Input.php

   1 <?php
   2 /*=====================================================================*\
   3 || ###################################################################
   4 || # Blue Static ISSO Framework
   5 || # Copyright ©2002-[#]year[#] Iris Studios, Inc.
   6 || #
   7 || # This program is free software; you can redistribute it and/or modify
   8 || # it under the terms of the GNU General Public License as published by
   9 || # the Free Software Foundation; version [#]gpl[#] of the License.
  10 || #
  11 || # This program is distributed in the hope that it will be useful, but
  12 || # WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY
  13 || # or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
  14 || # more details.
  15 || #
  16 || # You should have received a copy of the GNU General Public License along
  17 || # with this program; if not, write to the Free Software Foundation, Inc.,
  18 || # 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
  19 || ###################################################################
  20 \*=====================================================================*/
  21
  22 /**
  23 * Input sanitizer (Input.php)
  24 *
  25 * @package      ISSO
  26 */
  27
  28 /**#@+
  29 * Input cleaning type constant
  30 */
  31 /**
  32 * Integer type
  33 */
  34 define('TYPE_INT', 1);
  35
  36 /**
  37 * Unsigned integer
  38 */
  39 define('TYPE_UINT', 2);
  40
  41 /**
  42 * Float type
  43 */
  44 define('TYPE_FLOAT', 4);
  45
  46 /**
  47 * Boolean type
  48 */
  49 define('TYPE_BOOL', 8);
  50
  51 /**
  52 * String - cleaned
  53 */
  54 define('TYPE_STR', 16);
  55
  56 /**
  57 * String - deliberate unclean
  58 */
  59 define('TYPE_STRUN', 32);
  60
  61 /**
  62 * No cleaning - here for use in API
  63 */
  64 define('TYPE_NONE', 64);
  65
  66 /**
  67 * Macro for using DB->escape_binary() without cleaning - used in API
  68 */
  69 define('TYPE_BIN', 128);
  70 /**#@-*/
  71
  72 /**
  73 * Input Sanitizer
  74 *
  75 * This class is responsible for cleaning input.
  76 *
  77 * Constants:
  78 *               ISSO_CHECK_POST_REFERER - Will check to make sure that on POSTed
  79 *                                                                       data, the referer matches the host
  80 *
  81 * @author               Blue Static
  82 * @copyright    Copyright ©2002 - [#]year[#], Blue Static
  83 * @version              $Revision$
  84 * @package              ISSO
  85 *
  86 */
  87 class BSInput
  88 {
  89         /**
  90         * An array of sanitized variables that have been cleaned for HTML tag openers and double quotes
  91         * @var  array
  92         */
  93         public $in = array();
  94
  95         /**
  96         * If we are running with magic_quotes_gpc on or off
  97         * @var  int
  98         */
  99         private $magicquotes = 0;
 100
 101         // ###################################################################
 102         /**
 103         * Constructor: set instance variables and execute input cleaning
 104         */
 105         public function __construct()
 106         {
 107                 // magic quotes
 108                 $this->magicquotes = get_magic_quotes_gpc();
 109                 set_magic_quotes_runtime(0);
 110
 111                 // some debug info that's always useful
 112                 BSRegister::Debug('magic_quotes_gpc = ' . $this->magicquotes);
 113                 BSRegister::Debug('register_globals = ' . ini_get('register_globals'));
 114
 115                 $this->sanitizeInputData();
 116
 117                 if (defined('ISSO_CHECK_POST_REFERER'))
 118                 {
 119                         $this->checkPostReferer();
 120                 }
 121         }
 122
 123         // ###################################################################
 124         /**
 125         * Recursive XSS cleaner
 126         *
 127         * @param        mixed   Unsanitized REQUEST data
 128         *
 129         * @return       mixed   Sanitized data
 130         */
 131         private function sanitizeDataRecursive($data)
 132         {
 133                 foreach ($data AS $key => $value)
 134                 {
 135                         if (is_array($value))
 136                         {
 137                                 $data["$key"] = $this->sanitizeDataRecursive($value);
 138                         }
 139                         else
 140                         {
 141                                 if ($this->magicquotes)
 142                                 {
 143                                         $value = str_replace("\'", "'", $value);
 144                                 }
 145                                 $data["$key"] = $this->sanitize($value);
 146                         }
 147                 }
 148                 return $data;
 149         }
 150
 151         // ###################################################################
 152         /**
 153         * Simple way to protect against HTML attacks with Unicode support
 154         *
 155         * @param        string  Unsanitzed text
 156         *
 157         * @return       string  Properly protected text that only encodes potential threats
 158         */
 159         public function sanitize($text)
 160         {
 161                 if ($this->magicquotes)
 162                 {
 163                         return str_replace(array('<', '>', '\"', '"'), array('&lt;', '&gt;', '&quot;', '&quot;'), $text);
 164                 }
 165                 else
 166                 {
 167                         return str_replace(array('<', '>', '"'), array('&lt;', '&gt;', '&quot;'), $text);
 168                 }
 169         }
 170
 171         // ###################################################################
 172         /**
 173         * Unicode-safe entity encoding system; similar to sanitize()
 174         *
 175         * @param        string  Unsanitized text
 176         *
 177         * @return       string  Unicode-safe sanitized text with entities preserved
 178         */
 179         public function entityEncode($text)
 180         {
 181                 $text = str_replace('&', '&amp;', $text);
 182                 $text = $this->sanitize($text);
 183                 return $text;
 184         }
 185
 186         // ###################################################################
 187         /**
 188         * Takes text that has been processed for HTML and unsanitizes it
 189         *
 190         * @param        string  Text that needs to be turned back into HTML
 191         *
 192         * @return       string  Unsanitized text
 193         */
 194         public function unsanitize($text)
 195         {
 196                 return str_replace(array('&lt;', '&gt;', '&quot;'), array('<', '>', '"'), $text);
 197         }
 198
 199         // ###################################################################
 200         /**
 201         * Smart addslashes() that only applies itself it the Magic Quotes GPC
 202         * is off. This should only be run on database query values that come
 203         * from ISSO->in[] input; data that needs sanitization should be run
 204         * through ISSO->DB->escape_string()
 205         *
 206         * @param        string  Some string
 207         * @param        bool    Force magic quotes to be off
 208         *
 209         * @return       string  String that has slashes added
 210         */
 211         public function escape($str, $force = true)
 212         {
 213                 if ($this->magicquotes AND !$force)
 214                 {
 215                         if (BSRegister::GetType('Db'))
 216                         {
 217                                 return BSRegister::GetType('Db')->escape_string(str_replace(array("\'", '\"'), array("'", '"'), $str));
 218                         }
 219                         return $str;
 220                 }
 221                 else
 222                 {
 223                         if (BSRegister::GetType('Db'))
 224                         {
 225                                 return BSRegister::GetType('Db')->escape_string($str);
 226                         }
 227                         return addslashes($str);
 228                 }
 229         }
 230
 231         // ###################################################################
 232         /**
 233         * Runs through all of the input data and sanitizes it.
 234         */
 235         private function sanitizeInputData()
 236         {
 237                 $this->in = $this->sanitizeDataRecursive(array_merge($_GET, $_POST, $_COOKIE));
 238         }
 239
 240         // ###################################################################
 241         /**
 242         * Sanitize function for something other than a string (which
 243         * everything is sanitized for if you use sanitizeInputData(). Cleaned
 244         * data is placed back into ISSO->in; this makes it so you don't have
 245         * to constantly intval() [etc.] data.
 246         *
 247         * @param        array   Array of elements to clean as varname => type
 248         */
 249         public function inputCleanArray($vars)
 250         {
 251                 foreach ($vars AS $varname => $type)
 252                 {
 253                         $this->inputClean($varname, $type);
 254                 }
 255         }
 256
 257         // ###################################################################
 258         /**
 259         * Sanitize function that does a single variable as oppoesd to an array
 260         * (see inputCleanArray() for more details)
 261         *
 262         * @param        string  Variable name in ISSO->in[]
 263         * @param        integer Sanitization type constant
 264         */
 265         public function inputClean($varname, $type)
 266         {
 267                 if (isset($this->in["$varname"]))
 268                 {
 269                         $this->in["$varname"] = $this->clean($this->in["$varname"], $type);
 270                 }
 271                 else
 272                 {
 273                         $this->in["$varname"] = $this->clean(null, $type);
 274                 }
 275
 276                 return $this->in["$varname"];
 277         }
 278
 279         // ###################################################################
 280         /**
 281         * Runs ISSO->escape() on a variable on ISSO->in[]. This is just a
 282         * short-hand wrapper so that queries can be shortened. When this is used,
 283         * the actual value in ISSO->in[] is not changed, only the return value
 284         * is escaped.
 285         *
 286         * @param        string  Input variable
 287         *
 288         * @return       string  Escaped input
 289         */
 290         public function inputEscape($varname)
 291         {
 292                 if (isset($this->in["$varname"]))
 293                 {
 294                         return $this->escape($this->in["$varname"]);
 295                 }
 296                 else
 297                 {
 298                         return $this->escape(null);
 299                 }
 300         }
 301
 302         // ###################################################################
 303         /**
 304         * Cleaning function that does the work for inputClean(); this is
 305         * moved here so it can be used to clean things that aren't in
 306         * ISSO->in[]
 307         *
 308         * @param        mixed   Data
 309         * @param        integer Sanitization type constant
 310         *
 311         * @return       mixed   Cleaned data
 312         */
 313         public function clean($value, $type)
 314         {
 315                 if (is_array($value))
 316                 {
 317                         return $this->cleanArray($value, $type);
 318                 }
 319
 320                 if ($type == TYPE_INT)
 321                 {
 322                         $value = intval($value);
 323                 }
 324                 else if ($type == TYPE_UINT)
 325                 {
 326                         $value = (($val = intval($value)) < 0 ? 0 : $val);
 327                 }
 328                 else if ($type == TYPE_FLOAT)
 329                 {
 330                         $value = floatval($value);
 331                 }
 332                 else if ($type == TYPE_BOOL)
 333                 {
 334                         $value = (bool)$value;
 335                 }
 336                 else if ($type == TYPE_STR)
 337                 {
 338                         $value = $value;
 339                 }
 340                 else if ($type == TYPE_STRUN)
 341                 {
 342                         $value = $this->unsanitize($value);
 343                 }
 344                 else if ($type == TYPE_NONE)
 345                 {
 346                         if ($this->magicquotes)
 347                         {
 348                                 $value = str_replace(array('\"', "\'"), array('"', "'"), $value);
 349                         }
 350                         else
 351                         {
 352                                 $value = $value;
 353                         }
 354                 }
 355                 else if ($type == TYPE_BIN)
 356                 {
 357                         $value = $value;
 358                 }
 359                 else
 360                 {
 361                         trigger_error('Invalid clean type specified in BSInput::clean()');
 362                         return;
 363                 }
 364
 365                 return $value;
 366         }
 367
 368         // ###################################################################
 369         /**
 370         * Recursion function for ISSO->clean()
 371         *
 372         * @param        array   Uncleaned array
 373         * @param        integer Sanitization type constant
 374         *
 375         * @return       array   Cleaned array of data
 376         */
 377         private function cleanArray($array, $type)
 378         {
 379                 foreach ($array AS $key => $value)
 380                 {
 381                         $array["$key"] = $this->clean($value, $type);
 382                 }
 383
 384                 return $array;
 385         }
 386
 387         // ###################################################################
 388         /**
 389         * Returns the lowercase version of the HTTP method (post or get)
 390         *
 391         * @return       string  HTTP method
 392         */
 393         public function getHttpMethod()
 394         {
 395                 $method = strtolower($_SERVER['REQUEST_METHOD']);
 396                 if (!in_array($method, array('get', 'post')))
 397                 {
 398                         trigger_error('Invalid server request method: ' . $method);
 399                 }
 400                 return $method;
 401         }
 402
 403         // ###################################################################
 404         /**
 405         * Checks to see if a POST refer is actually from us
 406         */
 407         private function checkPostReferer()
 408         {
 409                 if ($_SERVER['REQUEST_METHOD'] == 'POST')
 410                 {
 411                         $host = ($_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : $_ENV['HTTP_HOST'];
 412
 413                         if ($host AND $_SERVER['HTTP_REFERER'])
 414                         {
 415                                 $parts = parse_url($_SERVER['HTTP_REFERER']);
 416                                 $ourhost = $parts['host'] . (isset($parts['port']) ? ":$parts[port]" : '');
 417
 418                                 if ($ourhost != $host)
 419                                 {
 420                                         trigger_error('No external hosts are allowed to POST to this application');
 421                                         exit;
 422                                 }
 423                                 BSRegister::Debug('remote post check = ok');
 424                         }
 425                         else
 426                         {
 427                                 BSRegister::Debug('remote post check = FAILED');
 428                         }
 429                 }
 430         }
 431 }
 432
 433 /*=====================================================================*\
 434 || ###################################################################
 435 || # $HeadURL$
 436 || # $Id$
 437 || ###################################################################
 438 \*=====================================================================*/
 439 ?>