-
-
Notifications
You must be signed in to change notification settings - Fork 211
/
class.administration.php
521 lines (453 loc) · 19.7 KB
/
class.administration.php
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
<?php
/**
* @package core
*/
/**
* The Administration class is an instance of Symphony that controls
* all backend pages. These pages are HTMLPages are usually generated
* using XMLElement before being rendered as HTML. These pages do not
* use XSLT. The Administration is only accessible by logged in Authors
*/
class Administration extends Symphony
{
/**
* The path of the current page, ie. '/blueprints/sections/'
* @var string
*/
private $_currentPage = null;
/**
* An associative array of the page's callback, including the keys
* 'driver', which is a lowercase version of `$this->_currentPage`
* with any slashes removed, 'classname', which is the name of the class
* for this page, 'pageroot', which is the root page for the given page, (ie.
* excluding /saved/, /created/ or any sub pages of the current page that are
* handled using the _switchboard function.
*
* @see toolkit.AdministrationPage#__switchboard()
* @var array
*/
private $_callback = null;
/**
* The class representation of the current Symphony backend page,
* which is a subclass of the `HTMLPage` class. Symphony uses a convention
* of prefixing backend page classes with 'content'. ie. 'contentBlueprintsSections'
* @var HTMLPage
*/
public $Page;
/**
* Overrides the default Symphony constructor to add XSRF checking
*/
protected function __construct()
{
parent::__construct();
// Ensure the request is legitimate. RE: #1874
if (self::isXSRFEnabled()) {
XSRF::validateRequest();
}
}
/**
* This function returns an instance of the Administration
* class. It is the only way to create a new Administration, as
* it implements the Singleton interface
*
* @return Administration
*/
public static function instance()
{
if (!(self::$_instance instanceof Administration)) {
self::$_instance = new Administration;
}
return self::$_instance;
}
/**
* Returns the current Page path, excluding the domain and Symphony path.
*
* @return string
* The path of the current page, ie. '/blueprints/sections/'
*/
public function getCurrentPageURL()
{
return $this->_currentPage;
}
/**
* Overrides the Symphony isLoggedIn function to allow Authors
* to become logged into the backend when `$_REQUEST['auth-token']`
* is present. This logs an Author in using the loginFromToken function.
* A token may be 6 or 8 characters in length in the backend. A 6 or 16 character token
* is used for forget password requests, whereas the 8 character token is used to login
* an Author into the page
*
* @see core.Symphony#loginFromToken()
* @return boolean
*/
public static function isLoggedIn()
{
if (isset($_REQUEST['auth-token']) && $_REQUEST['auth-token'] && in_array(strlen($_REQUEST['auth-token']), array(6, 8, 16))) {
return self::loginFromToken($_REQUEST['auth-token']);
}
return parent::isLoggedIn();
}
/**
* Given the URL path of a Symphony backend page, this function will
* attempt to resolve the URL to a Symphony content page in the backend
* or a page provided by an extension. This function checks to ensure a user
* is logged in, otherwise it will direct them to the login page
*
* @param string $page
* The URL path after the root of the Symphony installation, including a starting
* slash, such as '/login/'
* @throws SymphonyErrorPage
* @throws Exception
* @return HTMLPage
*/
private function __buildPage($page)
{
$is_logged_in = self::isLoggedIn();
if (empty($page) || is_null($page)) {
if (!$is_logged_in) {
$page = "/login";
} else {
// Will redirect an Author to their default area of the Backend
// Integers are indicative of section's, text is treated as the path
// to the page after `SYMPHONY_URL`
$default_area = null;
if (is_numeric(Symphony::Author()->get('default_area'))) {
$default_section = SectionManager::fetch(Symphony::Author()->get('default_area'));
if ($default_section instanceof Section) {
$section_handle = $default_section->get('handle');
}
if (!$section_handle) {
$all_sections = SectionManager::fetch();
if (!empty($all_sections)) {
$section_handle = $all_sections[0]->get('handle');
} else {
$section_handle = null;
}
}
if (!is_null($section_handle)) {
$default_area = "/publish/{$section_handle}/";
}
} elseif (!is_null(Symphony::Author()->get('default_area'))) {
$default_area = preg_replace('/^' . preg_quote(SYMPHONY_URL, '/') . '/i', '', Symphony::Author()->get('default_area'));
}
// Fallback: No default area found
if (is_null($default_area)) {
if (Symphony::Author()->isDeveloper()) {
// Redirect to the section index if author is a developer
redirect(SYMPHONY_URL . '/blueprints/sections/');
} else {
// Redirect to the author page if author is not a developer
redirect(SYMPHONY_URL . "/system/authors/edit/".Symphony::Author()->get('id')."/");
}
} else {
redirect(SYMPHONY_URL . $default_area);
}
}
}
if (!$this->_callback = $this->getPageCallback($page)) {
if ($page === '/publish/') {
$sections = SectionManager::fetch(null, 'ASC', 'sortorder');
$section = current($sections);
redirect(SYMPHONY_URL . '/publish/' . $section->get('handle'));
} else {
$this->errorPageNotFound();
}
}
require_once($this->_callback['driver_location']);
$this->Page = new $this->_callback['classname'];
if (!$is_logged_in && $this->_callback['driver'] !== 'login') {
if (is_callable(array($this->Page, 'handleFailedAuthorisation'))) {
$this->Page->handleFailedAuthorisation();
} else {
$this->Page = new contentLogin;
// Include the query string for the login, RE: #2324
if ($queryString = $this->Page->__buildQueryString(array('symphony-page', 'mode'), FILTER_SANITIZE_STRING)) {
$page .= '?' . $queryString;
}
$this->Page->build(array('redirect' => $page));
}
} else {
if (!is_array($this->_callback['context'])) {
$this->_callback['context'] = array();
}
if ($this->__canAccessAlerts()) {
// Can the core be updated?
$this->checkCoreForUpdates();
// Do any extensions need updating?
$this->checkExtensionsForUpdates();
}
$this->Page->build($this->_callback['context']);
}
return $this->Page;
}
/**
* Scan the install directory to look for new migrations that can be applied
* to update this version of Symphony. If one if found, a new Alert is added
* to the page.
*
* @since Symphony 2.5.2
* @return boolean
* Returns true if there is an update available, false otherwise.
*/
public function checkCoreForUpdates()
{
// Is there even an install directory to check?
if ($this->isInstallerAvailable() === false) {
return false;
}
try {
// The updater contains a version higher than the current Symphony version.
if ($this->isUpgradeAvailable()) {
$message = __('An update has been found in your installation to upgrade Symphony to %s.', array($this->getMigrationVersion())) . ' <a href="' . URL . '/install/">' . __('View update.') . '</a>';
// The updater contains a version lower than the current Symphony version.
// The updater is the same version as the current Symphony install.
} else {
$message = __('Your Symphony installation is up to date, but the installer was still detected. For security reasons, it should be removed.') . ' <a href="' . URL . '/install/?action=remove">' . __('Remove installer?') . '</a>';
}
// Can't detect update Symphony version
} catch (Exception $e) {
$message = __('An update script has been found in your installation.') . ' <a href="' . URL . '/install/">' . __('View update.') . '</a>';
}
$this->Page->pageAlert($message, Alert::NOTICE);
return true;
}
/**
* Checks all installed extensions to see any have an outstanding update. If any do
* an Alert will be added to the current page directing the Author to the Extension page
*
* @since Symphony 2.5.2
*/
public function checkExtensionsForUpdates()
{
$extensions = Symphony::ExtensionManager()->listInstalledHandles();
if (is_array($extensions) && !empty($extensions)) {
foreach ($extensions as $name) {
$about = Symphony::ExtensionManager()->about($name);
if (array_key_exists('status', $about) && in_array(EXTENSION_REQUIRES_UPDATE, $about['status'])) {
$this->Page->pageAlert(
__('An extension requires updating.') . ' <a href="' . SYMPHONY_URL . '/system/extensions/">' . __('View extensions') . '</a>'
);
break;
}
}
}
}
/**
* This function determines whether an administrative alert can be
* displayed on the current page. It ensures that the page exists,
* and the user is logged in and a developer
*
* @since Symphony 2.2
* @return boolean
*/
private function __canAccessAlerts()
{
if ($this->Page instanceof AdministrationPage && self::isLoggedIn() && Symphony::Author()->isDeveloper()) {
return true;
}
return false;
}
/**
* This function resolves the string of the page to the relevant
* backend page class. The path to the backend page is split on
* the slashes and the resulting pieces used to determine if the page
* is provided by an extension, is a section (index or entry creation)
* or finally a standard Symphony content page. If no page driver can
* be found, this function will return false.
*
* @uses AdminPagePostCallback
* @param string $page
* The full path (including the domain) of the Symphony backend page
* @return array|boolean
* If successful, this function will return an associative array that at the
* very least will return the page's classname, pageroot, driver, driver_location
* and context, otherwise this will return false.
*/
public function getPageCallback($page = null)
{
if (!$page && $this->_callback) {
return $this->_callback;
} elseif (!$page && !$this->_callback) {
trigger_error(__('Cannot request a page callback without first specifying the page.'));
}
$this->_currentPage = SYMPHONY_URL . preg_replace('/\/{2,}/', '/', $page);
$bits = preg_split('/\//', trim($page, '/'), 3, PREG_SPLIT_NO_EMPTY);
$callback = array(
'driver' => null,
'driver_location' => null,
'context' => array(),
'classname' => null,
'pageroot' => null
);
// Login page, /symphony/login/
if ($bits[0] === 'login') {
$callback['driver'] = 'login';
$callback['driver_location'] = CONTENT . '/content.login.php';
$callback['classname'] = 'contentLogin';
$callback['pageroot'] = '/login/';
// Extension page, /symphony/extension/{extension_name}/
} elseif ($bits[0] === 'extension' && isset($bits[1])) {
$extension_name = $bits[1];
$bits = preg_split('/\//', trim($bits[2], '/'), 2, PREG_SPLIT_NO_EMPTY);
// check if extension is enabled, if it's not, pretend the extension doesn't
// even exist. #2367
if (!ExtensionManager::isInstalled($extension_name)) {
return false;
}
$callback['driver'] = 'index';
$callback['classname'] = 'contentExtension' . ucfirst($extension_name) . 'Index';
$callback['pageroot'] = '/extension/' . $extension_name. '/';
$callback['extension'] = $extension_name;
if (isset($bits[0])) {
$callback['driver'] = $bits[0];
$callback['classname'] = 'contentExtension' . ucfirst($extension_name) . ucfirst($bits[0]);
$callback['pageroot'] .= $bits[0] . '/';
}
if (isset($bits[1])) {
$callback['context'] = preg_split('/\//', $bits[1], -1, PREG_SPLIT_NO_EMPTY);
}
$callback['driver_location'] = EXTENSIONS . '/' . $extension_name . '/content/content.' . $callback['driver'] . '.php';
// Extensions won't be part of the autoloader chain, so first try to require them if they are available.
if (!is_file($callback['driver_location'])) {
return false;
} else {
require_once $callback['driver_location'];
}
// Publish page, /symphony/publish/{section_handle}/
} elseif ($bits[0] === 'publish') {
if (!isset($bits[1])) {
return false;
}
$callback['driver'] = 'publish';
$callback['driver_location'] = CONTENT . '/content.publish.php';
$callback['pageroot'] = '/' . $bits[0] . '/' . $bits[1] . '/';
$callback['classname'] = 'contentPublish';
// Everything else
} else {
$callback['driver'] = ucfirst($bits[0]);
$callback['pageroot'] = '/' . $bits[0] . '/';
if (isset($bits[1])) {
$callback['driver'] = $callback['driver'] . ucfirst($bits[1]);
$callback['pageroot'] .= $bits[1] . '/';
}
$callback['classname'] = 'content' . $callback['driver'];
$callback['driver'] = strtolower($callback['driver']);
$callback['driver_location'] = CONTENT . '/content.' . $callback['driver'] . '.php';
}
// Parse the context
if (isset($callback['classname'])) {
$page = new $callback['classname'];
// Named context
if (method_exists($page, 'parseContext')) {
$page->parseContext($callback['context'], $bits);
// Default context
} elseif (isset($bits[2])) {
$callback['context'] = preg_split('/\//', $bits[2], -1, PREG_SPLIT_NO_EMPTY);
}
}
/**
* Immediately after determining which class will resolve the current page, this
* delegate allows extension to modify the routing or provide additional information.
*
* @since Symphony 2.3.1
* @delegate AdminPagePostCallback
* @param string $context
* '/backend/'
* @param string $page
* The current URL string, after the SYMPHONY_URL constant (which is `/symphony/`
* at the moment.
* @param array $parts
* An array representation of `$page`
* @param array $callback
* An associative array that contains `driver`, `pageroot`, `classname` and
* `context` keys. The `driver_location` is the path to the class to render this
* page, `driver` should be the view to render, the `classname` the name of the
* class, `pageroot` the rootpage, before any extra URL params and `context` can
* provide additional information about the page
*/
Symphony::ExtensionManager()->notifyMembers('AdminPagePostCallback', '/backend/', array(
'page' => $this->_currentPage,
'parts' => $bits,
'callback' => &$callback
));
if (!isset($callback['driver_location']) || !is_file($callback['driver_location'])) {
return false;
}
return $callback;
}
/**
* Called by index.php, this function is responsible for rendering the current
* page on the Frontend. Two delegates are fired, AdminPagePreGenerate and
* AdminPagePostGenerate. This function runs the Profiler for the page build
* process.
*
* @uses AdminPagePreBuild
* @uses AdminPagePreGenerate
* @uses AdminPagePostGenerate
* @see core.Symphony#__buildPage()
* @see boot.getCurrentPage()
* @param string $page
* The result of getCurrentPage, which returns the $_GET['symphony-page']
* variable.
* @throws Exception
* @throws SymphonyErrorPage
* @return string
* The HTML of the page to return
*/
public function display($page)
{
Symphony::Profiler()->sample('Page build process started');
/**
* Immediately before building the admin page. Provided with the page parameter
* @delegate AdminPagePreBuild
* @since Symphony 2.6.0
* @param string $context
* '/backend/'
* @param string $page
* The result of getCurrentPage, which returns the $_GET['symphony-page']
* variable.
*/
Symphony::ExtensionManager()->notifyMembers('AdminPagePreBuild', '/backend/', array('page' => $page));
$this->__buildPage($page);
// Add XSRF token to form's in the backend
if (self::isXSRFEnabled() && isset($this->Page->Form)) {
$this->Page->Form->prependChild(XSRF::formToken());
}
/**
* Immediately before generating the admin page. Provided with the page object
* @delegate AdminPagePreGenerate
* @param string $context
* '/backend/'
* @param HTMLPage $oPage
* An instance of the current page to be rendered, this will usually be a class that
* extends HTMLPage. The Symphony backend uses a convention of contentPageName
* as the class that extends the HTMLPage
*/
Symphony::ExtensionManager()->notifyMembers('AdminPagePreGenerate', '/backend/', array('oPage' => &$this->Page));
$output = $this->Page->generate();
/**
* Immediately after generating the admin page. Provided with string containing page source
* @delegate AdminPagePostGenerate
* @param string $context
* '/backend/'
* @param string $output
* The resulting backend page HTML as a string, passed by reference
*/
Symphony::ExtensionManager()->notifyMembers('AdminPagePostGenerate', '/backend/', array('output' => &$output));
Symphony::Profiler()->sample('Page built');
return $output;
}
/**
* If a page is not found in the Symphony backend, this function should
* be called which will raise a customError to display the default Symphony
* page not found template
*/
public function errorPageNotFound()
{
$this->throwCustomError(
__('The page you requested does not exist.'),
__('Page Not Found'),
Page::HTTP_STATUS_NOT_FOUND
);
}
}