9.5/_file_persistence_slot_8php_source.html

<?php

declare(strict_types = 1);

namespace ‪TYPO3\CMS\Form\Slot;


/*

 * This file is part of the TYPO3 CMS project.

 *

 * It is free software; you can redistribute it and/or modify it under

 * the terms of the GNU General Public License, either version 2

 * of the License, or any later version.

 *

 * For the full copyright and license information, please read the

 * LICENSE.txt file that was distributed with this source code.

 *

 * The TYPO3 project - inspiring people to share!

 */


use ‪TYPO3\CMS\Core\Resource\FileInterface;

use ‪TYPO3\CMS\Core\Resource\FolderInterface;

use ‪TYPO3\CMS\Core\SingletonInterface;

use ‪TYPO3\CMS\Core\Utility\GeneralUtility;

use ‪TYPO3\CMS\Core\Utility\StringUtility;

use ‪TYPO3\CMS\Form\Mvc\Persistence\FormPersistenceManager;


class ‪FilePersistenceSlot implements ‪SingletonInterface

{

    const ‪COMMAND_FILE_ADD = 'fileAdd';

    const ‪COMMAND_FILE_CREATE = 'fileCreate';

    const ‪COMMAND_FILE_MOVE = 'fileMove';

    const ‪COMMAND_FILE_RENAME = 'fileRename';

    const ‪COMMAND_FILE_REPLACE = 'fileReplace';

    const ‪COMMAND_FILE_SET_CONTENTS = 'fileSetContents';


    protected ‪$definedInvocations = [];


    protected ‪$allowedInvocations = [];


    public function ‪getContentSignature(string $content): string

    {

        return GeneralUtility::hmac($content);

    }


    public function ‪defineInvocation(string $command, bool $type = null)

    {

        $this->definedInvocations[$command] = $type;

        if ($type === null) {

            unset($this->definedInvocations[$command]);

        }

    }


    public function ‪allowInvocation(

        string $command,

        string $combinedFileIdentifier,

        string $contentSignature = null

    ): bool {

        $index = $this->‪searchAllowedInvocation(

            $command,

            $combinedFileIdentifier,

            $contentSignature

        );


        if ($index !== null) {

            return false;

        }


        $this->allowedInvocations[] = [

            'command' => $command,

            'combinedFileIdentifier' => $combinedFileIdentifier,

            'contentSignature' => $contentSignature,

        ];


        return true;

    }


    public function ‪onPreFileCreate(string $fileName, FolderInterface $targetFolder): void

    {

        $combinedFileIdentifier = $this->‪buildCombinedIdentifier(

            $targetFolder,

            $fileName

        );


        $this->‪assertFileName(

            self::COMMAND_FILE_CREATE,

            $combinedFileIdentifier

        );

    }


    public function ‪onPreFileAdd(

        string $targetFileName,

        FolderInterface $targetFolder,

        string $sourceFilePath

    ): void {

        $combinedFileIdentifier = $this->‪buildCombinedIdentifier(

            $targetFolder,

            $targetFileName

        );

        // while assertFileName below also checks if it's a form definition

        // we want an early return here to get rid of the file_get_contents

        // below which would be triggered on every file add command otherwise

        if (!$this->‪isFormDefinition($combinedFileIdentifier)) {

            return;

        }

        $this->‪assertFileName(

            self::COMMAND_FILE_ADD,

            $combinedFileIdentifier,

            file_get_contents($sourceFilePath)

        );

    }


    public function ‪onPreFileRename(FileInterface $file, string $targetFileName): void

    {

        $combinedFileIdentifier = $this->‪buildCombinedIdentifier(

            $file->getParentFolder(),

            $targetFileName

        );


        $this->‪assertFileName(

            self::COMMAND_FILE_RENAME,

            $combinedFileIdentifier

        );

    }


    public function ‪onPreFileReplace(FileInterface $file, string $localFilePath): void

