1: <?php
  2: /**
  3:  * This file contains the class cAjaxRequest which handles ajax requests
  4:  * for the CONTENIDO backend.
  5:  *
  6:  * @package Core
  7:  * @subpackage Backend
  8:  * @author Timo Trautmann
  9:  * @copyright four for business AG <www.4fb.de>
 10:  * @license http://www.contenido.org/license/LIZENZ.txt
 11:  * @link http://www.4fb.de
 12:  * @link http://www.contenido.org
 13:  */
 14: 
 15: defined('CON_FRAMEWORK') || die('Illegal call: Missing framework initialization - request aborted.');
 16: 
 17: /**
 18:  * Class for outputting some content for Ajax use
 19:  *
 20:  * @package Core
 21:  * @subpackage Backend
 22:  */
 23: class cAjaxRequest {
 24:     /**
 25:      * Handles AJAX requests for certain data. Which data is returned
 26:      * depends upon the given $action. If the $action is unknown an
 27:      * error message is generated. Available actions are:
 28:      *
 29:      * <ul>
 30:      *     <li>artsel
 31:      *          Return a select box containing articles of a category.
 32:      *          All params (name, idcat & value) are required.
 33:      *          name = name of select box
 34:      *          idcat = category ID whose articles should be contained
 35:      *          value = selected article
 36:      *     <li>dirlist
 37:      *     <li>imgdirlist
 38:      *     <li>filelist
 39:      *     <li>inused_layout
 40:      *          List templates using a given layout.
 41:      *     <li>inused_module
 42:      *          List templates using a given module.
 43:      *     <li>inused_template
 44:      *          List categories and articles using a given template.
 45:      *     <li>scaleImage
 46:      *     <li>imagelist
 47:      *     <li>inlineeditart
 48:      *     <li>loadImageMeta
 49:      *     <li>upl_mkdir
 50:      *     <li>upl_upload
 51:      *     <li>linkeditorarticleslist
 52:      *     <li>linkeditordirlist
 53:      *     <li>linkeditorimagelist
 54:      *     <li>generaljstranslations
 55:      *     <li>logfilecontent
 56:      *     <li>updatepluginorder
 57:      *          only sysadmins can do this
 58:      *     <li>verify_module
 59:      *          check module syntax
 60:      *          modules are checked by default
 61:      *          This can be deactivated when the system property
 62:      *          system/modulecheck is set accordingly.
 63:      *          TODO Describe what "accordingly" means. The rules are a mess!
 64:      *     <li>authentication_fail
 65:      *          Returns a static answer for a not authenticated AJAX
 66:      *          request, e.g. due to an invalid or expired session.
 67:      * </ul>
 68:      *
 69:      * @todo split functionality into seperate methods
 70:      * @todo use registry instead of globals where possible
 71:      *
 72:      * @param string $action
 73:      *         name of requested ajax action
 74:      *
 75:      * @return string
 76:      * 
 77:      * @throws cDbException
 78:      * @throws cException
 79:      * @throws cInvalidArgumentException
 80:      */
 81:     public function handle($action) {
 82:         $backendPath = cRegistry::getBackendPath();
 83: 
 84:         $string = '';
 85:         switch ($action) {
 86:             case 'artsel':
 87:                 $name  = cSecurity::toString($_REQUEST['name']);
 88:                 $idcat = cSecurity::toInteger($_REQUEST['idcat']);
 89:                 $value = cSecurity::toInteger($_REQUEST['value']);
 90: 
 91:                 $string = buildArticleSelect($name, $idcat, $value);
 92:                 break;
 93: 
 94:             case 'dirlist':
 95: 
 96:                 $idartlang = cSecurity::toInteger($_REQUEST['idartlang']);
 97:                 $fileListId = cSecurity::toInteger($_REQUEST['id']);
 98:                 $dirname = cSecurity::toString($_REQUEST['dir']);
 99: 
100:                 $clientId = cRegistry::getClientId();
101:                 $cfgClient = cRegistry::getClientConfig($clientId);
102:                 $uplPath = $cfgClient['upl']['path'];
103: 
104:                 $art = new cApiArticleLanguage($idartlang, true);
105:                 $content = $art->getContent('CMS_FILELIST', $fileListId);
106: 
107:                 $fileList = new cContentTypeFilelist($content, $fileListId, array());
108:                 $directoryList = $fileList->buildDirectoryList($uplPath . $dirname);
109:                 $string = $fileList->generateDirectoryList($directoryList);
110:                 break;
111: 
112:             case 'imgdirlist':
113: 
114:                 $idartlang  = cSecurity::toInteger($_REQUEST['idartlang']);
115:                 $fileListId = cSecurity::toInteger($_REQUEST['id']);
116:                 $dirname    = cSecurity::toString($_REQUEST['dir']);
117: 
118:                 $clientId  = cRegistry::getClientId();
119:                 $cfgClient = cRegistry::getClientConfig($clientId);
120:                 $uplPath   = $cfgClient['upl']['path'];
121: 
122:                 $art     = new cApiArticleLanguage($idartlang, true);
123:                 $content = $art->getContent('CMS_IMGEDITOR', $fileListId);
124: 
125:                 $fileList      = new cContentTypeImgeditor($content, $fileListId, []);
126:                 $directoryList = $fileList->buildDirectoryList($uplPath . $dirname);
127:                 $string = $fileList->generateDirectoryList($directoryList);
128:                 break;
129: 
130:             case 'filelist':
131:                 $idartlang  = cSecurity::toInteger($_REQUEST['idartlang']);
132:                 $fileListId = cSecurity::toInteger($_REQUEST['id']);
133:                 $dirname    = cSecurity::toString($_REQUEST['dir']);
134: 
135:                 $art = new cApiArticleLanguage($idartlang, true);
136:                 $content = $art->getContent('CMS_FILELIST', $fileListId);
137: 
138:                 $fileList = new cContentTypeFilelist($content, $fileListId, array());
139:                 $string = $fileList->generateFileSelect($dirname);
140:                 break;
141: 
142:             case 'inused_layout':
143:                 global $cfg;
144:                 if (0 < (int) $_REQUEST['id']) {
145:                     $layout = new cApiLayout((int) $_REQUEST['id']);
146:                     if ($layout->isInUse(true)) {
147:                         $template = new cTemplate();
148:                         $usedTemplates = $layout->getUsedTemplates();
149:                         if (count($usedTemplates) > 0) {
150:                             foreach ($usedTemplates as $i => $usedTemplate) {
151:                                 if ($i % 2 == 0) {
152:                                     $template->set('d', 'CLASS', 'grey');
153:                                 } else {
154:                                     $template->set('d', 'CLASS', 'white');
155:                                 }
156:                                 $template->set('d', 'NAME', $usedTemplate['tpl_name']);
157:                                 $template->next();
158:                             }
159: 
160:                             $string = '<div class="inuse_info" >' . $template->generate($backendPath . $cfg['path']['templates'] . $cfg['templates']['inuse_lay_mod'], true) . '</div>';
161:                         } else {
162:                             $string = i18n('No data found!');
163:                         }
164:                     }
165:                 }
166:                 break;
167: 
168:             case 'inused_module':
169:                 global $cfg;
170:                 $module = new cApiModule();
171:                 if ((int) $_REQUEST['id'] > 0 && $module->moduleInUse((int) $_REQUEST['id'], true)) {
172:                     $template = new cTemplate();
173:                     $usedTemplates = $module->getUsedTemplates();
174:                     if (count($usedTemplates) > 0) {
175:                         foreach ($usedTemplates as $i => $usedTemplate) {
176:                             if ($i % 2 == 0) {
177:                                 $template->set('d', 'CLASS', 'grey');
178:                             } else {
179:                                 $template->set('d', 'CLASS', 'white');
180:                             }
181: 
182:                             $template->set('d', 'NAME', $usedTemplate['tpl_name']);
183:                             $template->next();
184:                         }
185: 
186:                         $string = '<div class="inuse_info" >' . $template->generate($backendPath . $cfg['path']['templates'] . $cfg['templates']['inuse_lay_mod'], true) . '</div>';
187:                     } else {
188:                         $string = i18n('No data found!');
189:                     }
190:                 }
191:                 break;
192: 
193:             case 'inused_template':
194:                 global $cfg;
195:                 cInclude('backend', 'includes/functions.tpl.php');
196: 
197:                 if ((int) $_REQUEST['id'] > 0) {
198:                     $template = new cTemplate();
199:                     $template->reset();
200:                     $usedData = tplGetInUsedData((int) $_REQUEST['id']);
201: 
202:                     if (isset($usedData['cat'])) {
203:                         $template->set('s', 'HEAD_TYPE', i18n('Category'));
204:                         foreach ($usedData['cat'] as $i => $cat) {
205:                             $template->set('d', 'ID', $cat['idcat']);
206:                             $template->set('d', 'LANG', $cat['lang']);
207:                             $template->set('d', 'NAME', $cat['name']);
208:                             $template->next();
209:                         }
210:                         $template->set('s', 'HEAD_ID', i18n('idcat'));
211:                         $template->set('s', 'HEAD_LANG', i18n('idlang'));
212:                         $template->set('s', 'HEAD_NAME', i18n('Name'));
213:                         $response = $template->generate($backendPath . $cfg['path']['templates'] . $cfg['templates']['inuse_tpl'], true);
214:                     }
215: 
216:                     $template->reset();
217: 
218:                     if (isset($usedData['art'])) {
219:                         $template->set('s', 'HEAD_TYPE', i18n('Article'));
220:                         foreach ($usedData['art'] as $i => $aArt) {
221:                             $template->set('d', 'ID', $aArt['idart']);
222:                             $template->set('d', 'LANG', $aArt['lang']);
223:                             $template->set('d', 'NAME', $aArt['title']);
224:                             $template->next();
225:                         }
226:                         $template->set('s', 'HEAD_ID', i18n('idart'));
227:                         $template->set('s', 'HEAD_LANG', i18n('idlang'));
228:                         $template->set('s', 'HEAD_NAME', i18n('Name'));
229:                         $response .= $template->generate($backendPath . $cfg['path']['templates'] . $cfg['templates']['inuse_tpl'], true);
230:                     }
231: 
232:                     $string = '<div class="inuse_info" >' . $response . '</div>';
233:                 } else {
234:                     $string = i18n('No data found!');
235:                 }
236: 
237:                 break;
238: 
239:             case 'scaleImage':
240:                 // Access to frontend configuration only when needed, clients config may not available everywhere in the backend
241:                 $frontendURL = cRegistry::getFrontendUrl();
242:                 $frontendPath = cRegistry::getFrontendPath();
243: 
244:                 $filename_a = $_REQUEST['url'];
245:                 $filename = str_replace($frontendURL, $frontendPath, $filename_a);
246:                 // $filename muss not url path(http://) sondern globale PC
247:                 // Path(c:/) sein.
248:                 $filetype = cString::getPartOfString($filename, cString::getStringLength($filename) - 4, 4);
249:                 switch (cString::toLowerCase($filetype)) {
250:                     case '.gif':
251:                         $string = cApiImgScale($filename, 428, 210);
252:                         break;
253:                     case '.png':
254:                         $string = cApiImgScale($filename, 428, 210);
255:                         break;
256:                     case '.jpg':
257:                         $string = cApiImgScale($filename, 428, 210);
258:                         break;
259:                     case 'jpeg':
260:                         $string = cApiImgScale($filename, 428, 210);
261:                         break;
262:                     default:
263:                         $string = $filename_a;
264:                         break;
265:                 }
266:                 // if can not scale, so $string is NULL, then show the
267:                 // original image
268:                 if ($string == '') {
269:                     $filename = str_replace($frontendPath, $frontendURL, $filename_a);
270:                     $string = $filename;
271:                 }
272:                 break;
273: 
274:             case 'imagelist':
275:                 $dirName = (string) $_REQUEST['dir'];
276:                 $imageId = (int) $_REQUEST['id'];
277:                 $idArtLang = (int) $_REQUEST['idartlang'];
278: 
279:                 $art = new cApiArticleLanguage($idArtLang, true);
280:                 $artReturn = $art->getContent('CMS_IMGEDITOR', $imageId);
281:                 $image = new cContentTypeImgeditor($artReturn, $imageId, array());
282: 
283:                 $string = $image->generateFileSelect($dirName);
284:                 break;
285: 
286:             case 'inlineeditart':
287: 
288:                 $languageCollection = new cApiArticleLanguageCollection();
289: 
290:                 for ($i = 0; $i < count($_REQUEST['fields']); $i++) {
291: 
292:                     $idartlang = $languageCollection->getIdByArticleIdAndLanguageId(cSecurity::toInteger($_REQUEST['fields'][$i]['idart']), cRegistry::getLanguageId());
293: 
294:                     $artLang = new cApiArticleLanguage(cSecurity::toInteger($idartlang));
295:                     $artLang->set('title', cSecurity::escapeString($_REQUEST['fields'][$i]['title']));
296:                     $artLang->set('artsort', cSecurity::escapeString($_REQUEST['fields'][$i]['index']));
297:                     $artLang->store();
298:                 }
299: 
300:                 break;
301: 
302:             case 'loadImageMeta':
303:                 $imageId = (int) $_REQUEST['id'];
304:                 $idArtLang = (int) $_REQUEST['idartlang'];
305: 
306:                 $art = new cApiArticleLanguage($idArtLang, true);
