Exponential 6.0.13 Exponential Enterprise Open Source CMS - PHP Class Reference

ezsslzone.php
Go to the documentation of this file.
1 <?php
26 class eZSSLZone
27 {
28 const DEFAULT_SSL_PORT = 443;
29
37 static function enabled()
38 {
39 if ( isset( $GLOBALS['eZSSLZoneEnabled'] ) )
40 return $GLOBALS['eZSSLZoneEnabled'];
41
42 $enabled = false;
43 $ini = eZINI::instance();
44 if ( $ini->hasVariable( 'SSLZoneSettings', 'SSLZones' ) )
45 $enabled = ( $ini->variable( 'SSLZoneSettings', 'SSLZones' ) == 'enabled' );
46
47 return $GLOBALS['eZSSLZoneEnabled'] = $enabled;
48 }
49
53 static function cacheFileName()
54 {
55 return eZDir::path( array( eZSys::cacheDirectory(), 'ssl_zones_cache.php' ) );
56 }
57
61 static function clearCacheIfNeeded()
62 {
63 if ( eZSSLZone::enabled() )
64 eZSSLZone::clearCache();
65 }
66
70 static function clearCache()
71 {
72 eZDebugSetting::writeDebug( 'kernel-ssl-zone', 'Clearing caches.' );
73
74 // clear in-memory cache
75 unset( $GLOBALS['eZSSLZonesCachedPathStrings'] );
76
77 // and remove cache file
78 $cacheFileName = eZSSLZone::cacheFileName();
79 if ( file_exists( $cacheFileName ) )
80 unlink( $cacheFileName );
81 }
82
91 static function getSSLZones()
92 {
93 if ( !isset( $GLOBALS['eZSSLZonesCachedPathStrings'] ) ) // if in-memory cache does not exist
94 {
95 $cacheFileName = eZSSLZone::cacheFileName();
96 $cacheDirName = eZSys::cacheDirectory();
97
98 // if file cache does not exist then create it
99 if ( !is_readable( $cacheFileName ) )
100 {
101 $ini = eZINI::instance();
102 $sslSubtrees = $ini->variable( 'SSLZoneSettings', 'SSLSubtrees' );
103
104 if ( !isset( $sslSubtrees ) || !$sslSubtrees )
105 return array();
106
107 // if there are some content SSL zones defined in the ini settings
108 // then let's calculate path strings for them
109 $pathStringsArray = array();
110 foreach ( $sslSubtrees as $uri )
111 {
112 $elements = eZURLAliasML::fetchByPath( $uri );
113 if ( count( $elements ) == 0 )
114 {
115 eZDebug::writeError( "Cannot fetch URI '$uri'", __METHOD__ );
116 continue;
117 }
118 $action = $elements[0]->attribute( 'action' );
119 if ( !preg_match( "#^eznode:(.+)#", $action, $matches ) )
120 {
121 eZDebug::writeError( "Cannot decode action '$action' for URI '$uri'", __METHOD__ );
122 continue;
123 }
124 $nodeID = (int)$matches[1];
125 $node = eZContentObjectTreeNode::fetch( $nodeID );
126 if ( !$node instanceof eZContentObjectTreeNode )
127 {
128 eZDebug::writeError( "cannot fetch node by URI '$uri'", __METHOD__ );
129 continue;
130 }
131 $pathStringsArray[$uri] = $node->attribute( 'path_string' );
132 unset( $node );
133 }
134
135 // write calculated path strings to the file
136 if ( !file_exists( $cacheDirName ) )
137 {
138 eZDir::mkdir( $cacheDirName, false, true );
139 }
140
141 $fh = fopen( $cacheFileName, 'w' );
142 if ( $fh )
143 {
144 fwrite( $fh, "<?php\n\$pathStringsArray = " . var_export( $pathStringsArray, true ) . ";\n?>" );
145 fclose( $fh );
146
147 $perm = eZINI::instance()->variable( 'FileSettings', 'StorageFilePermissions' );
148 chmod( $cacheFileName, octdec( $perm ) );
149 }
150
151 return $GLOBALS['eZSSLZonesCachedPathStrings'] = $pathStringsArray;
152 }
153 else // if the cache file exists
154 {
155 // let's read its contents and return them
156 include_once( $cacheFileName ); // stores array to $pathStringsArray
157 return $GLOBALS['eZSSLZonesCachedPathStrings'] = $pathStringsArray;
158 }
159 }
160
161 // else if in-memory cache already exists then return its contents
162 $pathStringsArray = $GLOBALS['eZSSLZonesCachedPathStrings'];
163
164 return $pathStringsArray;
165 }
166
176 static function viewIsInArray( $module, $view, $moduleViews )
177 {
178 if ( in_array( "$module/$view", $moduleViews ) )
179 return 2;
180 if ( in_array( "$module/*", $moduleViews ) )
181 return 1;
182 return 0;
183 }
184
189 static function isKeepModeView( $module, $view )
190 {
191 $ini = eZINI::instance();
192 $viewsModes = $ini->variable( 'SSLZoneSettings', 'ModuleViewAccessMode' );
193 $sslViews = array_keys( $viewsModes, 'ssl' );
194 $keepModeViews = array_keys( $viewsModes, 'keep' );
195
196 if ( eZSSLZone::viewIsInArray( $module, $view, $keepModeViews ) <
197 eZSSLZone::viewIsInArray( $module, $view, $sslViews ) )
198 {
199 eZDebugSetting::writeDebug( 'kernel-ssl-zone', 'The view cannot choose access mode itself.' );
200 return false;
201 }
202
203 return true;
204 }
205
220 static function switchIfNeeded( $inSSL )
221 {
222 // if it's undefined whether we should redirect we do nothing
223 if ( !isset( $inSSL ) )
224 return;
225
226 // Disable any further redirection/usage of SSLZones, see EZP-22204
227 // Prevents inner modules from redirecting to SSL if requested
228 $GLOBALS['eZSSLZoneEnabled'] = false;
229
230 // $nowSSl is true if current access mode is HTTPS.
231 $nowSSL = eZSys::isSSLNow();
232
233 $requestURI = eZSys::requestURI();
234 $indexDir = eZSys::indexDir( false );
235
236 // If there are any $_GET parameters, those should be passed into the new URI
237 $getString = eZSys::queryString();
238
239 $sslZoneRedirectionURL = false;
240 if ( $nowSSL && !$inSSL )
241 {
242 // switch to plain HTTP
243 $ini = eZINI::instance();
244 $host = $ini->variable( 'SiteSettings', 'SiteURL' );
245 $port = parse_url( "http://$host", PHP_URL_PORT );
246 $host = eZSys::serverVariable( 'HTTP_HOST' );
247 $host = preg_replace( '/:\d+$/', '', $host );
248 if ( $port && $port != 80 )
249 $host .= ":$port";
250 $sslZoneRedirectionURL = "http://" . $host . $indexDir . $requestURI . $getString;
251 }
252 elseif ( !$nowSSL && $inSSL )
253 {
254 // switch to HTTPS
255 $host = eZSys::serverVariable( 'HTTP_HOST' );
256 $host = preg_replace( '/:\d+$/', '', $host );
257
258 $ini = eZINI::instance();
259 $sslPort = $ini->variable( 'SiteSettings', 'SSLPort' );
260 $sslPortString = ( $sslPort == eZSSLZone::DEFAULT_SSL_PORT ) ? '' : ":$sslPort";
261 $sslZoneRedirectionURL = "https://" . $host . $sslPortString . $indexDir . $requestURI . $getString;
262 }
263
264 if ( $sslZoneRedirectionURL ) // if a redirection URL is found
265 {
266 eZDebugSetting::writeDebug( 'kernel-ssl-zone', "redirecting to [$sslZoneRedirectionURL]" );
267 eZHTTPTool::redirect( $sslZoneRedirectionURL, array(), false, false );
268 eZExecution::cleanExit();
269 }
270 }
271
281 static function checkNodeID( $module, $view, $nodeID )
282 {
283 if ( !eZSSLZone::enabled() )
284 return;
285
286 /* If the given module/view is not in the list of 'keep mode' views,
287 * i.e. it cannot choose access mode itself,
288 * then do nothing.
289 */
290 if ( !eZSSLZone::isKeepModeView( $module, $view ) )
291 return;
292
293 // Fetch path string for the given node.
