
|
264
|
20 |
|
public function getHeader($name) { |
|
265
|
|
|
|
|
266
|
20 |
|
$name = strtoupper(str_replace(array('-'),array('_'),$name)); |
|
267
|
20 |
|
if (isset($this->server['HTTP_' . $name])) { |
|
|
|
|
|
|
268
|
2 |
|
return $this->server['HTTP_' . $name]; |
|
|
|
|
|
|
269
|
|
|
} |
|
270
|
|
|
|
|
271
|
|
|
// There's a few headers that seem to end up in the top-level |
|
272
|
|
|
// server array. |
|
273
|
|
|
switch($name) { |
|
274
|
18 |
|
case 'CONTENT_TYPE' : |
|
275
|
18 |
|
case 'CONTENT_LENGTH' : |
|
276
|
18 |
|
if (isset($this->server[$name])) { |
|
|
|
|
|
|
277
|
5 |
|
return $this->server[$name]; |
|
|
|
|
|
|
278
|
|
|
} |
|
279
|
13 |
|
break; |
|
280
|
|
|
|
|
281
|
|
|
} |
|
282
|
|
|
|
|
283
|
13 |
|
return null; |
|
284
|
|
|
} |
|
285
|
|
|
|
|
286
|
|
|
/** |
|
287
|
|
|
* Lets you access post and get parameters by the index |
|
288
|
|
|
* In case of json requests the encoded json body is accessed |
|
289
|
|
|
* |
|
290
|
|
|
* @param string $key the key which you want to access in the URL Parameter |
|
291
|
|
|
* placeholder, $_POST or $_GET array. |
|
292
|
|
|
* The priority how they're returned is the following: |
|
293
|
|
|
* 1. URL parameters |
|
294
|
|
|
* 2. POST parameters |
|
295
|
|
|
* 3. GET parameters |
|
296
|
|
|
* @param mixed $default If the key is not found, this value will be returned |
|
297
|
|
|
* @return mixed the content of the array |
|
298
|
|
|
*/ |
|
299
|
11 |
|
public function getParam($key, $default = null) { |
|
300
|
11 |
|
return isset($this->parameters[$key]) |
|
|
|
|
|
|
301
|
11 |
|
? $this->parameters[$key] |
|
|
|
|
|
|
302
|
11 |
|
: $default; |
|
303
|
|
|
} |
|
304
|
|
|
|
|
305
|
|
|
/** |
|
306
|
|
|
* Returns all params that were received, be it from the request |
|
307
|
|
|
* (as GET or POST) or throuh the URL by the route |
|
308
|
|
|
* @return array the array with all parameters |
|
309
|
|
|
*/ |
|
310
|
2 |
|
public function getParams() { |
|
311
|
2 |
|
return $this->parameters; |
|
|
|
|
|
|
312
|
|
|
} |
|
313
|
|
|
|
|
314
|
|
|
/** |
|
315
|
|
|
* Returns the method of the request |
|
316
|
|
|
* @return string the method of the request (POST, GET, etc) |
|
317
|
|
|
*/ |
|
318
|
1 |
|
public function getMethod() { |
|
319
|
1 |
|
return $this->method; |
|
|
|
|
|
|
320
|
|
|
} |
|
321
|
|
|
|
|
322
|
|
|
/** |
|
323
|
|
|
* Shortcut for accessing an uploaded file through the $_FILES array |
|
324
|
|
|
* @param string $key the key that will be taken from the $_FILES array |
|
325
|
|
|
* @return array the file in the $_FILES element |
|
326
|
|
|
*/ |
|
327
|
1 |
|
public function getUploadedFile($key) { |
|
328
|
1 |
|
return isset($this->files[$key]) ? $this->files[$key] : null; |
|
|
|
|
|
|
329
|
|
|
} |
|
330
|
|
|
|
|
331
|
|
|
/** |
|
332
|
|
|
* Shortcut for getting env variables |
|
333
|
|
|
* @param string $key the key that will be taken from the $_ENV array |
|
334
|
|
|
* @return array the value in the $_ENV element |
|
335
|
|
|
*/ |
|
336
|
1 |
|
public function getEnv($key) { |
|
337
|
1 |
|
return isset($this->env[$key]) ? $this->env[$key] : null; |
|
|
|
|
|
|
338
|
|
|
} |
|
339
|
|
|
|
|
340
|
|
|
/** |
|
341
|
|
|
* Shortcut for getting cookie variables |
|
342
|
|
|
* @param string $key the key that will be taken from the $_COOKIE array |
|
343
|
|
|
* @return array the value in the $_COOKIE element |
|
344
|
|
|
*/ |
|
345
|
1 |
|
public function getCookie($key) { |
|
346
|
1 |
|
return isset($this->cookies[$key]) ? $this->cookies[$key] : null; |
|
|
|
|
|
|
347
|
|
|
} |
|
348
|
|
|
|
|
349
|
|
|
/** |
|
350
|
|
|
* Returns the request body content. |
|
351
|
|
|
* |
|
352
|
|
|
* If the HTTP request method is PUT and the body |
|
353
|
|
|
* not application/x-www-form-urlencoded or application/json a stream |
|
354
|
|
|
* resource is returned, otherwise an array. |
|
355
|
|
|
* |
|
356
|
|
|
* @return array|string|resource The request body content or a resource to read the body stream. |
|
357
|
|
|
* |
|
358
|
|
|
* @throws \LogicException |
|
359
|
|
|
*/ |
|
360
|
19 |
|
protected function getContent() { |
|
361
|
|
|
// If the content can't be parsed into an array then return a stream resource. |
|
362
|
19 |
|
if ($this->method === 'PUT' |
|
|
|
|
|
|
363
|
19 |
|
&& strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') === false |
|
364
|
19 |
|
&& strpos($this->getHeader('Content-Type'), 'application/json') === false |
|
365
|
19 |
|
) { |
|
366
|
1 |
|
if ($this->content === false) { |
|
367
|
1 |
|
throw new \LogicException( |
|
368
|
|
|
'"put" can only be accessed once if not ' |
|
369
|
|
|
. 'application/x-www-form-urlencoded or application/json.' |
|
370
|
1 |
|
); |
|
371
|
|
|
} |
|
372
|
1 |
|
$this->content = false; |
|
373
|
1 |
|
return fopen($this->inputStream, 'rb'); |
|
374
|
|
|
} else { |
|
375
|
18 |
|
$this->decodeContent(); |
|
376
|
18 |
|
return $this->items['parameters']; |
|
377
|
|
|
} |
|
378
|
|
|
} |
|
379
|
|
|
|
|
380
|
|
|
/** |
|
381
|
|
|
* Attempt to decode the content and populate parameters |
|
382
|
|
|
*/ |
|
383
|
18 |
|
protected function decodeContent() { |
|
384
|
18 |
|
if ($this->contentDecoded) { |
|
385
|
9 |
|
return; |
|
386
|
|
|
} |
|
387
|
18 |
|
$params = []; |
|
388
|
|
|
|
|
389
|
|
|
// 'application/json' must be decoded manually. |
|
390
|
18 |
|
if (strpos($this->getHeader('Content-Type'), 'application/json') !== false) { |
|
391
|
3 |
|
$params = json_decode(file_get_contents($this->inputStream), true); |
|
392
|
3 |
|
if(count($params) > 0) { |
|
393
|
2 |
|
$this->items['params'] = $params; |
|
394
|
2 |
|
if($this->method === 'POST') { |
|
|
|
|
|
|
395
|
1 |
|
$this->items['post'] = $params; |
|
396
|
1 |
|
} |
|
397
|
2 |
|
} |
|
398
|
|
|
|
|
399
|
|
|
// Handle application/x-www-form-urlencoded for methods other than GET |
|
400
|
|
|
// or post correctly |
|
401
|
18 |
|
} elseif($this->method !== 'GET' |
|
|
|
|
|
|
402
|
15 |
|
&& $this->method !== 'POST' |
|
|
|
|
|
|
403
|
15 |
|
&& strpos($this->getHeader('Content-Type'), 'application/x-www-form-urlencoded') !== false) { |
|
404
|
|
|
|
|
405
|
2 |
|
parse_str(file_get_contents($this->inputStream), $params); |