307:                 $artReturn = $art->getContent('CMS_IMGEDITOR', $imageId);
308:                 $image = new cContentTypeImgeditor($artReturn, $imageId, array());
309: 
310:                 $filename = (string) basename($_REQUEST['filename']);
311:                 $dirname = (string) dirname($_REQUEST['filename']);
312:                 if ($dirname != '.') {
313:                     $dirname .= '/';
314:                 } else {
315:                     $dirname = '';
316:                 }
317: 
318:                 $string = $image->getImageMeta($filename, $dirname);
319:                 break;
320: 
321:             case 'upl_mkdir':
322:                 $imageId = (int) $_REQUEST['id'];
323:                 $idArtLang = (int) $_REQUEST['idartlang'];
324:                 $path = (string) $_REQUEST['path'];
325:                 $name = (string) $_REQUEST['foldername'];
326: 
327:                 $art = new cApiArticleLanguage($idArtLang, true);
328:                 $artReturn = $art->getContent('CMS_IMGEDITOR', $imageId);
329:                 $image = new cContentTypeImgeditor($artReturn, $imageId, array());
330: 
331:                 $string = $image->uplmkdir($path, $name);
332:                 switch ($string) {
333:                     case 1:
334:                         break;
335:                     case '0702':
336:                         $string = i18n('Directory already exist.');
337:                         break;
338:                     case '0703':
339:                         $string = i18n('Directories with special characters and spaces are not allowed.');
340:                         break;
341:                     case '0704':
342:                         $string = i18n('Can not write directory.');
343:                         break;
344:                 }
345:                 break;
346: 
347:             case 'upl_upload':
348:                 $imageId = (int) $_REQUEST['id'];
349:                 $idArtLang = (int) $_REQUEST['idartlang'];
350:                 $path = (string) $_REQUEST['path'];
351:                 if ($path == '/') {
352:                     $path = '';
353:                 }
354: 
355:                 $art = new cApiArticleLanguage($idArtLang, true);
356:                 $artReturn = $art->getContent('CMS_IMGEDITOR', $imageId);
357:                 $image = new cContentTypeImgeditor($artReturn, $imageId, array());
358: 
359:                 $string = $image->uplupload($path);
360:                 break;
361: 
362:             case 'linkeditorarticleslist':
363:                 $id = (int) $_REQUEST['id'];
364:                 $idArtLang = (int) $_REQUEST['idartlang'];
365:                 $idCat = (string) $_REQUEST['idcat'];
366: 
367:                 $art = new cApiArticleLanguage($idArtLang, true);
368:                 $artReturn = $art->getContent('CMS_LINKEDITOR', $id);
369:                 $linkEditor = new cContentTypeLinkeditor($artReturn, $id, array());
370: 
371:                 if ($idCat === '') {
372:                     $activeIdcats = $linkEditor->getActiveIdcats();
373:                     $idCat        = $activeIdcats[0];
374:                 }
375: 
376:                 $string = $linkEditor->generateArticleSelect($idCat);
377:                 break;
378: 
379:             case 'linkeditordirlist':
380:                 $id = (int) $_REQUEST['id'];
381:                 $idArtLang = (int) $_REQUEST['idartlang'];
382:                 $levelId = (string) $_REQUEST['level'];
383:                 $parentidcat = (string) $_REQUEST['parentidcat'];
384: 
385:                 $art = new cApiArticleLanguage($idArtLang, true);
386:                 $artReturn = $art->getContent('CMS_LINKEDITOR', $id);
387:                 $linkEditor = new cContentTypeLinkeditor($artReturn, $id, array());
388: 
389:                 $string = $linkEditor->getCategoryList($linkEditor->buildCategoryArray($levelId, $parentidcat));
390:                 break;
391: 
392:             case 'linkeditorimagelist':
393:                 $dirName = (string) $_REQUEST['dir'];
394:                 $id = (int) $_REQUEST['id'];
395:                 $idArtLang = (int) $_REQUEST['idartlang'];
396: 
397:                 $art = new cApiArticleLanguage($idArtLang, true);
398:                 $artReturn = $art->getContent('CMS_LINKEDITOR', $id);
399:                 $linkEditor = new cContentTypeLinkeditor($artReturn, $id, array());
400: 
401:                 if ($dirName === '') {
402:                     $dirName = dirname($linkEditor->getFilename());
403:                 }
404: 
405:                 $string = $linkEditor->getUploadFileSelect($dirName);
406:                 break;
407: 
408:             case 'generaljstranslations':
409:                 $translations = array();
410:                 $translations['Confirmation Required'] = i18n('Confirmation Required');
411:                 $translations['OK'] = i18n('OK');
412:                 $translations['Cancel'] = i18n('Cancel');
413:                 $string = json_encode($translations);
414:                 break;
415: 
416:             case 'logfilecontent':
417:                 $type = cSecurity::escapeString($_REQUEST['logfile']);
418:                 $numberOfLines = cSecurity::toInteger($_REQUEST['numberOfLines']);
419:                 $cfg = cRegistry::getConfig();
420:                 if (in_array($type, $cfg['system_log']['allowed_filenames'])) {
421:                     $filename = $cfg['path']['frontend'] . DIRECTORY_SEPARATOR . $cfg['path']['logs'] . $type;
422:                     $lines = file($filename);
423:                     $lines = array_splice($lines, $numberOfLines * -1);
424:                     $string = implode('', $lines);
425:                 }
426:                 break;
427: 
428:             case 'updatepluginorder':
429:                 // only sysadmins can do this
430:                 if (cRegistry::getPerm()->have_perm()) {
431:                     $newOrder = cSecurity::toInteger($_POST['neworder']);
432:                     $pluginColl = new PimPluginCollection();
433:                     $pluginColl->select();
434:                     if ($newOrder <= 0 || $newOrder > $pluginColl->count()) {
435:                         $string = 'order must be > 0 and <= number of plugins';
436:                         break;
437:                     }
438: 
439:                     $pluginId = cSecurity::toInteger($_POST['idplugin']);
440:                     $plugin = new PimPlugin($pluginId);
441:                     $result = $plugin->updateExecOrder($newOrder);
442:                     if ($result === true) {
443:                         $string = 'ok';
444:                     }
445:                 } else {
446:                     $string = 'Unknown Ajax Action';
447:                 }
448:                 break;
449: 
450:             case 'verify_module':
451:                 $idmod = isset($_POST['idmod']) ? $_POST['idmod'] : NULL;
452:                 $inputType = isset($_POST['type']) ? $_POST['type'] : NULL;
453: 
454:                 // @see CON-2425 modules are checked by default
455:                 $moduleCheck = getSystemProperty('system', 'modulecheck');
456:                 $moduleCheck = ($moduleCheck == '' && $moduleCheck != 'false') || $moduleCheck == 'true' || $moduleCheck == '1';
457: 
458:                 $result = array(
459:                     'state' => 'ok',
460:                     'message' => i18n("Module successfully compiled")
461:                 );
462: 
463:                 if ($idmod && $inputType && $moduleCheck) {
464:                     $contenidoModuleHandler = new cModuleHandler($idmod);
465:                     switch ($inputType) {
466:                         case 'input':
467:                             $result = $contenidoModuleHandler->testInput();
468:                             break;
469:                         case 'output':
470:                             $result = $contenidoModuleHandler->testOutput();
471:                             break;
472:                         default:
473:                             $result = array(
474:                                 'state' => 'error',
475:                                 'message' => 'No cModuleHandler for ' . $idmod . ', or wrong code type: ' . $inputType
476:                             );
477:                     }
478: 
479:                     // create answer
480:                     if ($result['state']) {
481:                         $result['state'] = 'ok';
482:                         $result['message'] = i18n("Module successfully compiled");
483:                     } else {
484:                         $result['state'] = 'error';
485:                         $result['message'] = $result['errorMessage'];
486:                     }
487:                 }
488: 
489:                 $string = json_encode($result);
490:                 break;
491: 
492:             case 'authentication_fail':
493:                 $string = json_encode(array(
494:                     'state' => 'error',
495:                     'code' => 401,
496:                     'message' => 'Unauthorized',
497:                     'type' => 'authentication_failure'
498:                 ));
499:                 break;
500:             case 'custom':
501:                 $string = cApiCecHook::executeAndReturn('Contenido.AjaxMain.CustomCall', $_REQUEST['method']);
502:                 if($string === NULL) {
503:                     $string = 'Unknown Custom Ajax Action';
504:                 }
505:                 break;
506:             default:
507:                 // If action is unknown generate error message
508:                 $string = 'Unknown Ajax Action';
509:                 break;
510:         }
511: 
512:         return $string;
513:     }
514: 
515: }
516: