|
@@ -65,7 +65,7 @@ class Organizr
|
|
|
|
|
|
|
|
// ===================================
|
|
// ===================================
|
|
|
// Organizr Version
|
|
// Organizr Version
|
|
|
- public $version = '2.1.1810';
|
|
|
|
|
|
|
+ public $version = '2.1.1830';
|
|
|
// ===================================
|
|
// ===================================
|
|
|
// Quick php Version check
|
|
// Quick php Version check
|
|
|
public $minimumPHP = '7.3';
|
|
public $minimumPHP = '7.3';
|
|
@@ -97,8 +97,9 @@ class Organizr
|
|
|
|
|
|
|
|
public function __construct($updating = false)
|
|
public function __construct($updating = false)
|
|
|
{
|
|
{
|
|
|
|
|
+ $this->errors = E_ALL;//E_ALL & ~E_NOTICE
|
|
|
// Set custom Error handler
|
|
// Set custom Error handler
|
|
|
- set_error_handler([$this, 'setErrorResponse']);
|
|
|
|
|
|
|
+ set_error_handler([$this, 'setAPIErrorResponse'], $this->errors);
|
|
|
// Next Check PHP Version
|
|
// Next Check PHP Version
|
|
|
$this->checkPHP();
|
|
$this->checkPHP();
|
|
|
// Check Disk Space
|
|
// Check Disk Space
|
|
@@ -326,9 +327,8 @@ class Organizr
|
|
|
{
|
|
{
|
|
|
$errorTypes = $this->dev ? E_ERROR | E_WARNING | E_PARSE | E_NOTICE : 0;
|
|
$errorTypes = $this->dev ? E_ERROR | E_WARNING | E_PARSE | E_NOTICE : 0;
|
|
|
// Temp overwrite for now
|
|
// Temp overwrite for now
|
|
|
- $errorTypes = E_ERROR | E_WARNING | E_PARSE | E_NOTICE;
|
|
|
|
|
$displayErrors = $this->dev ? 1 : 0;
|
|
$displayErrors = $this->dev ? 1 : 0;
|
|
|
- error_reporting($errorTypes);
|
|
|
|
|
|
|
+ error_reporting($this->errors);
|
|
|
ini_set('display_errors', $displayErrors);
|
|
ini_set('display_errors', $displayErrors);
|
|
|
}
|
|
}
|
|
|
|
|
|
|
@@ -750,15 +750,75 @@ class Organizr
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
+ public function printWarningsAndErrors()
|
|
|
|
|
+ {
|
|
|
|
|
+ if (isset($GLOBALS['api']['response']['exceptions'])) {
|
|
|
|
|
+ $this->prettyPrint($GLOBALS['api']['response']['exceptions'], true);
|
|
|
|
|
+ } else {
|
|
|
|
|
+ $this->prettyPrint('No Errors');
|
|
|
|
|
+ }
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
public function setAPIErrorResponse($number, $message, $file, $line)
|
|
public function setAPIErrorResponse($number, $message, $file, $line)
|
|
|
{
|
|
{
|
|
|
- $GLOBALS['api']['response']['errors'][] = [
|
|
|
|
|
- 'error' => $number,
|
|
|
|
|
- 'message' => $message,
|
|
|
|
|
- 'file' => $file,
|
|
|
|
|
- 'line' => $line
|
|
|
|
|
|
|
+ if (!(error_reporting() & $number)) {
|
|
|
|
|
+ return;
|
|
|
|
|
+ }
|
|
|
|
|
+ $exceptions = [
|
|
|
|
|
+ E_ERROR => 'E_ERROR',
|
|
|
|
|
+ E_WARNING => 'E_WARNING',
|
|
|
|
|
+ E_PARSE => 'E_PARSE',
|
|
|
|
|
+ E_NOTICE => 'E_NOTICE',
|
|
|
|
|
+ E_CORE_ERROR => 'E_CORE_ERROR',
|
|
|
|
|
+ E_CORE_WARNING => 'E_CORE_WARNING',
|
|
|
|
|
+ E_COMPILE_ERROR => 'E_COMPILE_ERROR',
|
|
|
|
|
+ E_COMPILE_WARNING => 'E_COMPILE_WARNING',
|
|
|
|
|
+ E_USER_ERROR => 'E_USER_ERROR',
|
|
|
|
|
+ E_USER_WARNING => 'E_USER_WARNING',
|
|
|
|
|
+ E_USER_NOTICE => 'E_USER_NOTICE',
|
|
|
|
|
+ E_STRICT => 'E_STRICT',
|
|
|
|
|
+ E_RECOVERABLE_ERROR => 'E_RECOVERABLE_ERROR',
|
|
|
|
|
+ E_DEPRECATED => 'E_DEPRECATED',
|
|
|
|
|
+ E_USER_DEPRECATED => 'E_USER_DEPRECATED',
|
|
|
|
|
+ E_ALL => 'E_ALL'
|
|
|
];
|
|
];
|
|
|
- $this->handleError($number, $message, $file, $line);
|
|
|
|
|
|
|
+ switch ($number) {
|
|
|
|
|
+ case E_USER_ERROR:
|
|
|
|
|
+ case E_ERROR:
|
|
|
|
|
+ case E_CORE_ERROR:
|
|
|
|
|
+ case E_COMPILE_ERROR:
|
|
|
|
|
+ case E_RECOVERABLE_ERROR:
|
|
|
|
|
+ $type = 'errors';
|
|
|
|
|
+ break;
|
|
|
|
|
+ case E_USER_WARNING:
|
|
|
|
|
+ case E_WARNING:
|
|
|
|
|
+ case E_CORE_WARNING:
|
|
|
|
|
+ case E_COMPILE_WARNING:
|
|
|
|
|
+ $type = 'warnings';
|
|
|
|
|
+ break;
|
|
|
|
|
+ case E_USER_NOTICE:
|
|
|
|
|
+ case E_PARSE:
|
|
|
|
|
+ case E_DEPRECATED:
|
|
|
|
|
+ case E_USER_DEPRECATED:
|
|
|
|
|
+ case E_NOTICE:
|
|
|
|
|
+ $type = 'notice';
|
|
|
|
|
+ break;
|
|
|
|
|
+ default:
|
|
|
|
|
+ $type = 'other';
|
|
|
|
|
+ break;
|
|
|
|
|
+ }
|
|
|
|
|
+ if ($this->qualifyRequest(1)) {
|
|
|
|
|
+ $count = isset($GLOBALS['api']['response']['exceptions'][$type]) ? count($GLOBALS['api']['response']['exceptions'][$type]) : 0;
|
|
|
|
|
+ if ($count <= 10) {
|
|
|
|
|
+ $GLOBALS['api']['response']['exceptions'][$type][] = [
|
|
|
|
|
+ 'error' => $exceptions[$number],
|
|
|
|
|
+ 'message' => $message,
|
|
|
|
|
+ 'file' => $file,
|
|
|
|
|
+ 'line' => $line
|
|
|
|
|
+ ];
|
|
|
|
|
+ }
|
|
|
|
|
+ }
|
|
|
|
|
+ $this->handleError($exceptions[$number], $message, $file, $line);
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
public function setErrorResponse($number, $message, $file, $line)
|
|
public function setErrorResponse($number, $message, $file, $line)
|
|
@@ -1895,7 +1955,7 @@ class Organizr
|
|
|
$tempFile = $_FILES['file']['tmp_name'];
|
|
$tempFile = $_FILES['file']['tmp_name'];
|
|
|
$targetPath = $this->root . DIRECTORY_SEPARATOR . 'data' . DIRECTORY_SEPARATOR . 'userTabs' . DIRECTORY_SEPARATOR;
|
|
$targetPath = $this->root . DIRECTORY_SEPARATOR . 'data' . DIRECTORY_SEPARATOR . 'userTabs' . DIRECTORY_SEPARATOR;
|
|
|
$this->makeDir($targetPath);
|
|
$this->makeDir($targetPath);
|
|
|
- $targetFile = $targetPath . $_FILES['file']['name'];
|
|
|
|
|
|
|
+ $targetFile = $targetPath . $this->sanitizeUserString($_FILES['file']['name']);
|
|
|
$this->setAPIResponse(null, pathinfo($_FILES['file']['name'], PATHINFO_BASENAME) . ' has been uploaded', null);
|
|
$this->setAPIResponse(null, pathinfo($_FILES['file']['name'], PATHINFO_BASENAME) . ' has been uploaded', null);
|
|
|
return move_uploaded_file($tempFile, $targetFile);
|
|
return move_uploaded_file($tempFile, $targetFile);
|
|
|
}
|
|
}
|
|
@@ -4873,6 +4933,7 @@ class Organizr
|
|
|
$array['type'] = ($array['type']) ?? 1;
|
|
$array['type'] = ($array['type']) ?? 1;
|
|
|
$array['order'] = ($array['order']) ?? $this->getNextTabOrder() + 1;
|
|
$array['order'] = ($array['order']) ?? $this->getNextTabOrder() + 1;
|
|
|
if (array_key_exists('name', $array)) {
|
|
if (array_key_exists('name', $array)) {
|
|
|
|
|
+ $array['name'] = $this->sanitizeUserString($array['name']);
|
|
|
if ($this->isTabNameTaken($array['name'])) {
|
|
if ($this->isTabNameTaken($array['name'])) {
|
|
|
$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -4922,6 +4983,7 @@ class Organizr
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
if (array_key_exists('name', $array)) {
|
|
if (array_key_exists('name', $array)) {
|
|
|
|
|
+ $array['name'] = $this->sanitizeUserString($array['name']);
|
|
|
if ($this->isTabNameTaken($array['name'], $id)) {
|
|
if ($this->isTabNameTaken($array['name'], $id)) {
|
|
|
$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Tab name: ' . $array['name'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -4993,6 +5055,7 @@ class Organizr
|
|
|
$array['order'] = ($array['order']) ?? $this->getNextCategoryOrder() + 1;
|
|
$array['order'] = ($array['order']) ?? $this->getNextCategoryOrder() + 1;
|
|
|
$array['category_id'] = ($array['category_id']) ?? $this->getNextCategoryId() + 1;
|
|
$array['category_id'] = ($array['category_id']) ?? $this->getNextCategoryId() + 1;
|
|
|
if (array_key_exists('category', $array)) {
|
|
if (array_key_exists('category', $array)) {
|
|
|
|
|
+ $array['category'] = $this->sanitizeUserString($array['category']);
|
|
|
if ($this->isCategoryNameTaken($array['category'])) {
|
|
if ($this->isCategoryNameTaken($array['category'])) {
|
|
|
$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -5003,6 +5066,9 @@ class Organizr
|
|
|
}
|
|
}
|
|
|
if (!array_key_exists('image', $array)) {
|
|
if (!array_key_exists('image', $array)) {
|
|
|
$this->setAPIResponse('error', 'Category image was not supplied', 422);
|
|
$this->setAPIResponse('error', 'Category image was not supplied', 422);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ } else {
|
|
|
|
|
+ $array['image'] = $this->sanitizeUserString($array['image']);
|
|
|
}
|
|
}
|
|
|
$response = [
|
|
$response = [
|
|
|
array(
|
|
array(
|
|
@@ -5037,11 +5103,15 @@ class Organizr
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
if (array_key_exists('category', $array)) {
|
|
if (array_key_exists('category', $array)) {
|
|
|
|
|
+ $array['category'] = $this->sanitizeUserString($array['category']);
|
|
|
if ($this->isCategoryNameTaken($array['category'], $id)) {
|
|
if ($this->isCategoryNameTaken($array['category'], $id)) {
|
|
|
$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Category name: ' . $array['category'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
}
|
|
}
|
|
|
|
|
+ if (array_key_exists('image', $array)) {
|
|
|
|
|
+ $array['image'] = $this->sanitizeUserString($array['image']);
|
|
|
|
|
+ }
|
|
|
if (array_key_exists('default', $array)) {
|
|
if (array_key_exists('default', $array)) {
|
|
|
if ($array['default']) {
|
|
if ($array['default']) {
|
|
|
$this->clearCategoryDefault();
|
|
$this->clearCategoryDefault();
|
|
@@ -6182,6 +6252,21 @@ class Organizr
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
|
|
|
|
|
+ public function validateEmail($email)
|
|
|
|
|
+ {
|
|
|
|
|
+ return filter_var(trim($email), FILTER_VALIDATE_EMAIL);
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
|
|
+ public function sanitizeEmail($email)
|
|
|
|
|
+ {
|
|
|
|
|
+ return filter_var(trim($email), FILTER_SANITIZE_EMAIL);
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
|
|
+ public function sanitizeUserString($string)
|
|
|
|
|
+ {
|
|
|
|
|
+ return htmlspecialchars(trim($string));
|
|
|
|
|
+ }
|
|
|
|
|
+
|
|
|
public function updateUser($id, $array)
|
|
public function updateUser($id, $array)
|
|
|
{
|
|
{
|
|
|
if (!$id) {
|
|
if (!$id) {
|
|
@@ -6209,6 +6294,7 @@ class Organizr
|
|
|
$this->setAPIResponse('error', 'Username was set but empty', 409);
|
|
$this->setAPIResponse('error', 'Username was set but empty', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ $array['username'] = $this->sanitizeUserString($array['username']);
|
|
|
if ($this->usernameTaken($array['username'], $array['username'], $id)) {
|
|
if ($this->usernameTaken($array['username'], $array['username'], $id)) {
|
|
|
$this->setAPIResponse('error', 'Username: ' . $array['username'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Username: ' . $array['username'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -6219,6 +6305,12 @@ class Organizr
|
|
|
$this->setAPIResponse('error', 'Email was set but empty', 409);
|
|
$this->setAPIResponse('error', 'Email was set but empty', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ if ($this->validateEmail($array['email'])) {
|
|
|
|
|
+ $array['email'] = $this->sanitizeEmail($array['email']);
|
|
|
|
|
+ } else {
|
|
|
|
|
+ $this->setResponse(409, 'Email is not a valid email', ['email' => $array['email']]);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ }
|
|
|
if ($this->usernameTaken($array['email'], $array['email'], $id)) {
|
|
if ($this->usernameTaken($array['email'], $array['email'], $id)) {
|
|
|
$this->setAPIResponse('error', 'Email: ' . $array['email'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Email: ' . $array['email'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -6258,6 +6350,9 @@ class Organizr
|
|
|
}
|
|
}
|
|
|
$array['password'] = password_hash($array['password'], PASSWORD_BCRYPT);
|
|
$array['password'] = password_hash($array['password'], PASSWORD_BCRYPT);
|
|
|
}
|
|
}
|
|
|
|
|
+ if (array_key_exists('image', $array)) {
|
|
|
|
|
+ $array['image'] = $this->sanitizeUserString($array['image']);
|
|
|
|
|
+ }
|
|
|
if (array_key_exists('register_date', $array)) {
|
|
if (array_key_exists('register_date', $array)) {
|
|
|
$this->setAPIResponse('error', 'Cannot update register date', 409);
|
|
$this->setAPIResponse('error', 'Cannot update register date', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -6315,10 +6410,30 @@ class Organizr
|
|
|
$this->setAPIResponse('error', 'Username was not supplied', 409);
|
|
$this->setAPIResponse('error', 'Username was not supplied', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ if ($username == '') {
|
|
|
|
|
+ $this->setResponse(409, 'Username was set but empty');
|
|
|
|
|
+ return false;
|
|
|
|
|
+ } else {
|
|
|
|
|
+ $username = $this->sanitizeUserString($username);
|
|
|
|
|
+ }
|
|
|
if (!$password) {
|
|
if (!$password) {
|
|
|
$this->setAPIResponse('error', 'Password was not supplied', 409);
|
|
$this->setAPIResponse('error', 'Password was not supplied', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ if (!$email) {
|
|
|
|
|
+ $this->setAPIResponse('error', 'Email was set not supplied', 409);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ }
|
|
|
|
|
+ if ($email == '') {
|
|
|
|
|
+ $this->setAPIResponse('error', 'Email was set but empty', 409);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ }
|
|
|
|
|
+ if ($this->validateEmail($email)) {
|
|
|
|
|
+ $email = $this->sanitizeEmail($email);
|
|
|
|
|
+ } else {
|
|
|
|
|
+ $this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ }
|
|
|
$this->setLoggerChannel('User Management');
|
|
$this->setLoggerChannel('User Management');
|
|
|
if ($this->createUser($username, $password, $email)) {
|
|
if ($this->createUser($username, $password, $email)) {
|
|
|
$this->logger->info('Account created for [' . $username . ']');
|
|
$this->logger->info('Account created for [' . $username . ']');
|
|
@@ -6338,10 +6453,21 @@ class Organizr
|
|
|
$this->setAPIResponse('error', 'Username was set but empty', 409);
|
|
$this->setAPIResponse('error', 'Username was set but empty', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ $username = $this->sanitizeUserString($username);
|
|
|
if (!$password) {
|
|
if (!$password) {
|
|
|
$this->setAPIResponse('error', 'Password was set but empty', 409);
|
|
$this->setAPIResponse('error', 'Password was set but empty', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ if ($email == '') {
|
|
|
|
|
+ $this->setAPIResponse('error', 'Email was set but empty', 409);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ }
|
|
|
|
|
+ if ($this->validateEmail($email)) {
|
|
|
|
|
+ $email = $this->sanitizeEmail($email);
|
|
|
|
|
+ } else {
|
|
|
|
|
+ $this->setResponse(409, 'Email is not a valid email', ['email' => $email]);
|
|
|
|
|
+ return false;
|
|
|
|
|
+ }
|
|
|
if ($this->usernameTaken($username, $email)) {
|
|
if ($this->usernameTaken($username, $email)) {
|
|
|
$this->setAPIResponse('error', 'Username: ' . $username . ' or Email: ' . $email . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Username: ' . $username . ' or Email: ' . $email . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -6395,6 +6521,7 @@ class Organizr
|
|
|
$this->setAPIResponse('error', 'Group was set but empty', 409);
|
|
$this->setAPIResponse('error', 'Group was set but empty', 409);
|
|
|
return false;
|
|
return false;
|
|
|
}
|
|
}
|
|
|
|
|
+ $array['group'] = $this->sanitizeUserString($array['group']);
|
|
|
if ($this->isGroupNameTaken($array['group'], $id)) {
|
|
if ($this->isGroupNameTaken($array['group'], $id)) {
|
|
|
$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|
|
@@ -6474,6 +6601,7 @@ class Organizr
|
|
|
$array['default'] = ($array['default']) ?? 0;
|
|
$array['default'] = ($array['default']) ?? 0;
|
|
|
$array['group_id'] = $this->getNextGroupOrder() + 1;
|
|
$array['group_id'] = $this->getNextGroupOrder() + 1;
|
|
|
if (array_key_exists('group', $array)) {
|
|
if (array_key_exists('group', $array)) {
|
|
|
|
|
+ $array['group'] = $this->sanitizeUserString($array['group']);
|
|
|
if ($this->isGroupNameTaken($array['group'])) {
|
|
if ($this->isGroupNameTaken($array['group'])) {
|
|
|
$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
|
|
$this->setAPIResponse('error', 'Group name: ' . $array['group'] . ' is already taken', 409);
|
|
|
return false;
|
|
return false;
|