AbstractController.php

Go to the documentation of this file.

<?php
namespace TYPO3\CMS\Install\Controller;

use TYPO3\CMS\Core\Utility\GeneralUtility;
use TYPO3\CMS\Install\Service\EnableFileService;

class AbstractController {

    protected $objectManager = NULL;

    protected $session = NULL;

    protected $authenticationActions = array();

    protected function isInstallToolAvailable() {
        $installToolEnableService = $this->objectManager->get('TYPO3\\CMS\\Install\\Service\\EnableFileService');
        if ($installToolEnableService->isFirstInstallAllowed()) {
            return TRUE;
        }
        return $installToolEnableService->checkInstallToolEnableFile();
    }

    protected function outputInstallToolNotEnabledMessageIfNeeded() {
        if (!$this->isInstallToolAvailable()) {
            if (!EnableFileService::isFirstInstallAllowed() && !is_dir(PATH_typo3conf)) {
                $action = $this->objectManager->get('TYPO3\\CMS\\Install\\Controller\\Action\\Common\\AccessNotAllowedAction');
                $action->setAction('accessNotAllowed');
            } else {
                $action = $this->objectManager->get('TYPO3\\CMS\\Install\\Controller\\Action\\Common\\InstallToolDisabledAction');
                $action->setAction('installToolDisabled');
            }
            $action->setController('common');
            $this->output($action->handle());
        }
    }

    protected function outputInstallToolPasswordNotSetMessageIfNeeded() {
        if (!$this->isInitialInstallationInProgress()
            && (empty($GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword']))
        ) {
            $action = $this->objectManager->get('TYPO3\\CMS\\Install\\Controller\\Action\\Common\\InstallToolPasswordNotSetAction');
            $action->setController('common');
            $action->setAction('installToolPasswordNotSet');
            $this->output($action->handle());
        }
    }

    protected function checkSessionToken() {
        $postValues = $this->getPostValues();
        $tokenOk = FALSE;
        if (count($postValues) > 0) {
            // A token must be given as soon as there is POST data
            if (isset($postValues['token'])) {
                $formProtection = \TYPO3\CMS\Core\FormProtection\FormProtectionFactory::get(
                    'TYPO3\\CMS\\Core\\FormProtection\\InstallToolFormProtection'
                );
                $action = $this->getAction();
                if ($action === '') {
                    throw new Exception(
                        'No POST action given for token check',
                        1369326593
                    );
                }
                $tokenOk = $formProtection->validateToken($postValues['token'], 'installTool', $action);
            }
        } else {
            $tokenOk = TRUE;
        }

        $this->handleSessionTokenCheck($tokenOk);
    }

    protected function handleSessionTokenCheck($tokenOk) {
        if (!$tokenOk) {
            $this->session->resetSession();
            $this->session->startSession();

            if ($this->isInitialInstallationInProgress()) {
                $this->redirect();
            } else {
                $message = $this->objectManager->get('TYPO3\\CMS\\Install\\Status\\ErrorStatus');
                $message->setTitle('Invalid form token');
                $message->setMessage(
                    'The form protection token was invalid. You have been logged out, please log in and try again.'
                );
                $this->output($this->loginForm($message));
            }
        }
    }

    protected function checkSessionLifetime() {
        if ($this->session->isExpired()) {
            // Session expired, log out user, start new session
            $this->session->resetSession();
            $this->session->startSession();

            $this->handleSessionLifeTimeExpired();
        }
    }

    protected function handleSessionLifeTimeExpired() {
        if ($this->isInitialInstallationInProgress()) {
            $this->redirect();
        } else {
            $message = $this->objectManager->get('TYPO3\\CMS\\Install\\Status\\ErrorStatus');
            $message->setTitle('Session expired');
            $message->setMessage(
                'Your Install Tool session has expired. You have been logged out, please log in and try again.'
            );
            $this->output($this->loginForm($message));
        }
    }

