silverstripe / cwp-core

src/Extension/LoginAttemptNotifications.php

Spacing +3 added lines, -3 removed lines

@@ -53,12 +53,12 @@ 
                 $failures = $meantimeLoginAttempts->filter(['Status' => 'Failure'])->count();
                 $IPs = array_unique($meantimeLoginAttempts->column('IP'));
 
-                if ($attempts == 1) {
+                if ($attempts==1) {
                     $statusString = $failures ? "a failed" : "a successful";
                     $message = "In the last $elapsed $statusString login attempt to your account was "
                         . "registered. The attempt was made from ${IPs[0]}. ";
                 } else {
-                    if ($failures == $attempts) {
+                    if ($failures==$attempts) {
                         $statusString = $failures ? "failed" : "successful";
                         $message = "In the last $elapsed $attempts $statusString login "
                             . "attempts to your account were registered. ";
@@ -85,7 +85,7 @@ 
                 $date = $lastLoginAttempt->Created;
                 $message = "Last login attempt to your account was on $lastLoginAttempt->Created "
                     . "from $lastLoginAttempt->IP";
-                $message .= $lastLoginAttempt->Status == 'Failure' ? " and was successful." : "and has failed.";
+                $message .= $lastLoginAttempt->Status=='Failure' ? " and was successful." : "and has failed.";
             }
         }
 

Indentation +66 added lines, -66 removed lines

@@ -19,81 +19,81 @@
 class LoginAttemptNotifications extends Extension
 {
 
-    /**
-     *
-     * @return mixed null
-     */
-    public function init()
-    {
+	/**
+	 *
+	 * @return mixed null
+	 */
+	public function init()
+	{
 
-        // Exclude default admin.
-        $member = Security::getCurrentUser();
-        if (!$member || !$member->ID) {
-            return;
-        }
+		// Exclude default admin.
+		$member = Security::getCurrentUser();
+		if (!$member || !$member->ID) {
+			return;
+		}
 
-        $message = null;
-        $session = $this->owner->getRequest()->getSession();
+		$message = null;
+		$session = $this->owner->getRequest()->getSession();
 
-        Requirements::javascript('cwp/cwp-core:javascript/LoginAttemptNotifications.js');
-        $sessionLastVisited = $session->get('LoginAttemptNotifications.SessionLastVisited');
-        if ($sessionLastVisited) {
-            // Session already in progress. Show all attempts since the session was last visited.
+		Requirements::javascript('cwp/cwp-core:javascript/LoginAttemptNotifications.js');
+		$sessionLastVisited = $session->get('LoginAttemptNotifications.SessionLastVisited');
+		if ($sessionLastVisited) {
+			// Session already in progress. Show all attempts since the session was last visited.
 
-            $meantimeLoginAttempts = LoginAttempt::get()->filter([
-                'MemberID' => $member->ID,
-                'Created:GreaterThan' => $sessionLastVisited
-            ]);
+			$meantimeLoginAttempts = LoginAttempt::get()->filter([
+				'MemberID' => $member->ID,
+				'Created:GreaterThan' => $sessionLastVisited
+			]);
 
-            $attempts = $meantimeLoginAttempts->count();
-            if ($attempts) {
-                $lastVisitedObj = DBDatetime::create();
-                $lastVisitedObj->setValue($sessionLastVisited);
-                $elapsed = $lastVisitedObj->TimeDiff();
-                $failures = $meantimeLoginAttempts->filter(['Status' => 'Failure'])->count();
-                $IPs = array_unique($meantimeLoginAttempts->column('IP'));
+			$attempts = $meantimeLoginAttempts->count();
+			if ($attempts) {
+				$lastVisitedObj = DBDatetime::create();
+				$lastVisitedObj->setValue($sessionLastVisited);
+				$elapsed = $lastVisitedObj->TimeDiff();
+				$failures = $meantimeLoginAttempts->filter(['Status' => 'Failure'])->count();
+				$IPs = array_unique($meantimeLoginAttempts->column('IP'));
 
-                if ($attempts == 1) {
-                    $statusString = $failures ? "a failed" : "a successful";
-                    $message = "In the last $elapsed $statusString login attempt to your account was "
-                        . "registered. The attempt was made from ${IPs[0]}. ";
-                } else {
-                    if ($failures == $attempts) {
-                        $statusString = $failures ? "failed" : "successful";
-                        $message = "In the last $elapsed $attempts $statusString login "
-                            . "attempts to your account were registered. ";
-                    } else {
-                        $message = "In the last $elapsed $attempts login attempts to your "
-                            . "account were registered, of which $failures failed. ";
-                    }
+				if ($attempts == 1) {
+					$statusString = $failures ? "a failed" : "a successful";
+					$message = "In the last $elapsed $statusString login attempt to your account was "
+						. "registered. The attempt was made from ${IPs[0]}. ";
+				} else {
+					if ($failures == $attempts) {
+						$statusString = $failures ? "failed" : "successful";
+						$message = "In the last $elapsed $attempts $statusString login "
+							. "attempts to your account were registered. ";
+					} else {
+						$message = "In the last $elapsed $attempts login attempts to your "
+							. "account were registered, of which $failures failed. ";
+					}
 
-                    $message .= "The attempts were from " . implode(', ', $IPs) . '. ';
+					$message .= "The attempts were from " . implode(', ', $IPs) . '. ';
 
-                    // TODO: add this call to action in a way that doesn't break out of the availabel space. Fix CSS?
-                    // $message .= "If you suspect somebody else might be trying to access
-                    //  . "your account, please contact support.";
-                }
-            }
-        } else {
-            // New session - show last login attempt.
-            // TODO: this currently does NOT surface to the frontend in any way.
-            $lastLoginAttempt = LoginAttempt::get()->filter([
-                        'MemberID' => $member->ID
-            ])->sort('Created DESC')->First();
+					// TODO: add this call to action in a way that doesn't break out of the availabel space. Fix CSS?
+					// $message .= "If you suspect somebody else might be trying to access
+					//  . "your account, please contact support.";
+				}
+			}
+		} else {
+			// New session - show last login attempt.
+			// TODO: this currently does NOT surface to the frontend in any way.
+			$lastLoginAttempt = LoginAttempt::get()->filter([
+						'MemberID' => $member->ID
+			])->sort('Created DESC')->First();
 
-            if ($lastLoginAttempt) {
-                $date = $lastLoginAttempt->Created;
-                $message = "Last login attempt to your account was on $lastLoginAttempt->Created "
-                    . "from $lastLoginAttempt->IP";
-                $message .= $lastLoginAttempt->Status == 'Failure' ? " and was successful." : "and has failed.";
-            }
-        }
+			if ($lastLoginAttempt) {
+				$date = $lastLoginAttempt->Created;
+				$message = "Last login attempt to your account was on $lastLoginAttempt->Created "
+					. "from $lastLoginAttempt->IP";
+				$message .= $lastLoginAttempt->Status == 'Failure' ? " and was successful." : "and has failed.";
+			}
+		}
 
-        $session->set(
-            'LoginAttemptNotifications.SessionLastVisited',
-            DBDatetime::now()->Format(DBDatetime::ISO_DATETIME)
-        );
+		$session->set(
+			'LoginAttemptNotifications.SessionLastVisited',
+			DBDatetime::now()->Format(DBDatetime::ISO_DATETIME)
+		);
 
-        $this->owner->getResponse()->addHeader('X-LoginAttemptNotifications', $message);
-    }
+		$this->owner->getResponse()->addHeader('X-LoginAttemptNotifications', $message);
+	}
 }

src/Feed/CwpAtomFeed.php

Indentation +49 added lines, -49 removed lines

@@ -18,57 +18,57 @@
 
 class CwpAtomFeed extends RSSFeed
 {
-    public function __construct(
-        SS_List $entries,
-        $link,
-        $title,
-        $description = null,
-        $titleField = "Title",
-        $descriptionField = "Content",
-        $authorField = null,
-        $lastModified = null,
-        $etag = null
-    ) {
-        parent::__construct(
-            $entries,
-            $link,
-            $title,
-            $description,
-            $titleField,
-            $descriptionField,
-            $authorField,
-            $lastModified
-        );
+	public function __construct(
+		SS_List $entries,
+		$link,
+		$title,
+		$description = null,
+		$titleField = "Title",
+		$descriptionField = "Content",
+		$authorField = null,
+		$lastModified = null,
+		$etag = null
+	) {
+		parent::__construct(
+			$entries,
+			$link,
+			$title,
+			$description,
+			$titleField,
+			$descriptionField,
+			$authorField,
+			$lastModified
+		);
 
-        $this->setTemplate(__CLASS__);
-    }
+		$this->setTemplate(__CLASS__);
+	}
 
-    /**
-     * Include an link to the feed
-     *
-     * @param string $url URL of the feed
-     * @param string $title Title to show
-     */
-    public static function linkToFeed($url, $title = null)
-    {
-        $title = Convert::raw2xml($title);
-        Requirements::insertHeadTags(
-            '<link rel="alternate" type="application/atom+xml" title="' . $title .
-            '" href="' . $url . '" />'
-        );
-    }
+	/**
+	 * Include an link to the feed
+	 *
+	 * @param string $url URL of the feed
+	 * @param string $title Title to show
+	 */
+	public static function linkToFeed($url, $title = null)
+	{
+		$title = Convert::raw2xml($title);
+		Requirements::insertHeadTags(
+			'<link rel="alternate" type="application/atom+xml" title="' . $title .
+			'" href="' . $url . '" />'
+		);
+	}
 
-    /**
-     * Output the feed to the browser
-     *
-     * @return DBHTMLText
-     */
-    public function outputToBrowser()
-    {
-        $output = parent::outputToBrowser();
-        $response = Controller::curr()->getResponse();
-        $response->addHeader("Content-Type", "application/atom+xml");
+	/**
+	 * Output the feed to the browser
+	 *
+	 * @return DBHTMLText
+	 */
+	public function outputToBrowser()
+	{
+		$output = parent::outputToBrowser();
+		$response = Controller::curr()->getResponse();
+		$response->addHeader("Content-Type", "application/atom+xml");
 
-        return $output;
-    }
+		return $output;
+	}
 }

src/Extension/CwpControllerExtension.php

Spacing +3 added lines, -3 removed lines

@@ -121,7 +121,7 @@ 
         // First, see if we can get a member to act on, either from a changepassword token or the session
         if (isset($_REQUEST['m']) && isset($_REQUEST['t'])) {
             /** @var Member $member */
-            $member = Member::get()->filter('ID', (int) $_REQUEST['m'])->first();
+            $member = Member::get()->filter('ID', (int)$_REQUEST['m'])->first();
 
             if (!$member->validateAutoLoginToken($_REQUEST['t'])) {
                 $member = null;
@@ -135,7 +135,7 @@ 
         }
 
         // Then, if they have the right permissions, check the allowed URLs
-        $existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function () use ($member) {
+        $existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function() use ($member) {
             return Permission::checkMember($member, 'ACCESS_UAT_SERVER');
         });
 
@@ -154,7 +154,7 @@ 
 
         // Finally if they weren't allowed to bypass Basic Auth, trigger it
         if (!$allowWithoutAuth) {
-            $this->callWithSubsitesDisabled(function () use ($request) {
+            $this->callWithSubsitesDisabled(function() use ($request) {
                 BasicAuth::requireLogin(
                     $request,
                     _t(__CLASS__ . '.LoginPrompt', "Please log in with your CMS credentials"),

Indentation +207 added lines, -207 removed lines

@@ -19,211 +19,211 @@
 class CwpControllerExtension extends Extension implements PermissionProvider
 {
 