|
406
|
2 |
|
if(is_array($params)) { |
|
407
|
2 |
|
$this->items['params'] = $params; |
|
408
|
2 |
|
} |
|
409
|
2 |
|
} |
|
410
|
|
|
|
|
411
|
18 |
|
if (is_array($params)) { |
|
412
|
17 |
|
$this->items['parameters'] = array_merge($this->items['parameters'], $params); |
|
413
|
17 |
|
} |
|
414
|
18 |
|
$this->contentDecoded = true; |
|
415
|
18 |
|
} |
|
416
|
|
|
|
|
417
|
|
|
|
|
418
|
|
|
/** |
|
419
|
|
|
* Checks if the CSRF check was correct |
|
420
|
|
|
* @return bool true if CSRF check passed |
|
421
|
|
|
* @see OC_Util::callRegister() |
|
422
|
|
|
*/ |
|
423
|
8 |
|
public function passesCSRFCheck() { |
|
424
|
8 |
|
if($this->items['requesttoken'] === false) { |
|
425
|
|
|
return false; |
|
426
|
|
|
} |
|
427
|
|
|
|
|
428
|
8 |
|
if (isset($this->items['get']['requesttoken'])) { |
|
429
|
1 |
|
$token = $this->items['get']['requesttoken']; |
|
430
|
8 |
|
} elseif (isset($this->items['post']['requesttoken'])) { |
|
431
|
1 |
|
$token = $this->items['post']['requesttoken']; |
|
432
|
7 |
|
} elseif (isset($this->items['server']['HTTP_REQUESTTOKEN'])) { |
|
433
|
4 |
|
$token = $this->items['server']['HTTP_REQUESTTOKEN']; |
|
434
|
4 |
|
} else { |
|
435
|
|
|
//no token found. |
|
436
|
2 |
|
return false; |
|
437
|
|
|
} |
|
438
|
|
|
|
|
439
|
|
|
// Deobfuscate token to prevent BREACH like attacks |
|
440
|
6 |
|
$token = explode(':', $token); |
|
441
|
6 |
|
if (count($token) !== 2) { |
|
442
|
2 |
|
return false; |
|
443
|
|
|
} |
|
444
|
|
|
|
|
445
|
4 |
|
$obfuscatedToken = $token[0]; |
|
446
|
4 |
|
$secret = $token[1]; |
|
447
|
4 |
|
$deobfuscatedToken = base64_decode($obfuscatedToken) ^ $secret; |
|
448
|
|
|
|
|
449
|
|
|
// Check if the token is valid |
|
450
|
4 |
|
if(\OCP\Security\StringUtils::equals($deobfuscatedToken, $this->items['requesttoken'])) { |
|
451
|
3 |
|
return true; |
|
452
|
|
|
} else { |
|
453
|
1 |
|
return false; |
|
454
|
|
|
} |
|
455
|
|
|
} |
|
456
|
|
|
|
|
457
|
|
|
/** |
|
458
|
|
|
* Returns an ID for the request, value is not guaranteed to be unique and is mostly meant for logging |
|
459
|
|
|
* If `mod_unique_id` is installed this value will be taken. |
|
460
|
|
|
* @return string |
|
461
|
|
|
*/ |
|
462
|
103 |
|
public function getId() { |
|
463
|
103 |
|
if(isset($this->server['UNIQUE_ID'])) { |
|
|
|
|
|
|
464
|
1 |
|
return $this->server['UNIQUE_ID']; |
|
|
|
|
|
|
465
|
|
|
} |
|
466
|
|
|
|
|
467
|
102 |
|
if(empty($this->requestId)) { |
|
468
|
3 |
|
$this->requestId = $this->secureRandom->getLowStrengthGenerator()->generate(20); |
|
469
|
3 |
|
} |
|
470
|
|
|
|
|
471
|
102 |
|
return $this->requestId; |
|
472
|
|
|
} |
|
473
|
|
|
|
|
474
|
|
|
/** |
|
475
|
|
|
* Returns the remote address, if the connection came from a trusted proxy |
|
476
|
|
|
* and `forwarded_for_headers` has been configured then the IP address |
|
477
|
|
|
* specified in this header will be returned instead. |
|
478
|
|
|
* Do always use this instead of $_SERVER['REMOTE_ADDR'] |
|
479
|
|
|
* @return string IP address |
|
480
|
|
|
*/ |
|
481
|
104 |
|
