This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | |||
4 | namespace dokuwiki\Subscriptions; |
||
5 | |||
6 | |||
7 | use dokuwiki\ChangeLog\PageChangeLog; |
||
8 | use dokuwiki\Input\Input; |
||
9 | use DokuWiki_Auth_Plugin; |
||
10 | |||
11 | class BulkSubscriptionSender extends SubscriptionSender |
||
12 | { |
||
13 | |||
14 | /** |
||
15 | * Send digest and list subscriptions |
||
16 | * |
||
17 | * This sends mails to all subscribers that have a subscription for namespaces above |
||
18 | * the given page if the needed $conf['subscribe_time'] has passed already. |
||
19 | * |
||
20 | * This function is called form lib/exe/indexer.php |
||
21 | * |
||
22 | * @param string $page |
||
23 | * |
||
24 | * @return int number of sent mails |
||
25 | */ |
||
26 | public function sendBulk($page) |
||
27 | { |
||
28 | $subscriberManager = new SubscriberManager(); |
||
29 | if (!$subscriberManager->isenabled()) { |
||
30 | return 0; |
||
31 | } |
||
32 | |||
33 | /** @var DokuWiki_Auth_Plugin $auth */ |
||
34 | global $auth; |
||
35 | global $conf; |
||
36 | global $USERINFO; |
||
37 | /** @var Input $INPUT */ |
||
38 | global $INPUT; |
||
39 | $count = 0; |
||
40 | |||
41 | $subscriptions = $subscriberManager->subscribers($page, null, ['digest', 'list']); |
||
42 | |||
43 | // remember current user info |
||
44 | $olduinfo = $USERINFO; |
||
45 | $olduser = $INPUT->server->str('REMOTE_USER'); |
||
46 | |||
47 | foreach ($subscriptions as $target => $users) { |
||
48 | if (!$this->lock($target)) { |
||
49 | continue; |
||
50 | } |
||
51 | |||
52 | foreach ($users as $user => $info) { |
||
53 | list($style, $lastupdate) = $info; |
||
54 | |||
55 | $lastupdate = (int)$lastupdate; |
||
56 | if ($lastupdate + $conf['subscribe_time'] > time()) { |
||
57 | // Less than the configured time period passed since last |
||
58 | // update. |
||
59 | continue; |
||
60 | } |
||
61 | |||
62 | // Work as the user to make sure ACLs apply correctly |
||
63 | $USERINFO = $auth->getUserData($user); |
||
64 | $INPUT->server->set('REMOTE_USER', $user); |
||
65 | if ($USERINFO === false) { |
||
66 | continue; |
||
67 | } |
||
68 | if (!$USERINFO['mail']) { |
||
69 | continue; |
||
70 | } |
||
71 | |||
72 | if (substr($target, -1, 1) === ':') { |
||
73 | // subscription target is a namespace, get all changes within |
||
74 | $changes = getRecentsSince($lastupdate, null, getNS($target)); |
||
0 ignored issues
–
show
Security
Bug
introduced
by
![]() |
|||
75 | } else { |
||
76 | // single page subscription, check ACL ourselves |
||
77 | if (auth_quickaclcheck($target) < AUTH_READ) { |
||
78 | continue; |
||
79 | } |
||
80 | $meta = p_get_metadata($target); |
||
81 | $changes = [$meta['last_change']]; |
||
82 | } |
||
83 | |||
84 | // Filter out pages only changed in small and own edits |
||
85 | $change_ids = []; |
||
86 | foreach ($changes as $rev) { |
||
87 | $n = 0; |
||
88 | while (!is_null($rev) && $rev['date'] >= $lastupdate && |
||
89 | ($INPUT->server->str('REMOTE_USER') === $rev['user'] || |
||
90 | $rev['type'] === DOKU_CHANGE_TYPE_MINOR_EDIT)) { |
||
91 | $pagelog = new PageChangeLog($rev['id']); |
||
92 | $rev = $pagelog->getRevisions($n++, 1); |
||
93 | $rev = (count($rev) > 0) ? $rev[0] : null; |
||
94 | } |
||
95 | |||
96 | if (!is_null($rev) && $rev['date'] >= $lastupdate) { |
||
97 | // Some change was not a minor one and not by myself |
||
98 | $change_ids[] = $rev['id']; |
||
99 | } |
||
100 | } |
||
101 | |||
102 | // send it |
||
103 | if ($style === 'digest') { |
||
104 | foreach ($change_ids as $change_id) { |
||
105 | $this->sendDigest( |
||
106 | $USERINFO['mail'], |
||
107 | $change_id, |
||
108 | $lastupdate |
||
109 | ); |
||
110 | $count++; |
||
111 | } |
||
112 | } else { |
||
113 | if ($style === 'list') { |
||
114 | $this->sendList($USERINFO['mail'], $change_ids, $target); |
||
115 | $count++; |
||
116 | } |
||
117 | } |
||
118 | // TODO: Handle duplicate subscriptions. |
||
119 | |||
120 | // Update notification time. |
||
121 | $subscriberManager->add($target, $user, $style, time()); |
||
122 | } |
||
123 | $this->unlock($target); |
||
124 | } |
||
125 | |||
126 | // restore current user info |
||
127 | $USERINFO = $olduinfo; |
||
128 | $INPUT->server->set('REMOTE_USER', $olduser); |
||
129 | return $count; |