-    /**
-     * Enables SSL redirections - disabling not recommended as it will prevent forcing SSL on admin panel.
-     *
-     * @config
-     * @var bool
-     */
-    private static $ssl_redirection_enabled = true;
-
-    /**
-     * Specify a domain to redirect the vulnerable areas to.
-     *
-     * If left as null, live instance will set this to <instance-id>.cwp.govt.nz via CWP_SECURE_DOMAIN in _config.php.
-     * This allows us to automatically protect vulnerable areas on live even if the frontend cert is not installed.
-     *
-     * Set to false to redirect to https protocol on current domain (e.g. if you have frontend cert).
-     *
-     * Set to a domain string (e.g. 'example.com') to force that domain.
-     *
-     * @config
-     * @var string
-     */
-    private static $ssl_redirection_force_domain = null;
-
-    /**
-     * Enables the BasicAuth protection on all test environments. Disable with caution - it will open up
-     * all your UAT and test environments to the world.
-     *
-     * @config
-     * @var bool
-     */
-    private static $test_basicauth_enabled = true;
-
-    /**
-     * Enables the BasicAuth protection on all live environments.
-     * Useful for securing sites prior to public launch.
-     *
-     * @config
-     * @var bool
-     */
-    private static $live_basicauth_enabled = false;
-
-    /**
-     * This executes the passed callback with subsite filter disabled,
-     * then enabled the filter again before returning the callback result
-     * (or throwing the exception the callback raised)
-     *
-     * @param  callback  $callback - The callback to execute
-     * @return mixed     The result of the callback
-     * @throws Exception Any exception the callback raised
-     */
-    protected function callWithSubsitesDisabled($callback)
-    {
-        $rv = null;
-
-        try {
-            if (class_exists(Subsite::class)) {
-                Subsite::disable_subsite_filter(true);
-            }
-
-            $rv = call_user_func($callback);
-        } catch (Exception $e) {
-            if (class_exists(Subsite::class)) {
-                Subsite::disable_subsite_filter(false);
-            }
-
-            throw $e;
-        }
-
-        if (class_exists(Subsite::class)) {
-            Subsite::disable_subsite_filter(false);
-        }
-
-        return $rv;
-    }
-
-    /**
-     * Trigger Basic Auth protection, except when there's a reason to bypass it
-     *  - The source IP address is in the comma-seperated string in the constant CWP_IP_BYPASS_BASICAUTH
-     *    (so Pingdom, etc, can access the site)
-     *  - There is an identifiable member, that member has the ACCESS_UAT_SERVER permission, and they're trying
-     *    to access a white-list of URLs (so people following a reset password link can reset their password)
-     */
-    protected function triggerBasicAuthProtection()
-    {
-        $allowWithoutAuth = false;
-
-        // Allow whitelisting IPs for bypassing the basic auth.
-        if (Environment::getEnv('CWP_IP_BYPASS_BASICAUTH')) {
-            $remote = $_SERVER['REMOTE_ADDR'];
-            $bypass = explode(',', Environment::getEnv('CWP_IP_BYPASS_BASICAUTH'));
-
-            if (in_array($remote, $bypass)) {
-                $allowWithoutAuth = true;
-            }
-        }
-
-        /** @var HTTPRequest|null $request */
-        $request = $this->getRequest();
-
-        // First, see if we can get a member to act on, either from a changepassword token or the session
-        if (isset($_REQUEST['m']) && isset($_REQUEST['t'])) {
-            /** @var Member $member */
-            $member = Member::get()->filter('ID', (int) $_REQUEST['m'])->first();
-
-            if (!$member->validateAutoLoginToken($_REQUEST['t'])) {
-                $member = null;
-            }
-        } elseif ($request && $request->getSession()->get('AutoLoginHash')) {
-            $member = Member::member_from_autologinhash(
-                $request->getSession()->get('AutoLoginHash')
-            );
-        } else {
-            $member = Security::getCurrentUser();
-        }
-
-        // Then, if they have the right permissions, check the allowed URLs
-        $existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function () use ($member) {
-            return Permission::checkMember($member, 'ACCESS_UAT_SERVER');
-        });
-
-        if ($existingMemberCanAccessUAT) {
-            $allowed = array(
