Completed
Push — master ( 4eb4a8...a52438 )
by Henry
07:48
created

includes/Admin/Router/Router.php (5 issues)

Check for loose comparison of strings.

Best Practice Bug Major

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
namespace Redaxscript\Admin\Router;
3
4
use Redaxscript\Admin;
5
use Redaxscript\Header;
6
use Redaxscript\Module;
7
use Redaxscript\Router\RouterAbstract;
8
use function in_array;
9
10
/**
11
 * parent class to provide the admin router
12
 *
13
 * @since 3.3.0
14
 *
15
 * @package Redaxscript
16
 * @category Router
17
 * @author Henry Ruhs
18
 */
19
20
class Router extends RouterAbstract
21
{
22
	/**
23
	 * route the header
24
	 *
25
	 * @since 3.3.0
26
	 *
27
	 * @return bool
28
	 */
29
30 2
	public function routeHeader() : bool
31
	{
32 2
		Module\Hook::trigger('adminRouteHeader');
33 2
		$adminParameter = $this->getAdmin();
34
35
		/* handle break */
36
37 2
		if ($this->_registry->get('adminRouterBreak'))
38
		{
39 1
			Header::responseCode(200);
40
		}
41
42
		/* handle guard */
43
44 2
		if ($adminParameter && ($this->_tokenGuard() || $this->_authGuard()))
0 ignored issues
show
Bug Best Practice introduced by
The expression $adminParameter of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
45
		{
46
			Header::responseCode(403);
47
		}
48 2
		return (bool)$this->_registry->get('adminRouterBreak');
49
	}
50
51
	/**
52
	 * route the content
53
	 *
54
	 * @since 3.3.0
55
	 *
56
	 * @return string|null
57
	 */
58
59 10
	public function routeContent() : ?string
60
	{
61 10
		Module\Hook::trigger('adminRouteContent');
62 10
		$firstParameter = $this->getFirst();
63 10
		$adminParameter = $this->getAdmin();
64 10
		$tableParameter = $this->getTable();
65
66
		/* handle admin */
67
68 10
		if ($firstParameter === 'admin')
69
		{
70
			/* handle break */
71
72 9
			if ($this->_registry->get('adminRouterBreak'))
73
			{
74
				return '<!-- adminRouterBreak -->';
75
			}
76
77
			/* handle guard */
78
79 9
			if ($adminParameter)
0 ignored issues
show
Bug Best Practice introduced by
The expression $adminParameter of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
80
			{
81 9
				if ($this->_tokenGuard())
82
				{
83 1
					return $this->_errorToken();
84
				}
85 8
				if ($this->_authGuard())
86
				{
87
					return $this->_errorAccess();
88
				}
89
			}
90
91
			/* handle update */
92
93 8
			if (!$adminParameter || $adminParameter === 'view' && $tableParameter === 'users' || $this->_registry->get('cronUpdate'))
0 ignored issues
show
Bug Best Practice introduced by
The expression $adminParameter of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
94
			{
95
				$this->_updateLast();
96
			}
97
98
			/* handle post */
99
100 8
			if ($this->_request->getPost('Redaxscript\Admin\View\CategoryForm'))
101
			{
102 1
				return $this->_processCategory();
103
			}
104 7
			if ($this->_request->getPost('Redaxscript\Admin\View\ArticleForm'))
105
			{
106 1
				return $this->_processArticle();
107
			}
108 6
			if ($this->_request->getPost('Redaxscript\Admin\View\ExtraForm'))
109
			{
110 1
				return $this->_processExtra();
111
			}
112 5
			if ($this->_request->getPost('Redaxscript\Admin\View\CommentForm'))
113
			{
114 1
				return $this->_processComment();
115
			}
116 4
			if ($this->_request->getPost('Redaxscript\Admin\View\UserForm'))
117
			{
118 1
				return $this->_processUser();
119
			}
120 3
			if ($this->_request->getPost('Redaxscript\Admin\View\GroupForm'))
121
			{
122 1
				return $this->_processGroup();
123
			}
124 2
			if ($this->_request->getPost('Redaxscript\Admin\View\ModuleForm'))
125
			{
126 1
				return $this->_processModule();
127
			}
128 1
			if ($this->_request->getPost('Redaxscript\Admin\View\SettingForm'))
129
			{
130 1
				return $this->_processSetting();
131
			}
132
133
			/* handle route */
134
135
			if ($adminParameter === 'view')
136
			{
137
				return $this->_renderView();
138
			}
139
			if ($adminParameter === 'new')
140
			{
141
				return $this->_renderNew();
142
			}
143
			if ($adminParameter === 'edit')
144
			{
145
				return $this->_renderEdit();
146
			}
147
			return $this->_processCommon();
148
		}
149 1
		return null;
150
	}
151
152
	/**
153
	 * token guard
154
	 *
155
	 * @since 3.3.0
156
	 *
157
	 * @return bool
158
	 */
159
160 9
	protected function _tokenGuard() : bool
161
	{
162 9
		$adminParameter = $this->getAdmin();
163 9
		$tokenParameter = $this->getToken();
164
		$tokenArray =
165
		[
166 9
			'enable',
167
			'disable',
168
			'publish',
169
			'unpublish',
170
			'install',
171
			'uninstall',
172
			'delete'
173
		];
174 9
		return $this->_request->get('post') && $this->_request->getPost('token') !== $this->_registry->get('token') || in_array($adminParameter, $tokenArray) && !$tokenParameter;
0 ignored issues
show
Bug Best Practice introduced by
The expression $tokenParameter of type string|null is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
175
	}
176
177
	/**
178
	 * auth guard
179
	 *
180
	 * @since 3.3.0
181
	 *
182
	 * @return bool
183
	 */
184
185 8
	protected function _authGuard() : bool
186
	{
187 8
		$adminParameter = $this->getAdmin();
188 8
		$tableParameter = $this->getTable();
189 8
		$idParameter = $this->getId();
190 8
		$myId = (int)$this->_registry->get('myId');
191
		$editArray =
192
		[
193 8
			'edit',
194
			'view',
195
			'enable',
196
			'disable',
197
			'publish',
198
			'unpublish'
199
		];
200 8
		$permissionNew = $adminParameter === 'new' && $this->_registry->get('tableNew');
201 8
		$permissionEdit = in_array($adminParameter, $editArray) && $this->_registry->get('tableEdit');
202 8
		$permissionDelete = $adminParameter === 'delete' && $this->_registry->get('tableDelete');
203 8
		$permissionInstall = $adminParameter === 'install' && $this->_registry->get('tableInstall');
204 8
		$permissionUninstall = $adminParameter === 'uninstall' && $this->_registry->get('tableUninstall');
205 8
		$permissionProfile = $tableParameter === 'users' && $idParameter === $myId;
206 8
		return !$permissionNew && !$permissionEdit && !$permissionDelete && !$permissionInstall && !$permissionUninstall && !$permissionProfile;
207
	}
208
209
	/**
210
	 * update last
211
	 *
212
	 * @since 4.00
213
	 */
214
215
	protected function _updateLast() : void
216
	{
217
		$userModel = new Admin\Model\User();
218
		if ($this->_registry->get('myId'))
219
		{
220
			$userModel->updateLastById($this->_registry->get('myId'), $this->_registry->get('now'));
221
		}
222
	}
223
224
	/**
225
	 * process the category
226
	 *
227
	 * @since 4.00
228
	 *
229
	 * @return string
230
	 */
231
232 1
	protected function _processCategory() : string
233
	{
234 1
		$categoryController = new Admin\Controller\Category($this->_registry, $this->_request, $this->_language, $this->_config);
235 1
		return $categoryController->process($this->_request->getPost('Redaxscript\Admin\View\CategoryForm'));
236
	}
237
238
	/**
239
	 * process the article
240
	 *
241
	 * @since 4.00
242
	 *
243
	 * @return string
244
	 */
245
246 1
	protected function _processArticle() : string
247
	{
248 1
		$articleController = new Admin\Controller\Article($this->_registry, $this->_request, $this->_language, $this->_config);
249 1
		return $articleController->process($this->_request->getPost('Redaxscript\Admin\View\ArticleForm'));
250
	}
251
252
	/**
253
	 * process the extra
254
	 *
255
	 * @since 4.00
256
	 *
257
	 * @return string
258
	 */
259
260 1
	protected function _processExtra() : string
261
	{
262 1
		$extraController = new Admin\Controller\Extra($this->_registry, $this->_request, $this->_language, $this->_config);
263 1
		return $extraController->process($this->_request->getPost('Redaxscript\Admin\View\ExtraForm'));
264
	}
265
266
	/**
267
	 * process the comment
268
	 *
269
	 * @since 4.00
270
	 *
271
	 * @return string
272
	 */
273
274 1
	protected function _processComment() : string
275
	{
276 1
		$commentController = new Admin\Controller\Comment($this->_registry, $this->_request, $this->_language, $this->_config);
277 1
		return $commentController->process($this->_request->getPost('Redaxscript\Admin\View\CommentForm'));
278
	}
279
280
	/**
281
	 * process the user
282
	 *
283
	 * @since 4.00
284
	 *
285
	 * @return string
286
	 */
287
288 1
	protected function _processUser() : string
289
	{
290 1
		$userController = new Admin\Controller\User($this->_registry, $this->_request, $this->_language, $this->_config);
291 1
		return $userController->process($this->_request->getPost('Redaxscript\Admin\View\UserForm'));
292
	}
293
294
	/**
295
	 * process the group
296
	 *
297
	 * @since 4.00
298
	 *
299
	 * @return string
300
	 */
301
302 1
	protected function _processGroup() : string
303
	{
304 1
		$groupController = new Admin\Controller\Group($this->_registry, $this->_request, $this->_language, $this->_config);
305 1
		return $groupController->process($this->_request->getPost('Redaxscript\Admin\View\GroupForm'));
306
	}
307
308
	/**
309
	 * process the module
310
	 *
311
	 * @since 4.00
312
	 *
313
	 * @return string
314
	 */
315
316 1
	protected function _processModule() : string
317
	{
318 1
		$moduleController = new Admin\Controller\Module($this->_registry, $this->_request, $this->_language, $this->_config);
319 1
		return $moduleController->process($this->_request->getPost('Redaxscript\Admin\View\ModuleForm'));
320
	}
321
322
	/**
323
	 * process the setting
324
	 *
325
	 * @since 4.00
326
	 *
327
	 * @return string
328
	 */
329
330 1
	protected function _processSetting() : string
331
	{
332 1
		$settingController = new Admin\Controller\Setting($this->_registry, $this->_request, $this->_language, $this->_config);
333 1
		return $settingController->process($this->_request->getPost('Redaxscript\Admin\View\SettingForm'));
334
	}
335
336
	/**
337
	 * process the common
338
	 *
339
	 * @since 4.00
340
	 *
341
	 * @return string|null
342
	 */
343
344
	protected function _processCommon() : ?string
345
	{
346
		$adminParameter = $this->getAdmin();
347
		$commonArray =
348
		[
349
			'enable',
350
			'disable',
351
			'publish',
352
			'unpublish',
353
			'install',
354
			'uninstall',
355
			'delete'
356
		];
357
		if (in_array($adminParameter, $commonArray))
358
		{
359
			$commonController = new Admin\Controller\Common($this->_registry, $this->_request, $this->_language, $this->_config);
360
			return $commonController->process($adminParameter);
361
		}
362
		return null;
363
	}
364
365
	/**
366
	 * render the view
367
	 *
368
	 * @since 3.3.0
369
	 *
370
	 * @return string|null
371
	 */
372
373
	protected function _renderView() : ?string
374
	{
375
		$tableParameter = $this->getTable();
376
377
		/* handle table */
378
379
		if ($tableParameter === 'categories')
380
		{
381
			$categoryTable = new Admin\View\CategoryTable($this->_registry, $this->_language);
382
			return $categoryTable->render();
383
		}
384
		if ($tableParameter === 'articles')
385
		{
386
			$articleTable = new Admin\View\ArticleTable($this->_registry, $this->_language);
387
			return $articleTable->render();
388
		}
389
		if ($tableParameter === 'extras')
390
		{
391
			$extraTable = new Admin\View\ExtraTable($this->_registry, $this->_language);
392
			return $extraTable->render();
393
		}
394
		if ($tableParameter === 'comments')
395
		{
396
			$commentTable = new Admin\View\CommentTable($this->_registry, $this->_language);
397
			return $commentTable->render();
398
		}
399
		if ($tableParameter === 'users')
400
		{
401
			$userTable = new Admin\View\UserTable($this->_registry, $this->_language);
402
			return $userTable->render();
403
		}
404
		if ($tableParameter === 'groups')
405
		{
406
			$groupTable = new Admin\View\GroupTable($this->_registry, $this->_language);
407
			return $groupTable->render();
408
		}
409
		if ($tableParameter === 'modules')
410
		{
411
			$moduleTable = new Admin\View\ModuleTable($this->_registry, $this->_language);
412
			return $moduleTable->render();
413
		}
414
		return $this->_errorAccess();
415
	}
416
417
	/**
418
	 * render the new
419
	 *
420
	 * @since 3.3.0
421
	 *
422
	 * @return string|null
423
	 */
424
425
	protected function _renderNew() : ?string
426
	{
427
		$tableParameter = $this->getTable();
428
429
		/* handle table */
430
431
		if ($tableParameter === 'categories')
432
		{
433
			$categoryForm = new Admin\View\CategoryForm($this->_registry, $this->_language);
434
			return $categoryForm->render();
435
		}
436
		if ($tableParameter === 'articles')
437
		{
438
			$articleForm = new Admin\View\ArticleForm($this->_registry, $this->_language);
439
			return $articleForm->render();
440
		}
441
		if ($tableParameter === 'extras')
442
		{
443
			$extraForm = new Admin\View\ExtraForm($this->_registry, $this->_language);
444
			return $extraForm->render();
445
		}
446
		if ($tableParameter === 'comments')
447
		{
448