    protected function loginForm(\TYPO3\CMS\Install\Status\StatusInterface $message = NULL) {
        $action = $this->objectManager->get('TYPO3\\CMS\\Install\\Controller\\Action\\Common\\LoginForm');
        $action->setController('common');
        $action->setAction('login');
        $action->setToken($this->generateTokenForAction('login'));
        $action->setPostValues($this->getPostValues());
        if ($message) {
            $action->setMessages(array($message));
        }
        $content = $action->handle();
        return $content;
    }

    protected function loginIfRequested() {
        $action = $this->getAction();
        $postValues = $this->getPostValues();
        if ($action === 'login') {
            $password = '';
            $validPassword = FALSE;
            if (isset($postValues['values']['password'])) {
                $password = $postValues['values']['password'];
                $installToolPassword = $GLOBALS['TYPO3_CONF_VARS']['BE']['installToolPassword'];
                $saltFactory = \TYPO3\CMS\Saltedpasswords\Salt\SaltFactory::getSaltingInstance($installToolPassword);
                if (is_object($saltFactory)) {
                    $validPassword = $saltFactory->checkPassword($password, $installToolPassword);
                } elseif (md5($password) === $installToolPassword) {
                    // Update install tool password
                    $saltFactory = \TYPO3\CMS\Saltedpasswords\Salt\SaltFactory::getSaltingInstance(NULL, 'BE');
                    $configurationManager = $this->objectManager->get('TYPO3\\CMS\\Core\\Configuration\\ConfigurationManager');
                    $configurationManager->setLocalConfigurationValueByPath(
                        'BE/installToolPassword',
                        $saltFactory->getHashedPassword($password)
                    );
                    $validPassword = TRUE;
                }
            }
            if ($validPassword) {
                $this->session->setAuthorized();
                $this->sendLoginSuccessfulMail();
                $this->redirect();
            } else {
                $saltFactory = \TYPO3\CMS\Saltedpasswords\Salt\SaltFactory::getSaltingInstance(NULL, 'BE');
                $hashedPassword = $saltFactory->getHashedPassword($password);
                $message = $this->objectManager->get('TYPO3\\CMS\\Install\\Status\\ErrorStatus');
                $message->setTitle('Login failed');
                $message->setMessage('Given password does not match the install tool login password. ' .
                    'Calculated hash: ' . $hashedPassword);
                $this->sendLoginFailedMail();
                $this->output($this->loginForm($message));
            }
        }
    }

    protected function outputLoginFormIfNotAuthorized() {
        if (!$this->session->isAuthorized()
            && !$this->isInitialInstallationInProgress()
        ) {
            $this->output($this->loginForm());
        } else {
            $this->session->refreshSession();
        }
    }

    protected function sendLoginSuccessfulMail() {
        $warningEmailAddress = $GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'];
        if ($warningEmailAddress) {
            $mailMessage = $this->objectManager->get('TYPO3\\CMS\\Core\\Mail\\MailMessage');
            $mailMessage
                ->addTo($warningEmailAddress)
                ->setSubject('Install Tool Login at \'' . $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'] . '\'')
                ->addFrom($this->getSenderEmailAddress(), $this->getSenderEmailName())
                ->setBody('There has been an Install Tool login at TYPO3 site'
                . ' \'' . $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'] . '\''
                . ' (' . GeneralUtility::getIndpEnv('HTTP_HOST') . ')'
                . ' from remote address \'' . GeneralUtility::getIndpEnv('REMOTE_ADDR') . '\''
                . ' (' . GeneralUtility::getIndpEnv('REMOTE_HOST') . ')')
                ->send();
        }
    }