public function getRemoteAddress() { |
|
482
|
104 |
|
$remoteAddress = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : ''; |
|
|
|
|
|
|
483
|
104 |
|
$trustedProxies = $this->config->getSystemValue('trusted_proxies', []); |
|
484
|
|
|
|
|
485
|
104 |
|
if(is_array($trustedProxies) && in_array($remoteAddress, $trustedProxies)) { |
|
486
|
3 |
|
$forwardedForHeaders = $this->config->getSystemValue('forwarded_for_headers', [ |
|
487
|
|
|
'HTTP_X_FORWARDED_FOR' |
|
488
|
|
|
// only have one default, so we cannot ship an insecure product out of the box |
|
489
|
3 |
|
]); |
|
490
|
|
|
|
|
491
|
3 |
|
foreach($forwardedForHeaders as $header) { |
|
492
|
2 |
|
if(isset($this->server[$header])) { |
|
|
|
|
|
|
493
|
2 |
|
foreach(explode(',', $this->server[$header]) as $IP) { |
|
|
|
|
|
|
494
|
2 |
|
$IP = trim($IP); |
|
495
|
2 |
|
if (filter_var($IP, FILTER_VALIDATE_IP) !== false) { |
|
496
|
2 |
|
return $IP; |
|
497
|
|
|
} |
|
498
|
|
|
} |
|
499
|
|
|
} |
|
500
|
2 |
|
} |
|
501
|
1 |
|
} |
|
502
|
|
|
|
|
503
|
102 |
|
return $remoteAddress; |
|
504
|
|
|
} |
|
505
|
|
|
|
|
506
|
|
|
/** |
|
507
|
|
|
* Check overwrite condition |
|
508
|
|
|
* @param string $type |
|
509
|
|
|
* @return bool |
|
510
|
|
|
*/ |
|
511
|
8 |
|
private function isOverwriteCondition($type = '') { |
|
512
|
8 |
|
$regex = '/' . $this->config->getSystemValue('overwritecondaddr', '') . '/'; |
|
513
|
8 |
|
$remoteAddr = isset($this->server['REMOTE_ADDR']) ? $this->server['REMOTE_ADDR'] : ''; |
|
|
|
|
|
|
514
|
8 |
|
return $regex === '//' || preg_match($regex, $remoteAddr) === 1 |
|
515
|
8 |
|
|| $type !== 'protocol'; |
|
516
|
|
|
} |
|
517
|
|
|
|
|
518
|
|
|
/** |
|
519
|
|
|
* Returns the server protocol. It respects one or more reverse proxies servers |
|
520
|
|
|
* and load balancers |
|
521
|
|
|
* @return string Server protocol (http or https) |
|
522
|
|
|
*/ |
|
523
|
72 |
|
public function getServerProtocol() { |
|
524
|
72 |
|
if($this->config->getSystemValue('overwriteprotocol') !== '' |
|
525
|
72 |
|
&& $this->isOverwriteCondition('protocol')) { |
|
526
|
1 |
|
return $this->config->getSystemValue('overwriteprotocol'); |
|
527
|
|
|
} |
|
528
|
|
|
|
|
529
|
71 |
|
if (isset($this->server['HTTP_X_FORWARDED_PROTO'])) { |
|
|
|
|
|
|
530
|
2 |
View Code Duplication |
if (strpos($this->server['HTTP_X_FORWARDED_PROTO'], ',') !== false) { |
|
|
|
|
|
|
531
|
1 |
|
$parts = explode(',', $this->server['HTTP_X_FORWARDED_PROTO']); |
|
|
|
|
|
|
532
|
1 |
|
$proto = strtolower(trim($parts[0])); |
|
533
|
1 |
|
} else { |
|
534
|
1 |
|
$proto = strtolower($this->server['HTTP_X_FORWARDED_PROTO']); |
|
|
|
|
|
|
535
|
|
|
} |
|
536
|
|
|
|
|
537
|
|
|
// Verify that the protocol is always HTTP or HTTPS |
|
538
|
|
|
// default to http if an invalid value is provided |
|
539
|
2 |
|
return $proto === 'https' ? 'https' : 'http'; |
|
540
|
|
|
} |
|
541
|
|
|
|
|
542
|
69 |
|
if (isset($this->server['HTTPS']) |
|
|
|
|
|
|
543
|
69 |
|
&& $this->server['HTTPS'] !== null |
|
|
|
|
|
|
544
|
69 |
|
&& $this->server['HTTPS'] !== 'off') { |
|
|
|
|
|
|
545
|
1 |
|
return 'https'; |
|
546
|
|
|
} |
|
547
|
|
|
|
|
548
|
68 |
|
return 'http'; |
|
549
|
|
|
} |
|
550
|
|
|
|
|
551
|
|
|
/** |
|
552
|
|
|
* Returns the used HTTP protocol. |
|
553
|
|
|
* |
|
554
|
|
|
* @return string HTTP protocol. HTTP/2, HTTP/1.1 or HTTP/1.0. |
|
555
|
|
|
*/ |
|
556
|
13 |
View Code Duplication |
public function getHttpProtocol() { |
|
557
|
13 |
|
$claimedProtocol = strtoupper($this->server['SERVER_PROTOCOL']); |
|
|
|
|
|
|
558
|
|
|
|
|
559
|
|
|
$validProtocols = [ |
|
560
|
13 |
|
'HTTP/1.0', |
|
561
|
13 |
|
'HTTP/1.1', |
|
562
|
13 |
|
'HTTP/2', |
|
563
|
13 |
|
]; |
|
564
|
|
|
|
|
565
|
13 |
|
if(in_array($claimedProtocol, $validProtocols, true)) { |
|
566
|
9 |
|
return $claimedProtocol; |
|
567
|
|
|
} |
|
568
|
|
|
|
|
569
|
4 |
|
return 'HTTP/1.1'; |
|
570
|
|
|
} |
|
571
|
|
|
|
|
572
|
|
|
/** |
|
573
|
|
|
* Returns the request uri, even if the website uses one or more |
|
574
|
|
|
* reverse proxies |
|
575
|
|
|
* @return string |
|
576
|
|
|
*/ |
|
577
|
3 |
|
public function getRequestUri() { |
|
578
|
3 |
|
$uri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : ''; |
|
|
|
|
|
|
579
|
3 |
|
if($this->config->getSystemValue('overwritewebroot') !== '' && $this->isOverwriteCondition()) { |
|
580
|
2 |
|
$uri = $this->getScriptName() . substr($uri, strlen($this->server['SCRIPT_NAME'])); |
|
|
|
|
|
|
581
|
2 |
|
} |
|
582
|
3 |
|
return $uri; |
|
583
|
|
|
} |
|
584
|
|
|
|
|
585
|
|
|
/** |
|
586
|
|
|
* Get raw PathInfo from request (not urldecoded) |
|
587
|
|
|
* @throws \Exception |
|
588
|
|
|
* @return string Path info |
|
589
|
|
|
*/ |
|
590
|
18 |
|
public function getRawPathInfo() { |
|
591
|
18 |
|
$requestUri = isset($this->server['REQUEST_URI']) ? $this->server['REQUEST_URI'] : ''; |
|
|
|
|
|
|
592
|
|
|
// remove too many leading slashes - can be caused by reverse proxy configuration |
|
593
|
18 |
|
if (strpos($requestUri, '/') === 0) { |
|
594
|
16 |
|
$requestUri = '/' . ltrim($requestUri, '/'); |
|
595
|
16 |
|
} |
|
596
|
|
|
|
|
597
|
18 |
|
$requestUri = preg_replace('%/{2,}%', '/', $requestUri); |
|
598
|
|
|
|
|
599
|
|
|
// Remove the query string from REQUEST_URI |
|
600
|
18 |
|
if ($pos = strpos($requestUri, '?')) { |
|
601
|
4 |
|
$requestUri = substr($requestUri, 0, $pos); |
|
602
|
4 |
|
} |
|
603
|
|
|
|
|
604
|
18 |
|
$scriptName = $this->server['SCRIPT_NAME']; |
|
|
|
|
|
|
605
|
18 |
|
$pathInfo = $requestUri; |
|
606
|
|
|
|
|
607
|
|
|
// strip off the script name's dir and file name |
|
608
|
|
|
// FIXME: Sabre does not really belong here |
|
609
|
18 |
|
list($path, $name) = \Sabre\HTTP\URLUtil::splitPath($scriptName); |
|
610
|
18 |
|
if (!empty($path)) { |
|
611
|
4 |
|
if($path === $pathInfo || strpos($pathInfo, $path.'/') === 0) { |
|
612
|
2 |
|
$pathInfo = substr($pathInfo, strlen($path)); |
|
613
|
2 |
|
} else { |
|
614
|
2 |
|
throw new \Exception("The requested uri($requestUri) cannot be processed by the script '$scriptName')"); |
|
615
|
|
|
} |
|
616
|
2 |
|
} |
|
617
|
16 |
|
if (strpos($pathInfo, '/'.$name) === 0) { |
|
