Changeset 5937

Timestamp:

01/14/12 19:53:37 (4 months ago)

Author:

vain

Message:

• added ids on off to constructor of httprequest
• added unittest class for router.. WIP fixing: buildURL()

Location:

trunk

Files:

• core/httprequest.core.php (modified) (6 diffs)
• core/router.core.php (modified) (6 diffs)
• tests/unittests/core/router.core.php (added)

trunk/core/httprequest.core.php

@@ -125 +125 @@
      * 5) Detect REST Tunneling through POST and set request_method accordingly
      */
-    public function __construct()
+    public function __construct($ids_on = false)
     {
         # 1) Drop $_REQUEST. Usage is forbidden.
         unset($_REQUEST);
 
-        # 2) Run Intrusion Detection System (on GET, POST, COOKIES)
-        $doorKeeper = new Clansuite_DoorKeeper;
-        $doorKeeper->runIDS();
+        if($ids_on === true)
+        {
+            # 2) Run Intrusion Detection System (on GET, POST, COOKIES)
+            $doorKeeper = new Clansuite_DoorKeeper;
+            $doorKeeper->runIDS();
+        }
 
         /**
@@ -637 +640 @@
      * This method takes care for REST (Representational State Transfer) by tunneling PUT, DELETE through POST (principal of least power).
      * Ok, this is faked or spoofed REST, but lowers the power of POST and it's short and nice in html forms.
-     * @todo allow 'GET' through POST?
+     * @todo consider allowing 'GET' through POST?
      *
      * @see https://wiki.nbic.nl/index.php/REST.inc
@@ -644 +647 @@
     public function detectRESTTunneling()
     {
-        # this will allow DELETE and PUT
-        $rest_methodnames = array('DELETE', 'PUT');
+        $allowed_rest_methodnames = array('DELETE', 'PUT');
 
         # request_method has to be POST AND GET has to to have the method GET
-        if ($_SERVER['REQUEST_METHOD'] == 'POST' and isset($_GET['method']))
+        if ($_SERVER['REQUEST_METHOD'] == 'POST' and $this->issetParameter('GET', 'method'))
         {
             # check for allowed rest commands
-            if (in_array(mb_strtoupper($_GET['method']), $rest_methodnames))
+            if (in_array(mb_strtoupper($_GET['method']), $allowed_rest_methodnames))
             {
                 # set the internal (tunneled) method as new REQUEST_METHOD
@@ -676 +678 @@
             }
         }
-        elseif($_SERVER['REQUEST_METHOD'] == 'GET' and isset($_GET['method'])) # $this->issetParameter('GET', 'method')
+        elseif($_SERVER['REQUEST_METHOD'] == 'GET' and $this->issetParameter('GET', 'method'))
         {
             # NOPE, there's no tunneling through GET!
@@ -684 +686 @@
 
     /**
-     * Get the REQUEST METHOD
-     * Returns the internal request method first, then $_SERVER REQUEST_METHOD.
+     * Get the REQUEST METHOD (POST, GET, PUT, DELETE)
+     *
+     * The internally set request_method (PUT or DELETE) is returned first,
+     * because we might have a REST-tunneling.
      *
      * @return string request method
@@ -691 +695 @@
     public static function getRequestMethod()
     {
-        # first get the internally set request_method (PUT or DELETE) because we might have a REST-tunneling
         if(isset(self::$request_method))
         {
             return self::$request_method;
         }
-        else # this will be POST or GET
-        {
-            #if(in_array(strtolower($_SERVER['REQUEST_METHOD']), array('get','post'))
-            #{
-                return $_SERVER['REQUEST_METHOD'];
-            #}
+        else
+        {
+            return $_SERVER['REQUEST_METHOD'];
         }
     }

trunk/core/router.core.php

@@ -223 +223 @@
     public static function buildURL($urlstring, $internal_url = true)
     {
-        # if urlstring is already a qualified url
+        # if urlstring is already a qualified url (http://...)
         if(false !== strpos($urlstring, WWW_ROOT . 'index.php?mod='))
         {
@@ -237 +237 @@
         else # ROOT/index.php?mod=abc&action=123&etc...
         {
-            $url_values = explode('/', ltrim($urlstring, '/'));
-            $url_keys = array('mod', 'sub', 'action', 'id');
-            $url_data = Clansuite_Functions::array_unequal_combine($url_keys, $url_values);
+            # remove all double slahes
+            while (false !== strpos($urlstring, '//'))
+            {
+                $url = str_replace('//', '/', $urlstring);
+            }
+
+            # get only the part after "index.php=?"
+            if(false !== strpos($urlstring, 'index.php?'))
+            {
+                $urlstring = strstr($urlstring, 'index.php?');
+            }
+
+            # and explode the string into an indexed array
+            $urlstring = ltrim($urlstring, '/');
+            $url_params_idx_array = explode('/', $urlstring);
+
+            var_dump($url_params_idx_array);
+
+            /**
+             * This turns the indexed url parameters array into a named one.
+             * [0]=> "news"  to  [mod]    => "news"
+             * [1]=> "show"  to  [action] => "show"
+             *
+             * It also a static whitelist for url parameter keys.
+             *
+             * @todo how do i get the dynamic parameter names in here? year, date, etc.
+             * To solve this, maybe, the first index might be used to load the routes of that module.
+             * Then a reverse lookup in the routes table. For now this is static.
+             */
+            if($url_params_idx_array[1] === 'admin')
+            {
+                # module admin whitelist
+                $url_keys = array('mod', 'sub', 'action', 'id', 'type');
+            }
+            else
+            {
+                # public module whitelist
+                $url_keys = array('mod', 'action', 'id', 'type');
+            }
+
+            $url_data = Clansuite_Functions::array_unequal_combine($url_keys, $url_params_idx_array);
             $url = '';
 
@@ -255 +293 @@
             }
 
+            #Clansuite_Debug::printR(WWW_ROOT . 'index.php?' . $url);
             #Clansuite_Debug::firebug(WWW_ROOT . 'index.php?' . $url);
             return WWW_ROOT . 'index.php?' . $url;
@@ -338 +377 @@
                 unset($route_pattern);
 
-                #Clansuite_Debug::printR($route_values);
+                Clansuite_Debug::printR($route_values);
 
                 $matches = '';
@@ -422 +461 @@
      * Checks if Apache Module "mod_rewrite" is loaded/enabled
      * and Rewrite Engine is enabled in .htaccess"
-     * 
+     *
      * @return boolean True, if mod_rewrite on.
      */
@@ -468 +507 @@
      * A multislash removal is not needed, because of the later usage of preg_split.
      *
-     * @param string $reuest_uril this is basically Clansuite_HttpRequest::getRequestURI
+     * @param string $request_url Clansuite_HttpRequest::getRequestURI
      *
      * @return string Request URL