|
| 1 | +<?php |
| 2 | + |
| 3 | +namespace EvolutionCMS\Support; |
| 4 | + |
| 5 | +/** |
| 6 | + * Keeps the TV bindings that run code out of the hands of managers who may edit TVs but not PHP. |
| 7 | + * |
| 8 | + * @EVAL passes its argument to eval() and @SELECT puts it into a query, in a TV's input options, |
| 9 | + * default value and output options. save_template alone is enough to store them, so they need the |
| 10 | + * permission that already grants arbitrary PHP (save_snippet). |
| 11 | + */ |
| 12 | +final class TvBindingGuard |
| 13 | +{ |
| 14 | + /** Definition fields (POST name => column) a binding can sit in. */ |
| 15 | + public const FIELDS = ['elements' => 'elements', 'default_text' => 'default_text', 'display_params' => 'display_params']; |
| 16 | + |
| 17 | + public static function hasCodeBinding(?string $value): bool |
| 18 | + { |
| 19 | + $value = (string) $value; |
| 20 | + // the parser trims with trim(), which also drops NUL and vertical tab, and matches a command |
| 21 | + // by prefix ("@EVALreturn 1;" runs), so no boundary may be required after the name. |
| 22 | + // @INHERIT hands its argument back to the parser, so it is looked through. |
| 23 | + for ($depth = 0; $depth < 20; $depth++) { |
| 24 | + $value = ltrim($value, " \t\n\r\0\x0B"); |
| 25 | + if (preg_match('/^@{1,2}(?:EVAL|SELECT)/i', $value)) { |
| 26 | + return true; |
| 27 | + } |
| 28 | + if (!preg_match('/^@INHERIT/i', $value)) { |
| 29 | + return false; |
| 30 | + } |
| 31 | + $value = substr($value, 8); |
| 32 | + } |
| 33 | + |
| 34 | + return true; // deeper than any real value nests: do not guess |
| 35 | + } |
| 36 | + |
| 37 | + /** |
| 38 | + * A TV value or resource field that can reach a code binding. Bindings nest (@INHERIT hands |
| 39 | + * its argument back to the binding parser), so one is also caught behind another binding. |
| 40 | + */ |
| 41 | + public static function reachesCodeBinding(?string $value): bool |
| 42 | + { |
| 43 | + return self::hasCodeBinding($value); |
| 44 | + } |
| 45 | + |
| 46 | + /** |
| 47 | + * Whether a manager may store these TV values and the resource content. Values that did not |
| 48 | + * change are kept, so an existing binding stays editable around by whoever may edit the page. |
| 49 | + * |
| 50 | + * @param array<int|string, string|null> $desired TV id => submitted value |
| 51 | + * @param array<int|string, string|null> $stored TV id => current value |
| 52 | + */ |
| 53 | + public static function allowsValues(bool $mayWritePhp, array $desired, array $stored, string $content = '', string $storedContent = '', array $fields = [], array $storedFields = []): bool |
| 54 | + { |
| 55 | + if ($mayWritePhp) { |
| 56 | + return true; |
| 57 | + } |
| 58 | + // content only runs as a binding when a TV pulls it in with @DOCUMENT, and then from its start |
| 59 | + if ($content !== $storedContent && self::hasCodeBinding($content)) { |
| 60 | + return false; |
| 61 | + } |
| 62 | + // [*field*] in a binding's argument pulls in any other field of the page, so each is checked |
| 63 | + foreach ($fields as $name => $value) { |
| 64 | + $value = (string) $value; |
| 65 | + if (self::hasCodeBinding($value) && $value !== (string) ($storedFields[$name] ?? '')) { |
| 66 | + return false; |
| 67 | + } |
| 68 | + } |
| 69 | + foreach ($desired as $id => $value) { |
| 70 | + $value = (string) $value; |
| 71 | + if (self::reachesCodeBinding($value) && $value !== (string) ($stored[$id] ?? '')) { |
| 72 | + return false; |
| 73 | + } |
| 74 | + } |
| 75 | + |
| 76 | + return true; |
| 77 | + } |
| 78 | + |
| 79 | + /** |
| 80 | + * @param array<string, mixed> $submitted values keyed by column |
| 81 | + * @param array<string, mixed> $stored current values keyed by column, empty for a new TV |
| 82 | + */ |
| 83 | + public static function allows(bool $mayWritePhp, array $submitted, array $stored = []): bool |
| 84 | + { |
| 85 | + if ($mayWritePhp) { |
| 86 | + return true; |
| 87 | + } |
| 88 | + foreach (self::FIELDS as $column) { |
| 89 | + $value = (string) ($submitted[$column] ?? ''); |
| 90 | + if (self::hasCodeBinding($value) && $value !== (string) ($stored[$column] ?? '')) { |
| 91 | + return false; |
| 92 | + } |
| 93 | + } |
| 94 | + |
| 95 | + return true; |
| 96 | + } |
| 97 | +} |
0 commit comments