618
|
12 |
|
$pathInfo = substr($pathInfo, strlen($name) + 1); |
|
619
|
12 |
|
} |
|
620
|
16 |
|
if (strpos($pathInfo, $name) === 0) { |
|
621
|
|
|
$pathInfo = substr($pathInfo, strlen($name)); |
|
622
|
|
|
} |
|
623
|
16 |
|
if($pathInfo === false || $pathInfo === '/'){ |
|
624
|
4 |
|
return ''; |
|
625
|
|
|
} else { |
|
626
|
12 |
|
return $pathInfo; |
|
627
|
|
|
} |
|
628
|
|
|
} |
|
629
|
|
|
|
|
630
|
|
|
/** |
|
631
|
|
|
* Get PathInfo from request |
|
632
|
|
|
* @throws \Exception |
|
633
|
|
|
* @return string|false Path info or false when not found |
|
634
|
|
|
*/ |
|
635
|
10 |
|
public function getPathInfo() { |
|
636
|
10 |
|
if(isset($this->server['PATH_INFO'])) { |
|
|
|
|
|
|
637
|
1 |
|
return $this->server['PATH_INFO']; |
|
|
|
|
|
|
638
|
|
|
} |
|
639
|
|
|
|
|
640
|
9 |
|
$pathInfo = $this->getRawPathInfo(); |
|
641
|
|
|
// following is taken from \Sabre\HTTP\URLUtil::decodePathSegment |
|
642
|
8 |
|
$pathInfo = rawurldecode($pathInfo); |
|
643
|
8 |
|
$encoding = mb_detect_encoding($pathInfo, ['UTF-8', 'ISO-8859-1']); |
|
644
|
|
|
|
|
645
|
|
|
switch($encoding) { |
|
646
|
8 |
|
case 'ISO-8859-1' : |
|
647
|
|
|
$pathInfo = utf8_encode($pathInfo); |
|
648
|
|
|
} |
|
649
|
|
|
// end copy |
|
650
|
|
|
|
|
651
|
8 |
|
return $pathInfo; |
|
652
|
|
|
} |
|
653
|
|
|
|
|
654
|
|
|
/** |
|
655
|
|
|
* Returns the script name, even if the website uses one or more |
|
656
|
|
|
* reverse proxies |
|
657
|
|
|
* @return string the script name |
|
658
|
|
|
*/ |
|
659
|
|
|
public function getScriptName() { |
|
660
|
|
|
$name = $this->server['SCRIPT_NAME']; |
|
|
|
|
|
|
661
|
|
|
$overwriteWebRoot = $this->config->getSystemValue('overwritewebroot'); |
|
662
|
|
|
if ($overwriteWebRoot !== '' && $this->isOverwriteCondition()) { |
|
663
|
|
|
// FIXME: This code is untestable due to __DIR__, also that hardcoded path is really dangerous |
|
664
|
|
|
$serverRoot = str_replace('\\', '/', substr(__DIR__, 0, -strlen('lib/private/appframework/http/'))); |
|
665
|
|
|
$suburi = str_replace('\\', '/', substr(realpath($this->server['SCRIPT_FILENAME']), strlen($serverRoot))); |
|
|
|
|
|
|
666
|
|
|
$name = '/' . ltrim($overwriteWebRoot . $suburi, '/'); |
|
667
|
|
|
} |
|
668
|
|
|
return $name; |
|
669
|
|
|
} |
|
670
|
|
|
|
|
671
|
|
|
/** |
|
672
|
|
|
* Checks whether the user agent matches a given regex |
|
673
|
|
|
* @param array $agent array of agent names |
|
674
|
|
|
* @return bool true if at least one of the given agent matches, false otherwise |
|
675
|
|
|
*/ |
|
676
|
18 |
|
public function isUserAgent(array $agent) { |
|
677
|
18 |
|
if (!isset($this->server['HTTP_USER_AGENT'])) { |
|
|
|
|
|
|
678
|
9 |
|
return false; |
|
679
|
|
|
} |
|
680
|
9 |
|
foreach ($agent as $regex) { |
|
681
|
9 |
|
if (preg_match($regex, $this->server['HTTP_USER_AGENT'])) { |
|
|
|
|
|
|
682
|
5 |
|
return true; |
|
683
|
|
|
} |
|
684
|
5 |
|
} |
|
685
|
4 |
|
return false; |
|
686
|
|
|
} |
|
687
|
|
|
|
|
688
|
|
|
/** |
|
689
|
|
|
* Returns the unverified server host from the headers without checking |
|
690
|
|
|
* whether it is a trusted domain |
|
691
|
|
|
* @return string Server host |
|
692
|
|
|
*/ |
|
693
|
85 |
|
public function getInsecureServerHost() { |
|
694
|
85 |
|
$host = 'localhost'; |
|
695
|
85 |
|
if (isset($this->server['HTTP_X_FORWARDED_HOST'])) { |
|
|
|
|
|
|
696
|
5 |
View Code Duplication |
if (strpos($this->server['HTTP_X_FORWARDED_HOST'], ',') !== false) { |
|
|
|
|
|
|
697
|
1 |
|
$parts = explode(',', $this->server['HTTP_X_FORWARDED_HOST']); |
|
|
|
|
|
|
698
|
1 |
|
$host = trim(current($parts)); |
|
699
|
1 |
|
} else { |
|
700
|
4 |
|
$host = $this->server['HTTP_X_FORWARDED_HOST']; |
|
|
|
|
|
|
701
|
|
|
} |
|
702
|
5 |
|
} else { |
|
703
|
80 |
|
if (isset($this->server['HTTP_HOST'])) { |
|
|
|
|
|
|
704
|
1 |
|
$host = $this->server['HTTP_HOST']; |
|
|
|
|
|
|
705
|
80 |
|
} else if (isset($this->server['SERVER_NAME'])) { |
|
|
|
|
|
|
706
|
1 |
|
$host = $this->server['SERVER_NAME']; |
|
|
|
|
|
|
707
|
1 |
|
} |
|
708
|
|
|
} |
|
709
|
85 |
|
return $host; |
|
710
|
|
|
} |
|
711
|
|
|
|
|
712
|
|
|
|
|
713
|
|
|
/** |
|
714
|
|
|
* Returns the server host from the headers, or the first configured |
|
715
|
|
|
* trusted domain if the host isn't in the trusted list |
|
716
|
|
|
* @return string Server host |
|
717
|
|
|
*/ |
|
718
|
82 |
|
public function getServerHost() { |
|
719
|
|
|
// overwritehost is always trusted |
|
720
|
82 |
|
$host = $this->getOverwriteHost(); |
|
721
|
82 |
|
if ($host !== null) { |
|
722
|
1 |
|
return $host; |
|
723
|
|
|
} |
|
724
|
|
|
|
|
725
|
|
|
// get the host from the headers |
|
726
|
81 |
|
$host = $this->getInsecureServerHost(); |
|
727
|
|
|
|
|
728
|
|
|
// Verify that the host is a trusted domain if the trusted domains |
|
729
|
|
|
// are defined |
|
730
|
|
|
// If no trusted domain is provided the first trusted domain is returned |
|
731
|
81 |
|
$trustedDomainHelper = new TrustedDomainHelper($this->config); |
|
732
|
81 |
|
if ($trustedDomainHelper->isTrustedDomain($host)) { |
|
733
|
79 |
|
return $host; |
|
734
|
|
|
} else { |
|
735
|
2 |
|
$trustedList = $this->config->getSystemValue('trusted_domains', []); |
|
736
|
2 |
|
if(!empty($trustedList)) { |
|
737
|
1 |
|
return $trustedList[0]; |
|
738
|
|
|
} else { |
|
739
|
1 |
|
return ''; |
|
740
|
|
|
} |
|
741
|
|
|
} |
|
742
|
|
|
} |
|
743
|
|
|
|
|
744
|
|
|
/** |
|
745
|
|
|
* Returns the overwritehost setting from the config if set and |
|
746
|
|
|
* if the overwrite condition is met |
|
747
|
|
|
* @return string|null overwritehost value or null if not defined or the defined condition |
|
748
|
|
|
* isn't met |
|
749
|
|
|
*/ |
|
750
|
84 |
|
private function getOverwriteHost() { |
|
751
|
84 |
|
if($this->config->getSystemValue('overwritehost') !== '' && $this->isOverwriteCondition()) { |
|
752
|
5 |
|
return $this->config->getSystemValue('overwritehost'); |
|
753
|
|
|
} |
|
754
|
79 |
|
return null; |
|
755
|
|
|
} |
|
756
|
|
|
|
|
757
|
|
|
} |
|
758
|
|
|
|
This check looks from parameters that have been defined for a function or method, but which are not used in the method body.