[Summary view] [Print] [Text view]

   1  <?php
   2  /**
   3  *
   4  * This file is part of the phpBB Forum Software package.
   5  *
   6  * @copyright (c) phpBB Limited <https://www.phpbb.com>
   7  * @license GNU General Public License, version 2 (GPL-2.0)
   8  *
   9  * For full copyright and license information, please see
  10  * the docs/CREDITS.txt file.
  11  *
  12  */
  13  
  14  namespace phpbb\request;
  15  
  16  /**
  17  * A helper class that provides convenience methods for type casting.
  18  */
  19  class type_cast_helper implements \phpbb\request\type_cast_helper_interface
  20  {
  21  
  22      /**
  23      * @var    string    Whether slashes need to be stripped from input
  24      */
  25      protected $strip;
  26  
  27      /**
  28      * Initialises the type cast helper class.
  29      * All it does is find out whether magic quotes are turned on.
  30      */
  31  	public function __construct()
  32      {
  33          if (version_compare(PHP_VERSION, '5.4.0-dev', '>='))
  34          {
  35              $this->strip = false;
  36          }
  37          else
  38          {
  39              $this->strip = (@get_magic_quotes_gpc()) ? true : false;
  40          }
  41      }
  42  
  43      /**
  44      * Recursively applies addslashes to a variable.
  45      *
  46      * @param    mixed    &$var    Variable passed by reference to which slashes will be added.
  47      */
  48  	public function addslashes_recursively(&$var)
  49      {
  50          if (is_string($var))
  51          {
  52              $var = addslashes($var);
  53          }
  54          else if (is_array($var))
  55          {
  56              $var_copy = $var;
  57              $var = array();
  58              foreach ($var_copy as $key => $value)
  59              {
  60                  if (is_string($key))
  61                  {
  62                      $key = addslashes($key);
  63                  }
  64                  $var[$key] = $value;
  65  
  66                  $this->addslashes_recursively($var[$key]);
  67              }
  68          }
  69      }
  70  
  71      /**
  72      * Recursively applies addslashes to a variable if magic quotes are turned on.
  73      *
  74      * @param    mixed    &$var    Variable passed by reference to which slashes will be added.
  75      */
  76  	public function add_magic_quotes(&$var)
  77      {
  78          if ($this->strip)
  79          {
  80              $this->addslashes_recursively($var);
  81          }
  82      }
  83  
  84      /**
  85      * Set variable $result to a particular type.
  86      *
  87      * @param mixed    &$result        The variable to fill
  88      * @param mixed    $var            The contents to fill with
  89      * @param mixed    $type            The variable type. Will be used with {@link settype()}
  90      * @param bool    $multibyte        Indicates whether string values may contain UTF-8 characters.
  91      *                                 Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks.
  92      * @param bool    $trim            Indicates whether trim() should be applied to string values.
  93      *                                 Default is true.
  94      */
  95  	public function set_var(&$result, $var, $type, $multibyte = false, $trim = true)
  96      {
  97          settype($var, $type);
  98          $result = $var;
  99  
 100          if ($type == 'string')
 101          {
 102              $result = str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result);
 103  
 104              if ($trim)
 105              {
 106                  $result = trim($result);
 107              }
 108  
 109              $result = htmlspecialchars($result, ENT_COMPAT, 'UTF-8');
 110  
 111              if ($multibyte)
 112              {
 113                  $result = utf8_normalize_nfc($result);
 114              }
 115  
 116              if (!empty($result))
 117              {
 118                  // Make sure multibyte characters are wellformed
 119                  if ($multibyte)
 120                  {
 121                      if (!preg_match('/^./u', $result))
 122                      {
 123                          $result = '';
 124                      }
 125                  }
 126                  else
 127                  {
 128                      // no multibyte, allow only ASCII (0-127)
 129                      $result = preg_replace('/[\x80-\xFF]/', '?', $result);
 130                  }
 131              }
 132  
 133              $result = ($this->strip) ? stripslashes($result) : $result;
 134          }
 135      }
 136  
 137      /**
 138      * Recursively sets a variable to a given type using {@link set_var set_var}
 139      *
 140      * @param    string    $var        The value which shall be sanitised (passed by reference).
 141      * @param    mixed    $default    Specifies the type $var shall have.
 142      *                                 If it is an array and $var is not one, then an empty array is returned.
 143      *                                 Otherwise var is cast to the same type, and if $default is an array all
 144      *                                 keys and values are cast recursively using this function too.
 145      * @param    bool    $multibyte    Indicates whether string keys and values may contain UTF-8 characters.
 146      *                                 Default is false, causing all bytes outside the ASCII range (0-127) to
 147      *                                 be replaced with question marks.
 148      * @param    bool    $trim        Indicates whether trim() should be applied to string values.
 149      *                                 Default is true.
 150      */
 151  	public function recursive_set_var(&$var, $default, $multibyte, $trim = true)
 152      {
 153          if (is_array($var) !== is_array($default))
 154          {
 155              $var = (is_array($default)) ? array() : $default;
 156              return;
 157          }
 158  
 159          if (!is_array($default))
 160          {
 161              $type = gettype($default);
 162              $this->set_var($var, $var, $type, $multibyte, $trim);
 163          }
 164          else
 165          {
 166              // make sure there is at least one key/value pair to use get the
 167              // types from
 168              if (empty($default))
 169              {
 170                  $var = array();
 171                  return;
 172              }
 173  
 174              list($default_key, $default_value) = each($default);
 175              $value_type = gettype($default_value);
 176              $key_type = gettype($default_key);
 177  
 178              $_var = $var;
 179              $var = array();
 180  
 181              foreach ($_var as $k => $v)
 182              {
 183                  $this->set_var($k, $k, $key_type, $multibyte);
 184  
 185                  $this->recursive_set_var($v, $default_value, $multibyte, $trim);
 186                  $var[$k] = $v;
 187              }
 188          }
 189      }
 190  }