silverstripe /
silverstripe-dms
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | class DMS extends SS_Object implements DMSInterface |
||
| 3 | { |
||
| 4 | /** |
||
| 5 | * Folder to store the documents in |
||
| 6 | * |
||
| 7 | * @config |
||
| 8 | * @var string |
||
| 9 | */ |
||
| 10 | private static $folder_name = 'assets/_dmsassets'; |
||
| 11 | |||
| 12 | /** |
||
| 13 | * How many documents to store in a single folder. The square of this number is the maximum number of documents. |
||
| 14 | * |
||
| 15 | * The number should be a multiple of 10 |
||
| 16 | * |
||
| 17 | * @config |
||
| 18 | * @var int |
||
| 19 | */ |
||
| 20 | private static $folder_size = 1000; |
||
| 21 | |||
| 22 | /** |
||
| 23 | * Singleton instance of a DMSInterface |
||
| 24 | * |
||
| 25 | * @var DMSInterface |
||
| 26 | */ |
||
| 27 | private static $instance; |
||
| 28 | |||
| 29 | /** |
||
| 30 | * The shortcode handler key. Can be changed by user code. |
||
| 31 | * |
||
| 32 | * @config |
||
| 33 | * @var string |
||
| 34 | */ |
||
| 35 | private static $shortcode_handler_key = 'dms_document_link'; |
||
| 36 | |||
| 37 | /** |
||
| 38 | * Factory method that returns an instance of the DMS. This could be any class that implements the DMSInterface. |
||
| 39 | * |
||
| 40 | * @return DMSInterface An instance of the Document Management System |
||
| 41 | */ |
||
| 42 | public static function inst() |
||
| 43 | { |
||
| 44 | if (!self::$instance) { |
||
| 45 | self::$instance = new static(); |
||
| 46 | |||
| 47 | $dmsPath = self::$instance->getStoragePath(); |
||
| 48 | |||
| 49 | if (!is_dir($dmsPath)) { |
||
| 50 | self::$instance->createStorageFolder($dmsPath); |
||
| 51 | } |
||
| 52 | |||
| 53 | if (!file_exists($dmsPath . DIRECTORY_SEPARATOR . '.htaccess')) { |
||
| 54 | // Restrict access to the storage folder |
||
| 55 | copy( |
||
| 56 | BASE_PATH . DIRECTORY_SEPARATOR . DMS_DIR . DIRECTORY_SEPARATOR |
||
| 57 | . 'resources' . DIRECTORY_SEPARATOR . '.htaccess', |
||
| 58 | $dmsPath . DIRECTORY_SEPARATOR . '.htaccess' |
||
| 59 | ); |
||
| 60 | |||
| 61 | copy( |
||
| 62 | BASE_PATH . DIRECTORY_SEPARATOR . DMS_DIR . DIRECTORY_SEPARATOR |
||
| 63 | . 'resources' . DIRECTORY_SEPARATOR . 'web.config', |
||
| 64 | $dmsPath . DIRECTORY_SEPARATOR . 'web.config' |
||
| 65 | ); |
||
| 66 | } |
||
| 67 | } |
||
| 68 | return self::$instance; |
||
| 69 | } |
||
| 70 | |||
| 71 | /** |
||
| 72 | * Get the storage path for DMS documents |
||
| 73 | * |
||
| 74 | * @return string |
||
| 75 | */ |
||
| 76 | public function getStoragePath() |
||
| 77 | { |
||
| 78 | return BASE_PATH . DIRECTORY_SEPARATOR . $this->config()->get('folder_name'); |
||
| 79 | } |
||
| 80 | |||
| 81 | /** |
||
| 82 | * Gets a file path from either a File or a string |
||
| 83 | * |
||
| 84 | * @param string|File $file |
||
| 85 | * @return string |
||
| 86 | * @throws FileNotFoundException If an unexpected value was provided, or the filename was null |
||
| 87 | */ |
||
| 88 | public function transformFileToFilePath($file) |
||
| 89 | { |
||
| 90 | //confirm we have a file |
||
| 91 | $filePath = null; |
||
| 92 | if (is_string($file)) { |
||
| 93 | $filePath = $file; |
||
| 94 | } elseif (is_object($file) && $file->is_a("File")) { |
||
| 95 | $filePath = $file->Filename; |
||
| 96 | } |
||
| 97 | |||
| 98 | if (!$filePath) { |
||
|
0 ignored issues
–
show
|
|||
| 99 | throw new FileNotFoundException(); |
||
| 100 | } |
||
| 101 | |||