294 $pathStrings = eZPersistentObject::fetchObjectList(
295 eZContentObjectTreeNode::definition(), // def
296 array( 'path_string' ), // field_filters
297 array( 'node_id' => $nodeID ), // conds
298 null, // sorts
299 null, // limit
300 false // asObject
301 );
302
303 if ( !$pathStrings )
304 {
305 eZDebug::writeError( "Node #$nodeID not found", __METHOD__ );
306 return;
307 }
308
309 eZSSLZone::checkNodePath( $module, $view, $pathStrings[0]['path_string'] );
310 }
311
317 static function checkNode( $module, $view, &$node, $redirect = true )
318 {
319 if ( !eZSSLZone::enabled() )
320 return;
321
322 /* If the given module/view is not in the list of 'keep mode' views,
323 * i.e. it cannot choose access mode itself,
324 * then do nothing.
325 */
326 if ( !eZSSLZone::isKeepModeView( $module, $view ) )
327 return;
328
329 $pathString = $node->attribute( 'path_string' );
330
331 return eZSSLZone::checkNodePath( $module, $view, $pathString, $redirect );
332 }
333
339 static function checkNodePath( $module, $view, $pathString, $redirect = true )
340 {
341 if ( !eZSSLZone::enabled() )
342 return;
343
344 /* If the given module/view is not in the list of 'keep mode' views,
345 * i.e. it cannot choose access mode itself,
346 * then do nothing.
347 */
348 if ( !$redirect && !eZSSLZone::isKeepModeView( $module, $view ) )
349 return;
350
351 // Decide whether the node belongs to an SSL zone or not.
352 $sslZones = eZSSLZone::getSSLZones();
353
354 $inSSLZone = false;
355 foreach ( $sslZones as $sslZonePathString )
356 {
357 if ( strpos( $pathString, $sslZonePathString ) === 0 )
358 {
359 $inSSLZone = true;
360 break;
361 }
362 }
363
364 eZDebugSetting::writeDebug( 'kernel-ssl-zone',
365 ( $inSSLZone ? 'yes' : 'no' ),
366 "Does the node having path $pathString belong to an SSL zone?" );
367
368 if ( $redirect )
369 eZSSLZone::switchIfNeeded( $inSSLZone );
370
371 return $inSSLZone;
372 }
373
379 static function checkObject( $module, $view, $object )
380 {
381 if ( !eZSSLZone::enabled() )
382 return;
383
384 /* If the given module/view is not in the list of 'keep mode' views,
385 * i.e. it cannot choose access mode itself,
386 * then do nothing.
387 */
388 if ( !eZSSLZone::isKeepModeView( $module, $view ) )
389 return;
390
391 $pathStringList = eZPersistentObject::fetchObjectList(
392 eZContentObjectTreeNode::definition(), // def
393 array( 'path_string' ), // field_filters
394 array( 'contentobject_id' => $object->attribute( 'id' ) ), // conds
395 null, // sorts
396 null, // limit
397 false // asObject
398 );
399
400 if ( is_array( $pathStringList ) && count( $pathStringList ) )
401 {
402 /* The object has some assigned nodes.
403 * If at least one of those nodes belongs to an SSL zone,
404 * we switch to SSL.
405 */
406
407 // "flatten" the array
408 array_walk( $pathStringList, function( &$a ) { $a = $a['path_string']; } );
409 }
410 else
411 {
412 /* The object has no assigned nodes.
413 * Let's work with its parent nodes.
414 * If at least one of the parent nodes belongs to an SSL zone,
415 * we switch to SSL.
416 */
417 $pathStringList = array();
418 $nodes = $object->parentNodes( $object->attribute( 'current' ) );
419 if ( !is_array( $nodes ) )
420 {
421 eZDebug::writeError( 'Object ' . $object->attribute( 'is' ) .
422 'does not have neither assigned nor parent nodes.' );
423 }
424 else
425 {
426 foreach( $nodes as $node )
427 {
428 $pathStringList[] = $node->attribute( 'path_string' );
429 }
430 }
431 }
432
433 $inSSL = false; // does the object belong to an SSL zone?
