smtech /
canvas-ics-sync
This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
| 1 | <?php |
||
| 2 | namespace smtech\CanvasICSSync; |
||
| 3 | |||
| 4 | use smtech\LTI\Configuration\Option; |
||
| 5 | use Battis\HierarchicalSimpleCache; |
||
| 6 | use Battis\BootstrapSmarty\NotificationMessage; |
||
| 7 | use DateTime; |
||
| 8 | |||
| 9 | /** |
||
| 10 | * St. Marks Reflexive Canvas LTI Example toolbox |
||
| 11 | * |
||
| 12 | * Adds some common, useful methods to the St. Mark's-styled |
||
| 13 | * ReflexiveCanvasLTI Toolbox |
||
| 14 | * |
||
| 15 | * @author Seth Battis <[email protected]> |
||
| 16 | * @version v1.2 |
||
| 17 | */ |
||
| 18 | class Toolbox extends \smtech\StMarksReflexiveCanvasLTI\Toolbox |
||
| 19 | { |
||
| 20 | private $FIELD_MAP = array( |
||
| 21 | 'calendar_event[title]' => 'SUMMARY', |
||
| 22 | 'calendar_event[description]' => 'DESCRIPTION', |
||
| 23 | 'calendar_event[start_at]' => array( |
||
| 24 | 0 => 'X-CURRENT-DTSTART', |
||
| 25 | 1 => 'DTSTART' |
||
| 26 | ), |
||
| 27 | 'calendar_event[end_at]' => array( |
||
| 28 | 0 => 'X-CURRENT-DTEND', |
||
| 29 | 1 => 'DTEND' |
||
| 30 | ), |
||
| 31 | 'calendar_event[location_name]' => 'LOCATION' |
||
| 32 | ); |
||
| 33 | |||
| 34 | private $LOCK_FILE_EXPIRATION = 60 * 60; /* 1 hour */ |
||
| 35 | |||
| 36 | private $SYNC_TIMESTAMP = null; |
||
| 37 | |||
| 38 | /** |
||
| 39 | * Configure course and account navigation placements |
||
| 40 | * |
||
| 41 | * @return Generator |
||
| 42 | */ |
||
| 43 | public function getGenerator() |
||
| 44 | { |
||
| 45 | parent::getGenerator(); |
||
| 46 | $this->generator->setOptionProperty( |
||
| 47 | Option::COURSE_NAVIGATION(), |
||
| 48 | 'visibility', |
||
| 49 | 'admins' |
||
| 50 | ); |
||
| 51 | return $this->generator; |
||
| 52 | } |
||
| 53 | |||
| 54 | /** |
||
| 55 | * Load the app schema into the database |
||
| 56 | * |
||
| 57 | * @return void |
||
| 58 | */ |
||
| 59 | public function loadSchema() |
||
| 60 | { |
||
| 61 | /* ...so that we can find the LTI_Tool_Provider database schema (oy!) */ |
||
| 62 | foreach (explode(';', file_get_contents(dirname(__DIR__) . '/schema.sql')) as $query) { |
||
| 63 | if (!empty(trim($query))) { |
||
| 64 | /* |
||
| 65 | * TODO should there be some sort of testing or logging here? |
||
| 66 | * If _some_ tables are present, that will trigger |
||
| 67 | * reloading all tables, which will generate ignorable |
||
| 68 | * errors. |
||
| 69 | */ |
||
| 70 | $this->mysql_query($query); |
||
| 71 | } |
||
| 72 | } |
||
| 73 | $this->log('Application database schema loaded.'); |
||
| 74 | } |
||
| 75 | |||
| 76 | /** |
||
| 77 | * Check to see if a URL exists |
||
| 78 | **/ |
||
| 79 | public function urlExists($url) |
||
| 80 | { |
||
| 81 | $handle = fopen($url, 'r'); |
||
| 82 | return $handle !== false; |
||
| 83 | } |
||
| 84 | |||
| 85 | /** |
||
| 86 | * compute the calendar context for the canvas object based on its URL |
||
| 87 | **/ |
||
| 88 | public function getCanvasContext($canvasUrl) |
||
| 89 | { |
||
| 90 | /* |
||
| 91 | * TODO: accept calendar2?contexts links too (they would be an intuitively |
||
| 92 | * obvious link to use, after all) |
||
| 93 | */ |
||
| 94 | /* |
||
| 95 | * FIXME: users aren't working |
||
| 96 | */ |
||
| 97 | /* |
||
| 98 | * TODO: it would probably be better to look up users by email address than |
||
| 99 | * URL |
||
| 100 | */ |
||
| 101 | /* get the context (user, course or group) for the canvas URL */ |
||
| 102 | $canvasContext = array(); |
||
| 103 | if (preg_match( |
||
| 104 | '%(https?://)?(' . |
||
| 105 | parse_url($this->config('TOOL_CANVAS_API')['url'], PHP_URL_HOST) . |
||
| 106 | '/((about/(\d+))|(courses/(\d+)(/groups/(\d+))?)|(accounts/\d+/groups/(\d+))))%', |
||
| 107 | $canvasUrl, |
||
| 108 | $matches |
||
| 109 | )) { |
||
| 110 | $canvasContext['canonical_url'] = "https://{$matches[2]}"; // https://stmarksschool.instructure.com/courses/953 |
||
| 111 | |||
| 112 | // course or account groups |
||
| 113 | if (isset($matches[9]) || isset($matches[11])) { |
||
| 114 | $canvasContext['context'] = 'group'; // used to for context_code in events |
||
| 115 | $canvasContext['id'] = ($matches[9] > $matches[11] ? $matches[9] : $matches[11]); |
||
| 116 | |||
| 117 | /* used once to look up the object to be sure it really exists */ |
||
| 118 | $canvasContext['verification_url'] = "groups/{$canvasContext['id']}"; |
||
| 119 | |||
| 120 | // courses |
||
| 121 | } elseif (isset($matches[7])) { |
||
| 122 | $canvasContext['context'] = 'course'; |
||
| 123 | $canvasContext['id'] = $matches[7]; |
||
| 124 | $canvasContext['verification_url'] = "courses/{$canvasContext['id']}"; |
||
| 125 | |||
| 126 | // users |
||
| 127 | } elseif (isset($matches[5])) { |
||
| 128 | $canvasContext['context'] = 'user'; |
||
| 129 | $canvasContext['id'] = $matches[5]; |
||
| 130 | $canvasContext['verification_url'] = "users/{$canvasContext['id']}/profile"; |
||
| 131 | |||
| 132 | // we're somewhere where we don't know where we are |
||
| 133 | } else { |
||
| 134 | return false; |
||
| 135 | } |
||
| 136 | return $canvasContext; |
||
| 137 | } |
||
| 138 | return false; |
||
| 139 | } |
||
| 140 | |||
| 141 | /** |
||
| 142 | * Filter and clean event data before posting to Canvas |
||
| 143 | * |
||
| 144 | * This must happen AFTER the event hash has been calculated! |
||
| 145 | **/ |
||
| 146 | public function filterEvent($event, $calendarCache) |
||
| 147 | { |
||
| 148 | return ( |
||
| 149 | ( |
||
| 150 | // TODO actual multi-day events would be nice |
||
| 151 | // only include first day of multi-day events |
||
| 152 | $event->getProperty('X-OCCURENCE') == false || |
||
| 153 | preg_match('/^day 1 of \d+$/i', $event->getProperty('X-OCCURENCE')[1]) |
||
| 154 | ) && |
||
| 155 | ( |
||
| 156 | // include this event if filtering is off... |
||
| 157 | $calendarCache['enable_regexp_filter'] == false || |
||
| 158 | ( |
||
| 159 | ( |
||
| 160 | ( // if filtering is on, and there's an include pattern test that pattern... |
||
| 161 | !empty($calendarCache['include_regexp']) && |
||
| 162 | preg_match("%{$calendarCache['include_regexp']}%", $event->getProperty('SUMMARY')) |
||
| 163 | ) |
||
| 164 | ) && |
||
| 165 | !( // if there is an exclude pattern, make sure that this event is NOT excluded |
||
| 166 | !empty($calendarCache['exclude_regexp']) && |
||
| 167 | preg_match("%{$calendarCache['exclude_regexp']}%", $event->getProperty('SUMMARY')) |
||
| 168 | ) |
||
| 169 | ) |
||
| 170 | ) |
||
| 171 | ); |
||
| 172 | } |
||
| 173 | |||
| 174 | public function postMessage($subject, $body, $flag = NotificationMessage::INFO) |
||
| 175 | { |
||
| 176 | global $toolbox; |
||
|
0 ignored issues
–
show
|
|||
| 177 | if (php_sapi_name() != 'cli') { |
||
| 178 | $this->smarty_addMessage($subject, $body, $flag); |
||
| 179 | } else { |
||
| 180 | $logEntry = "[$flag] $subject: $body"; |
||
| 181 | $this->log($logEntry); |
||
| 182 | } |
||
| 183 | } |
||
| 184 | |||
| 185 | /** |
||
| 186 | * Generate a unique ID to identify this particular pairing of ICS feed and |
||
| 187 | * Canvas calendar |
||
| 188 | **/ |
||
| 189 | public function getPairingHash($icsUrl, $canvasContext) |
||
| 190 | { |
||
| 191 | return md5($icsUrl . $canvasContext . $this->config('CANVAS_INSTANCE_URL')); |
||
| 192 | } |
||
| 193 | |||
| 194 | /** |
||
| 195 | * Generate a hash of this version of an event to cache in the database |
||
| 196 | **/ |
||
| 197 | public function getEventHash($event) |
||
| 198 | { |
||
| 199 | $blob = ''; |
||
| 200 | foreach ($this->FIELD_MAP as $field) { |
||
| 201 | if (is_array($field)) { |
||
| 202 | foreach ($field as $option) { |
||
| 203 | if (!empty($property = $event->getProperty($option))) { |
||
| 204 | $blob .= serialize($property); |
||
| 205 | break; |
||
| 206 | } |
||
| 207 | } |
||
| 208 | } else { |
||
| 209 | if (!empty($property = $event->getProperty($field))) { |
||
| 210 | $blob .= serialize($property); |
||
| 211 | } |
||
| 212 | } |
||
| 213 | } |
||
| 214 | return md5($blob); |
||
| 215 | } |
||
| 216 | |||
| 217 | /** |
||
| 218 | * Generate a unique identifier for this synchronization pass |
||
| 219 | **/ |
||
| 220 | public function getSyncTimestamp() |
||
| 221 | { |
||
| 222 | if ($this->SYNC_TIMESTAMP) { |
||
| 223 | return $this->SYNC_TIMESTAMP; |
||
| 224 | } else { |
||
| 225 | $timestamp = new DateTime(); |
||
| 226 | $this->SYNC_TIMESTAMP = $timestamp->format(SYNC_TIMESTAMP_FORMAT) . SEPARATOR . |
||
| 227 | md5((php_sapi_name() == 'cli' ? 'cli' : $_SERVER['REMOTE_ADDR']) . time()); |
||
| 228 | return $this->SYNC_TIMESTAMP; |
||
| 229 | } |
||
| 230 | } |
||
| 231 | |||
| 232 | protected function lockFileName($pairingHash) |
||
| 233 | { |
||
| 234 | return "$pairingHash.lock"; |
||
| 235 | } |
||
| 236 | |||
| 237 | public function lock($pairingHash) |
||
| 238 | { |
||
| 239 | if (empty($this->config($this->lockFileName($pairingHash))) || |
||
| 240 | strtotime($this->config($this->lockFileName($pairingHash))) < time() - $this->LOCK_FILE_EXPIRATION) { |
||
| 241 | $this->config($this->lockFileName($pairingHash), date('c')); |
||
| 242 | return true; |
||
| 243 | } |
||
| 244 | return false; |
||
| 245 | } |
||
| 246 | |||
| 247 | public function unlock($pairingHash) |
||
| 248 | { |
||
| 249 | $this->config($this->lockFileName($pairingHash), false); |
||
| 250 | } |
||
| 251 | } |
||
| 252 |
Instead of relying on
globalstate, we recommend one of these alternatives:1. Pass all data via parameters
2. Create a class that maintains your state