| 102 | return $filePath; |
||
| 103 | } |
||
| 104 | |||
| 105 | /** |
||
| 106 | * Takes a File object or a String (path to a file) and copies it into the DMS. The original file remains unchanged. |
||
| 107 | * When storing a document, sets the fields on the File has "tag" metadata. |
||
| 108 | * @param File|string $file File object, or String that is path to a file to store, |
||
| 109 | * e.g. "assets/documents/industry/supplied-v1-0.pdf" |
||
| 110 | * @return DMSDocument |
||
| 111 | */ |
||
| 112 | public function storeDocument($file) |
||
| 113 | { |
||
| 114 | $filePath = $this->transformFileToFilePath($file); |
||
| 115 | |||
| 116 | // Create a new document and get its ID |
||
| 117 | $doc = DMSDocument::create(); |
||
| 118 | $doc->write(); |
||
| 119 | $doc->storeDocument($filePath); |
||
| 120 | |||
| 121 | return $doc; |
||
| 122 | } |
||
| 123 | |||
| 124 | /** |
||
| 125 | * Returns a number of Document objects that match a full-text search of the Documents and their contents |
||
| 126 | * (if contents is searchable and compatible search module is installed - e.g. FullTextSearch module) |
||
| 127 | * @param $searchText String to search for |
||
| 128 | * @param bool $showEmbargoed Boolean that specifies if embargoed documents should be included in results |
||
| 129 | * @return DocumentInterface |
||
|
0 ignored issues
–
show
|
|||
| 130 | */ |
||
| 131 | public function getByFullTextSearch($searchText, $showEmbargoed = false) |
||
| 132 | { |
||
| 133 | // TODO: Implement getByFullTextSearch() method. |
||
| 134 | } |
||
| 135 | |||
| 136 | public function getByPage(SiteTree $page, $showEmbargoed = false) |
||
| 137 | { |
||
| 138 | /** @var ArrayList $documents */ |
||
| 139 | $documents = $page->getAllDocuments(); |
||
| 140 | |||
| 141 | if (!$showEmbargoed) { |
||
| 142 | foreach ($documents as $document) { |
||
| 143 | if ($document->isEmbargoed()) { |
||
| 144 | $documents->remove($document); |
||
| 145 | } |
||
| 146 | } |
||
| 147 | } |
||
| 148 | |||
| 149 | return $documents; |
||
| 150 | } |
||
| 151 | |||
| 152 | public function getDocumentSetsByPage(SiteTree $page) |
||
| 153 | { |
||
| 154 | return $page->getDocumentSets(); |
||
| 155 | } |
||
| 156 | |||
| 157 | /** |
||
| 158 | * Creates a storage folder for the given path |
||
| 159 | * |
||
| 160 | * @param string $path Path to create a folder for |
||
| 161 | * @return $this |
||
| 162 | */ |
||
| 163 | public function createStorageFolder($path) |
||
| 164 | { |
||
| 165 | if (!is_dir($path)) { |
||
| 166 | mkdir($path, 0777, true); |
||
| 167 | } |
||
| 168 | return $this; |
||
| 169 | } |
||
| 170 | |||
| 171 | /** |
||
| 172 | * Calculates the storage path from a database DMSDocument ID |
||
| 173 | * |
||
| 174 | * @return int |
||
| 175 | */ |
||
| 176 | public function getStorageFolder($id) |
||
| 177 | { |
||
| 178 | return intval($id / self::config()->get('folder_size')); |
||
| 179 | } |
||
| 180 | |||
| 181 | /** |
||
| 182 | * Get the shortcode handler key |
||
| 183 | * |
||
| 184 | * @return string |
||
| 185 | */ |
||
| 186 | public function getShortcodeHandlerKey() |
||
| 187 | { |
||
| 188 | return (string) Config::inst()->get('DMS', 'shortcode_handler_key'); |
||
| 189 | } |
||
| 190 | } |
||
| 191 |
In PHP, under loose comparison (like
==, or!=, orswitchconditions), values of different types might be equal.For
stringvalues, the empty string''is a special case, in particular the following results might be unexpected: