Merge pull request #103 from mambax7/feature/improvements

mambax7 · web-flow · commit b07423d13729 · 2023-10-31T17:21:46.000-04:00
diff --git a/src/FilterInput.php b/src/FilterInput.php
@@ -29,7 +29,7 @@
  * @copyright 2005 Daniel Morris
  * @copyright 2005 - 2013 Open Source Matters, Inc. All rights reserved.
  * @copyright 2011-2023 XOOPS Project (https://xoops.org)
- * @license   GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html)
+ * @license   GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)
  * @link      https://xoops.org
  */
 class FilterInput
@@ -146,7 +146,7 @@ public static function getInstance(
      *
      * @param mixed $source - input string/array-of-string to be 'cleaned'
      *
-     * @return string $source - 'cleaned' version of input parameter
+     * @return string|array $source - 'cleaned' version of input parameter
      */
     public function process($source)
     {
@@ -159,7 +159,8 @@ public function process($source)
                 }
             }
             return $source;
-        } elseif (is_string($source)) {
+        }
+        if (is_string($source)) {
             // clean this string
             return $this->remove($this->decode($source));
         } else {
@@ -421,7 +422,7 @@ protected function filterTags($source)
             // appears in array specified by user
             $tagFound = in_array(strtolower($tagName), $this->tagsArray);
             // remove this tag on condition
-            if ((!$tagFound && $this->tagsMethod) || ($tagFound && !$this->tagsMethod)) {
+            if ($tagFound !== (bool) $this->tagsMethod) {
                 // reconstruct tag with allowed attributes
                 if (!$isCloseTag) {
                     $attrSet = $this->filterAttr($attrSet);
@@ -512,7 +513,7 @@ protected function filterAttr($attrSet)
             // if matches user defined array
             $attrFound = in_array(strtolower($attrSubSet[0]), $this->attrArray);
             // keep this attr on condition
-            if ((!$attrFound && $this->attrMethod) || ($attrFound && !$this->attrMethod)) {
+            if ($attrFound !== (bool) $this->attrMethod) {
                 if ($attrSubSet[1]) {
                     // attr has value
                     $newSet[] = $attrSubSet[0] . '="' . $attrSubSet[1] . '"';
diff --git a/src/Jwt/JsonWebToken.php b/src/Jwt/JsonWebToken.php
@@ -90,7 +90,9 @@ public function decode($jwtString, $assertClaims = array())
         foreach ($assertClaims as $claim => $assert) {
             if (!property_exists($values, $claim)) {
                 return false;
-            } elseif ($values->$claim != $assert) {
+            }
+
+            if ($values->$claim != $assert) {
                 return false;
             }
         }
diff --git a/src/ProxyCheck.php b/src/ProxyCheck.php
@@ -18,7 +18,7 @@
  * @package   Xmf
  * @author    Richard Griffith <richard@geekwright.com>
  * @copyright 2019-2020 XOOPS Project (https://xoops.org)
- * @license   GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html)
+ * @license   GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)
  */
 class ProxyCheck
 {
@@ -108,10 +108,12 @@ protected function getProxyEnvConfig()
      */
     protected function getProxyHeader()
     {
-        if (!isset($_SERVER[$this->proxyHeaderName]) || empty($_SERVER[$this->proxyHeaderName])) {
+        if (false === $this->proxyHeaderName || empty($_SERVER[$this->proxyHeaderName])) {
             return false;
         }
-        return $_SERVER[$this->proxyHeaderName];
+
+        // Use PHP 5.3 compatible type casting
+        return (string)$_SERVER[$this->proxyHeaderName];
     }
 
     /**
diff --git a/src/Random.php b/src/Random.php
@@ -18,7 +18,7 @@
  * @package   Xmf
  * @author    Richard Griffith <richard@geekwright.com>
  * @copyright 2015-2018 XOOPS Project (https://xoops.org)
- * @license   GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html)
+ * @license   GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)
  * @link      https://xoops.org
  */
 class Random
@@ -37,7 +37,29 @@ class Random
      */
     public static function generateOneTimeToken($hash = 'sha512', $bytes = 64)
     {
-        $token = hash($hash, random_bytes($bytes));
+        if (function_exists('random_bytes')) {
+            $randomData = random_bytes($bytes);
+        } elseif (function_exists('openssl_random_pseudo_bytes')) {
+            $crypto_strong = false;
+            $randomData = openssl_random_pseudo_bytes($bytes, $crypto_strong);
+
+            if ($randomData === false) {
+                throw new Exception("Could not generate secure random bytes.");
+            }
+
+            if (!$crypto_strong) {
+                throw new Exception("Non-cryptographically strong algorithm used for random bytes.");
+            }
+        } else {
+            $randomData = md5(uniqid(mt_rand(), true));
+        }
+
+        if ($randomData === null) {
+            throw new Exception("Failed to generate random data.");
+        }
+
+        $token = hash($hash, $randomData);
+
         return $token;
     }
 
@@ -55,7 +77,28 @@ public static function generateOneTimeToken($hash = 'sha512', $bytes = 64)
      */
     public static function generateKey($hash = 'sha512', $bytes = 128)
     {
-        $token = hash($hash, random_bytes($bytes));
+        if (function_exists('random_bytes')) {
+            $randomData = random_bytes($bytes);
+        } elseif (function_exists('openssl_random_pseudo_bytes')) {
+            $crypto_strong = false;
+            $randomData = openssl_random_pseudo_bytes($bytes, $crypto_strong);
+
+            if ($randomData === false) {
+                throw new Exception("Could not generate secure random bytes.");
+            }
+
+            if (!$crypto_strong) {
+                throw new Exception("Non-cryptographically strong algorithm used for random bytes.");
+            }
+        } else {
+            $randomData = md5(uniqid(mt_rand(), true));
+        }
+
+        if ($randomData === null) {
+            throw new Exception("Failed to generate random data.");
+        }
+
+        $token = hash($hash, $randomData);
         return $token;
     }
 }
diff --git a/src/Request.php b/src/Request.php
@@ -24,7 +24,7 @@
  * @author    trabis <lusopoemas@gmail.com>
  * @author    Joomla!
  * @copyright 2011-2023 XOOPS Project (https://xoops.org)
- * @license   GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html)
+ * @license   GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)
  * @link      https://xoops.org
  */
 class Request
@@ -338,6 +338,7 @@ public static function getIP($name, $default = '', $hash = 'default')
      */
     public static function getHeader($headerName, $default = '')
     {
+        /** @var string[] $headers */
         static $headers = null;
 
         if (null === $headers) {
@@ -348,10 +349,10 @@ public static function getHeader($headerName, $default = '')
                     $headers[strtolower($name)] = $value;
                 }
             } else {
-                // From joyview - http://php.net/manual/en/function.getallheaders.php
+                // From joyview - https://php.net/manual/en/function.getallheaders.php
                 foreach ($_SERVER as $name => $value) {
                     if ('HTTP_' === substr($name, 0, 5)) {
-                        $translatedName = str_replace(' ', '-', strtolower(str_replace('_', ' ', substr($name, 5))));
+                        $translatedName = (string)str_replace(' ', '-', strtolower(str_replace('_', ' ', substr($name, 5))));
                         $headers[$translatedName] = $value;
                     }
                 }
@@ -371,7 +372,7 @@ public static function getHeader($headerName, $default = '')
      * @param string $name variable to look for
      * @param string $hash hash to check
      *
-     * @return boolean True if hash has an element 'name', otherwise false
+     * @return bool True if hash has an element 'name', otherwise false
      */
     public static function hasVar($name, $hash = 'default')
     {
@@ -391,10 +392,10 @@ public static function hasVar($name, $hash = 'default')
     /**
      * Set a variable in one of the request variables
      *
-     * @param string  $name      Name
-     * @param string  $value     Value
-     * @param string  $hash      Hash
-     * @param boolean $overwrite Boolean
+     * @param string $name      Name
+     * @param string $value     Value
+     * @param string $hash      Hash
+     * @param bool   $overwrite Boolean
      *
      * @return string Previous value
      */
@@ -516,9 +517,9 @@ public static function get($hash = 'default', $mask = 0)
     /**
      * Sets a request variable
      *
-     * @param array   $array     An associative array of key-value pairs
-     * @param string  $hash      The request variable to set (POST, GET, FILES, METHOD)
-     * @param boolean $overwrite If true and an existing key is found, the value is overwritten,
+     * @param array  $array       An associative array of key-value pairs
+     * @param string $hash        The request variable to set (POST, GET, FILES, METHOD)
+     * @param bool   $overwrite   If true and an existing key is found, the value is overwritten,
      *                            otherwise it is ignored
      *
      * @return void
@@ -575,7 +576,7 @@ protected static function cleanVar($var, $mask = 0, $type = null)
                 if (null === $noHtmlFilter) {
                     $noHtmlFilter = FilterInput::getInstance();
                 }
-                $var = $noHtmlFilter->clean($var, $type);
+                $var = $noHtmlFilter::clean($var, $type);
             }
         }
 

Original file line number	Diff line number	Diff line change
`@@ -90,7 +90,9 @@ public function decode($jwtString, $assertClaims = array())`
`90`	`90`	`foreach ($assertClaims as $claim => $assert) {`
`91`	`91`	`if (!property_exists($values, $claim)) {`
`92`	`92`	`return false;`
`93`		`- } elseif ($values->$claim != $assert) {`
	`93`	`+ }`
	`94`	`+`
	`95`	`+ if ($values->$claim != $assert) {`
`94`	`96`	`return false;`
`95`	`97`	`}`
`96`	`98`	`}`
Original file line number	Diff line number	Diff line change
`@@ -18,7 +18,7 @@`
`18`	`18`	`* @package Xmf`
`19`	`19`	`* @author Richard Griffith <richard@geekwright.com>`
`20`	`20`	`* @copyright 2019-2020 XOOPS Project (https://xoops.org)`
`21`		`- * @license GNU GPL 2 or later (https://www.gnu.org/licenses/gpl-2.0.html)`
	`21`	`+ * @license GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)`
`22`	`22`	`*/`
`23`	`23`	`class ProxyCheck`
`24`	`24`	`{`
`@@ -108,10 +108,12 @@ protected function getProxyEnvConfig()`
`108`	`108`	`*/`
`109`	`109`	`protected function getProxyHeader()`
`110`	`110`	`{`
`111`		`- if (!isset($_SERVER[$this->proxyHeaderName]) \|\| empty($_SERVER[$this->proxyHeaderName])) {`
	`111`	`+ if (false === $this->proxyHeaderName \|\| empty($_SERVER[$this->proxyHeaderName])) {`
`112`	`112`	`return false;`
`113`	`113`	`}`
`114`		`- return $_SERVER[$this->proxyHeaderName];`
	`114`	`+`
	`115`	`+ // Use PHP 5.3 compatible type casting`
	`116`	`+ return (string)$_SERVER[$this->proxyHeaderName];`
`115`	`117`	`}`
`116`	`118`
`117`	`119`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -24,7 +24,7 @@`
`24`	`24`	`* @author trabis <lusopoemas@gmail.com>`
`25`	`25`	`* @author Joomla!`
`26`	`26`	`* @copyright 2011-2023 XOOPS Project (https://xoops.org)`
`27`		`- * @license GNU GPL 2 or later (http://www.gnu.org/licenses/gpl-2.0.html)`
	`27`	`+ * @license GNU GPL 2.0 or later (https://www.gnu.org/licenses/gpl-2.0.html)`
`28`	`28`	`* @link https://xoops.org`
`29`	`29`	`*/`
`30`	`30`	`class Request`
`@@ -338,6 +338,7 @@ public static function getIP($name, $default = '', $hash = 'default')`
`338`	`338`	`*/`
`339`	`339`	`public static function getHeader($headerName, $default = '')`
`340`	`340`	`{`
	`341`	`+ /** @var string[] $headers */`
`341`	`342`	`static $headers = null;`
`342`	`343`
`343`	`344`	`if (null === $headers) {`
`@@ -348,10 +349,10 @@ public static function getHeader($headerName, $default = '')`
`348`	`349`	`$headers[strtolower($name)] = $value;`
`349`	`350`	`}`
`350`	`351`	`} else {`
`351`		`- // From joyview - http://php.net/manual/en/function.getallheaders.php`
	`352`	`+ // From joyview - https://php.net/manual/en/function.getallheaders.php`
`352`	`353`	`foreach ($_SERVER as $name => $value) {`
`353`	`354`	`if ('HTTP_' === substr($name, 0, 5)) {`
`354`		`- $translatedName = str_replace(' ', '-', strtolower(str_replace('_', ' ', substr($name, 5))));`
	`355`	`+ $translatedName = (string)str_replace(' ', '-', strtolower(str_replace('_', ' ', substr($name, 5))));`
`355`	`356`	`$headers[$translatedName] = $value;`
`356`	`357`	`}`
`357`	`358`	`}`
`@@ -371,7 +372,7 @@ public static function getHeader($headerName, $default = '')`
`371`	`372`	`* @param string $name variable to look for`
`372`	`373`	`* @param string $hash hash to check`
`373`	`374`	`*`
`374`		`- * @return boolean True if hash has an element 'name', otherwise false`
	`375`	`+ * @return bool True if hash has an element 'name', otherwise false`
`375`	`376`	`*/`
`376`	`377`	`public static function hasVar($name, $hash = 'default')`
`377`	`378`	`{`
`@@ -391,10 +392,10 @@ public static function hasVar($name, $hash = 'default')`
`391`	`392`	`/**`
`392`	`393`	`* Set a variable in one of the request variables`
`393`	`394`	`*`
`394`		`- * @param string $name Name`
`395`		`- * @param string $value Value`
`396`		`- * @param string $hash Hash`
`397`		`- * @param boolean $overwrite Boolean`
	`395`	`+ * @param string $name Name`
	`396`	`+ * @param string $value Value`
	`397`	`+ * @param string $hash Hash`
	`398`	`+ * @param bool $overwrite Boolean`
`398`	`399`	`*`
`399`	`400`	`* @return string Previous value`
`400`	`401`	`*/`
`@@ -516,9 +517,9 @@ public static function get($hash = 'default', $mask = 0)`
`516`	`517`	`/**`
`517`	`518`	`* Sets a request variable`
`518`	`519`	`*`
`519`		`- * @param array $array An associative array of key-value pairs`
`520`		`- * @param string $hash The request variable to set (POST, GET, FILES, METHOD)`
`521`		`- * @param boolean $overwrite If true and an existing key is found, the value is overwritten,`
	`520`	`+ * @param array $array An associative array of key-value pairs`
	`521`	`+ * @param string $hash The request variable to set (POST, GET, FILES, METHOD)`
	`522`	`+ * @param bool $overwrite If true and an existing key is found, the value is overwritten,`
`522`	`523`	`* otherwise it is ignored`
`523`	`524`	`*`
`524`	`525`	`* @return void`
`@@ -575,7 +576,7 @@ protected static function cleanVar($var, $mask = 0, $type = null)`
`575`	`576`	`if (null === $noHtmlFilter) {`
`576`	`577`	`$noHtmlFilter = FilterInput::getInstance();`
`577`	`578`	`}`
`578`		`- $var = $noHtmlFilter->clean($var, $type);`
	`579`	`+ $var = $noHtmlFilter::clean($var, $type);`
`579`	`580`	`}`
`580`	`581`	`}`
`581`	`582`