1227 lines
34 KiB
PHP
1227 lines
34 KiB
PHP
<?php namespace ProcessWire;
|
||
|
||
/**
|
||
* ProcessWire Pages Request
|
||
*
|
||
* #pw-summary Methods for identifying and loading page from current request URL.
|
||
* #pw-body =
|
||
* Methods in this class should be accessed from `$pages->request()`, i.e.
|
||
* ~~~~~
|
||
* $page = $pages->request()->getPage();
|
||
* ~~~~~
|
||
* #pw-body
|
||
*
|
||
* ProcessWire 3.x, Copyright 2023 by Ryan Cramer
|
||
* https://processwire.com
|
||
*
|
||
* @method Page|NullPage getPage()
|
||
* @method Page|null getPageForUser(Page $page, User $user)
|
||
* @method Page|NullPage getClosestPage()
|
||
* @method Page|string getLoginPageOrUrl(Page $page)
|
||
*
|
||
*/
|
||
|
||
class PagesRequest extends Wire {
|
||
|
||
/**
|
||
* @var Pages
|
||
*
|
||
*/
|
||
protected $pages;
|
||
|
||
/**
|
||
* @var Config
|
||
*
|
||
*/
|
||
protected $config;
|
||
|
||
/**
|
||
* @var Page|null|bool Page when found, NullPage when 404, null when not yet known
|
||
*
|
||
*/
|
||
protected $page = null;
|
||
|
||
/**
|
||
* Closest page to one requested, when getPage() didn’t resolve
|
||
*
|
||
* @var null|Page
|
||
*
|
||
*/
|
||
protected $closestPage = null;
|
||
|
||
/**
|
||
* Page that access was requested to and denied
|
||
*
|
||
* @var Page|null
|
||
*
|
||
*/
|
||
protected $requestPage = null;
|
||
|
||
/**
|
||
* @var array
|
||
*
|
||
*/
|
||
protected $pageInfo = array();
|
||
|
||
/**
|
||
* Sanitized path that generated this request
|
||
*
|
||
* Set by the getPage() method and passed to the pageNotFound function.
|
||
*
|
||
*/
|
||
protected $requestPath = '';
|
||
|
||
/**
|
||
* Processed request path (for identifying if setRequestPath called manually)
|
||
*
|
||
* @var string
|
||
*
|
||
*/
|
||
protected $processedPath = '';
|
||
|
||
/**
|
||
* Unsanitized URL from $_SERVER['REQUEST_URI']
|
||
*
|
||
* @var string
|
||
*
|
||
*/
|
||
protected $dirtyUrl = '';
|
||
|
||
/**
|
||
* Requested filename, if URL in /path/to/page/-/filename.ext format
|
||
*
|
||
*/
|
||
protected $requestFile = '';
|
||
|
||
/**
|
||
* Page number found in the URL or null if not found
|
||
*
|
||
*/
|
||
protected $pageNum = null;
|
||
|
||
/**
|
||
* Page number prefix found in the URL or null if not found
|
||
*
|
||
*/
|
||
protected $pageNumPrefix = null;
|
||
|
||
/**
|
||
* Response type codes to response type names
|
||
*
|
||
* @var array
|
||
*
|
||
*/
|
||
protected $responseCodeNames = array(
|
||
0 => 'unknown',
|
||
200 => 'ok',
|
||
300 => 'maybeRedirect',
|
||
301 => 'permRedirect',
|
||
302 => 'tempRedirect',
|
||
307 => 'tempRedo',
|
||
308 => 'permRedo',
|
||
400 => 'badRequest',
|
||
401 => 'unauthorized',
|
||
403 => 'forbidden',
|
||
404 => 'pageNotFound',
|
||
405 => 'methodNotAllowed',
|
||
414 => 'pathTooLong',
|
||
);
|
||
|
||
/**
|
||
* Response http code
|
||
*
|
||
* @var int
|
||
*
|
||
*/
|
||
protected $responseCode = 0;
|
||
|
||
/**
|
||
* URL that should be redirected to for this request
|
||
*
|
||
* Set by other methods in this class, and checked by the execute method before rendering.
|
||
*
|
||
*/
|
||
protected $redirectUrl = '';
|
||
|
||
/**
|
||
* @var int 301 or 302
|
||
*
|
||
*/
|
||
protected $redirectType = 0;
|
||
|
||
/**
|
||
* @var string
|
||
*
|
||
*/
|
||
protected $languageName = '';
|
||
|
||
/**
|
||
* Previous value of $_GET[it] when used for something non PW
|
||
*
|
||
* @var mixed
|
||
*
|
||
*/
|
||
protected $prevGetIt = null;
|
||
|
||
/**
|
||
* Optional message provided to setResponseCode() with additional detail
|
||
*
|
||
* @var string
|
||
*
|
||
*/
|
||
protected $responseMessage = '';
|
||
|
||
/*************************************************************************************/
|
||
|
||
/**
|
||
* Construct
|
||
*
|
||
* @param Pages $pages
|
||
*
|
||
*/
|
||
public function __construct(Pages $pages) {
|
||
parent::__construct();
|
||
$this->pages = $pages;
|
||
$this->config = $pages->wire()->config;
|
||
$this->init();
|
||
}
|
||
|
||
/**
|
||
* Initialize
|
||
*
|
||
*/
|
||
protected function init() {
|
||
|
||
$dirtyUrl = isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : '';
|
||
|
||
if(!strlen($dirtyUrl) && !empty($_SERVER['QUERY_STRING'])) {
|
||
if(strlen($_SERVER['QUERY_STRING']) < 4096) {
|
||
$dirtyUrl = '?' . $_SERVER['QUERY_STRING'];
|
||
}
|
||
}
|
||
|
||
$this->dirtyUrl = $dirtyUrl;
|
||
|
||
if(!isset($_GET['it'])) return;
|
||
|
||
// check if there is an 'it' var present in the request query string, which we don’t want
|
||
if((strpos($dirtyUrl, '?it=') !== false || strpos($dirtyUrl, '&it='))) {
|
||
// the request URL included a user-inserted 'it' variable in query string
|
||
// force to use path in request url rather than contents of 'it' var
|
||
list($it, /*query-string*/) = explode('?', $dirtyUrl, 2);
|
||
$rootUrl = $this->config->urls->root;
|
||
if(strlen($rootUrl) > 1) {
|
||
// root url is a subdirectory, like /pwsite/
|
||
if(strpos($it, $rootUrl) === 0) {
|
||
// url begins with that subdirectory, like /pwsite/
|
||
// convert '/pwsite/path/to/page/' to just '/path/to/page/'
|
||
$it = substr($it, strlen($rootUrl) - 1);
|
||
} else if(strpos(ltrim($it, '/'), ltrim($rootUrl, '/')) === 0) {
|
||
$it = substr(ltrim($it, '/'), strlen(ltrim($rootUrl, '/')));
|
||
}
|
||
}
|
||
$it = str_ireplace('index.php', '', $it);
|
||
$this->prevGetIt = $_GET['it'];
|
||
$_GET['it'] = $it;
|
||
}
|
||
}
|
||
|
||
/**
|
||
* Set current request page
|
||
*
|
||
* @param Page|NullPage|null $page
|
||
* @return Page|NullPage|null
|
||
*
|
||
*/
|
||
public function setPage($page) {
|
||
$this->page = $page;
|
||
$this->dirtyUrl = '';
|
||
$input = $this->wire()->input;
|
||
if($this->prevGetIt === null) {
|
||
unset($_GET['it']);
|
||
$input->get->offsetUnset('it');
|
||
} else {
|
||
$_GET['it'] = $this->prevGetIt;
|
||
$input->get->offsetSet('it', $this->prevGetIt);
|
||
$this->prevGetIt = null;
|
||
}
|
||
return $page;
|
||
}
|
||
|
||
/**
|
||
* Get the requested page
|
||
*
|
||
* - Populates identified urlSegments or page numbers to $input.
|
||
* - Returns NullPage for error, call getResponseCode() and/or getResponseMessage() for details.
|
||
* - Returned page should be validated with getPageForUser() method before rendering it.
|
||
* - Call getFile() method afterwards to see if request resolved to file managed by returned page.
|
||
*
|
||
* @param array $options
|
||
* @return Page|NullPage
|
||
*
|
||
*/
|
||
public function ___getPage(array $options = array()) {
|
||
|
||
$defaults = array(
|
||
'verbose' => false,
|
||
'useHistory' => false, // disabled because redundant with hook in PagePathHistory module
|
||
'useExcludeRoot' => false,
|
||
);
|
||
|
||
$options = empty($options) ? $defaults : array_merge($defaults, $options);
|
||
|
||
// perform this work only once unless reset by setPage or setRequestPath
|
||
if($this->page && $this->requestPath === $this->processedPath) return $this->page;
|
||
|
||
$input = $this->wire()->input;
|
||
$languages = $this->wire()->languages;
|
||
|
||
// get the requested path
|
||
$path = $this->getRequestPath();
|
||
|
||
// request path is not one ProcessWire is allowed to handle
|
||
if($path === false) return $this->setPage($this->pages->newNullPage());
|
||
|
||
// SECURE-PAGEFILES: check if request is for a secure pagefile
|
||
if($this->pagefileSecurePossibleUrl($path)) {
|
||
// get Page (success), NullPage (404), false (no file present), true (file present old method)
|
||
$page = $this->checkRequestFile($path); // can modify $path directly
|
||
if(is_object($page)) {
|
||
// Page (success) or NullPage (404)
|
||
$this->setResponseCode($page->id ? 200 : 404, 'Secure pagefile request');
|
||
return $this->setPage($page);
|
||
} else if($page === false) {
|
||
// $path is unrelated to /site/assets/files/
|
||
} else if($page === true) {
|
||
// $path was to a file using config.pageFileUrlPrefix prefix method
|
||
// $this->requestFile is populated and $path is now updated to be
|
||
// the page path without the filename in it
|
||
}
|
||
}
|
||
|
||
// populate request path to class as other methods will now use it
|
||
$this->setRequestPath($path);
|
||
|
||
// determine if original URL had anything filtered out of path that will suggest a redirect
|
||
list($dirtyUrl,) = explode('?', "$this->dirtyUrl?", 2); // exclude query string
|
||
if(stripos($dirtyUrl, 'index.php') !== false && stripos($path, 'index.php') === false) {
|
||
// force pathFinder to detect a redirect condition without index.php
|
||
$dirtyUrl = strtolower(rtrim($dirtyUrl, '/'));
|
||
if(substr("/$dirtyUrl", -10) === '/index.php') $path = rtrim($path, '/') . '/index.php';
|
||
} else if(strpos($dirtyUrl, '//') !== false) {
|
||
// force pathFinder to detect redirect sans double slashes, /page/path// => /page/path/
|
||
$path = rtrim($path, '/') . '//';
|
||
}
|
||
|
||
// get info about requested path
|
||
$info = $this->pages->pathFinder()->get($path, $options);
|
||
$pageId = $info['page']['id'];
|
||
$this->pageInfo = &$info;
|
||
$this->languageName = $info['language']['name'];
|
||
$this->setResponseCode($info['response']);
|
||
|
||
// URL segments
|
||
if(count($info['urlSegments'])) {
|
||
$input->setUrlSegments($info['urlSegments']);
|
||
}
|
||
|
||
// pagination numbers
|
||
if($info['pageNum'] > 1) {
|
||
$input->setPageNum($info['pageNum']);
|
||
$this->pageNum = $info['pageNum'];
|
||
$this->pageNumPrefix = $info['pageNumPrefix'];
|
||
}
|
||
|
||
// check if we have matched a page
|
||
if($pageId) {
|
||
$page = $this->pages->getOneById($pageId, array(
|
||
'template' => $info['page']['templates_id'],
|
||
'parent_id' => $info['page']['parent_id'],
|
||
));
|
||
} else {
|
||
$page = $this->pages->newNullPage();
|
||
}
|
||
|
||
$this->requestPage = $page;
|
||
|
||
if($page->id) {
|
||
if(!empty($info['urlSegments'])) {
|
||
// the first version of PW populated first URL segment to $page,
|
||
// this undocumented behavior retained for backwards compatibility
|
||
$page->setQuietly('urlSegment', $input->urlSegment1);
|
||
}
|
||
if(!$this->checkRequestMethod($page)) {
|
||
// request method not allowed
|
||
$page = $this->pages->newNullPage();
|
||
}
|
||
} else if($this->responseCode < 300) {
|
||
// no page ID found but got success code (this should not be possible)
|
||
$this->setResponseCode(404);
|
||
}
|
||
|
||
if($this->responseCode === 300) {
|
||
// 300 “maybe” redirect: page not available in requested language
|
||
if($languages && $languages->hasPageNames()) {
|
||
$language = $languages->get($info['language']['name']);
|
||
$result = $languages->pageNames()->pageNotAvailableInLanguage($page, $language);
|
||
if(is_array($result)) {
|
||
// array returned where index 0=301|302, 1=redirect URL
|
||
$this->setResponseCode($result[0]);
|
||
$this->setRedirectUrl($result[1], $result[0]);
|
||
} else if(is_bool($result)) {
|
||
// bool returned where true=200 (render anyway), false=404 (fail)
|
||
$this->setResponseCode($result ? 200 : 404);
|
||
}
|
||
} else if(!empty($info['redirect'])) {
|
||
$this->setResponseCode(301);
|
||
}
|
||
}
|
||
|
||
// check for redirect
|
||
if(empty($this->redirectUrl) && $this->responseCode >= 300 && $this->responseCode < 400) {
|
||
// 301 permRedirect, 302 tempRedirect, 307 or 308
|
||
$this->setRedirectPath($info['redirect'], $info['response']);
|
||
}
|
||
|
||
// check for error
|
||
if($this->responseCode >= 400) {
|
||
// 400 badRequest, 401 unauthorized, 403 forbidden,
|
||
// 404 pageNotFound, 405 methodNotallowed, 414 pathTooLong
|
||
if(!empty($info['redirect'])) {
|
||
// pathFinder suggests a redirect may still be possible
|
||
// currently not implemented
|
||
}
|
||
if($page->id) {
|
||
// if a page was found but with an error code then set the
|
||
// closestPage property for optional later inspection
|
||
$this->closestPage = $page;
|
||
}
|
||
$page = $this->pages->newNullPage();
|
||
}
|
||
|
||
if($page->id) $this->setPage($page);
|
||
|
||
return $page;
|
||
}
|
||
|
||
/**
|
||
* Update/get page for given user
|
||
*
|
||
* Must be called once the current $user is known as it may change the $page.
|
||
* Returns NullPage if user lacks access or page out of bounds.
|
||
* Returns different page if it should be substituted due to lack of access (like login page).
|
||
*
|
||
* @param Page $page
|
||
* @param User $user
|
||
* @return Page|NullPage
|
||
*
|
||
*/
|
||
public function ___getPageForUser(Page $page, User $user) {
|
||
|
||
$config = $this->config;
|
||
$isGuest = $user->isGuest();
|
||
|
||
// if no page found for guest user, check if path was in admin and map to admin root
|
||
if(!$page->id && $isGuest) {
|
||
// this ensures that no admin requests resolve to a 404 and instead show login form
|
||
$adminPath = substr($config->urls->admin, strlen($config->urls->root) - 1);
|
||
if(strpos($this->requestPath, $adminPath) === 0) {
|
||
$page = $this->pages->get($config->adminRootPageID);
|
||
$this->redirectUrl = '';
|
||
}
|
||
}
|
||
|
||
$requestPage = $page;
|
||
|
||
// enforce max pagination number when user is not logged in
|
||
$pageNum = $this->wire()->input->pageNum();
|
||
if($pageNum > 1 && $page->id && $isGuest) {
|
||
$maxPageNum = $config->maxPageNum;
|
||
if(!$maxPageNum) $maxPageNum = 999;
|
||
if($this->pageNum > $maxPageNum) {
|
||
$page = $this->pages->newNullPage();
|
||
}
|
||
}
|
||
|
||
if($page->id) {
|
||
$page = $this->checkAccess($page, $user);
|
||
if(is_string($page)) {
|
||
// redirect URL
|
||
if(strlen($page)) $this->setRedirectUrl($page, 302);
|
||
$page = $this->pages->newNullPage();
|
||
} else if(!$page || !$page->id) {
|
||
// 404
|
||
$page = $this->pages->newNullPage();
|
||
} else {
|
||
// login Page or Page to render
|
||
}
|
||
if($page && $page->id) {
|
||
// access allowed
|
||
} else if($user->isLoggedin()) {
|
||
$this->setResponseCode(403, 'Authenticated user lacks access');
|
||
} else {
|
||
$this->setResponseCode(401, 'User must login for access');
|
||
}
|
||
}
|
||
|
||
if($page->id) {
|
||
$this->checkScheme($page);
|
||
$this->setPage($page);
|
||
$page->of(true);
|
||
}
|
||
|
||
// if $page was changed as a result of above remember the requested one
|
||
if($requestPage->id != $page->id) {
|
||
$this->requestPage = $requestPage;
|
||
}
|
||
|
||
return $page;
|
||
}
|
||
|
||
/**
|
||
* Get closest matching page when getPage() returns an error/NullPage
|
||
*
|
||
* This is useful for a 404 page to suggest if maybe the user intended a different page
|
||
* and give them a link to it. For instance, you might have the following code in the
|
||
* template file used by your 404 page:
|
||
* ~~~~~
|
||
* echo "<h1>404 Page Not Found</h1>";
|
||
* $p = $pages->request()->getClosestPage();
|
||
* if($p->id) {
|
||
* echo "<p>Are you looking for <a href='$p->url'>$p->title</a>?</p>";
|
||
* }
|
||
* ~~~~~
|
||
*
|
||
* @return Page|NullPage
|
||
*
|
||
*/
|
||
public function ___getClosestPage() {
|
||
return $this->closestPage ? $this->closestPage : $this->pages->newNullPage();
|
||
}
|
||
|
||
/**
|
||
* Get page that was requested
|
||
*
|
||
* If this is different from the Page returned by getPageForUser() then it would
|
||
* represent the page that the user lacked access to.
|
||
*
|
||
* @return NullPage|Page
|
||
*
|
||
*/
|
||
public function getRequestPage() {
|
||
if($this->requestPage) return $this->requestPage;
|
||
$page = $this->getPage();
|
||
if($this->requestPage) return $this->requestPage; // duplication from above intentional
|
||
return $page;
|
||
}
|
||
|
||
/**
|
||
* Get the requested path
|
||
*
|
||
* @return bool|string Return false on fail, path on success
|
||
*
|
||
*/
|
||
protected function getRequestPagePath() {
|
||
|
||
$config = $this->config;
|
||
$sanitizer = $this->wire()->sanitizer;
|
||
|
||
/** @var string $shit Dirty URL */
|
||
/** @var string $it Clean URL */
|
||
|
||
if(isset($_GET['it'])) {
|
||
// normal request
|
||
$shit = trim($_GET['it']);
|
||
|
||
} else if(isset($_SERVER['REQUEST_URI'])) {
|
||
// abnormal request, something about request URL made .htaccess skip it, or index.php called directly
|
||
$rootUrl = $config->urls->root;
|
||
$shit = trim($_SERVER['REQUEST_URI']);
|
||
if(strpos($shit, '?') !== false) list($shit,) = explode('?', $shit, 2);
|
||
if($rootUrl != '/') {
|
||
if(strpos($shit, $rootUrl) === 0) {
|
||
// remove root URL from request
|
||
$shit = substr($shit, strlen($rootUrl) - 1);
|
||
} else {
|
||
// request URL outside of our root directory
|
||
$this->setResponseCode(404, 'Request URL outside of our web root');
|
||
return false;
|
||
}
|
||
}
|
||
} else {
|
||
$shit = '/';
|
||
}
|
||
|
||
if($shit === '/') {
|
||
$it = '/';
|
||
} else {
|
||
$it = preg_replace('{[^-_./a-zA-Z0-9]}', '', $shit); // clean
|
||
}
|
||
|
||
unset($_GET['it']);
|
||
|
||
if($shit !== $it) {
|
||
// sanitized URL does not match requested URL
|
||
if($config->pageNameCharset === 'UTF8') {
|
||
// test for extended page name URL
|
||
$it = $sanitizer->pagePathNameUTF8($shit);
|
||
}
|
||
if($shit !== $it) {
|
||
// if still does not match then fail
|
||
$this->setResponseCode(400, 'Request URL contains invalid/unsupported characters');
|
||
return false;
|
||
}
|
||
}
|
||
|
||
$maxUrlDepth = $config->maxUrlDepth;
|
||
if($maxUrlDepth > 0 && substr_count($it, '/') > $config->maxUrlDepth) {
|
||
$this->setResponseCode(414, 'Request URL exceeds max depth set in $config->maxUrlDepth');
|
||
return false;
|
||
}
|
||
|
||
if(!isset($it[0]) || $it[0] != '/') $it = "/$it";
|
||
|
||
if(strpos($it, '//') !== false) {
|
||
$this->setResponseCode(400, 'Request URL contains a blank segment “//”');
|
||
return false;
|
||
}
|
||
|
||
$this->requestPath = $it;
|
||
$this->processedPath = $it;
|
||
|
||
return $it;
|
||
}
|
||
|
||
/**
|
||
* Check if the requested path is to a secured page file
|
||
*
|
||
* - This function sets $this->requestFile when it finds one.
|
||
* - Returns Page when a pagefile was found and matched to a page.
|
||
* - Returns NullPage when request should result in a 404.
|
||
* - Returns true and updates $path when pagefile was found using deprecated prefix method.
|
||
* - Returns false when none found.
|
||
*
|
||
* @param string $path Request path
|
||
* @return bool|Page|NullPage
|
||
*
|
||
*/
|
||
protected function checkRequestFile(&$path) {
|
||
|
||
$config = $this->config;
|
||
$pages = $this->wire()->pages;
|
||
|
||
// request with url to root (applies only if site runs from subdirectory)
|
||
$url = rtrim($config->urls->root, '/') . $path;
|
||
|
||
// check for secured filename, method 1: actual file URL, minus leading "." or "-"
|
||
if(strpos($url, $config->urls->files) !== 0) {
|
||
// if URL is not to files, check if it might be using legacy prefix
|
||
if($config->pagefileUrlPrefix) return $this->checkRequestFilePrefix($path);
|
||
// request is not for a file
|
||
return false;
|
||
}
|
||
|
||
// request is for file in site/assets/files/...
|
||
$idAndFile = substr($url, strlen($config->urls->files));
|
||
|
||
// matching in $idAndFile: 1234/file.jpg, 1/2/3/4/file.jpg, 1234/subdir/file.jpg, 1/2/3/4/subdir/file.jpg, etc.
|
||
$regex = '{^(\d[\d\/]*)/([-_a-zA-Z0-9][-_./a-zA-Z0-9]+)$}';
|
||
if(!preg_match($regex, $idAndFile, $matches) && strpos($matches[2], '.')) {
|
||
// request was to something in /site/assets/files/ but we don't recognize it
|
||
// tell caller that this should be a 404
|
||
return $pages->newNullPage();
|
||
}
|
||
|
||
// request is consistent with those that would match to a file
|
||
$idPath = trim($matches[1], '/');
|
||
$file = trim($matches[2], '.');
|
||
|
||
if(!strpos($file, '.')) return $pages->newNullPage();
|
||
|
||
if(!ctype_digit("$idPath")) {
|
||
// extended paths where id separated by slashes, i.e. 1/2/3/4
|
||
if($config->pagefileExtendedPaths) {
|
||
// allow extended paths
|
||
$idPath = str_replace('/', '', $matches[1]);
|
||
if(!ctype_digit("$idPath")) return $pages->newNullPage();
|
||
} else {
|
||
// extended paths not allowed
|
||
return $pages->newNullPage();
|
||
}
|
||
}
|
||
|
||
if(strpos($file, '/') !== false) {
|
||
// file in subdirectory (for instance ProDrafts uses subdirectories for draft files)
|
||
list($subdir, $file) = explode('/', $file, 2);
|
||
|
||
if(strpos($file, '/') !== false) {
|
||
// there is more than one subdirectory, which we do not allow
|
||
return $pages->newNullPage();
|
||
|
||
} else if(strpos($subdir, '.') !== false || strlen($subdir) > 128) {
|
||
// subdirectory has a "." in it or subdir length is too long
|
||
return $pages->newNullPage();
|
||
|
||
} else if(!preg_match('/^[a-zA-Z0-9][-_a-zA-Z0-9]+$/', $subdir)) {
|
||
// subdirectory not in expected format
|
||
return $pages->newNullPage();
|
||
}
|
||
|
||
$file = trim($file, '.');
|
||
$this->requestFile = "$subdir/$file";
|
||
|
||
} else {
|
||
// file without subdirectory
|
||
$this->requestFile = $file;
|
||
}
|
||
|
||
return $pages->get((int) $idPath); // Page or NullPage
|
||
}
|
||
|
||
/**
|
||
* Check for secured filename: method 2 (deprecated)
|
||
*
|
||
* Used only if $config->pagefileUrlPrefix is defined
|
||
*
|
||
* @param string $path
|
||
* @return bool
|
||
*
|
||
*/
|
||
protected function checkRequestFilePrefix(&$path) {
|
||
$filePrefix = $this->wire()->config->pagefileUrlPrefix;
|
||
if(empty($filePrefix)) return false;
|
||
if(!strpos($path, '/' . $filePrefix)) return false;
|
||
$regex = '{^(.*/)' . $filePrefix . '([-_.a-zA-Z0-9]+)$}';
|
||
if(!preg_match($regex, $path, $matches)) return false;
|
||
if(!strpos($matches[2], '.')) return false;
|
||
$path = $matches[1];
|
||
$this->requestFile = $matches[2];
|
||
return true;
|
||
}
|
||
|
||
/**
|
||
* Get login Page object or URL to redirect to for login needed to access given $page
|
||
*
|
||
* - When a Page is returned, it is suggested the Page be rendered in this request.
|
||
* - When a string/URL is returned, it is suggested you redirect to it.
|
||
* - When null is returned no login page or URL could be identified and 404 should render.
|
||
*
|
||
* @param Page|null $page Page that access was requested to or omit to get admin login page
|
||
* @return string|Page|null Login page object or string w/redirect URL, null if 404
|
||
*
|
||
*/
|
||
public function ___getLoginPageOrUrl(Page $page = null) {
|
||
|
||
$config = $this->wire()->config;
|
||
|
||
// if no $page given return default login page
|
||
if($page === null) return $this->pages->get((int) $config->loginPageID);
|
||
|
||
// if NullPage given return URL to default login page
|
||
if(!$page->id) return $this->pages->get((int) $config->loginPageID)->httpUrl();
|
||
|
||
// if given page is one that cannot be accessed regardless of login return null
|
||
if($page->id === $config->trashPageID) return null;
|
||
|
||
// get redirectLogin setting from the template
|
||
$accessTemplate = $page->getAccessTemplate();
|
||
$redirectLogin = $accessTemplate ? $accessTemplate->redirectLogin : false;
|
||
|
||
if(empty($redirectLogin)) {
|
||
// no setting for template.redirectLogin means 404
|
||
return null;
|
||
|
||
} else if(ctype_digit("$redirectLogin")) {
|
||
// Page ID provided in template.redirectLogin
|
||
$loginID = (int) $redirectLogin;
|
||
if($loginID < 2) $loginID = (int) $config->loginPageID;
|
||
$loginPage = $this->pages->get($loginID);
|
||
if(!$loginPage->id && $loginID != $config->loginPageID) {
|
||
$loginPage = $this->pages->get($config->loginPageID);
|
||
}
|
||
if(!$loginPage->id) $loginPage = null;
|
||
return $loginPage;
|
||
|
||
} else if(strlen($redirectLogin)) {
|
||
// redirect URL provided in template.redirectLogin
|
||
$redirectUrl = str_replace('{id}', $page->id, $redirectLogin);
|
||
list($path, $query) = array($redirectUrl, '');
|
||
if(strpos($redirectUrl, '?') !== false) list($path, $query) = explode('?', $redirectUrl, 2);
|
||
if(strlen($path) && strpos($path, '/') === 0 && strpos($path, '//') === false) {
|
||
// attempt to match to page so we can use URL with scheme and relative to installation url
|
||
$p = $this->wire()->pages->get($path);
|
||
if($p->id && $p->viewable()) {
|
||
$redirectUrl = $p->httpUrl() . ($query ? "?$query" : "");
|
||
}
|
||
} else if(strpos($path, '//') === 0 && strpos($path, '://') === false) {
|
||
// double slash at beginning force path without checking if it maps to page
|
||
$redirectUrl = '/' . ltrim($redirectUrl, '/');
|
||
}
|
||
return $redirectUrl;
|
||
}
|
||
|
||
return null;
|
||
}
|
||
|
||
/**
|
||
* Check that the current user has access to the page and return it
|
||
*
|
||
* If the user doesn’t have access, then a login Page or NULL (for 404) is returned instead.
