application/Utils.php

   1 <?php
   2 /**
   3  * Shaarli utilities
   4  */
   5
   6 /**
   7  * Logs a message to a text file
   8  *
   9  * The log format is compatible with fail2ban.
  10  *
  11  * @param string $logFile  where to write the logs
  12  * @param string $clientIp the client's remote IPv4/IPv6 address
  13  * @param string $message  the message to log
  14  */
  15 function logm($logFile, $clientIp, $message)
  16 {
  17     file_put_contents(
  18         $logFile,
  19         date('Y/m/d H:i:s').' - '.$clientIp.' - '.strval($message).PHP_EOL,
  20         FILE_APPEND
  21     );
  22 }
  23
  24 /**
  25  *  Returns the small hash of a string, using RFC 4648 base64url format
  26  *
  27  *  Small hashes:
  28  *   - are unique (well, as unique as crc32, at last)
  29  *   - are always 6 characters long.
  30  *   - only use the following characters: a-z A-Z 0-9 - _ @
  31  *   - are NOT cryptographically secure (they CAN be forged)
  32  *
  33  *  In Shaarli, they are used as a tinyurl-like link to individual entries,
  34  *  built once with the combination of the date and item ID.
  35  *  e.g. smallHash('20111006_131924' . 142) --> eaWxtQ
  36  *
  37  * @warning before v0.8.1, smallhashes were built only with the date,
  38  *          and their value has been preserved.
  39  *
  40  * @param string $text Create a hash from this text.
  41  *
  42  * @return string generated small hash.
  43  */
  44 function smallHash($text)
  45 {
  46     $t = rtrim(base64_encode(hash('crc32', $text, true)), '=');
  47     return strtr($t, '+/', '-_');
  48 }
  49
  50 /**
  51  * Tells if a string start with a substring
  52  *
  53  * @param string $haystack Given string.
  54  * @param string $needle   String to search at the beginning of $haystack.
  55  * @param bool   $case     Case sensitive.
  56  *
  57  * @return bool True if $haystack starts with $needle.
  58  */
  59 function startsWith($haystack, $needle, $case = true)
  60 {
  61     if ($case) {
  62         return (strcmp(substr($haystack, 0, strlen($needle)), $needle) === 0);
  63     }
  64     return (strcasecmp(substr($haystack, 0, strlen($needle)), $needle) === 0);
  65 }
  66
  67 /**
  68  * Tells if a string ends with a substring
  69  *
  70  * @param string $haystack Given string.
  71  * @param string $needle   String to search at the end of $haystack.
  72  * @param bool   $case     Case sensitive.
  73  *
  74  * @return bool True if $haystack ends with $needle.
  75  */
  76 function endsWith($haystack, $needle, $case = true)
  77 {
  78     if ($case) {
  79         return (strcmp(substr($haystack, strlen($haystack) - strlen($needle)), $needle) === 0);
  80     }
  81     return (strcasecmp(substr($haystack, strlen($haystack) - strlen($needle)), $needle) === 0);
  82 }
  83
  84 /**
  85  * Htmlspecialchars wrapper
  86  * Support multidimensional array of strings.
  87  *
  88  * @param mixed $input Data to escape: a single string or an array of strings.
  89  *
  90  * @return string|array escaped.
  91  */
  92 function escape($input)
  93 {
  94     if (null === $input) {
  95         return null;
  96     }
  97
  98     if (is_bool($input) || is_int($input) || is_float($input) || $input instanceof DateTimeInterface) {
  99         return $input;
 100     }
 101
 102     if (is_array($input)) {
 103         $out = array();
 104         foreach ($input as $key => $value) {
 105             $out[escape($key)] = escape($value);
 106         }
 107         return $out;
 108     }
 109     return htmlspecialchars($input, ENT_COMPAT, 'UTF-8', false);
 110 }
 111
 112 /**
 113  * Reverse the escape function.
 114  *
 115  * @param string $str the string to unescape.
 116  *
 117  * @return string unescaped string.
 118  */
 119 function unescape($str)
 120 {
 121     return htmlspecialchars_decode($str);
 122 }
 123
 124 /**
 125  * Sanitize link before rendering.
 126  *
 127  * @param array $link Link to escape.
 128  */
 129 function sanitizeLink(&$link)
 130 {
 131     $link['url'] = escape($link['url']); // useful?
 132     $link['title'] = escape($link['title']);
 133     $link['description'] = escape($link['description']);
 134     $link['tags'] = escape($link['tags']);
 135 }
 136
 137 /**
 138  * Checks if a string represents a valid date
 139
 140  * @param string $format The expected DateTime format of the string
 141  * @param string $string A string-formatted date
 142  *
 143  * @return bool whether the string is a valid date
 144  *
 145  * @see http://php.net/manual/en/class.datetime.php
 146  * @see http://php.net/manual/en/datetime.createfromformat.php
 147  */
 148 function checkDateFormat($format, $string)
 149 {
 150     $date = DateTime::createFromFormat($format, $string);
 151     return $date && $date->format($string) == $string;
 152 }
 153
 154 /**
 155  * Generate a header location from HTTP_REFERER.
 156  * Make sure the referer is Shaarli itself and prevent redirection loop.
 157  *
 158  * @param string $referer - HTTP_REFERER.
 159  * @param string $host - Server HOST.
 160  * @param array $loopTerms - Contains list of term to prevent redirection loop.
 161  *
 162  * @return string $referer - final referer.
 163  */
 164 function generateLocation($referer, $host, $loopTerms = array())
 165 {
 166     $finalReferer = './?';
 167
 168     // No referer if it contains any value in $loopCriteria.
 169     foreach (array_filter($loopTerms) as $value) {
 170         if (strpos($referer, $value) !== false) {
 171             return $finalReferer;
 172         }
 173     }
 174
 175     // Remove port from HTTP_HOST
 176     if ($pos = strpos($host, ':')) {
 177         $host = substr($host, 0, $pos);
 178     }
 179
 180     $refererHost = parse_url($referer, PHP_URL_HOST);
 181     if (!empty($referer) && (strpos($refererHost, $host) !== false || startsWith('?', $refererHost))) {
 182         $finalReferer = $referer;
 183     }
 184
 185     return $finalReferer;
 186 }
 187
 188 /**
 189  * Sniff browser language to set the locale automatically.
 190  * Note that is may not work on your server if the corresponding locale is not installed.
 191  *
 192  * @param string $headerLocale Locale send in HTTP headers (e.g. "fr,fr-fr;q=0.8,en;q=0.5,en-us;q=0.3").
 193  **/
 194 function autoLocale($headerLocale)
 195 {
 196     // Default if browser does not send HTTP_ACCEPT_LANGUAGE
 197     $locales = array('en_US', 'en_US.utf8', 'en_US.UTF-8');
 198     if (! empty($headerLocale)) {
 199         if (preg_match_all('/([a-z]{2,3})[-_]?([a-z]{2})?,?/i', $headerLocale, $matches, PREG_SET_ORDER)) {
 200             $attempts = [];
 201             foreach ($matches as $match) {
 202                 $first = [strtolower($match[1]), strtoupper($match[1])];
 203                 $separators = ['_', '-'];
 204                 $encodings = ['utf8', 'UTF-8'];
 205                 if (!empty($match[2])) {
 206                     $second = [strtoupper($match[2]), strtolower($match[2])];
 207                     $items = [$first, $separators, $second, ['.'], $encodings];
 208                 } else {
 209                     $items = [$first, $separators, $first, ['.'], $encodings];
 210                 }
 211                 $attempts = array_merge($attempts, iterator_to_array(cartesian_product_generator($items)));
 212             }
 213
 214             if (! empty($attempts)) {
 215                 $locales = array_merge(array_map('implode', $attempts), $locales);
 216             }
 217         }
 218     }
 219
 220     setlocale(LC_ALL, $locales);
 221 }
 222
 223 /**
 224  * Build a Generator object representing the cartesian product from given $items.
 225  *
 226  * Example:
 227  *   [['a'], ['b', 'c']]
 228  * will generate:
 229  *   [
 230  *      ['a', 'b'],
 231  *      ['a', 'c'],
 232  *   ]
 233  *
 234  * @param array $items array of array of string
 235  *
 236  * @return Generator representing the cartesian product of given array.
 237  *
 238  * @see https://en.wikipedia.org/wiki/Cartesian_product
 239  */
 240 function cartesian_product_generator($items)
 241 {
 242     if (empty($items)) {
 243         yield [];
 244     }
 245     $subArray = array_pop($items);
 246     if (empty($subArray)) {
 247         return;
 248     }
 249     foreach (cartesian_product_generator($items) as $item) {
 250         foreach ($subArray as $value) {
 251             yield $item + [count($item) => $value];
 252         }
 253     }
 254 }
 255
 256 /**
 257  * Generates a default API secret.
 258  *
 259  * Note that the random-ish methods used in this function are predictable,
 260  * which makes them NOT suitable for crypto.
 261  * BUT the random string is salted with the salt and hashed with the username.
 262  * It makes the generated API secret secured enough for Shaarli.
 263  *
 264  * PHP 7 provides random_int(), designed for cryptography.
 265  * More info: http://stackoverflow.com/questions/4356289/php-random-string-generator
 266
 267  * @param string $username Shaarli login username
 268  * @param string $salt     Shaarli password hash salt
 269  *
 270  * @return string|bool Generated API secret, 12 char length.
 271  *                     Or false if invalid parameters are provided (which will make the API unusable).
 272  */
 273 function generate_api_secret($username, $salt)
 274 {
 275     if (empty($username) || empty($salt)) {
 276         return false;
 277     }
 278
 279     return str_shuffle(substr(hash_hmac('sha512', uniqid($salt), $username), 10, 12));
 280 }
 281
 282 /**
 283  * Trim string, replace sequences of whitespaces by a single space.
 284  * PHP equivalent to `normalize-space` XSLT function.
 285  *
 286  * @param string $string Input string.
 287  *
 288  * @return mixed Normalized string.
 289  */
 290 function normalize_spaces($string)
 291 {
 292     return preg_replace('/\s{2,}/', ' ', trim($string));
 293 }
 294
 295 /**
 296  * Format the date according to the locale.
 297  *
 298  * Requires php-intl to display international datetimes,
 299  * otherwise default format '%c' will be returned.
 300  *
 301  * @param DateTimeInterface $date to format.
 302  * @param bool              $time Displays time if true.
 303  * @param bool              $intl Use international format if true.
 304  *
 305  * @return bool|string Formatted date, or false if the input is invalid.
 306  */
 307 function format_date($date, $time = true, $intl = true)
 308 {
 309     if (! $date instanceof DateTimeInterface) {
 310         return false;
 311     }
 312
 313     if (! $intl || ! class_exists('IntlDateFormatter')) {
 314         $format = $time ? '%c' : '%x';
 315         return strftime($format, $date->getTimestamp());
 316     }
 317
 318     $formatter = new IntlDateFormatter(
 319         setlocale(LC_TIME, 0),
 320         IntlDateFormatter::LONG,
 321         $time ? IntlDateFormatter::LONG : IntlDateFormatter::NONE
 322     );
 323
 324     return $formatter->format($date);
 325 }
 326
 327 /**
 328  * Check if the input is an integer, no matter its real type.
 329  *
 330  * PHP is a bit messy regarding this:
 331  *   - is_int returns false if the input is a string
 332  *   - ctype_digit returns false if the input is an integer or negative
 333  *
 334  * @param mixed $input value
 335  *
 336  * @return bool true if the input is an integer, false otherwise
 337  */
 338 function is_integer_mixed($input)
 339 {
 340     if (is_array($input) || is_bool($input) || is_object($input)) {
 341         return false;
 342     }
 343     $input = strval($input);
 344     return ctype_digit($input) || (startsWith($input, '-') && ctype_digit(substr($input, 1)));
 345 }
 346
 347 /**
 348  * Convert post_max_size/upload_max_filesize (e.g. '16M') parameters to bytes.
