This project does not seem to handle request data directly as such no vulnerable execution paths were found.
include
, or for example
via PHP's auto-loading mechanism.
These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more
1 | <?php |
||
2 | |||
3 | |||
4 | class HideMailto extends SiteTreeExtension |
||
5 | { |
||
6 | private static $email_field = "Email"; |
||
7 | |||
8 | private static $default_subject = "enquiry"; |
||
9 | |||
10 | private static $replace_characters = array( |
||
11 | "." => ".", |
||
12 | "@" => "@", |
||
13 | "a" => "a", |
||
14 | "b" => "b", |
||
15 | "c" => "c", |
||
16 | "d" => "d", |
||
17 | "e" => "e", |
||
18 | "f" => "f", |
||
19 | "g" => "g", |
||
20 | "h" => "h", |
||
21 | "i" => "i" |
||
22 | ); |
||
23 | |||
24 | /** |
||
25 | * |
||
26 | * @param String $email |
||
27 | * @param String $subject |
||
28 | * @return Obj (MailTo, Text, Original, Subject) |
||
29 | */ |
||
30 | public static function convert_email($email, $subject = '') |
||
31 | { |
||
32 | $obj = new ViewableData(); |
||
33 | if (!$subject) { |
||
34 | $subject = self::$default_subject; |
||
35 | } |
||
36 | //mailto part |
||
37 | $mailTo = "mailto:".$email."?subject=".Convert::raw2mailto($subject); |
||
38 | $mailToConverted = self::string_encoder($mailTo); |
||
39 | $convertedEmail = self::string_encoder($email); |
||
40 | $obj->MailTo = $mailToConverted; |
||
41 | $obj->Text = $convertedEmail; |
||
42 | $obj->Original = $email; |
||
43 | $obj->Subject = $subject; |
||
44 | //$obj->OnClick = "jQuery(this).attr('href', HideMailto2Email('".self::get_dot_replacer()."', '".$array[0]."', '".$array[1]."', '".Convert::raw2mailto($subject)."')); return true;"; |
||
45 | //TO DO: add a JS function that puts the |
||
46 | Requirements::javascript(THIRDPARTY_DIR."/jquery/jquery.js"); |
||
47 | //Requirements::javascript("hidemailto/javascript/HideMailto2Email.js"); |
||
48 | return $obj; |
||
49 | } |
||
50 | |||
51 | |||
52 | /** |
||
53 | * encodes a string - randomly |
||
54 | * @param String $string |
||
55 | * @return String |
||
56 | */ |
||
57 | private static function string_encoder($string) |
||
58 | { |
||
59 | $encodedString = ''; |
||
60 | $nowCodeString = ''; |
||
61 | $originalLength = strlen($string); |
||
62 | for ($i = 0; $i < $originalLength; $i++) { |
||
63 | $encodeMode = rand(1, 2); |
||
64 | switch ($encodeMode) { |
||
65 | case 1: // Decimal code |
||
66 | $nowCodeString = '&#' . ord($string[$i]) . ';'; |
||
67 | break; |
||
68 | case 2: // Hexadecimal code |
||
69 | $nowCodeString = '&#x' . dechex(ord($string[$i])) . ';'; |
||
70 | break; |
||
71 | default: |
||
72 | return 'ERROR: wrong encoding mode.'; |
||
73 | } |
||
74 | $encodedString .= $nowCodeString; |
||
75 | } |
||
76 | return $encodedString; |
||
77 | } |
||
78 | |||
79 | public function HideMailToObject() |
||
80 | { |
||
81 | if ($email = $this->getHiddenEmailData()) { |
||
82 | $obj = self::convert_email($email); |
||
83 | return $obj; |
||
84 | } |
||
85 | } |
||
86 | |||
87 | private function getHiddenEmailData() |
||
88 | { |
||
89 | if ($field = self::$email_field) { |
||
90 | if ($email = $this->owner->$field) { |
||
91 | return $this->isEmail($email); |
||
92 | } |
||
93 | } |
||
94 | } |
||
95 | |||
96 | private function isEmail($email) |
||
97 | { |
||
98 | if (!preg_match("/^([A-Za-z0-9._-])+\@(([A-Za-z0-9-])+\.)+([A-Za-z0-9])+$/", trim($email))) { |
||
99 | return ""; |
||
100 | } else { |
||
101 | return $email; |
||
102 | } |
||
103 | } |
||
104 | } |
||
105 | |||
106 | class HideMailto_Role extends DataExtension |
||
107 | { |
||
108 | |||
109 | //member link |
||
110 | |||
111 | public function HideMailtoLink() |
||
112 | { |
||
113 | return "mailto/" . $this->owner->ID; |
||
114 | } |
||
115 | } |
||
116 | |||
117 | /** |
||
118 | * Generates obfusticated links, and also holds the method called when /mailto/ |
||