-                '/^Security\/changepassword/',
-                '/^Security\/ChangePasswordForm/'
-            );
-
-            $relativeURL = Director::makeRelative(Director::absoluteURL($_SERVER['REQUEST_URI']));
-
-            foreach ($allowed as $pattern) {
-                $allowWithoutAuth = $allowWithoutAuth || preg_match($pattern, $relativeURL);
-            }
-        }
-
-        // Finally if they weren't allowed to bypass Basic Auth, trigger it
-        if (!$allowWithoutAuth) {
-            $this->callWithSubsitesDisabled(function () use ($request) {
-                BasicAuth::requireLogin(
-                    $request,
-                    _t(__CLASS__ . '.LoginPrompt', "Please log in with your CMS credentials"),
-                    'ACCESS_UAT_SERVER',
-                    true
-                );
-            });
-        }
-    }
-
-    /**
-     * Get the current request, either from an Injector service or from the current controller
-     *
-     * @return HTTPRequest|null
-     */
-    protected function getRequest()
-    {
-        if (Injector::inst()->has(HTTPRequest::class)) {
-            return Injector::inst()->get(HTTPRequest::class);
-        }
-        return $this->owner->getRequest();
-    }
-
-    /**
-     * @return void
-     */
-    public function onBeforeInit()
-    {
-        // Grab global injectable service to allow testing.
-        $director = Injector::inst()->get(Director::class);
-
-        if (Config::inst()->get(__CLASS__, 'ssl_redirection_enabled')) {
-            // redirect some vulnerable areas to the secure domain
-            if (!$director::is_https()) {
-                $forceDomain = Config::inst()->get(__CLASS__, 'ssl_redirection_force_domain');
-
-                if ($forceDomain) {
-                    $director::forceSSL(['/^Security/', '/^api/'], $forceDomain);
-                } else {
-                    $director::forceSSL(['/^Security/', '/^api/']);
-                }
-            }
-        }
-
-        if (Config::inst()->get(__CLASS__, 'test_basicauth_enabled')) {
-            // Turn on Basic Auth in testing mode
-            if ($director::isTest()) {
-                $this->triggerBasicAuthProtection();
-            }
-        }
-
-        if (Config::inst()->get(__CLASS__, 'live_basicauth_enabled')) {
-            // Turn on Basic Auth in live mode
-            if ($director::isLive()) {
-                $this->triggerBasicAuthProtection();
-            }
-        }
-    }
-
-    /**
-     * @return array
-     */
-    public function providePermissions()
-    {
-        return [
-            'ACCESS_UAT_SERVER' => _t(
-                __CLASS__ . '.UatServerPermission',
-                'Allow users to use their accounts to access the UAT server'
-            )
-        ];
-    }
+	/**
+	 * Enables SSL redirections - disabling not recommended as it will prevent forcing SSL on admin panel.
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $ssl_redirection_enabled = true;
+
+	/**
+	 * Specify a domain to redirect the vulnerable areas to.
+	 *
+	 * If left as null, live instance will set this to <instance-id>.cwp.govt.nz via CWP_SECURE_DOMAIN in _config.php.
+	 * This allows us to automatically protect vulnerable areas on live even if the frontend cert is not installed.
+	 *
+	 * Set to false to redirect to https protocol on current domain (e.g. if you have frontend cert).
+	 *
+	 * Set to a domain string (e.g. 'example.com') to force that domain.
+	 *
+	 * @config
+	 * @var string
+	 */
+	private static $ssl_redirection_force_domain = null;
+
+	/**
+	 * Enables the BasicAuth protection on all test environments. Disable with caution - it will open up
+	 * all your UAT and test environments to the world.
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $test_basicauth_enabled = true;
+
+	/**
+	 * Enables the BasicAuth protection on all live environments.
+	 * Useful for securing sites prior to public launch.
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $live_basicauth_enabled = false;
+
+	/**
+	 * This executes the passed callback with subsite filter disabled,
+	 * then enabled the filter again before returning the callback result
+	 * (or throwing the exception the callback raised)
+	 *
+	 * @param  callback  $callback - The callback to execute
+	 * @return mixed     The result of the callback
+	 * @throws Exception Any exception the callback raised
+	 */
+	protected function callWithSubsitesDisabled($callback)
+	{
+		$rv = null;
+
+		try {
+			if (class_exists(Subsite::class)) {
+				Subsite::disable_subsite_filter(true);
+			}
+
+			$rv = call_user_func($callback);
+		} catch (Exception $e) {
+			if (class_exists(Subsite::class)) {
+				Subsite::disable_subsite_filter(false);
+			}
+
+			throw $e;
+		}
+
+		if (class_exists(Subsite::class)) {
+			Subsite::disable_subsite_filter(false);
+		}
+
+		return $rv;
+	}
+
+	/**
+	 * Trigger Basic Auth protection, except when there's a reason to bypass it
+	 *  - The source IP address is in the comma-seperated string in the constant CWP_IP_BYPASS_BASICAUTH
+	 *    (so Pingdom, etc, can access the site)
+	 *  - There is an identifiable member, that member has the ACCESS_UAT_SERVER permission, and they're trying
+	 *    to access a white-list of URLs (so people following a reset password link can reset their password)
+	 */
+	protected function triggerBasicAuthProtection()
+	{
+		$allowWithoutAuth = false;
+
+		// Allow whitelisting IPs for bypassing the basic auth.
+		if (Environment::getEnv('CWP_IP_BYPASS_BASICAUTH')) {
+			$remote = $_SERVER['REMOTE_ADDR'];
+			$bypass = explode(',', Environment::getEnv('CWP_IP_BYPASS_BASICAUTH'));
+
+			if (in_array($remote, $bypass)) {
+				$allowWithoutAuth = true;
+			}
+		}
+
+		/** @var HTTPRequest|null $request */
+		$request = $this->getRequest();
+
+		// First, see if we can get a member to act on, either from a changepassword token or the session
+		if (isset($_REQUEST['m']) && isset($_REQUEST['t'])) {
+			/** @var Member $member */
+			$member = Member::get()->filter('ID', (int) $_REQUEST['m'])->first();
+
+			if (!$member->validateAutoLoginToken($_REQUEST['t'])) {
+				$member = null;
+			}
+		} elseif ($request && $request->getSession()->get('AutoLoginHash')) {
+			$member = Member::member_from_autologinhash(
+				$request->getSession()->get('AutoLoginHash')
+			);
+		} else {
+			$member = Security::getCurrentUser();
+		}
+
+		// Then, if they have the right permissions, check the allowed URLs
+		$existingMemberCanAccessUAT = $member && $this->callWithSubsitesDisabled(function () use ($member) {
+			return Permission::checkMember($member, 'ACCESS_UAT_SERVER');
+		});
+
+		if ($existingMemberCanAccessUAT) {
+			$allowed = array(
+				'/^Security\/changepassword/',
+				'/^Security\/ChangePasswordForm/'
+			);
+
+			$relativeURL = Director::makeRelative(Director::absoluteURL($_SERVER['REQUEST_URI']));
+
+			foreach ($allowed as $pattern) {
+				$allowWithoutAuth = $allowWithoutAuth || preg_match($pattern, $relativeURL);
+			}
+		}
+
+		// Finally if they weren't allowed to bypass Basic Auth, trigger it
+		if (!$allowWithoutAuth) {
+			$this->callWithSubsitesDisabled(function () use ($request) {
+				BasicAuth::requireLogin(
+					$request,
+					_t(__CLASS__ . '.LoginPrompt', "Please log in with your CMS credentials"),
+					'ACCESS_UAT_SERVER',
+					true
+				);
+			});
+		}
+	}
+
+	/**
+	 * Get the current request, either from an Injector service or from the current controller
+	 *
+	 * @return HTTPRequest|null
+	 */
+	protected function getRequest()
+	{
+		if (Injector::inst()->has(HTTPRequest::class)) {
+			return Injector::inst()->get(HTTPRequest::class);
+		}
+		return $this->owner->getRequest();
+	}
+
+	/**
+	 * @return void
+	 */
+	public function onBeforeInit()
+	{
+		// Grab global injectable service to allow testing.
+		$director = Injector::inst()->get(Director::class);
+
+		if (Config::inst()->get(__CLASS__, 'ssl_redirection_enabled')) {
+			// redirect some vulnerable areas to the secure domain
+			if (!$director::is_https()) {
+				$forceDomain = Config::inst()->get(__CLASS__, 'ssl_redirection_force_domain');
+
+				if ($forceDomain) {
+					$director::forceSSL(['/^Security/', '/^api/'], $forceDomain);
+				} else {
+					$director::forceSSL(['/^Security/', '/^api/']);
+				}
+			}
+		}
+
+		if (Config::inst()->get(__CLASS__, 'test_basicauth_enabled')) {
+			// Turn on Basic Auth in testing mode
+			if ($director::isTest()) {
+				$this->triggerBasicAuthProtection();
+			}
+		}
+
+		if (Config::inst()->get(__CLASS__, 'live_basicauth_enabled')) {
+			// Turn on Basic Auth in live mode
+			if ($director::isLive()) {
+				$this->triggerBasicAuthProtection();
+			}
+		}
+	}
+
+	/**
+	 * @return array
+	 */
+	public function providePermissions()
+	{
+		return [
+			'ACCESS_UAT_SERVER' => _t(
+				__CLASS__ . '.UatServerPermission',
+				'Allow users to use their accounts to access the UAT server'
+			)
+		];
+	}
 }

src/Control/InitialisationMiddleware.php

Indentation +92 added lines, -92 removed lines

@@ -12,97 +12,97 @@
  */
 class InitialisationMiddleware implements HTTPMiddleware
 {
-    use Configurable;
-
-    /**
-     * Disable the automatically added 'X-XSS-Protection' header that is added to all responses. This should be left
-     * alone in most circumstances to include the header. Refer to Mozilla Developer Network for more information:
-     * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
-     *
-     * @config
-     * @var bool
-     */
-    private static $xss_protection_disabled = false;
-
-    /**
-     * Enable egress proxy. This works on the principle of setting http(s)_proxy environment variables,
-     *  which will be automatically picked up by curl. This means RestfulService and raw curl
-     *  requests should work out of the box. Stream-based requests need extra manual configuration.
-     *  Refer to https://www.cwp.govt.nz/guides/core-technical-documentation/common-web-platform-core/en/how-tos/external_http_requests_with_proxy
-     *
-     * @config
-     * @var bool
-     */
-    private static $egress_proxy_default_enabled = true;
-
-    /**
-     * Configure the list of domains to bypass proxy by setting the NO_PROXY environment variable.
-     * 'services.cwp.govt.nz' needs to be present for Solr and Docvert internal CWP integration.
-     * 'localhost' is necessary for accessing services on the same instance such as tika-server for text extraction.
-     *
-     * @config
-     * @var string[]
-     */
-    private static $egress_proxy_exclude_domains = [
-        'services.cwp.govt.nz',
-        'localhost',
-    ];
-
-    public function process(HTTPRequest $request, callable $delegate)
-    {
-        $response = $delegate($request);
-
-        if ($this->config()->get('egress_proxy_default_enabled')) {
-            $this->configureEgressProxy();
-        }
+	use Configurable;
+
+	/**
+	 * Disable the automatically added 'X-XSS-Protection' header that is added to all responses. This should be left
+	 * alone in most circumstances to include the header. Refer to Mozilla Developer Network for more information:
+	 * https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $xss_protection_disabled = false;
+
+	/**
+	 * Enable egress proxy. This works on the principle of setting http(s)_proxy environment variables,
+	 *  which will be automatically picked up by curl. This means RestfulService and raw curl
+	 *  requests should work out of the box. Stream-based requests need extra manual configuration.
+	 *  Refer to https://www.cwp.govt.nz/guides/core-technical-documentation/common-web-platform-core/en/how-tos/external_http_requests_with_proxy
+	 *
+	 * @config
+	 * @var bool
+	 */
+	private static $egress_proxy_default_enabled = true;
+
+	/**
+	 * Configure the list of domains to bypass proxy by setting the NO_PROXY environment variable.
+	 * 'services.cwp.govt.nz' needs to be present for Solr and Docvert internal CWP integration.
+	 * 'localhost' is necessary for accessing services on the same instance such as tika-server for text extraction.
+	 *
+	 * @config
+	 * @var string[]
+	 */
+	private static $egress_proxy_exclude_domains = [
+		'services.cwp.govt.nz',
+		'localhost',
+	];
+
+	public function process(HTTPRequest $request, callable $delegate)
+	{
+		$response = $delegate($request);
+
+		if ($this->config()->get('egress_proxy_default_enabled')) {
+			$this->configureEgressProxy();
+		}
         
-        $this->configureProxyDomainExclusions();
-
-        if (!$this->config()->get('xss_protection_disabled') && $response) {
-            $response->addHeader('X-XSS-Protection', '1; mode=block');
-        }
-
-        return $response;
-    }
-
-    /**
-     * If the outbound egress proxy details have been defined in environment variables, configure the proxy
-     * variables that are used to configure it.
-     */
-    protected function configureEgressProxy()
-    {
-        if (!Environment::getEnv('SS_OUTBOUND_PROXY')
-            || !Environment::getEnv('SS_OUTBOUND_PROXY_PORT')
-        ) {
-            return;
-        }
-
-        $proxy = Environment::getEnv('SS_OUTBOUND_PROXY');
-        $proxyPort = Environment::getEnv('SS_OUTBOUND_PROXY_PORT');
-
-        Environment::setEnv('http_proxy', $proxy . ':' . $proxyPort);
-        Environment::setEnv('https_proxy', $proxy . ':' . $proxyPort);
-    }
-
-    /**
-     * Configure any domains that should be excluded from egress proxy rules and provide them to the environment
-     */
-    protected function configureProxyDomainExclusions()
-    {
-        $noProxy = $this->config()->get('egress_proxy_exclude_domains');
-        if (empty($noProxy)) {
-            return;
-        }
-
-        if (!is_array($noProxy)) {
-            $noProxy = [$noProxy];
-        }
-
-        // Merge with exsiting if needed.
-        if (Environment::getEnv('NO_PROXY')) {
-            $noProxy = array_merge(explode(',', Environment::getEnv('NO_PROXY')), $noProxy);
-        }
-
-        Environment::setEnv('NO_PROXY', implode(',', array_unique($noProxy)));
-    }
+		$this->configureProxyDomainExclusions();
+
+		if (!$this->config()->get('xss_protection_disabled') && $response) {
+			$response->addHeader('X-XSS-Protection', '1; mode=block');
+		}
+
+		return $response;
+	}
+
+	/**
+	 * If the outbound egress proxy details have been defined in environment variables, configure the proxy
+	 * variables that are used to configure it.
+	 */
+	protected function configureEgressProxy()
+	{
+		if (!Environment::getEnv('SS_OUTBOUND_PROXY')
+			|| !Environment::getEnv('SS_OUTBOUND_PROXY_PORT')
+		) {
+			return;
+		}
+
+		$proxy = Environment::getEnv('SS_OUTBOUND_PROXY');
+		$proxyPort = Environment::getEnv('SS_OUTBOUND_PROXY_PORT');
+
+		Environment::setEnv('http_proxy', $proxy . ':' . $proxyPort);
+		Environment::setEnv('https_proxy', $proxy . ':' . $proxyPort);
+	}
+
+	/**
+	 * Configure any domains that should be excluded from egress proxy rules and provide them to the environment
+	 */
+	protected function configureProxyDomainExclusions()
+	{
+		$noProxy = $this->config()->get('egress_proxy_exclude_domains');
+		if (empty($noProxy)) {
+			return;
+		}
+
+		if (!is_array($noProxy)) {
+			$noProxy = [$noProxy];
+		}
+
+		// Merge with exsiting if needed.
+		if (Environment::getEnv('NO_PROXY')) {
+			$noProxy = array_merge(explode(',', Environment::getEnv('NO_PROXY')), $noProxy);
+		}
+
+		Environment::setEnv('NO_PROXY', implode(',', array_unique($noProxy)));
+	}
 }

src/Extension/RichLinksExtension.php

Indentation +38 added lines, -38 removed lines

@@ -17,48 +17,48 @@
 class RichLinksExtension extends Extension
 {
 
-    /**
-     * @var array
-     */
-    private static $casting = [
-        'RichLinks' => 'HTMLText'
-    ];
+	/**
+	 * @var array
+	 */
+	private static $casting = [
+		'RichLinks' => 'HTMLText'
+	];
 
-    /**
-     * @return string
-     */
-    public function RichLinks()
-    {
-        // Note:
-        // Assume we can use Regexes because the link will always be formatted
-        // in the same way coming from the CMS.
+	/**
+	 * @return string
+	 */
+	public function RichLinks()
+	{
+		// Note:
+		// Assume we can use Regexes because the link will always be formatted
+		// in the same way coming from the CMS.
 
-        $content = $this->owner->value;
+		$content = $this->owner->value;
 
-        // Find all file links for processing.
-        preg_match_all('/<a.*href="\[file_link,id=([0-9]+)\].*".*>.*<\/a>/U', $content, $matches);
+		// Find all file links for processing.
+		preg_match_all('/<a.*href="\[file_link,id=([0-9]+)\].*".*>.*<\/a>/U', $content, $matches);
 
-        // Attach the file type and size to each of the links.
-        for ($i = 0; $i < count($matches[0]); $i++) {
-            $file = DataObject::get_by_id(File::class, $matches[1][$i]);
-            if ($file) {
-                $size = $file->getSize();
-                $ext = strtoupper($file->getExtension());
-                // Replace the closing </a> tag with the size span (and reattach the closing tag).
-                $newLink = substr($matches[0][$i], 0, strlen($matches[0][$i]) - 4)
-                    . "<span class='fileExt'> [$ext, $size]</span></a>";
-                $content = str_replace($matches[0][$i], $newLink, $content);
-            }
-        }
+		// Attach the file type and size to each of the links.
+		for ($i = 0; $i < count($matches[0]); $i++) {
+			$file = DataObject::get_by_id(File::class, $matches[1][$i]);
+			if ($file) {
+				$size = $file->getSize();
+				$ext = strtoupper($file->getExtension());
+				// Replace the closing </a> tag with the size span (and reattach the closing tag).
+				$newLink = substr($matches[0][$i], 0, strlen($matches[0][$i]) - 4)
+					. "<span class='fileExt'> [$ext, $size]</span></a>";
+				$content = str_replace($matches[0][$i], $newLink, $content);
+			}
+		}
 
-        // Inject extra attributes into the external links.
-        $pattern = '/(<a.*)(href=\"https?:\/\/[^\"]*\"[^>]*>.*)(<\/a>)/iU';
-        $replacement = sprintf(
-            '$1class="external" rel="external" title="%s" $2<span class="nonvisual-indicator">(external link)</span>$3',
-            _t(__CLASS__ . '.OpenLinkTitle', 'Open external link')
-        );
-        $content = preg_replace($pattern, $replacement, $content, -1);
+		// Inject extra attributes into the external links.
+		$pattern = '/(<a.*)(href=\"https?:\/\/[^\"]*\"[^>]*>.*)(<\/a>)/iU';
+		$replacement = sprintf(
+			'$1class="external" rel="external" title="%s" $2<span class="nonvisual-indicator">(external link)</span>$3',
+			_t(__CLASS__ . '.OpenLinkTitle', 'Open external link')
+		);
+		$content = preg_replace($pattern, $replacement, $content, -1);
 
-        return $content;
-    }
+		return $content;
+	}
 }