||
130 | } |
||
131 | |||
132 | /** |
||
133 | * Lock subscription info |
||
134 | * |
||
135 | * We don't use io_lock() her because we do not wait for the lock and use a larger stale time |
||
136 | * |
||
137 | * @param string $id The target page or namespace, specified by id; Namespaces |
||
138 | * are identified by appending a colon. |
||
139 | * |
||
140 | * @return bool true, if you got a succesful lock |
||
141 | * @author Adrian Lang <[email protected]> |
||
142 | */ |
||
143 | protected function lock($id) |
||
144 | { |
||
145 | global $conf; |
||
146 | |||
147 | $lock = $conf['lockdir'] . '/_subscr_' . md5($id) . '.lock'; |
||
148 | |||
149 | if (is_dir($lock) && time() - @filemtime($lock) > 60 * 5) { |
||
150 | // looks like a stale lock - remove it |
||
151 | @rmdir($lock); |
||
152 | } |
||
153 | |||
154 | // try creating the lock directory |
||
155 | if (!@mkdir($lock, $conf['dmode'])) { |
||
156 | return false; |
||
157 | } |
||
158 | |||
159 | if ($conf['dperm']) { |
||
160 | chmod($lock, $conf['dperm']); |
||
161 | } |
||
162 | return true; |
||
163 | } |
||
164 | |||
165 | /** |
||
166 | * Unlock subscription info |
||
167 | * |
||
168 | * @param string $id The target page or namespace, specified by id; Namespaces |
||
169 | * are identified by appending a colon. |
||
170 | * |
||
171 | * @return bool |
||
172 | * @author Adrian Lang <[email protected]> |
||
173 | */ |
||
174 | protected function unlock($id) |
||
175 | { |
||
176 | global $conf; |
||
177 | $lock = $conf['lockdir'] . '/_subscr_' . md5($id) . '.lock'; |
||
178 | return @rmdir($lock); |
||
179 | } |
||
180 | |||
181 | /** |
||
182 | * Send a digest mail |
||
183 | * |
||
184 | * Sends a digest mail showing a bunch of changes of a single page. Basically the same as sendPageDiff() |
||
185 | * but determines the last known revision first |
||
186 | * |
||
187 | * @param string $subscriber_mail The target mail address |
||
188 | * @param string $id The ID |
||
189 | * @param int $lastupdate Time of the last notification |
||
190 | * |
||
191 | * @return bool |
||
192 | * @author Adrian Lang <[email protected]> |
||
193 | * |
||
194 | */ |
||
195 | protected function sendDigest($subscriber_mail, $id, $lastupdate) |
||
196 | { |
||
197 | $pagelog = new PageChangeLog($id); |
||
198 | $n = 0; |
||
199 | do { |
||
200 | $rev = $pagelog->getRevisions($n++, 1); |
||
201 | $rev = (count($rev) > 0) ? $rev[0] : null; |
||
202 | } while (!is_null($rev) && $rev > $lastupdate); |
||
203 | |||
204 | // TODO I'm not happy with the following line and passing $this->mailer around. Not sure how to solve it better |
||
205 | $pageSubSender = new PageSubscriptionSender($this->mailer); |
||
206 | return $pageSubSender->sendPageDiff( |
||
207 | $subscriber_mail, |
||
208 | 'subscr_digest', |
||
209 | $id, |
||
210 | $rev |
||
211 | ); |
||
212 | } |
||
213 | |||
214 | /** |
||
215 | * Send a list mail |
||
216 | * |
||
217 | * Sends a list mail showing a list of changed pages. |
||
218 | * |
||
219 | * @param string $subscriber_mail The target mail address |
||
220 | * @param array $ids Array of ids |
||
221 | * @param string $ns_id The id of the namespace |
||
222 | * |
||
223 | * @return bool true if a mail was sent |
||
224 | * @author Adrian Lang <[email protected]> |
||
225 | * |
||
226 | */ |
||
227 | protected function sendList($subscriber_mail, $ids, $ns_id) |
||
228 | { |
||
229 | if (count($ids) === 0) { |
||
230 | return false; |
||
231 | } |
||
232 | |||
233 | $tlist = ''; |
||
234 | $hlist = '<ul>'; |
||
235 | foreach ($ids as $id) { |
||
236 | $link = wl($id, [], true); |
||
237 | $tlist .= '* ' . $link . NL; |
||
238 | $hlist .= '<li><a href="' . $link . '">' . hsc($id) . '</a></li>' . NL; |
||
239 | } |
||
240 | $hlist .= '</ul>'; |
||
241 | |||
242 | $id = prettyprint_id($ns_id); |
||
243 | $trep = [ |
||
244 | 'DIFF' => rtrim($tlist), |
||
245 | 'PAGE' => $id, |
||
246 | 'SUBSCRIBE' => wl($id, ['do' => 'subscribe'], true, '&'), |
||
247 | ]; |
||
248 | $hrep = [ |
||
249 | 'DIFF' => $hlist, |
||
250 | ]; |
||
251 | |||
252 | return $this->send( |
||
253 | $subscriber_mail, |
||
254 | 'subscribe_list', |
||
255 | $ns_id, |
||
256 | 'subscr_list', |
||
257 | $trep, |
||
258 | $hrep |
||
259 | ); |
||
260 | } |
||
261 | } |
||
262 |