lepton_core.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
class LEPTON_core extends LEPTON_securecms
{
    use LEPTON_singleton;
 
    public static $instance;
 
    public string $string_secure = 'a-zA-Z0-9\-_\.';
 
    public string $password_chars = 'a-zA-Z0-9\_\-\!\$\ย\ง\#\*\+';
 
    public string $email_chars = 'a-zA-Z0-9@\_\-\.';
 
    public string $username_chars = 'a-zA-Z0-9@ \_\-,\.';
    
    public string $hex_chars = 'a-fA-F0-9\-';
    
    public static array $HEADERS = [
            'frontend' => [
                'css' => [],
                'js' => []
            ],
            'backend' => [
                'css' => [],
                'js' => []
            ]
        ];
 
    public static array $FOOTERS = [
            'frontend' => [
                'css' => [],
                'js' => []
            ],
            'backend' => [
                'css' => [],
                'js' => []
            ]
        ];
    
    public static bool $bUserGotAdminRights = false;
    
    public function __construct()
    {
        
    }
    
    public function page_is_visible( $page ): bool
    {
        // First check if visibility is 'none', 'deleted'
 
        $show_it = false;
        switch ($page['visibility'])
        {
            case 'hidden':
            case 'public':
                $show_it = true;
                break;
 
            case 'private':
            case 'registered':
                if ($this->is_authenticated() === true)
                {
                    $show_it = ($this->is_group_match($this->getValue('groups_id', 'string', 'session',','), $page['viewing_groups']) );
                }
                break;
 
            case 'none':
            case 'deleted':
            default:
                $show_it = false;
                break;                
        }
 
        return ($show_it);
    }
    
    public function section_is_active(int $section_id): bool
    {
        $now = time();
        $sql = "
            SELECT COUNT(*) 
            FROM    `" . TABLE_PREFIX . "sections` 
            WHERE   (" . $now . " BETWEEN `publ_start` AND `publ_end`) 
                OR  (" . $now . " > `publ_start` AND `publ_end`=0) 
                AND `section_id`=" . $section_id;
 
        return (LEPTON_database::getInstance()->get_one($sql) > 0);
    }
 
    public function page_is_active(array $page ): bool
    {
        $now = time();
        $sql = "
            SELECT COUNT(*) 
            FROM `".TABLE_PREFIX."sections` 
            WHERE `page_id` = ".$page['page_id']." 
            AND (".$now." BETWEEN `publ_start` AND `publ_end` OR (".$now." > `publ_start` AND `publ_end`= 0))
        ";
             
        return (LEPTON_database::getInstance()->get_one($sql) > 0 );
    }
 
    public function show_page(array|null $page ): bool
    {
        if (!is_array($page))
        {
            $page = [];
            LEPTON_database::getInstance()->execute_query(
                "SELECT `page_id`, `visibility` FROM `" . TABLE_PREFIX . "pages` WHERE `page_id`=" . (int) $page,
                true, 
                $page,
                false
            );
            
            if (empty($page))
            {
                return false;
            }
        }
        return ($this->page_is_visible($page) && $this->page_is_active($page));
    }
 
    // Check if the user is already authenticated or not
    public function is_authenticated(): bool
    {
        return (    (isset( $_SESSION[ 'USER_ID' ] ) )      // gesetzt
                &&  ($_SESSION[ 'USER_ID' ] != "")          // nicht leer
                &&  (is_numeric( $_SESSION[ 'USER_ID' ] ) ) // eine Zahl
        );
    }
 
    public function buildPageLink(string $link): string
    {
        // Check for :// in the link (used in URL's) as well as mailto:
        if (strstr($link, '://') == '' && !str_starts_with($link, 'mailto:'))
        {
            return LEPTON_URL . PAGES_DIRECTORY . $link . PAGE_EXTENSION;
        }
        else
        {
            return $link;
        }
    }
    
    // @ADD_method 20230907: for use instead of old marked deprecated methods
    public static function getValue(
        string $lookForName,
        string $type = "string_clean",
        string $requestFrom = "post",
        string $dividerString = "X"
    ): string|int|array|null
    {
        // $_SESSION keys are always upper case
        if ($requestFrom == 'session')
        {
            $lookForName = strtoupper($lookForName);
        }
 
        LEPTON_request::getInstance()->setStrictLookInside($requestFrom);
        $aField = [ $lookForName    => ['type' => $type, 'default' => null] ];
        $sTested = LEPTON_request::getInstance()->testValues($aField);
 
        // make sure, that array that are comma seperated strings are exploded
        if ($dividerString != 'X')
        {
            if (!is_array($sTested[$lookForName]))
            {
                $sTested[$lookForName] = explode($dividerString, $sTested[$lookForName] ?? "");
            } else {
                foreach ($sTested[$lookForName] as &$item)
                {
                    $item = explode($dividerString, $item ?? "");
                }
            }
        }
        return $sTested[$lookForName];
    }
 
    public function is_group_match(int|string|array $groups_list1 = '', int|string|array $groups_list2 = ''): bool
    {
        if ($groups_list1 == '')
        {
            return false;
        }
        if ($groups_list2 == '')
        {
            return false;
        }
        if (!is_array($groups_list1))
        {
            $groups_list1 = explode( ',', $groups_list1 );
        }
        if (!is_array($groups_list2))
        {
            $groups_list2 = explode( ',', $groups_list2 );
        }
 
        return (sizeof(array_intersect($groups_list1, $groups_list2)) != 0);
    }
 
    public static function addItems(string $for = 'frontend', string $path = LEPTON_PATH, bool $footer = false): void
    {
        $trail = explode('/', $path);
        $subdir = array_pop($trail);
    
        $mod_headers = [];
        $mod_footers = [];
 
        if ($footer)
        {
            $add_to = &self::$FOOTERS;
            $to_load = 'footers.inc.php';
        }
        else
        {
            $add_to = &self::$HEADERS;
            $to_load = 'headers.inc.php';
        }
 
        require $path.'/'.$to_load;
 
        if (true === $footer)
        { 
            $aRefArray = &$mod_footers;
        }
        else
        {
            $aRefArray = &$mod_headers;
        }
 
        if (count($aRefArray))
        {
            foreach (['css', 'js'] as $key)
            {
                if (!isset($aRefArray[$for][$key]))
                {
                    continue;
                }
                foreach ($aRefArray[$for][$key] as &$item)
                {
                    // let's see if the path is relative (i.e., does not contain the current subdir)
                    if ((isset($item['file']))
                        && (!preg_match("#/$subdir/#", $item['file']))
                        && (file_exists($path.'/'.$item['file']))
                    )
                    {
                        // treat path as relative, add modules subfolder
                        $item['file'] = str_ireplace(LEPTON_PATH, '', $path).'/'.$item['file'];
                    }
                    
                    $is_ok = true;
                    if ($key === "css") {
                        foreach ($add_to[$for][$key] as $temp_ref)
                        {
                            if ($temp_ref['file'] == $item['file'])
                            {
                                $is_ok = false;
                            }
                        }
                    } elseif ($key === "js")
                    {
                        foreach ($add_to[$for][$key] as $temp_ref)
                        {
                            if ($item === $temp_ref)
                            {
                                $is_ok = false;
                            }
                        }
                    
                    }
 
                    if (true === $is_ok)
                    {
                        $add_to[$for][$key][] = $item;
                    }
                }
            }
        }
 
        if ($footer && file_exists($path.$for.'_body.js'))
        {
            $add_to[$for]['js'][] = '/modules/'.$subdir.'_body.js';
        }
        
    }
 
    public function getProtectedFunctions(string &$html, object &$oReference): void
    {
        $this->addLepToken($html, $oReference);
    }
 
    protected function addLepToken(string &$html, object &$oReference): void
    {
        if (!LEPTOKEN_LIFETIME)
        {
            return;
        }
 
        $token = $oReference->createLepToken();
 
        $token1      = "$1?leptoken=".$token."$3"; // no parameters so far
        $token2      = "leptoken=".$token; // for replacing placeholder in JS functions
        $token3      = "$1&leptoken=".$token."$3"; // with existing parameters, produces html-valid code
        $token4      = "$1?leptoken=".$token."$2"; // for special cases
        $hiddentoken = "$1\n<span><input type='hidden' name='leptoken' value='".$token."' /></span>\n"; // for GET forms, add a hidden field too
 
        // finds absolute Links with Parameter:
        $qs   = '~((href|action|window\.location)\s?=\s?[\'"]' . LEPTON_URL . '[\w\-\./]+\.php\?[\w\-\.=&%;/]+)([#[\w]*]?[\'"])~';
        $html = preg_replace( $qs, $token3, $html, -1 );
 
        // finds absolute Links without Parameter:
        $qs   = '~((href|action|ajaxfilemanagerurl|window\.location)\s?=\s?[\'"]' . LEPTON_URL . '[\w\-\./]+\.php)([#[\w]*]?[\'"])~';
        $html = preg_replace( $qs, $token1, $html, -1 );
 
        // finds relative Links with Parameter:
        $qs   = '~((href|action|window\.location)\s?=\s?[\'"][\w/]+\.php\?[\w\-\.=%&;/]+)([#[\w]*]?[\'"])~';
        $html = preg_replace( $qs, $token3, $html, -1 );
 
        // finds relative Links without Parameter:
        $qs   = '~((href|action|window\.location)\s?=\s?[\'"][\w/]+\.php)([#[\w]*]?[\'"])~';
        $html = preg_replace( $qs, $token1, $html, -1 );
 
        // finds Start page without Parameter:
        $qs   = '~(href\s?=\s?[\'"]' . LEPTON_URL . ')([\'"])~';
        $html = preg_replace( $qs, $token4, $html, -1 );
 
        // finds Testmail in Options:
        $qs   = '~(send_testmail\‍(\'' . ADMIN_URL . '/settings/ajax_testmail\.php)(\'\‍))~';
        $html = preg_replace( $qs, $token4, $html, -1 );
 
        // finds forms with method=get and adds a hidden field
        $qs   = '~(<form\s+action=[\'"][\w:\.\?/]+leptoken=\w{32}[\'"]\s+method=[\'"]get[\'"]\s*>)~';
        $html = preg_replace( $qs, $hiddentoken, $html, -1 );
 
        // set leptoken in JS functions
        $qs   = '~leptokh=#-!leptoken-!#~';
        $html = preg_replace( $qs, $token2, $html, -1 );    
    }
 
 
    static public function make_dir(string $dir_name, string $dir_mode = NULL): bool
    {
        if ($dir_mode == NULL)
        {
            $dir_mode = (int) octdec( STRING_DIR_MODE );
        }
        
        if (!is_dir($dir_name))
        {
            $umask = umask(); // get current mask
            mkdir($dir_name, $dir_mode, true);
            umask($umask);
            return true;
        }
        return false;
    }
 
    static public function change_mode(string $name ): bool
    {
        if (OPERATING_SYSTEM != 'windows')
        {
            $mode = (is_dir($name)) ? (int)octdec(STRING_DIR_MODE) : (int)octdec(STRING_FILE_MODE);
            if (file_exists($name))
            {
                $umask = umask();       // get current
                chmod($name, $mode);
                umask($umask);
                return true;
            }
            else
            {
                return false;
            }
        }
        else
        {
            return true;
        }
    }
 
 
    static public function create_access_file(string $filename, int $page_id): bool
    {
        global $admin, $MESSAGE;
        $pages_path = LEPTON_PATH . PAGES_DIRECTORY;
        $rel_pages_dir = str_replace($pages_path, '', dirname($filename));
        $rel_filename = str_replace($pages_path, '', $filename);
        // root_check prevent system directories and important files from being overwritten if PAGES_DIR = '/'
        $denied = false;
        if (PAGES_DIRECTORY == '')
        {
            $forbidden = [
                'account',
                'admins',
                'framework',
                'include',
                'install',
                'languages',
                'media',
                'modules',
                'page',
                'search',
                'temp',
                'templates',
                'index.php',
                '/config/config.php'
            ];
            $search = explode('/', $rel_filename);
            // we need only the first level
            $denied = in_array($search[1], $forbidden);
        }
        if ((true === is_writable($pages_path)) && (false === $denied))
        {
            // First make sure parent folder exists
            $parent_folders = explode('/', $rel_pages_dir);
            $parents = '';
            foreach ($parent_folders as $parent_folder)
            {
                if ($parent_folder != '/' && $parent_folder != '')
                {
                    $parents .= '/' . $parent_folder;
                    if (!file_exists($pages_path . $parents))
                    {
                        LEPTON_core::make_dir( $pages_path . $parents );
                        LEPTON_core::change_mode( $pages_path . $parents );
                    }
                }
            }
            $step_back = str_repeat('../', substr_count($rel_pages_dir, '/') + (PAGES_DIRECTORY == "" ? 0 : 1));
            $content   = '<?php' . "\n";
            $content .= "/**\n *\tThis file is autogenerated by LEPTON - Version: ".LEPTON_VERSION."\n";
            $content .= " *\tDo not modify this file!\n */\n";
            $content .= "\t" . '$page_id = ' . $page_id . ';' . "\n";
            $content .= "\t" . 'require_once(\'' . $step_back . 'index.php\');' . "\n";
 
            $fp = fopen($filename, 'w');
            if ($fp)
            {
                fwrite($fp, $content, strlen($content));
                fclose($fp);
                LEPTON_core::change_mode($filename);
                $temp_index_path = dirname($filename)."/index.php";
                if (!file_exists($temp_index_path))
                {
                    $origin = ADMIN_PATH."/pages/master_index.php";
                    if (file_exists($origin))
                    {
                        copy($origin, $temp_index_path);
                    }
                }
            }
            else
            {
                $admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']."<br />Problems while trying to open the file!");
                return false;
            }
            return true;
        }
        else
        {
            $admin->print_error($MESSAGE['PAGES_CANNOT_CREATE_ACCESS_FILE']);
            return false;
        }
    }
 
    static public function level_count(int $iPageId ): int
    {
        $database = LEPTON_database::getInstance();
        // Get page parent
        $iParent = $database->get_one('SELECT `parent` FROM `'.TABLE_PREFIX.'pages` WHERE `page_id` = '.$iPageId);
        if ($iParent > 0)
        {
            // Get the level of the parent
            $iLevel = $database->get_one('SELECT `level` FROM `'.TABLE_PREFIX.'pages` WHERE `page_id` = '.$iParent);
            return $iLevel + 1;
        }
        else
        {
            return 0;
        }
    }
 
 
    static public function get_subs(int $parent, array &$subs): void
    {
        $database = LEPTON_database::getInstance();
 
        // Get id's
        $all = [];
        $database->execute_query(
            "SELECT page_id FROM ".TABLE_PREFIX."pages WHERE parent = ".$parent." ORDER BY position",
            true,
            $all,
            true
        );
 
        foreach ($all as &$fetch)
        {
            $subs[] = $fetch['page_id'];
 
            // Get subs of this sub - recursive call!
            self::get_subs($fetch['page_id'], $subs);
        }
    }
 
 
    static public function delete_page(int $page_id): void
    {
        $database = LEPTON_database::getInstance();
        $admin = self::getGlobal('admin');
        $MESSAGE = self::getGlobal('MESSAGE');
        $section_id = self::getGlobal('section_id');
 
        LEPTON_handle::register("rm_full_dir");
        
        // Find out more about the page
        $page_info = [];
        $database->execute_query(
            'SELECT link, parent FROM '.TABLE_PREFIX.'pages WHERE page_id = '.$page_id,
            true,
            $page_info,
            false
        );
 
        if (empty($page_info))
        {
            $admin->print_error($MESSAGE['PAGES_NOT_FOUND']);
        }
 
        // Get the sections that belong to the page
        $all_sections = [];
        $database->execute_query(
            'SELECT section_id, module FROM '.TABLE_PREFIX.'sections WHERE page_id = '.$page_id,
            true,
            $all_sections
        );
 
        foreach($all_sections as &$section)
        {
            // Set section id
            $section_id = $section['section_id'];
 
            // Include the modules delete file if it exists
            if (file_exists(LEPTON_PATH.'/modules/'.$section['module'].'/delete.php'))
            {
                include LEPTON_PATH.'/modules/'.$section['module'].'/delete.php';
            }
        }
        
        // Update the pages table
        $database->simple_query("DELETE FROM ".TABLE_PREFIX."pages WHERE page_id = ".$page_id);
        
        // Update the sections table
        $database->simple_query("DELETE FROM ".TABLE_PREFIX."sections WHERE page_id = ".$page_id);
 
        // Include the ordering class or clean-up ordering
        $order = LEPTON_order::getInstance(TABLE_PREFIX.'pages', 'position', 'page_id', 'parent');
        $order->clean($page_info['parent']);
 
        // Unlink the page access file and directory
        $directory = LEPTON_PATH . PAGES_DIRECTORY . $page_info['link'];
        $filename  = $directory . PAGE_EXTENSION;
        $directory .= '/';
        if (file_exists($filename))
        {
            if (!is_writable(LEPTON_PATH . PAGES_DIRECTORY . '/'))
            {
                $admin->print_error($MESSAGE['PAGES_CANNOT_DELETE_ACCESS_FILE']);
            }
            else
            {
                unlink($filename);
                if (file_exists($directory) && (rtrim($directory, '/') != LEPTON_PATH . PAGES_DIRECTORY) && ($page_info['link'][0] != '.'))
                {
                    rm_full_dir($directory);
                }
            }
        }
    }
 
    static public function getGlobal(string $name): null|int|string|array|object
    {
        $returnValue = null;
        if (isset($GLOBALS[$name]))
        {
            $returnValue = &$GLOBALS[$name];
        }
        return $returnValue;
    }
 
    static function registerBasicFunctions(): void
    {
        $functionListToRegister = [
            "get_page_headers",
            "get_page_footers",
            "page_content",
            "easymultilang_menu"
        ];
 
        LEPTON_handle::register($functionListToRegister);
    }
 
    static function loadCodeSnippets(): void
    {
        $snippets = [];
        LEPTON_database::getInstance()->execute_query(
            "SELECT `directory` FROM `".TABLE_PREFIX."addons` WHERE `function` = 'snippet'",
            true,
            $snippets,
            true
        );
 
        foreach ($snippets as $snippet)
        {
            $tempPath = LEPTON_PATH."/modules/".$snippet['directory']."/include.php";
            if (file_exists($tempPath))
            {
                require $tempPath;
            }
        }
    }
 
    static public function check_entry(string $value): bool
    {
        // get all keepouts
        $all_entries = [];
        LEPTON_database::getInstance()->execute_query(
            "SELECT * FROM ".TABLE_PREFIX."keepout ORDER BY id DESC",
            true,
            $all_entries,
            true
        );
 
        if (!empty($all_entries))
        {
            foreach ($all_entries as $check)
            {
                if (str_contains($check['email'], '*'))
                {
                    $check_email = str_replace('*','',$check['email']);
                    if (str_contains($value, $check_email))
                    {
                        return true;
                    }
                }
 
                if ($value == $check['ip'] || $value == $check['email'])
                {
                    return true;
                }
            }
            return false;
        }
        return false;
    }
    
    static public function userHasAdminRights(): bool
    {
        if (self::$bUserGotAdminRights == false)
        {
            //  Current user has admin rights?
            $aUser = explode(",", ($_SESSION['GROUPS_ID'] ?? ""));
            self::$bUserGotAdminRights = (in_array(1, $aUser));
        }
 
        return self::$bUserGotAdminRights;
    }
 
    static public function imageTypesAllowed(): array
    {
        $aWhiteList = explode(',', UPLOAD_WHITELIST);
        $aImageTypes = lib_r_filemanager::allowed_image_types;
 
        return array_merge(array_intersect($aWhiteList, $aImageTypes), []);
    }
 
}