    protected function sendLoginFailedMail() {
        $formValues = GeneralUtility::_GP('install');
        $warningEmailAddress = $GLOBALS['TYPO3_CONF_VARS']['BE']['warning_email_addr'];
        if ($warningEmailAddress) {
            $mailMessage = $this->objectManager->get('TYPO3\\CMS\\Core\\Mail\\MailMessage');
            $mailMessage
                ->addTo($warningEmailAddress)
                ->setSubject('Install Tool Login ATTEMPT at \'' . $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'] . '\'')
                ->addFrom($this->getSenderEmailAddress(), $this->getSenderEmailName())
                ->setBody('There has been an Install Tool login attempt at TYPO3 site'
                . ' \'' . $GLOBALS['TYPO3_CONF_VARS']['SYS']['sitename'] . '\''
                . ' (' . GeneralUtility::getIndpEnv('HTTP_HOST') . ')'
                . ' The last 5 characters of the MD5 hash of the password tried was \'' . substr(md5($formValues['password']), -5) . '\''
                . ' remote address was \'' . GeneralUtility::getIndpEnv('REMOTE_ADDR') . '\''
                . ' (' . GeneralUtility::getIndpEnv('REMOTE_HOST') . ')')
                ->send();
        }
    }

    protected function generateTokenForAction($action = NULL) {
        if (!$action) {
            $action = $this->getAction();
        }
        if ($action === '') {
            throw new Exception(
                'Token must have a valid action name',
                1369326592
            );
        }
        $formProtection = \TYPO3\CMS\Core\FormProtection\FormProtectionFactory::get(
            'TYPO3\\CMS\\Core\\FormProtection\\InstallToolFormProtection'
        );
        return $formProtection->generateToken('installTool', $action);
    }

    protected function isInitialInstallationInProgress() {
        $configurationManager = $this->objectManager->get('TYPO3\\CMS\\Core\\Configuration\\ConfigurationManager');

        $localConfigurationFileLocation = $configurationManager->getLocalConfigurationFileLocation();
        $localConfigurationFileExists = @is_file($localConfigurationFileLocation);
        $result = FALSE;
        if (!$localConfigurationFileExists
            || !empty($GLOBALS['TYPO3_CONF_VARS']['SYS']['isInitialInstallationInProgress'])
        ) {
            $result = TRUE;
        }
        return $result;
    }

    protected function initializeSession() {
        $this->session = $this->objectManager->get('TYPO3\\CMS\\Install\\Service\\SessionService');
        if (!$this->session->hasSession()) {
            $this->session->startSession();
        }
    }

    protected function addSessionMessages(array $messages) {
        foreach ($messages as $message) {
            $this->session->addMessage($message);
        }
    }

    protected function initializeObjectManager() {
        $objectManager = GeneralUtility::makeInstance('TYPO3\\CMS\\Extbase\\Object\\ObjectManager');
        $this->objectManager = $objectManager;
    }

    protected function loadBaseExtensions() {
        if ($this->isDbalEnabled()) {
            require(\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::extPath('dbal') . 'ext_localconf.php');
            $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['dbal']['backend']
                = 'TYPO3\\CMS\\Core\\Cache\\Backend\\NullBackend';
            $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['dbal']['options'] = array();
        }

        require(\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::extPath('extbase') . 'ext_localconf.php');
        require(\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::extPath('fluid') . 'ext_localconf.php');

        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_datamapfactory_datamap']['backend']
            = 'TYPO3\\CMS\\Core\\Cache\\Backend\\NullBackend';
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_datamapfactory_datamap']['options'] = array();
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_object']['backend']
            = 'TYPO3\\CMS\\Core\\Cache\\Backend\\NullBackend';
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_object']['options'] = array();
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_reflection']['backend']
            = 'TYPO3\\CMS\\Core\\Cache\\Backend\\NullBackend';
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_reflection']['options'] = array();
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_typo3dbbackend_tablecolumns']['backend']
            = 'TYPO3\\CMS\\Core\\Cache\\Backend\\NullBackend';
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['extbase_typo3dbbackend_tablecolumns']['options'] = array();
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['fluid_template']['backend']
            = 'TYPO3\\CMS\\Core\\Cache\\Backend\\NullBackend';
        $GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']['fluid_template']['options'] = array();

