oxutilsserver.php

Go to the documentation of this file.

<?php

class oxUtilsServer extends oxSuperCfg
{

    protected $_aUserCookie = array();

    protected $_sSessionCookiesName = 'aSessionCookies';

    protected $_sSessionCookies = array();

    public function setOxCookie($sName, $sValue = "", $iExpire = 0, $sPath = '/', $sDomain = null, $blToSession = true, $blSecure = false)
    {
        //TODO: since setcookie takes more than just 4 params..
        // would be nice to have it sending through https only, if in https mode
        // or allowing only http access to cookie [no JS access - reduces XSS attack possibility]
        // ref: http://lt.php.net/manual/en/function.setcookie.php

        if ($blToSession && !$this->isAdmin()) {
            $this->_saveSessionCookie($sName, $sValue, $iExpire, $sPath, $sDomain);
        }

        if (defined('OXID_PHP_UNIT')) {
            // do NOT set cookies in php unit.
            return;
        }

        return setcookie(
            $sName,
            $sValue,
            $iExpire,
            $this->_getCookiePath($sPath),
            $this->_getCookieDomain($sDomain),
            $blSecure,
            true
        );
    }

    protected $_blSaveToSession = null;

    protected function _mustSaveToSession()
    {
        if ($this->_blSaveToSession === null) {
            $this->_blSaveToSession = false;

            $myConfig = $this->getConfig();
            if ($sSslUrl = $myConfig->getSslShopUrl()) {
                $sUrl = $myConfig->getShopUrl();

                $sHost = parse_url($sUrl, PHP_URL_HOST);
                $sSslHost = parse_url($sSslUrl, PHP_URL_HOST);

                // testing if domains matches..
                if ($sHost != $sSslHost) {
                    $oUtils = oxRegistry::getUtils();
                    $this->_blSaveToSession = $oUtils->extractDomain($sHost) != $oUtils->extractDomain($sSslHost);
                }
            }
        }

        return $this->_blSaveToSession;
    }

    protected function _getSessionCookieKey($blGet)
    {
        $blSsl = $this->getConfig()->isSsl();
        $sKey = $blSsl ? 'nossl' : 'ssl';

        if ($blGet) {
            $sKey = $blSsl ? 'ssl' : 'nossl';
        }

        return $sKey;
    }

    protected function _saveSessionCookie($sName, $sValue, $iExpire, $sPath, $sDomain)
    {
        if ($this->_mustSaveToSession()) {
            $aCookieData = array('value' => $sValue, 'expire' => $iExpire, 'path' => $sPath, 'domain' => $sDomain);

            $aSessionCookies = ( array ) oxRegistry::getSession()->getVariable($this->_sSessionCookiesName);
            $aSessionCookies[$this->_getSessionCookieKey(false)][$sName] = $aCookieData;

            oxRegistry::getSession()->setVariable($this->_sSessionCookiesName, $aSessionCookies);
        }
    }

    public function loadSessionCookies()
    {
        if (($aSessionCookies = oxRegistry::getSession()->getVariable($this->_sSessionCookiesName))) {
            $sKey = $this->_getSessionCookieKey(true);
            if (isset($aSessionCookies[$sKey])) {
                // writing session data to cookies
                foreach ($aSessionCookies[$sKey] as $sName => $aCookieData) {
                    $this->setOxCookie($sName, $aCookieData['value'], $aCookieData['expire'], $aCookieData['path'], $aCookieData['domain'], false);
                    $this->_sSessionCookies[$sName] = $aCookieData['value'];
                }

                // cleanup
                unset($aSessionCookies[$sKey]);
                oxRegistry::getSession()->setVariable($this->_sSessionCookiesName, $aSessionCookies);
            }
        }
    }

    protected function _getCookiePath($sPath)
    {
        if ($aCookiePaths = $this->getConfig()->getConfigParam('aCookiePaths')) {
            // in case user wants to have shop specific setup
            $sShopId = $this->getConfig()->getShopId();
            $sPath = isset($aCookiePaths[$sShopId]) ? $aCookiePaths[$sShopId] : $sPath;
        }