434 foreach ( $pathStringList as $pathString )
435 {
436 if ( eZSSLZone::checkNodePath( $module, $view, $pathString, false ) )
437 {
438 $inSSL = true;
439 break;
440 }
441 }
442
443 eZSSLZone::switchIfNeeded( $inSSL );
444 }
445
451 static function checkModuleView( $module, $view )
452 {
453 if ( !eZSSLZone::enabled() )
454 return;
455
456 $ini = eZINI::instance();
457 $viewsModes = $ini->variable( 'SSLZoneSettings', 'ModuleViewAccessMode' );
458
459 $sslViews = array_keys( $viewsModes, 'ssl' );
460 $keepModeViews = array_keys( $viewsModes, 'keep' );
461
462 $sslPriority = eZSSLZone::viewIsInArray( $module, $view, $sslViews );
463 $keepModePriority = eZSSLZone::viewIsInArray( $module, $view, $keepModeViews );
464
465 if ( $sslPriority && $keepModePriority && $sslPriority == $keepModePriority )
466 {
467 eZDebug::writeError( "Configuration error: view $module/$view is defined both as 'ssl' and 'keep'",
468 'eZSSLZone' );
469 return;
470 }
471
472 /* If the view belongs to the list of views we should not change access mode for,
473 * then do nothing.
474 * (however, the view may do access mode switch itself later)
475 */
476 if ( $keepModePriority > $sslPriority )
477 {
478 eZDebugSetting::writeDebug( 'kernel-ssl-zone', 'Keeping current access mode...' );
479 return;
480 }
481
482 /* Otherwise we look if the view is in the list of SSL views,
483 * and if it is, we switch to SSL. Else, if it's not, we switch to plain HTTP.
484 */
485 $inSSL = ( $sslPriority > 0 );
486
487 eZDebugSetting::writeDebug( 'kernel-ssl-zone',
488 ( isset( $inSSL ) ? ( $inSSL?'yes':'no') : 'dunno' ),
489 'Should we use SSL for this view?' );
490
491 // Change access mode if we need to.
492 eZSSLZone::switchIfNeeded( $inSSL );
493 }
494 }
495 ?>
eZContentObjectTreeNode
Definition: ezcontentobjecttreenode.php:17
eZContentObjectTreeNode\definition
static definition()
Definition: ezcontentobjecttreenode.php:52
eZContentObjectTreeNode\fetch
static fetch( $nodeID=false, $lang=false, $asObject=true, $conditions=false)
Definition: ezcontentobjecttreenode.php:3058
eZDebugSetting\writeDebug
static writeDebug( $conditionName, $string, $label="")
Definition: ezdebugsetting.php:127
eZDebug\writeError
static writeError( $string, $label="", $backgroundClass="")
Definition: ezdebug.php:545
eZDir\mkdir
static mkdir( $dir, $perm=false, $recursive=false)
Definition: ezdir.php:73
eZDir\path
static path( $names, $includeEndSeparator=false, $type=self::SEPARATOR_UNIX)
Definition: ezdir.php:237
eZExecution\cleanExit
static cleanExit()
Definition: ezexecution.php:100
eZHTTPTool\redirect
static redirect( $path, $parameters=array(), $status=false, $encodeURL=true, $returnRedirectObject=false)
Definition: ezhttptool.php:593
eZPersistentObject\fetchObjectList
static fetchObjectList( $def, $field_filters=null, $conds=null, $sorts=null, $limit=null, $asObject=true, $grouping=false, $custom_fields=null, $custom_tables=null, $custom_conds=null)
Definition: ezpersistentobject.php:806
eZSSLZone
SSL zones handling functionality.
eZSys\indexDir
static indexDir( $withAccessList=true)
Definition: ezsys.php:593
eZSys\isSSLNow
static isSSLNow()
Definition: ezsys.php:744
eZSys\serverVariable
static serverVariable( $variableName, $quiet=false)
Definition: ezsys.php:856
eZSys\requestURI
static requestURI()
Definition: ezsys.php:1262
eZSys\queryString
static queryString()
Definition: ezsys.php:607
eZSys\cacheDirectory
static cacheDirectory()
Definition: ezsys.php:527
eZURLAliasML\fetchByPath
static fetchByPath( $uriString, $glob=false)
Definition: ezurlaliasml.php:1253
Copyright © 1998 – 2026 7x. All rights reserved. Licensed under the GNU GPLv2+.