        $cacheManager = GeneralUtility::makeInstance('TYPO3\\CMS\\Core\\Cache\\CacheManager');
        $cacheManager->setCacheConfigurations($GLOBALS['TYPO3_CONF_VARS']['SYS']['caching']['cacheConfigurations']);
    }

    protected function isDbalEnabled() {
        if (\TYPO3\CMS\Core\Utility\ExtensionManagementUtility::isLoaded('adodb')
            && \TYPO3\CMS\Core\Utility\ExtensionManagementUtility::isLoaded('dbal')
        ) {
            return TRUE;
        }
        return FALSE;
    }

    protected function validateAuthenticationAction($action) {
        if (!in_array($action, $this->authenticationActions)) {
            throw new Exception(
                $action . ' is not a valid authentication action',
                1369345838
            );
        }
    }

    protected function getAction() {
        $formValues = GeneralUtility::_GP('install');
        $action = '';
        if (isset($formValues['action'])) {
            $action = $formValues['action'];
        }
        if ($action !== ''
            && $action !== 'login'
            && $action !== 'loginForm'
            && $action !== 'logout'
            && !in_array($action, $this->authenticationActions)
        ) {
            throw new Exception(
                'Invalid action ' . $action,
                1369325619
            );
        }
        return $action;
    }

    protected function getPostValues() {
        $postValues = GeneralUtility::_POST('install');
        if (!is_array($postValues)) {
            $postValues = array();
        }
        return $postValues;
    }

    protected function redirect($controller = '', $action = '') {
        $getPostValues = GeneralUtility::_GP('install');

        $parameters = array();

        // Current redirect count
        if (isset($getPostValues['redirectCount'])) {
            $redirectCount = (int)$getPostValues['redirectCount'] + 1;
        } else {
            $redirectCount = 0;
        }
        if ($redirectCount >= 10) {
            // Abort a redirect loop by throwing an exception. Calling this method
            // some times in a row is ok, but break a loop if this happens too often.
            throw new Exception\RedirectLoopException(
                'Redirect loop aborted. If this message is shown again after a reload,' .
                    ' your setup is so weird that the install tool is unable to handle it.' .
                    ' Please make sure to remove the "install[redirectCount]" parameter from your request or' .
                    ' restart the install tool from the backend navigation.',
                1380581244
            );
        }
        $parameters[] = 'install[redirectCount]=' . $redirectCount;

        // Add context parameter in case this script was called within backend scope
        $context = 'install[context]=standalone';
        if (isset($getPostValues['context']) && $getPostValues['context'] === 'backend') {
            $context = 'install[context]=backend';
        }
        $parameters[] = $context;

        // Add controller parameter
        $controllerParameter = 'install[controller]=step';
        if ((isset($getPostValues['controller']) && $getPostValues['controller'] === 'tool')
            || $controller === 'tool'
        ) {
            $controllerParameter = 'install[controller]=tool';
        }
        $parameters[] = $controllerParameter;

        // Add action if specified
        if (strlen($action) > 0) {
            $parameters[] = 'install[action]=' . $action;
        }

        $redirectLocation = 'Install.php?' . implode('&', $parameters);

        \TYPO3\CMS\Core\Utility\HttpUtility::redirect(
            $redirectLocation,
            \TYPO3\CMS\Core\Utility\HttpUtility::HTTP_STATUS_303
        );
    }

    protected function output($content = '') {
        header('Content-Type: text/html; charset=utf-8');
        header('Cache-Control: no-cache, must-revalidate');
        header('Pragma: no-cache');
        echo $content;
        die;
    }

    protected function getSenderEmailAddress() {
        return !empty($GLOBALS['TYPO3_CONF_VARS']['MAIL']['defaultMailFromAddress'])
            ? $GLOBALS['TYPO3_CONF_VARS']['MAIL']['defaultMailFromAddress']
            : 'no-reply@example.com';
    }

    protected function getSenderEmailName() {
        return !empty($GLOBALS['TYPO3_CONF_VARS']['MAIL']['defaultMailFromName'])
            ? $GLOBALS['TYPO3_CONF_VARS']['MAIL']['defaultMailFromName']
            : 'TYPO3 CMS install tool';
    }
}