			$commentForm = new Admin\View\CommentForm($this->_registry, $this->_language);
449
			return $commentForm->render();
450
		}
451
		if ($tableParameter === 'users')
452
		{
453
			$userForm = new Admin\View\UserForm($this->_registry, $this->_language);
454
			return $userForm->render();
455
		}
456
		if ($tableParameter === 'groups')
457
		{
458
			$groupForm = new Admin\View\GroupForm($this->_registry, $this->_language);
459
			return $groupForm->render();
460
		}
461
		return $this->_errorAccess();
462
	}
463
464
	/**
465
	 * render the edit
466
	 *
467
	 * @since 3.3.0
468
	 *
469
	 * @return string
470
	 */
471
472
	protected function _renderEdit() : string
473
	{
474
		$categoryModel = new Admin\Model\Category();
475
		$articleModel = new Admin\Model\Article();
476
		$extraModel = new Admin\Model\Extra();
477
		$commentModel = new Admin\Model\Comment();
478
		$userModel = new Admin\Model\User();
479
		$groupModel = new Admin\Model\Group();
480
		$moduleModel = new Admin\Model\Module();
481
		$tableParameter = $this->getTable();
482
		$idParameter = $this->getId();
483
484
		/* handle table */
485
486
		if ($tableParameter === 'categories' && $categoryModel->getRouteById($idParameter))
0 ignored issues
show
Bug Best Practice introduced by
The expression $categoryModel->getRouteById($idParameter) of type string|null is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== null instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
487
		{
488
			$categoryForm = new Admin\View\CategoryForm($this->_registry, $this->_language);
489
			return $categoryForm->render($idParameter);
490
		}
491
		if ($tableParameter === 'articles' && $articleModel->getById($idParameter))
492
		{
493
			$articleForm = new Admin\View\ArticleForm($this->_registry, $this->_language);
494
			return $articleForm->render($idParameter);
495
		}
496
		if ($tableParameter === 'extras' && $extraModel->getById($idParameter))
497
		{
498
			$extraForm = new Admin\View\ExtraForm($this->_registry, $this->_language);
499
			return $extraForm->render($idParameter);
500
		}
501
		if ($tableParameter === 'comments' && $commentModel->getById($idParameter))
502
		{
503
			$commentForm = new Admin\View\CommentForm($this->_registry, $this->_language);
504
			return $commentForm->render($idParameter);
505
		}
506
		if ($tableParameter === 'users' && $userModel->getById($idParameter))
507
		{
508
			$userForm = new Admin\View\UserForm($this->_registry, $this->_language);
509
			return $userForm->render($idParameter);
510
		}
511
		if ($tableParameter === 'groups' && $groupModel->getById($idParameter))
512
		{
513
			$groupForm = new Admin\View\GroupForm($this->_registry, $this->_language);
514
			return $groupForm->render($idParameter);
515
		}
516
		if ($tableParameter === 'modules' && $moduleModel->getById($idParameter))
517
		{
518
			$moduleForm = new Admin\View\ModuleForm($this->_registry, $this->_language);
519
			return $moduleForm->render($idParameter);
520
		}
521
		if ($tableParameter === 'settings')
522
		{
523
			$settingForm = new Admin\View\SettingForm($this->_registry, $this->_language);
524
			return $settingForm->render();
525
		}
526
		return $this->_errorAccess();
527
	}
528
529
	/**
530
	 * messenger factory
531
	 *
532
	 * @since 4.0.0
533
	 *
534
	 * @return Admin\View\Helper\Messenger
535
	 */
536
537 1
	protected function _messengerFactory() : Admin\View\Helper\Messenger
538
	{
539 1
		return new Admin\View\Helper\Messenger($this->_registry);
540
	}
541
542
	/**
543
	 * show the token error
544
	 *
545
	 * @since 3.3.0
546
	 *
547
	 * @return string
548
	 */
549
550 1
	protected function _errorToken() : string
551
	{
552 1
		$messenger = $this->_messengerFactory();
553
		return $messenger
554 1
			->setRoute($this->_language->get('back'), 'admin')
555 1
			->error($this->_language->get('token_incorrect'), $this->_language->get('error_occurred'));
556
	}
557
558
	/**
559
	 * show the access error
560
	 *
561
	 * @since 3.3.0
562
	 *
563
	 * @return string
564
	 */
565
566
	protected function _errorAccess() : string
567
	{
568
		$messenger = $this->_messengerFactory();
569
		return $messenger
570
			->setRoute($this->_language->get('back'), 'admin')
571
			->error($this->_language->get('access_no'), $this->_language->get('error_occurred'));
572
	}
573
}
574