|
||
*
|
||
* @param Page $page
|
||
* @param User $user
|
||
* @return Page|string|null Page to render, URL to redirect to, or null for 404
|
||
*
|
||
*
|
||
*/
|
||
protected function checkAccess(Page $page, User $user) {
|
||
|
||
if($this->requestFile) {
|
||
// if a file was requested, we still allow view even if page doesn't have template file
|
||
if($page->viewable($this->requestFile) === false) return null;
|
||
if($page->viewable(false)) return $page; // false=viewable without template file check
|
||
if($this->checkAccessDelegated($page)) return $page;
|
||
// below seems to be redundant with the above $page->viewable(false) check
|
||
// if($page->status < Page::statusUnpublished && $user->hasPermission('page-view', $page)) return $page;
|
||
return null;
|
||
}
|
||
|
||
if($page->viewable()) {
|
||
// regular page view
|
||
return $page;
|
||
}
|
||
|
||
if($page->parent_id && $page->parent->template->name === 'admin' && $page->parent->viewable()) {
|
||
// check for special case in admin when Process::executeSegment() collides with page name underneath
|
||
// example: a role named "edit" is created and collides with ProcessPageType::executeEdit()
|
||
$input = $this->wire()->input;
|
||
if($user->isLoggedin() && $page->editable() && !strlen($input->urlSegmentStr())) {
|
||
$input->setUrlSegment(1, $page->name);
|
||
return $page->parent;
|
||
}
|
||
}
|
||
|
||
// if we reach this point, page is not viewable
|
||
// get login Page or URL to redirect to for login (Page, string or null)
|
||
$result = $this->getLoginPageOrUrl($page);
|
||
|
||
// if we won’t be presenting a login or redirect then return null (404)
|
||
if(empty($result)) return null;
|
||
|
||
return $result;
|
||
}
|
||
|
||
/**
|
||
* Check access to a delegated page (like a repeater)
|
||
*
|
||
* Note: this should move to PagePermissions.module or FieldtypeRepeater.module
|
||
* if a similar check is needed somewhere else in the core.
|
||
*
|
||
* @param Page $page
|
||
* @return Page|null|bool
|
||
*
|
||
*/
|
||
protected function checkAccessDelegated(Page $page) {
|
||
if(strpos($page->template->name, 'repeater_') === 0) {
|
||
return $this->checkAccessRepeater($page);
|
||
}
|
||
return null;
|
||
}
|
||
|
||
/**
|
||
* Check access to a delegated repeater
|
||
*
|
||
* @param Page $page
|
||
* @return Page|null|bool
|
||
*
|
||
*/
|
||
protected function checkAccessRepeater(Page $page) {
|
||
|
||
if(!$this->wire()->modules->isInstalled('FieldtypeRepeater')) return false;
|
||
|
||
$fieldName = substr($page->template->name, strpos($page->template->name, '_') + 1); // repeater_(fieldName)
|
||
if(!$fieldName) return false;
|
||
|
||
$field = $this->wire()->fields->get($fieldName);
|
||
if(!$field) return false;
|
||
|
||
$forPageID = substr($page->parent->name, strrpos($page->parent->name, '-') + 1); // for-page-(id)
|
||
$forPage = $this->pages->get((int) $forPageID);
|
||
|
||
if(!$forPage->id) return null;
|
||
|
||
// delegate viewable check to the page the repeater lives on
|
||
if($forPage->viewable($field)) return $page;
|
||
|
||
if(strpos($forPage->template->name, 'repeater_') === 0) {
|
||
// go recursive for nested repeaters
|
||
$forPage = $this->checkAccessRepeater($forPage);
|
||
if($forPage && $forPage->id) return $forPage;
|
||
}
|
||
|
||
return null;
|
||
}
|
||
|
||
/**
|
||
* If the template requires a different scheme/protocol than what is here, then redirect to it.
|
||
*
|
||
* This method just silently sets the $this->redirectUrl var if a redirect is needed.
|
||
* Note this does not work if GET vars are present in the URL -- they will be lost in the redirect.
|
||
*
|
||
* @param Page $page
|
||
*
|
||
*/
|
||
public function checkScheme(Page $page) {
|
||
|
||
$config = $this->config;
|
||
$input = $this->wire()->input;
|
||
$requireHTTPS = $page->template->https;
|
||
|
||
if($requireHTTPS == 0 || $config->noHTTPS) return; // neither HTTP or HTTPS required
|
||
|
||
$isHTTPS = $config->https;
|
||
$scheme = '';
|
||
|
||
if($requireHTTPS == -1 && $isHTTPS) {
|
||
// HTTP required: redirect to HTTP non-secure version
|
||
$scheme = "http";
|
||
|
||
} else if($requireHTTPS == 1 && !$isHTTPS) {
|
||
// HTTPS required: redirect to HTTPS secure version
|
||
$scheme = "https";
|
||
}
|
||
|
||
if(!$scheme) return;
|
||
|
||
if($this->redirectUrl) {
|
||
if(strpos($this->redirectUrl, '://') !== false) {
|
||
$url = str_replace(array('http://', 'https://'), "$scheme://", $this->redirectUrl);
|
||
} else {
|
||
$url = "$scheme://$config->httpHost$this->redirectUrl";
|
||
}
|
||
} else {
|
||
$url = "$scheme://$config->httpHost$page->url";
|
||
}
|
||
|
||
if($this->redirectUrl) {
|
||
// existing redirectUrl will already have segments/page numbers as needed
|
||
} else {
|
||
$urlSegmentStr = $input->urlSegmentStr;
|
||
if(strlen($urlSegmentStr) && $page->template->urlSegments) {
|
||
$url = rtrim($url, '/') . '/' . $urlSegmentStr;
|
||
if($page->template->slashUrlSegments) {
|
||
// use defined setting for trailing slash
|
||
if($page->template->slashUrlSegments == 1) $url .= '/';
|
||
} else {
|
||
// use whatever the request came with
|
||
if(substr($this->requestPath, -1) == '/') $url .= '/';
|
||
}
|
||
}
|
||
|
||
$pageNum = (int) $this->pageNum;
|
||
|
||
if($pageNum > 1 && $page->template->allowPageNum) {
|
||
$prefix = $this->pageNumPrefix ? $this->pageNumPrefix : $config->pageNumUrlPrefix;
|
||
if(!$prefix) $prefix = 'page';
|
||
$url = rtrim($url, '/') . "/$prefix$pageNum";
|
||
if($page->template->slashPageNum) {
|
||
// defined setting for trailing slash
|
||
if($page->template->slashPageNum == 1) $url .= '/';
|
||
} else {
|
||
// use whatever setting the URL came with
|
||
if(substr($this->requestPath, -1) == '/') $url .= '/';
|
||
}
|
||
}
|
||
}
|
||
|
||
$this->setRedirectUrl($url, 301);
|
||
}
|
||
|
||
/**
|
||
* Check current request method
|
||
*
|
||
* @param Page $page
|
||
* @return bool True if current request method allowed, false if not
|
||
*
|
||
*/
|
||
private function checkRequestMethod(Page $page) {
|
||
// @todo replace static allowMethods array with template setting like below
|
||
// $allowMethods = $page->template->get('requestMethods');
|
||
// $allowMethods = array('GET', 'HEAD', 'POST', 'PUT', 'DELETE', 'CONNECT', 'OPTIONS', 'TRACE', 'PATCH');
|
||
$allowMethods = array(); // feature disabled until further development
|
||
if(empty($allowMethods)) return true; // all allowed when none selected
|
||
$method = isset($_SERVER['REQUEST_METHOD']) ? strtoupper($_SERVER['REQUEST_METHOD']) : '';
|
||
if(empty($method)) return true;
|
||
if(in_array($method, $allowMethods, true)) return true;
|
||
if($method === 'GET' || $method === 'POST') {
|
||
if($page->template->name === 'admin') return true;
|
||
if($page->id == $this->wire()->config->http404PageID) return true;
|
||
}
|
||
$this->setResponseCode(405, "Request method $method not allowed by $page->template");
|
||
return false;
|
||
}
|
||
|
||
/**
|
||
* Are secure pagefiles possible on this system and url?
|
||
*
|
||
* @param string $url
|
||
* @return bool
|
||
* @since 3.0.166
|
||
*
|
||
*/
|
||
protected function pagefileSecurePossibleUrl($url) {
|
||
$config = $this->config;
|
||
|
||
// if URL does not start from root, prepend root
|
||
if(strpos($url, $config->urls->root) !== 0) $url = $config->urls->root . ltrim($url, '/');
|
||
|
||
// if URL is not pointing to the files structure, then this is not a files URL
|
||
if(strpos($url, $config->urls->files) !== 0) return false;
|
||
|
||
// pagefileSecure option is enabled and URL pointing to files
|
||
if($config->pagefileSecure) return true;
|
||
|
||
// check if any templates allow pagefileSecure option
|
||
$allow = false;
|
||
foreach($this->wire()->templates as $template) {
|
||
if(!$template->pagefileSecure) continue;
|
||
$allow = true;
|
||
break;
|
||
}
|
||
|
||
// if at least one template supports pagefileSecure option we will return true here
|
||
return $allow;
|
||
}
|
||
|
||
/**
|
||
* Set response code and type
|
||
*
|
||
* @param int $code
|
||
* @param string $message Optional message string
|
||
*
|
||
*/
|
||
protected function setResponseCode($code, $message = '') {
|
||
$this->responseCode = (int) $code;
|
||
if($message) $this->responseMessage = $message;
|
||
}
|
||
|
||
/**
|
||
* Get all possible response code names indexed by http response code
|
||
*
|
||
* @return array
|
||
*
|
||
*/
|
||
public function getResponseCodeNames() {
|
||
return $this->responseCodeNames;
|
||
}
|
||
|
||
/**
|
||
* Get response type name for this request
|
||
*
|
||
* Returns string, one of:
|
||
*
|
||
* - unknown: request not yet analyzed (0)
|
||
* - ok: successful request (200)
|
||
* - fileOk: successful file request (200)
|
||
* - fileNotFound: requested file not found (404)
|
||
* - maybeRedirect: needs decision about whether to redirect (300)
|
||
* - permRedirect: permanent redirect (301)
|
||
* - tempRedirect: temporary redirect (302)
|
||
* - tempRedo: temporary redirect and redo using same method (307)
|
||
* - permRedo: permanent redirect and redo using same method (308)
|
||
* - badRequest: bad request/page path error (400)
|
||
* - unauthorized: login required (401)
|
||
* - forbidden: authenticated user lacks access (403)
|
||
* - pageNotFound: page not found (404)
|
||
* - methodNotAllowed: request method is not allowed by template (405)
|
||
* - pathTooLong: path too long or segment too long (414)
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getResponseCodeName() {
|
||
return $this->responseCodeNames[$this->responseCode];
|
||
}
|
||
|
||
/**
|
||
* Get response http code for this request
|
||
*
|
||
* Returns integer, one of:
|
||
*
|
||
* - 0: unknown/request not yet analyzed
|
||
* - 200: successful request
|
||
* - 300: maybe redirect (needs decision)
|
||
* - 301: permanent redirect
|
||
* - 302: temporary redirect
|
||
* - 307: temporary redirect and redo using same method
|
||
* - 308: permanent redirect and redo using same method
|
||
* - 400: bad request/page path error
|
||
* - 401: unauthorized/login required
|
||
* - 403: forbidden/authenticated user lacks access
|
||
* - 404: page not found
|
||
* - 405: method not allowed
|
||
* - 414: request path too long or segment too long
|
||
*
|
||
* @return int
|
||
*
|
||
*/
|
||
public function getResponseCode() {
|
||
return $this->responseCode;
|
||
}
|
||
|
||
/**
|
||
* Set request path
|
||
*
|
||
* @param string $requestPath
|
||
*
|
||
*/
|
||
public function setRequestPath($requestPath) {
|
||
$this->requestPath = $requestPath;
|
||
}
|
||
|
||
/**
|
||
* Get request path
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getRequestPath() {
|
||
if(empty($this->requestPath)) $this->requestPath = $this->getRequestPagePath();
|
||
return $this->requestPath;
|
||
}
|
||
|
||
/**
|
||
* Get request language name
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getLanguageName() {
|
||
return $this->languageName;
|
||
}
|
||
|
||
/**
|
||
* Set the redirect path
|
||
*
|
||
* @param string $redirectPath
|
||
* @param int $type 301 or 302
|
||
*
|
||
*/
|
||
public function setRedirectPath($redirectPath, $type = 301) {
|
||
$this->redirectUrl = $this->wire()->config->urls->root . ltrim($redirectPath, '/');
|
||
$this->redirectType = (int) $type;
|
||
}
|
||
|
||
/**
|
||
* Set the redirect URL
|
||
*
|
||
* @param string $redirectUrl
|
||
* @param int $type
|
||
*
|
||
*/
|
||
public function setRedirectUrl($redirectUrl, $type = 301) {
|
||
$this->redirectUrl = $redirectUrl;
|
||
$this->redirectType = (int) $type;
|
||
}
|
||
|
||
/**
|
||
* Get the redirect URL
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getRedirectUrl() {
|
||
return $this->redirectUrl;
|
||
}
|
||
|
||
/**
|
||
* Get the redirect type (0, 301, 302, 307, 308)
|
||
*
|
||
* @return int
|
||
*
|
||
*/
|
||
public function getRedirectType() {
|
||
return $this->redirectType === 300 ? 301 : $this->redirectType;
|
||
}
|
||
|
||
/**
|
||
* Get the requested pagination number
|
||
*
|
||
* @return null|int
|
||
*
|
||
*/
|
||
public function getPageNum() {
|
||
return $this->pageNum;
|
||
}
|
||
|
||
/**
|
||
* Get the requested pagination number prefix
|
||
*
|
||
* @return null|string
|
||
*
|
||
*/
|
||
public function getPageNumPrefix() {
|
||
return $this->pageNumPrefix;
|
||
}
|
||
|
||
/**
|
||
* Get the requested file
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getFile() {
|
||
return $this->requestFile;
|
||
}
|
||
|
||
/**
|
||
* Get the requested file (alias of getFile method)
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getRequestFile() {
|
||
return $this->requestFile;
|
||
}
|
||
|
||
/**
|
||
* Get message about response only if response was an error, blank otherwise
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getResponseError() {
|
||
return ($this->responseCode >= 400 ? $this->getResponseMessage() : '');
|
||
}
|
||
|
||
/**
|
||
* Set response message
|
||
*
|
||
* @param string $message
|
||
* @param bool $append Append to existing message?
|
||
*
|
||
*/
|
||
public function setResponseMessage($message, $append = false) {
|
||
if($append && $this->responseMessage) $message = "$this->responseMessage \n$message";
|
||
$this->responseMessage = $message;
|
||
}
|
||
|
||
/**
|
||
* Get message string about response
|
||
*
|
||
* @return string
|
||
*
|
||
*/
|
||
public function getResponseMessage() {
|
||
$code = $this->getResponseCode();
|
||
$value = $this->getResponseCodeName();
|
||
if(empty($value)) $value = "unknown";
|
||
$value = "$code $value";
|
||
if($this->responseMessage) $value .= ": $this->responseMessage";
|
||
$attrs = array();
|
||
if(!empty($this->pageInfo['urlSegments'])) $attrs[] = 'urlSegments';
|
||
if($this->pageNum > 1) $attrs[] = 'pageNum';
|
||
if($this->requestFile) $attrs[] = 'file';
|
||
return $value;
|
||
}
|
||
}
|