oxutilsserver.php

Go to the documentation of this file.

<?php

class oxUtilsServer extends oxSuperCfg
{
    private static $_instance = null;

    protected $_aUserCookie = array();

    protected $_sSessionCookiesName = 'aSessionCookies';

    protected $_sSessionCookies = array();

    public static function getInstance()
    {
        return oxRegistry::get("oxUtilsServer");
    }

    public function setOxCookie( $sName, $sValue = "", $iExpire = 0, $sPath = '/', $sDomain = null, $blToSession = true, $blSecure = false )
    {
        //TODO: since setcookie takes more than just 4 params..
        // would be nice to have it sending through https only, if in https mode
        // or allowing only http access to cookie [no JS access - reduces XSS attack possibility]
        // ref: http://lt.php.net/manual/en/function.setcookie.php

        if ( $blToSession && !$this->isAdmin() ) {
           $this->_saveSessionCookie( $sName, $sValue, $iExpire, $sPath, $sDomain );
        }

        if ( defined('OXID_PHP_UNIT')) {
            // do NOT set cookies in php unit.
            return;
        }

        return setcookie(
            $sName,
            $sValue,
            $iExpire,
            $this->_getCookiePath( $sPath ),
            $this->_getCookieDomain( $sDomain ),
            $blSecure,
            true
        );
    }

    protected $_blSaveToSession = null;

    protected function _mustSaveToSession()
    {
        if ( $this->_blSaveToSession === null ) {
            $this->_blSaveToSession = false;

            $myConfig = $this->getConfig();
            if ( $sSslUrl = $myConfig->getSslShopUrl() ) {
                $sUrl  = $myConfig->getShopUrl();

                $sHost    = parse_url( $sUrl, PHP_URL_HOST );
                $sSslHost = parse_url( $sSslUrl, PHP_URL_HOST );

                // testing if domains matches..
                if ( $sHost != $sSslHost ) {
                    $oUtils = oxRegistry::getUtils();
                    $this->_blSaveToSession = $oUtils->extractDomain( $sHost ) != $oUtils->extractDomain( $sSslHost );
                }
            }
        }

        return $this->_blSaveToSession;
    }

    protected function _getSessionCookieKey( $blGet )
    {
        $blSsl = $this->getConfig()->isSsl();
        $sKey  = $blSsl ? 'nossl' : 'ssl';

        if ( $blGet ) {
            $sKey = $blSsl ? 'ssl' : 'nossl';
        }

        return $sKey;
    }

    protected function _saveSessionCookie( $sName, $sValue, $iExpire, $sPath, $sDomain )
    {
        if ( $this->_mustSaveToSession() ) {
            $aCookieData = array( 'value' => $sValue, 'expire' => $iExpire, 'path' => $sPath, 'domain' => $sDomain );

            $aSessionCookies = ( array ) oxSession::getVar( $this->_sSessionCookiesName );
            $aSessionCookies[$this->_getSessionCookieKey( false )][$sName] = $aCookieData;

            oxSession::setVar( $this->_sSessionCookiesName, $aSessionCookies );
        }
    }

    public function loadSessionCookies()
    {
        if ( ( $aSessionCookies = oxSession::getVar( $this->_sSessionCookiesName ) ) ) {
            $sKey = $this->_getSessionCookieKey( true );
            if ( isset( $aSessionCookies[$sKey] ) ) {
                // writing session data to cookies
                foreach ( $aSessionCookies[$sKey] as $sName => $aCookieData ) {
                    $this->setOxCookie( $sName, $aCookieData['value'], $aCookieData['expire'], $aCookieData['path'], $aCookieData['domain'], false );
                    $this->_sSessionCookies[$sName] = $aCookieData['value'];
                }

                // cleanup
                unset( $aSessionCookies[$sKey] );
                oxSession::setVar( $this->_sSessionCookiesName, $aSessionCookies );
            }
        }
    }

    protected function _getCookiePath( $sPath )
    {
        if ( $aCookiePaths = $this->getConfig()->getConfigParam( 'aCookiePaths' ) ) {
            // in case user wants to have shop specific setup
            $sShopId = $this->getConfig()->getShopId();
            $sPath = isset( $aCookiePaths[$sShopId] ) ? $aCookiePaths[$sShopId] : $sPath;
        }

        // from php doc: .. You may also replace an argument with an empty string ("") in order to skip that argument..
        return $sPath ? $sPath : "";
    }

    protected function _getCookieDomain( $sDomain )
    {
        $sDomain = $sDomain ? $sDomain : "";

        // on special cases, like separate domain for SSL, cookies must be defined on domain specific path
        // please have a look at
        if ( !$sDomain ) {
            if ( $aCookieDomains = $this->getConfig()->getConfigParam( 'aCookieDomains' ) ) {
                // in case user wants to have shop specific setup
                $sShopId = $this->getConfig()->getShopId();
                $sDomain = isset( $aCookieDomains[$sShopId] ) ? $aCookieDomains[$sShopId] : $sDomain;
            }
        }
        return $sDomain;
    }

    public function getOxCookie( $sName = null )
    {
        $sValue = null;
        if ( $sName && isset( $_COOKIE[$sName] ) ) {
            $sValue = oxRegistry::getConfig()->checkParamSpecialChars($_COOKIE[$sName]);
        } elseif ( $sName && !isset( $_COOKIE[$sName] ) ) {
            $sValue = isset( $this->_sSessionCookies[$sName] ) ? $this->_sSessionCookies[$sName] : null;
        } elseif ( !$sName && isset( $_COOKIE ) ) {
            $sValue = $_COOKIE;
        }
        return $sValue;
    }

    public function getRemoteAddress()
    {
        if ( isset( $_SERVER["HTTP_X_FORWARDED_FOR"] ) ) {
            $sIP = $_SERVER["HTTP_X_FORWARDED_FOR"];
            $sIP = preg_replace('/,.*$/', '', $sIP);
        } elseif ( isset( $_SERVER["HTTP_CLIENT_IP"] ) ) {
            $sIP = $_SERVER["HTTP_CLIENT_IP"];
        } else {
            $sIP = $_SERVER["REMOTE_ADDR"];
        }
        return $sIP;
    }

    public function getServerVar( $sServVar = null )
    {
        $sValue = null;
        if ( isset( $_SERVER ) ) {
            if ( $sServVar && isset( $_SERVER[$sServVar] ) ) {
                $sValue = $_SERVER[$sServVar];
            } elseif ( !$sServVar ) {
                $sValue = $_SERVER;
            }
        }
        return $sValue;
    }

    public function setUserCookie( $sUser, $sPassword,  $sShopId = null, $iTimeout = 31536000, $sSalt = 'ox' )
    {
        $myConfig = $this->getConfig();
        $sShopId = ( !$sShopId ) ? $myConfig->getShopId() : $sShopId;
        $sSslUrl = $myConfig->getSslShopUrl();
        if (stripos($sSslUrl, 'https') === 0) {
            $blSsl = true;
        } else {
            $blSsl = false;
        }

        $this->_aUserCookie[$sShopId] = $sUser . '@@@' . crypt( $sPassword, $sSalt );
        $this->setOxCookie( 'oxid_' . $sShopId, $this->_aUserCookie[$sShopId], oxRegistry::get("oxUtilsDate")->getTime() + $iTimeout, '/', null, true, $blSsl );
        $this->setOxCookie( 'oxid_' . $sShopId.'_autologin', '1', oxRegistry::get("oxUtilsDate")->getTime() + $iTimeout, '/', null, true, false);
    }

    public function deleteUserCookie( $sShopId = null )
    {
        $myConfig = $this->getConfig();
        $sShopId = ( !$sShopId ) ? $this->getConfig()->getShopId() : $sShopId;
        $sSslUrl = $myConfig->getSslShopUrl();
        if (stripos($sSslUrl, 'https') === 0) {
            $blSsl = true;
        } else {
            $blSsl = false;
        }

        $this->_aUserCookie[$sShopId] = '';
        $this->setOxCookie( 'oxid_'.$sShopId, '', oxRegistry::get("oxUtilsDate")->getTime() - 3600, '/', null, true, $blSsl );
        $this->setOxCookie( 'oxid_' . $sShopId.'_autologin', '0', oxRegistry::get("oxUtilsDate")->getTime() - 3600, '/', null, true, false);
    }

    public function getUserCookie( $sShopId = null )
    {
        $myConfig = parent::getConfig();
        $sShopId = ( !$sShopId ) ? $myConfig->getShopId() : $sShopId;
        // check for SSL connection
        if (!$myConfig->isSsl() && $this->getOxCookie('oxid_'.$sShopId.'_autologin') == '1') {
            $sSslUrl = rtrim($myConfig->getSslShopUrl(), '/').$_SERVER['REQUEST_URI'];
            if (stripos($sSslUrl, 'https') === 0) {
                oxRegistry::getUtils()->redirect($sSslUrl, true, 302);
            }
        }

        if ( array_key_exists( $sShopId, $this->_aUserCookie ) && $this->_aUserCookie[$sShopId] !== null ) {
            return $this->_aUserCookie[$sShopId] ? $this->_aUserCookie[$sShopId] : null;
        }

        return $this->_aUserCookie[$sShopId] = $this->getOxCookie( 'oxid_'.$sShopId );
    }

    public function isTrustedClientIp()
    {
        $blTrusted = false;
        $aTrustedIPs = ( array ) $this->getConfig()->getConfigParam( "aTrustedIPs" );
        if ( count( $aTrustedIPs ) ) {
            $blTrusted = in_array( $this->getRemoteAddress(), $aTrustedIPs );
        }

        return $blTrusted;
    }

    public function processUserAgentInfo( $sAgent )
    {
        if ( $sAgent ) {
            $sAgent = getStr()->preg_replace( "/MSIE(\s)?(\S)*(\s)/", "", (string) $sAgent );
        }
        return $sAgent;
    }

    public function isCurrentUrl( $sURL )
    {
        // Missing protocol, cannot proceed, assuming true.
        if ( !$sURL || (strpos( $sURL, "http" ) !== 0)) {
            return true;
        }

        // #4010: force_sid added in https to every link
        preg_match("/^(https?:\/\/)?(www\.)?([^\/]+)/i", $sURL, $matches);
        $sUrlHost = $matches[3];

        // #4010: force_sid added in https to every link
        preg_match("/^(https?:\/\/)?(www\.)?([^\/]+)/i", $this->getServerVar( 'HTTP_HOST' ), $matches);
        $sRealHost = $matches[3];

        $sCurrentHost = preg_replace( '/\/\w*\.php.*/', '', $this->getServerVar( 'HTTP_HOST' ) . $this->getServerVar( 'SCRIPT_NAME' ) );

        //remove double slashes all the way
        $sCurrentHost = str_replace( '/', '', $sCurrentHost );
        $sURL = str_replace( '/', '', $sURL );

        //var_dump($sURL,$sCurrentHost, $sRealHost);
        if ( $sURL && $sCurrentHost && strpos( $sURL, $sCurrentHost ) !== false ) {
            //bug fix #0002991
            if ( $sUrlHost == $sRealHost ) {
                return true;
            }
        }

        return false;
    }
}