        // from php doc: .. You may also replace an argument with an empty string ("") in order to skip that argument..
        return $sPath ? $sPath : "";
    }

    protected function _getCookieDomain($sDomain)
    {
        $sDomain = $sDomain ? $sDomain : "";

        // on special cases, like separate domain for SSL, cookies must be defined on domain specific path
        // please have a look at
        if (!$sDomain) {
            if ($aCookieDomains = $this->getConfig()->getConfigParam('aCookieDomains')) {
                // in case user wants to have shop specific setup
                $sShopId = $this->getConfig()->getShopId();
                $sDomain = isset($aCookieDomains[$sShopId]) ? $aCookieDomains[$sShopId] : $sDomain;
            }
        }

        return $sDomain;
    }

    public function getOxCookie($sName = null)
    {
        $sValue = null;
        if ($sName && isset($_COOKIE[$sName])) {
            $sValue = oxRegistry::getConfig()->checkParamSpecialChars($_COOKIE[$sName]);
        } elseif ($sName && !isset($_COOKIE[$sName])) {
            $sValue = isset($this->_sSessionCookies[$sName]) ? $this->_sSessionCookies[$sName] : null;
        } elseif (!$sName && isset($_COOKIE)) {
            $sValue = $_COOKIE;
        }

        return $sValue;
    }

    public function getRemoteAddress()
    {
        if (isset($_SERVER["HTTP_X_FORWARDED_FOR"])) {
            $sIP = $_SERVER["HTTP_X_FORWARDED_FOR"];
            $sIP = preg_replace('/,.*$/', '', $sIP);
        } elseif (isset($_SERVER["HTTP_CLIENT_IP"])) {
            $sIP = $_SERVER["HTTP_CLIENT_IP"];
        } else {
            $sIP = $_SERVER["REMOTE_ADDR"];
        }

        return $sIP;
    }

    public function getServerVar($sServVar = null)
    {
        $sValue = null;
        if (isset($_SERVER)) {
            if ($sServVar && isset($_SERVER[$sServVar])) {
                $sValue = $_SERVER[$sServVar];
            } elseif (!$sServVar) {
                $sValue = $_SERVER;
            }
        }

        return $sValue;
    }

    public function setUserCookie($sUser, $sPassword, $sShopId = null, $iTimeout = 31536000, $sSalt = 'ox')
    {
        $myConfig = $this->getConfig();
        $sShopId = (!$sShopId) ? $myConfig->getShopId() : $sShopId;
        $sSslUrl = $myConfig->getSslShopUrl();
        if (stripos($sSslUrl, 'https') === 0) {
            $blSsl = true;
        } else {
            $blSsl = false;
        }

        $this->_aUserCookie[$sShopId] = $sUser . '@@@' . crypt($sPassword, $sSalt);
        $this->setOxCookie('oxid_' . $sShopId, $this->_aUserCookie[$sShopId], oxRegistry::get("oxUtilsDate")->getTime() + $iTimeout, '/', null, true, $blSsl);
        $this->setOxCookie('oxid_' . $sShopId . '_autologin', '1', oxRegistry::get("oxUtilsDate")->getTime() + $iTimeout, '/', null, true, false);
    }

    public function deleteUserCookie($sShopId = null)
    {
        $myConfig = $this->getConfig();
        $sShopId = (!$sShopId) ? $this->getConfig()->getShopId() : $sShopId;
        $sSslUrl = $myConfig->getSslShopUrl();
        if (stripos($sSslUrl, 'https') === 0) {
            $blSsl = true;
        } else {
            $blSsl = false;
        }

        $this->_aUserCookie[$sShopId] = '';
        $this->setOxCookie('oxid_' . $sShopId, '', oxRegistry::get("oxUtilsDate")->getTime() - 3600, '/', null, true, $blSsl);
        $this->setOxCookie('oxid_' . $sShopId . '_autologin', '0', oxRegistry::get("oxUtilsDate")->getTime() - 3600, '/', null, true, false);
    }

    public function getUserCookie($sShopId = null)
    {
        $myConfig = parent::getConfig();
        $sShopId = (!$sShopId) ? $myConfig->getShopId() : $sShopId;
        // check for SSL connection
        if (!$myConfig->isSsl() && $this->getOxCookie('oxid_' . $sShopId . '_autologin') == '1') {
            $sSslUrl = rtrim($myConfig->getSslShopUrl(), '/') . $_SERVER['REQUEST_URI'];
            if (stripos($sSslUrl, 'https') === 0) {
                oxRegistry::getUtils()->redirect($sSslUrl, true, 302);
            }
        }

        if (array_key_exists($sShopId, $this->_aUserCookie) && $this->_aUserCookie[$sShopId] !== null) {
            return $this->_aUserCookie[$sShopId] ? $this->_aUserCookie[$sShopId] : null;
        }

        return $this->_aUserCookie[$sShopId] = $this->getOxCookie('oxid_' . $sShopId);
    }

    public function isTrustedClientIp()
    {
        $blTrusted = false;
        $aTrustedIPs = ( array ) $this->getConfig()->getConfigParam("aTrustedIPs");
        if (count($aTrustedIPs)) {
            $blTrusted = in_array($this->getRemoteAddress(), $aTrustedIPs);
        }

        return $blTrusted;
    }

    public function processUserAgentInfo($sAgent)
    {
        if ($sAgent) {
            $sAgent = getStr()->preg_replace("/MSIE(\s)?(\S)*(\s)/", "", (string) $sAgent);
        }

        return $sAgent;
    }

    public function isCurrentUrl($sURL)
    {
        // Missing protocol, cannot proceed, assuming true.
        if (!$sURL || (strpos($sURL, "http") !== 0)) {
            return true;
        }

        $sServerHost = $this->getServerVar('HTTP_HOST');
        $blIsCurrentUrl = $this->_isCurrentUrl($sURL, $sServerHost);
        if (!$blIsCurrentUrl) {
            $sServerHost = $this->getServerVar('HTTP_X_FORWARDED_HOST');
            if ($sServerHost) {
                $blIsCurrentUrl = $this->_isCurrentUrl($sURL, $sServerHost);
            }
        }

        return $blIsCurrentUrl;
    }

    public function _isCurrentUrl($sURL, $sServerHost)
    {
        // #4010: force_sid added in https to every link
        preg_match("/^(https?:\/\/)?(www\.)?([^\/]+)/i", $sURL, $matches);
        $sUrlHost = $matches[3];

        preg_match("/^(https?:\/\/)?(www\.)?([^\/]+)/i", $sServerHost, $matches);
        $sRealHost = $matches[3];

        $sScriptName = $this->getServerVar('SCRIPT_NAME');
        $sCurrentHost = preg_replace('/\/((?:modules|core)\/[\w\/]*)?\w*\.php.*/', '', $sServerHost . $sScriptName);
        //remove double slashes all the way
        $sCurrentHost = str_replace('/', '', $sCurrentHost);
        $sURL = str_replace('/', '', $sURL);

        if ($sURL && $sCurrentHost && strpos($sURL, $sCurrentHost) !== false) {
            //bug fix #0002991
            if ($sUrlHost == $sRealHost) {
                return true;
            }
        }

        return false;
    }

    public function getServerNodeId()
    {
        return md5($this->getServerName() . $this->getServerIp());
    }

    public function getServerIp()
    {
        return $this->getServerVar('SERVER_ADDR');
    }

    private function getServerName()
    {
        return php_uname();
    }
}