1 | <?php |
||
17 | class Controller |
||
18 | { |
||
19 | |||
20 | /** |
||
21 | * Controller action is publicly accessible |
||
22 | */ |
||
23 | const ACTION_PUBLIC = 0; |
||
24 | |||
25 | /** |
||
26 | * Controller action requires authentication |
||
27 | * Will redirect to login page if not authenticated |
||
28 | */ |
||
29 | const ACTION_PROTECTED = 1; |
||
30 | |||
31 | /** |
||
32 | * Controller action requires authentication |
||
33 | * Will result in an 404 if not authenticated |
||
34 | */ |
||
35 | const ACTION_PRIVATE = 2; |
||
36 | |||
37 | /** |
||
38 | * @var array Controller action access rules |
||
39 | */ |
||
40 | protected $access = []; |
||
41 | |||
42 | /** |
||
43 | * @var \PDO PDO |
||
44 | */ |
||
45 | protected $pdo; |
||
46 | |||
47 | /** |
||
48 | * @var string App file path |
||
49 | */ |
||
50 | protected $appPath; |
||
51 | |||
52 | /** |
||
53 | * @var null|User User |
||
54 | */ |
||
55 | protected $user; |
||
56 | |||
57 | /** |
||
58 | * @var string Controller action |
||
59 | */ |
||
60 | protected $action; |
||
61 | |||
62 | /** |
||
63 | * @var array View variables |
||
64 | */ |
||
65 | protected $variables = []; |
||
66 | |||
67 | /** |
||
68 | * @var bool Should render view for controller action |
||
69 | */ |
||
70 | protected $render = true; |
||
71 | |||
72 | /** |
||
73 | * @var string File path for layout template file |
||
74 | */ |
||
75 | protected $layout; |
||
76 | |||
77 | /** |
||
78 | * @var string File path for view template file |
||
79 | */ |
||
80 | protected $view; |
||
81 | |||
82 | /** |
||
83 | * @var array Headers for output |
||
84 | * |
||
85 | * @todo JSON content type: `Content-Type: application/javascript; charset=utf-8` |
||
86 | */ |
||
87 | protected $headers = [ |
||
88 | 'content-type' => 'Content-Type: text/html; charset=utf-8' |
||
89 | ]; |
||
90 | |||
91 | /** |
||
92 | * @return string Controller name without namespace |
||
93 | */ |
||
94 | public function getShortName(): string |
||
98 | |||
99 | /** |
||
100 | * @param string $action Controller action |
||
101 | * |
||
102 | * @throws ControllerActionNonexistentException |
||
103 | * @throws ControllerActionPrivateInsufficientAuthenticationException |
||
104 | * @throws ControllerActionProtectedInsufficientAuthenticationException |
||
105 | */ |
||
106 | 4 | public function setAction(string $action) |
|
131 | |||
132 | /** |
||
133 | * Call action |
||
134 | * |
||
135 | * @return array<string,array|string> Headers and output if render is enabled, otherwise FALSE |
||
136 | * |
||
137 | * @throws \LogicException If controller action is not set |
||
138 | */ |
||
139 | public function callAction(): array |
||
178 | |||
179 | /** |
||
180 | * Before controller action hook |
||
181 | * |
||
182 | * Called right before controller action is called |
||
183 | */ |
||
184 | protected function beforeAction() |
||
193 | |||
194 | /** |
||
195 | * After controller action hook |
||
196 | * |
||
197 | * Called right after controller action is called, but before rendering of the view |
||
198 | */ |
||
199 | protected function afterAction() |
||
202 | |||
203 | /** |
||
204 | * Set view variable |
||
205 | * |
||
206 | * @param string $variable |
||
207 | * @param mixed $value |
||
208 | */ |
||
209 | protected function set(string $variable, $value) |
||
213 | |||
214 | /** |
||
215 | * Get layout template |
||
216 | * |
||
217 | * @return string Layout template file path |
||
218 | */ |
||
219 | protected function getLayoutTemplate(): string |
||
229 | |||
230 | /** |
||
231 | * Get view template |
||
232 | * |
||
233 | * @return string View template file path |
||
234 | */ |
||
235 | 2 | protected function getViewTemplate(): string |
|
245 | |||
246 | /** |
||
247 | * Set response code |
||
248 | * |
||
249 | * Supports 200 OK, 403 Forbidden, 404 Not Found & 500 Internal Server Error |
||
250 | * |
||
251 | * @param int $code HTTP response code |
||
252 | * |
||
253 | * @throws \InvalidArgumentException If unsupported code is provided |
||
254 | */ |
||
255 | protected function setResponseCode(int $code) |
||
285 | |||
286 | /** |
||
287 | * @param \PDO $pdo |
||
288 | * @param string $appPath |
||
289 | * @param null|User $user |
||
290 | */ |
||
291 | public function __construct(\PDO $pdo, string $appPath, User $user = null) |
||
297 | } |
||
298 |
$action
can contain request data and is used in code execution context(s) leading to a potential security vulnerability.General Strategies to prevent injection
In general, it is advisable to prevent any user-data to reach this point. This can be done by white-listing certain values:
For numeric data, we recommend to explicitly cast the data: