lepton_secure.php

Go to the documentation of this file.

<?php
 
declare(strict_types=1);
 
class LEPTON_secure extends LEPTON_abstract
{
    //  0.0 Basics
    private $admin_dir = "";
    public static $instance;
    
    //  0.1 Boolean for the "state"
    public $bCalledByModule = false;
    
    //  0.2 For the filepaths
    private $direct_access_allowed = array();
    
    //  0.3 List of allowed fils by default
    private $files_access_allowed = array(
        'backend' => array(
            '/access/index.php',
            '/addons/index.php',
            '/addons/reload.php',
            '/admintools/index.php',
            '/admintools/tool.php',
            '/groups/add.php',
            '/groups/groups.php',
            '/groups/index.php',
            '/groups/save.php',
            '/languages/details.php',
            '/languages/index.php',
            '/languages/install.php',
            '/languages/uninstall.php',
            '/login/index.php',
            '/login/tfa.php',
            '/login/forgot/index.php',
            '/logout/index.php',
            '/media/thumb.php',
            '/modules/details.php',
            '/modules/index.php',
            '/modules/install.php',
            '/modules/manual_install.php',
            '/modules/uninstall.php',
            '/modules/save_permissions.php',
            '/pages/add.php',
            '/pages/delete.php',
            '/pages/empty_trash.php',
            '/pages/index.php',
            '/pages/modify.php',
            '/pages/move_down.php',
            '/pages/move_up.php',
            '/pages/restore.php',
            '/pages/save.php',
            '/pages/sections_save.php',
            '/pages/sections.php',
            '/pages/settings.php',
            '/pages/settings2.php',
            '/preferences/save.php',
            '/settings/ajax_testmail.php',
            '/settings/index.php',
            '/settings/save.php',
            '/start/index.php',
            '/templates/details.php',
            '/templates/index.php',
            '/templates/install.php',
            '/templates/uninstall.php',
            '/users/add.php',
            '/users/index.php',
            '/users/save.php',
            '/users/users.php'
        ),
        'account'   => array(
            '/forgot.php',
            '/login.php',
            '/logout.php',
            '/tfa.php',         
            '/new_password.php',
            '/save_new_password.php',
            '/preferences.php',
            '/signup.php'
        ),
        'modules'   => array(
            '/cronjob.php',     // @ADD_cronjob 20230727, include cronjob file for external call
            '/edit_module_files.php',
            '/menu_link/save.php',
            '/wrapper/save.php',
            '/jsadmin/move_to.php',
            '/lib_search/frontend_result.php'
        )
    );
    
    protected function initialize()
    {
        $fp = fopen( dirname(dirname(__DIR__))."/config/config.php", "r");
        $source = fread($fp, 1024);
        fclose($fp);
        $pattern = "/ADMIN_PATH', LEPTON_PATH\.'(.*?)'\‍);/i";
        $founds = array();
 
        preg_match_all( $pattern, $source, $founds , PREG_SET_ORDER);
    
        if(isset($founds[0][1]))
        {
            self::$instance->admin_dir = $founds[0][1];
        } 
        
        foreach( self::$instance->files_access_allowed as $key => $value)
        {
            $dirname  = ($key == 'backend')
                ? self::$instance->admin_dir
                : "/".$key
                ;
                
            foreach($value as $filename)
            {
                static::$instance->direct_access_allowed[] = $dirname.$filename;
            }
        }
    }
    
    public function accessFiles( $newFileNames = array())
    {
        //  to avoid unexpected results on local windows installations we coerce the backslashes to slashes: 
        $sServerFileName = str_replace("\\", "/",$_SERVER['SCRIPT_FILENAME']);
        if( false !== strpos( $sServerFileName, "modules") )
        {
            $aTerms = explode("/", $sServerFileName);
            $sFolder = array_pop($aTerms);
            $sPrefix = "";
            $iCounter = 0;      // temp. counter var
            $iMaxCounts = 16;   // maximum repeats ... 
            while ($sFolder != "modules")
            {
            
                $sFolder = array_pop($aTerms);      // get the last array element
                $sPrefix = "/".$sFolder.$sPrefix;   // put the element before the existing one
                
                if( ++$iCounter > $iMaxCounts )
                {
                    $sPrefix = "/";
                    break;
                }
            }
        
            foreach($newFileNames as &$ref)
            {
                if($ref[0] != "/")
                {
                    $ref = "/".$ref;
                }
 
                if( false === strpos($ref, $sPrefix))
                {
                    $ref = $sPrefix.$ref;
                }
            }
        }
 
        static::$instance->direct_access_allowed = $newFileNames;
        static::$instance->bCalledByModule = true;
    }
    
    public function getAllowedFiles() {
        return static::$instance->direct_access_allowed;
    }
    
    public function getAdminDir()
    {
        return self::$instance->admin_dir;
    }
    
    public function testFile( string $sFilename = "" ) : bool
    {
        if(!is_string($sFilename)) 
        {
            return false;
        }
        
        if( "" === $sFilename)
        {
            return false;
        }
        
        foreach( static::$instance->direct_access_allowed as $allowed_file)
        {
            if (strpos( $sFilename, $allowed_file) !== false)
            {
                return true;
            }
        }
        return false;
    }
}