 349  *
 350  * @param string $val Size expressed in string.
 351  *
 352  * @return int Size expressed in bytes.
 353  */
 354 function return_bytes($val)
 355 {
 356     if (is_integer_mixed($val) || $val === '0' || empty($val)) {
 357         return $val;
 358     }
 359     $val = trim($val);
 360     $last = strtolower($val[strlen($val)-1]);
 361     $val = intval(substr($val, 0, -1));
 362     switch ($last) {
 363         case 'g':
 364             $val *= 1024;
 365         case 'm':
 366             $val *= 1024;
 367         case 'k':
 368             $val *= 1024;
 369     }
 370     return $val;
 371 }
 372
 373 /**
 374  * Return a human readable size from bytes.
 375  *
 376  * @param int $bytes value
 377  *
 378  * @return string Human readable size
 379  */
 380 function human_bytes($bytes)
 381 {
 382     if ($bytes === '') {
 383         return t('Setting not set');
 384     }
 385     if (! is_integer_mixed($bytes)) {
 386         return $bytes;
 387     }
 388     $bytes = intval($bytes);
 389     if ($bytes === 0) {
 390         return t('Unlimited');
 391     }
 392
 393     $units = [t('B'), t('kiB'), t('MiB'), t('GiB')];
 394     for ($i = 0; $i < count($units) && $bytes >= 1024; ++$i) {
 395         $bytes /= 1024;
 396     }
 397
 398     return round($bytes) . $units[$i];
 399 }
 400
 401 /**
 402  * Try to determine max file size for uploads (POST).
 403  * Returns an integer (in bytes) or formatted depending on $format.
 404  *
 405  * @param mixed $limitPost   post_max_size PHP setting
 406  * @param mixed $limitUpload upload_max_filesize PHP setting
 407  * @param bool  $format      Format max upload size to human readable size
 408  *
 409  * @return int|string max upload file size
 410  */
 411 function get_max_upload_size($limitPost, $limitUpload, $format = true)
 412 {
 413     $size1 = return_bytes($limitPost);
 414     $size2 = return_bytes($limitUpload);
 415     // Return the smaller of two:
 416     $maxsize = min($size1, $size2);
 417     return $format ? human_bytes($maxsize) : $maxsize;
 418 }
 419
 420 /**
 421  * Sort the given array alphabetically using php-intl if available.
 422  * Case sensitive.
 423  *
 424  * Note: doesn't support multidimensional arrays
 425  *
 426  * @param array $data    Input array, passed by reference
 427  * @param bool  $reverse Reverse sort if set to true
 428  * @param bool  $byKeys  Sort the array by keys if set to true, by value otherwise.
 429  */
 430 function alphabetical_sort(&$data, $reverse = false, $byKeys = false)
 431 {
 432     $callback = function ($a, $b) use ($reverse) {
 433         // Collator is part of PHP intl.
 434         if (class_exists('Collator')) {
 435             $collator = new Collator(setlocale(LC_COLLATE, 0));
 436             if (!intl_is_failure(intl_get_error_code())) {
 437                 return $collator->compare($a, $b) * ($reverse ? -1 : 1);
 438             }
 439         }
 440
 441         return strcasecmp($a, $b) * ($reverse ? -1 : 1);
 442     };
 443
 444     if ($byKeys) {
 445         uksort($data, $callback);
 446     } else {
 447         usort($data, $callback);
 448     }
 449 }
 450
 451 /**
 452  * Wrapper function for translation which match the API
 453  * of gettext()/_() and ngettext().
 454  *
 455  * @param string $text   Text to translate.
 456  * @param string $nText  The plural message ID.
 457  * @param int    $nb     The number of items for plural forms.
 458  * @param string $domain The domain where the translation is stored (default: shaarli).
 459  *
 460  * @return string Text translated.
 461  */
 462 function t($text, $nText = '', $nb = 1, $domain = 'shaarli')
 463 {
 464     return dn__($domain, $text, $nText, $nb);
 465 }