PHP sanitise_filepath函数代码示例

/**
 * Returns a list of upgrade files relative to the $upgrade_path dir.
 *
 * @param string $upgrade_path The directory that has upgrade scripts
 * @return array|false
 * @access private
 *
 * @todo the wire and groups plugins and the installer are using this
 */
function elgg_get_upgrade_files($upgrade_path = null)
{
    if (!$upgrade_path) {
        $upgrade_path = elgg_get_root_path() . 'engine/lib/upgrades/';
    }
    $upgrade_path = sanitise_filepath($upgrade_path);
    $handle = opendir($upgrade_path);
    if (!$handle) {
        return false;
    }
    $upgrade_files = array();
    while ($upgrade_file = readdir($handle)) {
        // make sure this is a well formed upgrade.
        if (is_dir($upgrade_path . '$upgrade_file')) {
            continue;
        }
        $upgrade_version = elgg_get_upgrade_file_version($upgrade_file);
        if (!$upgrade_version) {
            continue;
        }
        $upgrade_files[] = $upgrade_file;
    }
    sort($upgrade_files);
    return $upgrade_files;
}

/**
 * Read a folder structure for a zip file
 *
 * @param ElggObject $folder  the folder to read
 * @param string     $prepend current prefix
 *
 * @return array
 */
function file_tools_get_zip_structure($folder, $prepend)
{
    $entries = [];
    if (!empty($prepend)) {
        $prepend = ltrim(sanitise_filepath($prepend), '/');
    }
    if (empty($folder)) {
        $parent_guid = 0;
    } else {
        $parent_guid = $folder->getGUID();
    }
    // get subfolder of this folder
    $entities = new ElggBatch('elgg_get_entities_from_metadata', ['type' => 'object', 'subtype' => FILE_TOOLS_SUBTYPE, 'limit' => false, 'metadata_name_value_pairs' => ['parent_guid' => $parent_guid]]);
    /* @var $subfolder ElggObject */
    foreach ($entities as $subfolder) {
        $path = $prepend . $subfolder->title;
        $entries[] = ['directory' => $path, 'files' => file_tools_has_files($subfolder->getGUID())];
        $entries = array_merge($entries, file_tools_get_zip_structure($subfolder, $path));
    }
    return $entries;
}

 /**
  * Loads the plugin by GUID or path.
  *
  * @warning Unlike other ElggEntity objects, you cannot null instantiate
  *          ElggPlugin. You must point it to an actual plugin GUID or location.
  *
  * @param mixed $plugin The GUID of the ElggPlugin object or the path of the plugin to load.
  *
  * @throws PluginException
  */
 public function __construct($plugin)
 {
     if (!$plugin) {
         throw new PluginException(elgg_echo("PluginException:NullInstantiated"));
     }
     // ElggEntity can be instantiated with a guid or an object.
     // @todo plugins w/id 12345
     if (is_numeric($plugin) || is_object($plugin)) {
         ElggObject::__construct($plugin);
         $this->path = elgg_get_plugins_path() . $this->getID();
     } else {
         $plugin_path = elgg_get_plugins_path();
         // not a full path, so assume an id
         // use the default path
         if (strpos($plugin, $plugin_path) !== 0) {
             $plugin = $plugin_path . $plugin;
         }
         // path checking is done in the package
         $plugin = sanitise_filepath($plugin);
         $this->path = $plugin;
         $path_parts = explode("/", rtrim($plugin, "/"));
         $plugin_id = array_pop($path_parts);
         $this->pluginID = $plugin_id;
         // check if we're loading an existing plugin
         $existing_plugin = elgg_get_plugin_from_id($this->pluginID);
         $existing_guid = null;
         if ($existing_plugin) {
             $existing_guid = $existing_plugin->guid;
         }
         // load the rest of the plugin
         ElggObject::__construct($existing_guid);
     }
     if ($this->site_guid == elgg_get_site_entity()->getGUID()) {
         _elgg_cache_plugin_by_id($this);
     }
 }

/**
 * When given a full path, finds translation files for a language and loads them
 *
 * This function was added in 1.9.4 to make it possible to load translations
 * for individual languages on-demand. This is needed in order to send
 * notifications in the recipient's language (see #3151 and #7241).
 *
 * @todo Replace this function in 1.10 by adding $language as the third parameter
 *       to register_translations().
 *
 * @access private
 * @since 1.9.4
 *
 * @param string $path     Full path of the directory (with trailing slash)
 * @param string $language Language code
 * @return bool success
 */
function _elgg_register_translations_for_language($path, $language)
{
    global $CONFIG;
    $path = sanitise_filepath($path);
    // Make a note of this path just in case we need to register this language later
    if (!isset($CONFIG->language_paths)) {
        $CONFIG->language_paths = array();
    }
    $CONFIG->language_paths[$path] = true;
    $language_file = "{$path}{$language}.php";
    if (!file_exists($language_file)) {
        elgg_log("Could not find language file: {$language_file}", 'NOTICE');
        return false;
    }
    $result = (include_once $language_file);
    elgg_log("Translations loaded from: {$language_file}", "INFO");
    // The old (< 1.9) translation files call add_translation() independently.
    // The new ones however just return the translations array. In this case
    // we need to add the translation here.
    if (is_array($result)) {
        return add_translation($language, $result);
    }
    return true;
}

 /**
  * When given a full path, finds translation files and loads them
  *
  * @param string $path     Full path
  * @param bool   $load_all If true all languages are loaded, if
  *                         false only the current language + en are loaded
  *
  * @return bool success
  */
 function registerTranslations($path, $load_all = false)
 {
     $path = sanitise_filepath($path);
     // Make a note of this path just incase we need to register this language later
     if (!isset($GLOBALS['_ELGG']->language_paths)) {
         $GLOBALS['_ELGG']->language_paths = array();
     }
     $GLOBALS['_ELGG']->language_paths[$path] = true;
     // Get the current language based on site defaults and user preference
     $current_language = $this->getCurrentLanguage();
     _elgg_services()->logger->info("Translations loaded from: {$path}");
     // only load these files unless $load_all is true.
     $load_language_files = array('en.php', "{$current_language}.php");
     $load_language_files = array_unique($load_language_files);
     $handle = opendir($path);
     if (!$handle) {
         _elgg_services()->logger->error("Could not open language path: {$path}");
         return false;
     }
     $return = true;
     while (false !== ($language = readdir($handle))) {
         // ignore bad files
         if (substr($language, 0, 1) == '.' || substr($language, -4) !== '.php') {
             continue;
         }
         if (in_array($language, $load_language_files) || $load_all) {
             $result = (include_once $path . $language);
             if ($result === false) {
                 $return = false;
                 continue;
             } elseif (is_array($result)) {
                 $this->addTranslation(basename($language, '.php'), $result);
             }
         }
     }
     return $return;
 }

/**
 * Serves up screenshots for plugins from
 * admin_plugin_screenshot/<plugin_id>/<size>/<ss_name>.<ext>
 *
 * @param array $pages The pages array
 * @return bool
 * @access private
 */
function _elgg_admin_plugin_screenshot_page_handler($pages)
{
    set_input('plugin_id', elgg_extract(0, $pages));
    set_input('size', elgg_extract(1, $pages, 'thumbnail'));
    // the rest of the string is the filename
    $filename_parts = array_slice($pages, 2);
    $filename = implode('/', $filename_parts);
    $filename = sanitise_filepath($filename, false);
    set_input('filename', $filename);
    echo elgg_view_resource('admin/plugin_screenshot.img');
    return true;
}

/**
 * A default page handler
 * Tries to locate a suitable file to include. Only works for core pages, not plugins.
 *
 * @param array  $page    The page URL elements
 * @param string $handler The base handler
 *
 * @return true|false Depending on success
 * @deprecated 1.8
 */
function default_page_handler($page, $handler)
{
    global $CONFIG;
    elgg_deprecated_notice("default_page_handler is deprecated", "1.8");
    $page = implode('/', $page);
    // protect against including arbitary files
    $page = str_replace("..", "", $page);
    $callpath = $CONFIG->path . $handler . "/" . $page;
    if (is_dir($callpath)) {
        $callpath = sanitise_filepath($callpath);
        $callpath .= "index.php";
        if (file_exists($callpath)) {
            if (include $callpath) {
                return TRUE;
            }
        }
    } else {
        if (file_exists($callpath)) {
            include $callpath;
            return TRUE;
        }
    }
    return FALSE;
}

 /**
  * Returns the plugin's full path with trailing slash.
  *
  * @return string
  */
 public function getPath()
 {
     return sanitise_filepath($this->path);
 }

/**
 * Loads configuration related to Elgg as an application
 *
 * This runs on the engine boot and loads from the datalists database table.
 * 
 * @see _elgg_engine_boot()
 * 
 * @access private
 */
function _elgg_load_application_config()
{
    global $CONFIG;
    $install_root = str_replace("\\", "/", dirname(dirname(dirname(__FILE__))));
    $defaults = array('path' => "{$install_root}/", 'plugins_path' => "{$install_root}/mod/", 'language' => 'en', 'pluginspath' => "{$install_root}/mod/");
    foreach ($defaults as $name => $value) {
        if (empty($CONFIG->{$name})) {
            $CONFIG->{$name} = $value;
        }
    }
    $GLOBALS['_ELGG']->view_path = "{$install_root}/views/";
    // set cookie values for session and remember me
    _elgg_configure_cookies($CONFIG);
    if (!is_memcache_available()) {
        _elgg_services()->datalist->loadAll();
    }
    // allow sites to set dataroot and simplecache_enabled in settings.php
    if (isset($CONFIG->dataroot)) {
        $CONFIG->dataroot = sanitise_filepath($CONFIG->dataroot);
        $GLOBALS['_ELGG']->dataroot_in_settings = true;
    } else {
        $dataroot = datalist_get('dataroot');
        if (!empty($dataroot)) {
            $CONFIG->dataroot = $dataroot;
        }
        $GLOBALS['_ELGG']->dataroot_in_settings = false;
    }
    if (isset($CONFIG->simplecache_enabled)) {
        $GLOBALS['_ELGG']->simplecache_enabled_in_settings = true;
    } else {
        $simplecache_enabled = datalist_get('simplecache_enabled');
        if ($simplecache_enabled !== false) {
            $CONFIG->simplecache_enabled = $simplecache_enabled;
        } else {
            $CONFIG->simplecache_enabled = 1;
        }
        $GLOBALS['_ELGG']->simplecache_enabled_in_settings = false;
    }
    $system_cache_enabled = datalist_get('system_cache_enabled');
    if ($system_cache_enabled !== false) {
        $CONFIG->system_cache_enabled = $system_cache_enabled;
    } else {
        $CONFIG->system_cache_enabled = 1;
    }
    // needs to be set before system, init for links in html head
    $CONFIG->lastcache = (int) datalist_get("simplecache_lastupdate");
    $GLOBALS['_ELGG']->i18n_loaded_from_cache = false;
    // this must be synced with the enum for the entities table
    $CONFIG->entity_types = array('group', 'object', 'site', 'user');
}

 * @subpackage Core
 * @author Curverider Ltd
 * @link http://elgg.org/
 */
define('INSTALLING', TRUE);
elgg_set_viewtype('failsafe');
// Set failsafe again incase we get an exception thrown
if (is_installed()) {
    forward();
}
if (get_input('settings') == 'go') {
    if (!datalist_get('default_site')) {
        // Sanitise
        $path = sanitise_filepath(get_input('path'));
        $dataroot = sanitise_filepath(get_input('dataroot'));
        $url = sanitise_filepath(get_input('wwwroot'));
        // Blank?
        if ($dataroot == "/") {
            throw new InstallationException(elgg_echo('InstallationException:DatarootBlank'));
        }
        // That it's valid
        if (stripos($dataroot, $path) !== false) {
            throw new InstallationException(sprintf(elgg_echo('InstallationException:DatarootUnderPath'), $dataroot));
        }
        // Check data root is writable
        if (!is_writable($dataroot)) {
            throw new InstallationException(sprintf(elgg_echo('InstallationException:DatarootNotWritable'), $dataroot));
        }
        $site = new ElggSite();
        $site->name = get_input('sitename');
        $site->url = $url;

 /**
  * Returns a list of upgrade files relative to the $upgrade_path dir.
  *
  * @param string $upgrade_path The up
  * @return array|false
  */
 protected function getUpgradeFiles($upgrade_path = null)
 {
     if (!$upgrade_path) {
         $upgrade_path = _elgg_services()->config->get('path') . 'engine/lib/upgrades/';
     }
     $upgrade_path = sanitise_filepath($upgrade_path);
     $handle = opendir($upgrade_path);
     if (!$handle) {
         return false;
     }
     $upgrade_files = array();
     while ($upgrade_file = readdir($handle)) {
         // make sure this is a wellformed upgrade.
         if (is_dir($upgrade_path . '$upgrade_file')) {
             continue;
         }
         $upgrade_version = $this->getUpgradeFileVersion($upgrade_file);
         if (!$upgrade_version) {
             continue;
         }
         $upgrade_files[] = $upgrade_file;
     }
     sort($upgrade_files);
     return $upgrade_files;
 }

<?php

$current_dir = elgg_extract('current_dir', $vars);
$current_dir = sanitise_filepath($current_dir);
$root_dir = elgg_get_data_path() . $current_dir;
if (!is_dir($root_dir)) {
    echo elgg_format_element('div', [], elgg_echo('dataroot_browser:list:invalid_dir'));
    return;
}
$dir_data = scandir($root_dir);
// breadcrumb
echo elgg_view('dataroot_browser/breadcrumb', ['current_dir' => $current_dir]);
// go through all folders/file in this dir
$dir_items = [];
$file_items = [];
$dir_classes = ['dataroot_browser_name', 'dataroot_browser_folder'];
$file_classes = ['dataroot_browser_name', 'dataroot_browser_file'];
$posix_getpwuid = is_callable('posix_getpwuid');
$base_url = 'admin/administer_utilities/dataroot_browser';
$download_url = 'action/dataroot_browser/download';
$delete_url = 'action/dataroot_browser/delete_file';
$dh = new DirectoryIterator($root_dir);
foreach ($dh as $file) {
    $cells = [];
    if ($file->isDot()) {
        continue;
    }
    $last_modified = date('Y/m/d H:i:s', $file->getMTime());
    if ($posix_getpwuid) {
        $owner = posix_getpwuid($file->getOwner());
        $owner = elgg_extract('name', $owner, $file->getOwner());

/**
 * Loads configuration related to Elgg as an application
 *
 * This runs on the engine boot and loads from the datalists database table.
 * 
 * @see _elgg_engine_boot()
 * 
 * @access private
 */
function _elgg_load_application_config()
{
    global $CONFIG, $DATALIST_CACHE;
    $install_root = str_replace("\\", "/", dirname(dirname(dirname(__FILE__))));
    $defaults = array('path' => "{$install_root}/", 'view_path' => "{$install_root}/views/", 'plugins_path' => "{$install_root}/mod/", 'language' => 'en', 'viewpath' => "{$install_root}/views/", 'pluginspath' => "{$install_root}/mod/");
    foreach ($defaults as $name => $value) {
        if (empty($CONFIG->{$name})) {
            $CONFIG->{$name} = $value;
        }
    }
    // set cookie values for session and remember me
    if (!isset($CONFIG->cookies)) {
        $CONFIG->cookies = array();
    }
    if (!isset($CONFIG->cookies['session'])) {
        $CONFIG->cookies['session'] = array();
    }
    $session_defaults = session_get_cookie_params();
    $session_defaults['name'] = 'Elgg';
    $CONFIG->cookies['session'] = array_merge($session_defaults, $CONFIG->cookies['session']);
    if (!isset($CONFIG->cookies['remember_me'])) {
        $CONFIG->cookies['remember_me'] = array();
    }
    $session_defaults['name'] = 'elggperm';
    $session_defaults['expire'] = strtotime("+30 days");
    $CONFIG->cookies['remember_me'] = array_merge($session_defaults, $CONFIG->cookies['remember_me']);
    // load entire datalist
    // This can cause OOM problems when the datalists table is large
    // @todo make a list of datalists that we want to get in one grab
    if (!is_memcache_available()) {
        $result = get_data("SELECT * FROM {$CONFIG->dbprefix}datalists");
        if ($result) {
            foreach ($result as $row) {
                $DATALIST_CACHE[$row->name] = $row->value;
            }
        }
    }
    $path = datalist_get('path');
    if (!empty($path)) {
        $CONFIG->path = $path;
    }
    // allow sites to set dataroot and simplecache_enabled in settings.php
    if (isset($CONFIG->dataroot)) {
        $CONFIG->dataroot = sanitise_filepath($CONFIG->dataroot);
        $CONFIG->dataroot_in_settings = true;
    } else {
        $dataroot = datalist_get('dataroot');
        if (!empty($dataroot)) {
            $CONFIG->dataroot = $dataroot;
        }
        $CONFIG->dataroot_in_settings = false;
    }
    if (isset($CONFIG->simplecache_enabled)) {
        $CONFIG->simplecache_enabled_in_settings = true;
    } else {
        $simplecache_enabled = datalist_get('simplecache_enabled');
        if ($simplecache_enabled !== false) {
            $CONFIG->simplecache_enabled = $simplecache_enabled;
        } else {
            $CONFIG->simplecache_enabled = 1;
        }
        $CONFIG->simplecache_enabled_in_settings = false;
    }
    $system_cache_enabled = datalist_get('system_cache_enabled');
    if ($system_cache_enabled !== false) {
        $CONFIG->system_cache_enabled = $system_cache_enabled;
    } else {
        $CONFIG->system_cache_enabled = 1;
    }
    // initialize context here so it is set before the first get_input call
    $CONFIG->context = array();
    // needs to be set before system, init for links in html head
    $CONFIG->lastcache = (int) datalist_get("simplecache_lastupdate");
    $CONFIG->i18n_loaded_from_cache = false;
    // this must be synced with the enum for the entities table
    $CONFIG->entity_types = array('group', 'object', 'site', 'user');
}

<?php

translation_editor_gatekeeper();
$language = get_input('language');
if (empty($language)) {
    register_error(elgg_echo('error:missing_data'));
    forward(REFERER);
}
$base_path = elgg_get_data_path() . 'translation_editor' . DIRECTORY_SEPARATOR;
$filename = $base_path . $language . DIRECTORY_SEPARATOR . 'translation_editor_cleanup.json';
$filename = sanitise_filepath($filename, false);
if (!file_exists($filename)) {
    register_error(elgg_echo('translation_editor:action:cleanup:remove:error:no_file'));
    forward(REFERER);
}
$contents = file_get_contents($filename);
$removed = json_decode($contents, true);
$fh = tmpfile();
fputcsv($fh, ['Plugin ID', 'key', 'translation'], ';');
foreach ($removed as $plugin_id => $translations) {
    if (!is_array($translations)) {
        continue;
    }
    foreach ($translations as $key => $value) {
        fputcsv($fh, [$plugin_id, $key, $value], ';');
    }
}
// read the csv in to a var before output
$contents = '';
rewind($fh);
while (!feof($fh)) {

 /**
  * Returns array of all plugin files
  *
  * @param array $valid_extensions array of extensions of files that will be returned
  *
  * @return \SplFileInfo[]
  */
 private function getPluginFiles($valid_extensions = ['php', 'html', 'js'])
 {
     $skip_folders = ['.git', 'vendor', 'vendors', '.svn'];
     $files = [];
     $base_path = sanitise_filepath(elgg_get_plugins_path() . $this->plugin->getID());
     $directory = new \RecursiveDirectoryIterator($base_path, \RecursiveDirectoryIterator::SKIP_DOTS);
     $iterator = new \RecursiveIteratorIterator($directory);
     foreach ($iterator as $file) {
         $file_folder = sanitise_filepath($file->getPath());
         $file_folder = str_replace($base_path, '', $file_folder);
         foreach ($skip_folders as $skip) {
             if (strpos($file_folder, $skip) === 0) {
                 continue 2;
             }
         }
         if (!in_array($file->getExtension(), $valid_extensions)) {
             continue;
         }
         $files[] = $file;
     }
     return $files;
 }