119 | * is called via the URL. As noted above, take a look at the _config.php file to |
||
120 | * see how mailto/ maps to this class. |
||
121 | */ |
||
122 | class HideMailto_Controller extends ContentController |
||
123 | { |
||
124 | /** |
||
125 | * The list of allowed domains to create a mailto: link to. By default, allow |
||
126 | * all domains. |
||
127 | * |
||
128 | * TODO Maybe the default should be to allow the current domain only? |
||
129 | */ |
||
130 | private static $allowed_domains = '*'; |
||
131 | |||
132 | public function __construct($dataRecord = null) |
||
133 | { |
||
134 | parent::__construct($dataRecord); |
||
135 | return $this->index(); |
||
0 ignored issues
–
show
Bug
introduced
by
![]() |
|||
136 | } |
||
137 | |||
138 | public function defaultAction($action) |
||
139 | { |
||
140 | return $this->index(); |
||
141 | } |
||
142 | |||
143 | public $url = ''; |
||
144 | |||
145 | /** |
||
146 | * This is called by default when this controller is executed. |
||
147 | */ |
||
148 | public function index() |
||
149 | { |
||
150 | $member = null; |
||
151 | $user = ''; |
||
152 | $domain = ''; |
||
153 | $subject = ''; |
||
154 | // We have two situations to deal with, where urlParams['Action'] is an int (assume Member ID), or a string (assume username) |
||
155 | if (is_numeric($this->getRequest()->param('Name'))) { |
||
156 | // Action is numeric, assume it's a member ID and optional ID is the email subject |
||
157 | $member = Member::get()->byID($this->getRequest()->param('Name')); |
||
158 | if (!$member) { |
||
159 | user_error("No member found with ID #" . $this->getRequest()->param('Name'), E_USER_ERROR); // No member found with this ID, perhaps we could redirect a user back instead of giving them a 500 error? |
||
160 | } |
||
161 | list($user, $domain) = explode('@', $member->Email); |
||
162 | $subject = $this->getRequest()->param('ID'); |
||
163 | } else { |
||
164 | // Action is not numeric, assume that Action is the username, ID is the domain and optional OtherID is the email subject |
||
165 | $user = urldecode($this->getRequest()->param('Name')); |
||
166 | $domain = urldecode($this->getRequest()->param('URL')); |
||
167 | $subject = $this->getRequest()->param('Subject'); |
||
168 | } |
||
169 | $emailString = "mailto: $user@$domain?subject=".$subject; |
||
170 | // Make sure the domain is in the allowed domains |
||
171 | if ((is_string(self::$allowed_domains) && self::$allowed_domains == '*') || in_array($domain, self::$allowed_domains)) { |
||
172 | // Create the redirect |
||
173 | header("Location: " . $emailString); |
||
174 | header("Refresh: 0; url=". $emailString); |
||
175 | echo $this->customise(array("RedirectBackURL" => $this->RedirectBackURL(), "Email" => $this->makeMailtoString($user, $domain, $subject)))->renderWith("HideMailto"); |
||
176 | $emailString = $this->makeMailtoString($user, $domain, $subject); |
||
177 | } else { |
||
178 | user_error("We're not allowed to redirect to the domain '$domain', because it's not listed in the _config.php file", E_USER_ERROR); |
||
179 | } |
||
180 | } |
||
181 | |||
182 | public function RedirectBackURL() |
||
183 | { |
||
184 | if (isset($_SERVER['HTTP_REFERER'])) { |
||
185 | $this->redirectBackURL = $_SERVER['HTTP_REFERER']; |
||
186 | } |
||
187 | if (!$this->redirectBackURL) { |
||
188 | $this->redirectBackURL = Director::absoluteBaseURL(); |
||
189 | } |
||
190 | return $this->redirectBackURL; |
||
191 | } |
||
192 | |||
193 | |||
194 | protected function makeMailtoString($user, $domain, $subject = '') |
||
195 | { |
||
196 | $target = 'mailto:' . $user . '@' . $domain; |
||
197 | if ($subject) { |
||
198 | $target .= '?subject=' . Convert::raw2mailto($subject); |
||
199 | } |
||
200 | $target = str_replace(".", "&x2e;", $target); |
||
201 | $target = str_replace("@", "&x40;", $target); |
||
202 | return $target; |
||
203 | } |
||
204 | } |
||
205 |