    {

        $combinedFileIdentifier = $this->‪buildCombinedIdentifier(

            $file->getParentFolder(),

            $file->getName()

        );


        $this->‪assertFileName(

            self::COMMAND_FILE_REPLACE,

            $combinedFileIdentifier

        );

    }


    public function ‪onPreFileMove(FileInterface $file, FolderInterface $targetFolder, string $targetFileName): void

    {

        // Skip check, in case file extension would not change during this

        // command. In case e.g. "file.txt" shall be renamed to "file.form.yaml"

        // the invocation still has to be granted.

        // Any file moved to a recycle folder is accepted as well.

        if ($this->‪isFormDefinition($file->getIdentifier())

            && $this->isFormDefinition($targetFileName)

            || $this->isRecycleFolder($targetFolder)) {

            return;

        }


        $combinedFileIdentifier = $this->‪buildCombinedIdentifier(

            $targetFolder,

            $targetFileName

        );


        $this->‪assertFileName(

            self::COMMAND_FILE_MOVE,

            $combinedFileIdentifier

        );

    }


    public function ‪onPreFileSetContents(FileInterface $file, $content = null): void

    {

        $combinedFileIdentifier = $this->‪buildCombinedIdentifier(

            $file->getParentFolder(),

            $file->getName()

        );


        $this->‪assertFileName(

            self::COMMAND_FILE_SET_CONTENTS,

            $combinedFileIdentifier,

            $content

        );

    }


    protected function ‪assertFileName(

        string $command,

        string $combinedFileIdentifier,

        string $content = null

    ): void {

        if (!$this->‪isFormDefinition($combinedFileIdentifier)) {

            return;

        }


        $definedInvocation = $this->definedInvocations[$command] ?? null;

        // whitelisted command

        if ($definedInvocation === true) {

            return;

        }

        // blacklisted command

        if ($definedInvocation === false) {

            throw new FormDefinitionPersistenceException(

                sprintf(

                    'Persisting form definition "%s" is denied',

                    $combinedFileIdentifier

                ),

                1530281201

            );

        }


        $contentSignature = null;

        if ($content !== null) {

            $contentSignature = $this->‪getContentSignature((string)$content);

        }

        $allowedInvocationIndex = $this->‪searchAllowedInvocation(

            $command,

            $combinedFileIdentifier,

            $contentSignature

        );


        if ($allowedInvocationIndex === null) {

            throw new FormDefinitionPersistenceException(

                sprintf(

                    'Persisting form definition "%s" is denied',

                    $combinedFileIdentifier

                ),

                1530281202

            );

        }

        unset($this->allowedInvocations[$allowedInvocationIndex]);

    }


    protected function ‪searchAllowedInvocation(

        string $command,

        string $combinedFileIdentifier,

        string $contentSignature = null

    ): ?int {

        foreach ($this->allowedInvocations as $index => $allowedInvocation) {

            if (

                $command === $allowedInvocation['command']

                && $combinedFileIdentifier === $allowedInvocation['combinedFileIdentifier']

                && $contentSignature === $allowedInvocation['contentSignature']

            ) {

                return $index;

            }

        }

        return null;

    }


    protected function ‪buildCombinedIdentifier(FolderInterface $folder, string $fileName): string

    {

        return sprintf(

            '%d:%s%s',

            $folder->getStorage()->getUid(),

            $folder->getIdentifier(),

            $fileName

        );

    }


    protected function ‪isFormDefinition(string $identifier): bool

    {

        return ‪StringUtility::endsWith(

            $identifier,

            ‪FormPersistenceManager::FORM_DEFINITION_FILE_EXTENSION

        );

    }


    protected function ‪isRecycleFolder(FolderInterface $folder): bool

    {

        $role = $folder->getStorage()->getRole($folder);

        return $role === ‪FolderInterface::ROLE_RECYCLER;

    }

}