/**
* Dispathes the execution control to correct controller
*
* @return nothing
*/
function fn_dispatch($controller = '', $mode = '', $action = '', $dispatch_extra = '', $area = AREA)
{
Debugger::checkpoint('After init');
$auth = $_SESSION['auth'];
$controller = empty($controller) ? Registry::get('runtime.controller') : $controller;
$mode = empty($mode) ? Registry::get('runtime.mode') : $mode;
$action = empty($action) ? Registry::get('runtime.action') : $action;
$dispatch_extra = empty($dispatch_extra) ? Registry::get('runtime.dispatch_extra') : $dispatch_extra;
fn_set_hook('before_dispatch', $controller, $mode, $action, $dispatch_extra, $area);
$view = Registry::get('view');
$run_controllers = true;
$external = false;
$status = CONTROLLER_STATUS_NO_PAGE;
// CSRF protection
if (fn_is_csrf_protection_enabled($auth) && !fn_csrf_validate_request(array('server' => $_SERVER, 'request' => $_REQUEST, 'session' => $_SESSION, 'controller' => $controller, 'mode' => $mode, 'action' => $action, 'dispatch_extra' => $dispatch_extra, 'area' => $area, 'auth' => $auth))) {
fn_set_notification('E', __('error'), __('text_csrf_attack'));
fn_redirect(fn_url());
}
// If $config['http_host'] was different from the domain name, there was redirection to $config['http_host'] value.
if (strtolower(Registry::get('config.current_host')) != strtolower(REAL_HOST) && $_SERVER['REQUEST_METHOD'] == 'GET' && !defined('CONSOLE')) {
if (!empty($_SERVER['REDIRECT_URL'])) {
$qstring = $_SERVER['REDIRECT_URL'];
} else {
if (!empty($_SERVER['REQUEST_URI'])) {
$qstring = $_SERVER['REQUEST_URI'];
} else {
$qstring = Registry::get('config.current_url');
}
}
$curent_path = Registry::get('config.current_path');
if (!empty($curent_path) && strpos($qstring, $curent_path) === 0) {
$qstring = substr_replace($qstring, '', 0, fn_strlen($curent_path));
}
fn_redirect(Registry::get('config.current_location') . $qstring, false, true);
}
$upload_max_filesize = Bootstrap::getIniParam('upload_max_filesize');
$post_max_size = Bootstrap::getIniParam('post_max_size');
if (!defined('AJAX_REQUEST') && isset($_SERVER['CONTENT_LENGTH']) && ($_SERVER['CONTENT_LENGTH'] > fn_return_bytes($upload_max_filesize) || $_SERVER['CONTENT_LENGTH'] > fn_return_bytes($post_max_size))) {
$max_size = fn_return_bytes($upload_max_filesize) < fn_return_bytes($post_max_size) ? $upload_max_filesize : $post_max_size;
fn_set_notification('E', __('error'), __('text_forbidden_uploaded_file_size', array('[size]' => $max_size)));
fn_redirect($_SERVER['HTTP_REFERER']);
}
// If URL contains session ID, remove it
if (!defined('AJAX_REQUEST') && !empty($_REQUEST[Session::getName()]) && $_SERVER['REQUEST_METHOD'] == 'GET') {
fn_redirect(fn_query_remove(Registry::get('config.current_url'), Session::getName()));
}
// If demo mode is enabled, check permissions FIX ME - why did we need one more user login check?
if ($area == 'A') {
if (Registry::get('config.demo_mode') == true) {
$run_controllers = fn_check_permissions($controller, $mode, 'demo');
if ($run_controllers == false) {
fn_set_notification('W', __('demo_mode'), __('demo_mode_content_text'), 'K', 'demo_mode');
if (defined('AJAX_REQUEST')) {
exit;
}
fn_delete_notification('changes_saved');
$status = CONTROLLER_STATUS_REDIRECT;
$_REQUEST['redirect_url'] = !empty($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : fn_url('');
}
} else {
$run_controllers = fn_check_permissions($controller, $mode, 'admin', '', $_REQUEST);
if ($run_controllers == false) {
if (defined('AJAX_REQUEST')) {
$_info = Debugger::isActive() || fn_is_development() ? ' ' . $controller . '.' . $mode : '';
fn_set_notification('W', __('warning'), __('access_denied') . $_info);
exit;
}
$status = CONTROLLER_STATUS_DENIED;
}
}
}
if ($_SERVER['REQUEST_METHOD'] != 'POST' && !defined('AJAX_REQUEST')) {
if ($area == 'A' && empty($_REQUEST['keep_location']) && !defined('CONSOLE')) {
if (!defined('HTTPS') && Registry::get('settings.Security.secure_admin') == 'Y') {
fn_redirect(Registry::get('config.https_location') . '/' . Registry::get('config.current_url'));
} elseif (defined('HTTPS') && Registry::get('settings.Security.secure_admin') != 'Y') {
fn_redirect(Registry::get('config.http_location') . '/' . Registry::get('config.current_url'));
}
} elseif ($area == 'C') {
$secure_controllers = fn_get_secure_controllers();
// if we are not on https but controller is secure, redirect to https
if (!defined('HTTPS') && (Registry::get('settings.Security.secure_storefront') == 'full' || isset($secure_controllers[$controller]) && $secure_controllers[$controller] == 'active')) {
fn_redirect(Registry::get('config.https_location') . '/' . Registry::get('config.current_url'), false, true);
}
// if we are on https and the controller is insecure, redirect to http
if (defined('HTTPS') && Registry::get('settings.Security.secure_storefront') != 'full' && !isset($secure_controllers[$controller]) && Registry::get('settings.Security.keep_https') != 'Y') {
fn_redirect(Registry::get('config.http_location') . '/' . Registry::get('config.current_url'), false, true);
}
}
}
LastView::instance()->prepare($_REQUEST);
$controllers_cascade = array();
$controllers_list = array('init');
if ($run_controllers == true) {
$controllers_list[] = $controller;
$controllers_list = array_unique($controllers_list);
}
foreach ($controllers_list as $ctrl) {
$core_controllers = fn_init_core_controllers($ctrl);
list($addon_controllers) = fn_init_addon_controllers($ctrl);
if (empty($core_controllers) && empty($addon_controllers)) {
//$controllers_cascade = array(); // FIXME: controllers_cascade contains INIT. We should not clear initiation code.
$status = CONTROLLER_STATUS_NO_PAGE;
$run_controllers = false;
break;
}
if (count($core_controllers) + count($addon_controllers) > 1) {
throw new DeveloperException('Duplicate controller ' . $controller . var_export(array_merge($core_controllers, $addon_controllers), true));
}
$core_pre_controllers = fn_init_core_controllers($ctrl, GET_PRE_CONTROLLERS);
$core_post_controllers = fn_init_core_controllers($ctrl, GET_POST_CONTROLLERS);
list($addon_pre_controllers) = fn_init_addon_controllers($ctrl, GET_PRE_CONTROLLERS);
list($addon_post_controllers, $addons) = fn_init_addon_controllers($ctrl, GET_POST_CONTROLLERS);
// we put addon post-controller to the top of post-controller cascade if current addon serves this request
if (count($addon_controllers)) {
$addon_post_controllers = fn_reorder_post_controllers($addon_post_controllers, $addon_controllers[0]);
}
$controllers_cascade = array_merge($controllers_cascade, $addon_pre_controllers, $core_pre_controllers, $core_controllers, $addon_controllers, $core_post_controllers, $addon_post_controllers);
if (empty($controllers_cascade)) {
throw new DeveloperException("No controllers for: {$ctrl}");
}
}
if ($mode == 'add') {
$tpl = 'update.tpl';
} elseif (strpos($mode, 'add_') === 0) {
$tpl = str_replace('add_', 'update_', $mode) . '.tpl';
} else {
$tpl = $mode . '.tpl';
}
$view = Registry::get('view');
if ($view->templateExists('views/' . $controller . '/' . $tpl)) {
// try to find template in base views
$view->assign('content_tpl', 'views/' . $controller . '/' . $tpl);
} elseif (defined('LOADED_ADDON_PATH') && $view->templateExists('addons/' . LOADED_ADDON_PATH . '/views/' . $controller . '/' . $tpl)) {
// try to find template in addon views
$view->assign('content_tpl', 'addons/' . LOADED_ADDON_PATH . '/views/' . $controller . '/' . $tpl);
} elseif (!empty($addons)) {
// try to find template in addon views that extend base views
foreach ($addons as $addon => $_v) {
if ($view->templateExists('addons/' . $addon . '/views/' . $controller . '/' . $tpl)) {
$view->assign('content_tpl', 'addons/' . $addon . '/views/' . $controller . '/' . $tpl);
break;
}
}
}
/**
* Performs actions after template assignment and before controller run
*
* @param string $controller controller name
* @param string $mode controller mode name
* @param string $area current working area
* @param array $controllers_cascade list of controllers to run
*/
fn_set_hook('dispatch_assign_template', $controller, $mode, $area, $controllers_cascade);
foreach ($controllers_cascade as $item) {
$_res = fn_run_controller($item, $controller, $mode, $action, $dispatch_extra);
// 0 - status, 1 - url
$url = !empty($_res[1]) ? $_res[1] : '';
$external = !empty($_res[2]) ? $_res[2] : false;
$permanent = !empty($_res[3]) ? $_res[3] : false;
// Status could be changed only if we allow to run controllers despite of init controller
if ($run_controllers == true) {
$status = !empty($_res[0]) ? $_res[0] : CONTROLLER_STATUS_OK;
}
if ($status == CONTROLLER_STATUS_OK && !empty($url)) {
$redirect_url = $url;
} elseif ($status == CONTROLLER_STATUS_REDIRECT && !empty($url)) {
$redirect_url = $url;
break;
} elseif ($status == CONTROLLER_STATUS_DENIED || $status == CONTROLLER_STATUS_NO_PAGE) {
break;
}
}
LastView::instance()->init($_REQUEST);
// In console mode, just stop here
if (defined('CONSOLE')) {
$notifications = fn_get_notifications();
$exit_code = 0;
foreach ($notifications as $n) {
fn_echo('[' . $n['title'] . '] ' . $n['message'] . "\n");
if ($n['type'] == 'E') {
$exit_code = 1;
}
}
exit($exit_code);
}
if (!empty($auth['this_login']) && Registry::ifGet($auth['this_login'], 'N') === 'Y') {
fn_set_notification('E', __('error'), __(ACCOUNT_TYPE . LOGIN_STATUS_USER_DISABLED));
$status = CONTROLLER_STATUS_DENIED;
}
// [Block manager]
// block manager is disabled for vendors.
if (!(fn_allowed_for('MULTIVENDOR') && Registry::get('runtime.company_id') || fn_allowed_for('ULTIMATE') && !Registry::get('runtime.company_id'))) {
if (fn_check_permissions('block_manager', 'manage', 'admin')) {
$dynamic_object = SchemesManager::getDynamicObject($_REQUEST['dispatch'], $area, $_REQUEST);
if (!empty($dynamic_object)) {
if ($area == 'A' && Registry::get('runtime.mode') != 'add' && !empty($_REQUEST[$dynamic_object['key']])) {
$object_id = $_REQUEST[$dynamic_object['key']];
$location = Location::instance()->get($dynamic_object['customer_dispatch'], $dynamic_object, CART_LANGUAGE);
if (!empty($location) && $location['is_default'] != 1) {
$params = array('dynamic_object' => array('object_type' => $dynamic_object['object_type'], 'object_id' => $object_id), $dynamic_object['key'] => $object_id, 'manage_url' => Registry::get('config.current_url'));
Registry::set('navigation.tabs.blocks', array('title' => __('layouts'), 'href' => 'block_manager.manage_in_tab?' . http_build_query($params), 'ajax' => true));
}
}
}
}
}
// [/Block manager]
// Redirect if controller returned successful/redirect status only
if (in_array($status, array(CONTROLLER_STATUS_OK, CONTROLLER_STATUS_REDIRECT)) && !empty($_REQUEST['redirect_url']) && !$external) {
$redirect_url = $_REQUEST['redirect_url'];
}
// If controller returns "Redirect" status, check if redirect url exists
if ($status == CONTROLLER_STATUS_REDIRECT && empty($redirect_url)) {
$status = CONTROLLER_STATUS_NO_PAGE;
}
// In backend show "changes saved" notification
if ($area == 'A' && $_SERVER['REQUEST_METHOD'] == 'POST' && in_array($status, array(CONTROLLER_STATUS_OK, CONTROLLER_STATUS_REDIRECT))) {
if (strpos($mode, 'update') !== false && $mode != 'update_status' && $mode != 'update_mode' && !fn_notification_exists('extra', 'demo_mode') && !fn_notification_exists('type', 'E')) {
fn_set_notification('N', __('notice'), __('text_changes_saved'), 'I', 'changes_saved');
}
}
// Attach params and redirect if needed
if (in_array($status, array(CONTROLLER_STATUS_OK, CONTROLLER_STATUS_REDIRECT)) && !empty($redirect_url)) {
if (!isset($_REQUEST['return_to_list'])) {
$params = array('page', 'selected_section', 'active_tab');
$url_params = array();
foreach ($params as $param) {
if (!empty($_REQUEST[$param])) {
$url_params[$param] = $_REQUEST[$param];
}
}
if (!empty($url_params)) {
$redirect_url = fn_link_attach($redirect_url, http_build_query($url_params));
}
}
if (!isset($external)) {
$external = false;
}
if (!isset($permanent)) {
$permanent = false;
}
fn_redirect($redirect_url, $external, $permanent);
}
if (!$view->getTemplateVars('content_tpl') && $status == CONTROLLER_STATUS_OK) {
// FIXME
$status = CONTROLLER_STATUS_NO_PAGE;
}
if ($status != CONTROLLER_STATUS_OK) {
if ($status == CONTROLLER_STATUS_NO_PAGE) {
if ($area == 'A' && empty($auth['user_id'])) {
// If admin is not logged in redirect to login page from not found page
fn_set_notification('W', __('page_not_found'), __('page_not_found_text'));
fn_redirect("auth.login_form");
}
header(' ', true, 404);
}
$view->assign('exception_status', $status);
if ($area == 'A') {
$view->assign('content_tpl', 'exception.tpl');
// for backend only
}
if ($status == CONTROLLER_STATUS_DENIED) {
$view->assign('page_title', __('access_denied'));
} elseif ($status == CONTROLLER_STATUS_NO_PAGE) {
$view->assign('page_title', __('page_not_found'));
}
}
fn_set_hook('dispatch_before_display');
Debugger::checkpoint('Before TPL');
// Pass current URL to ajax response only if we render whole page
if (defined('AJAX_REQUEST') && Registry::get('runtime.root_template') == 'index.tpl') {
Registry::get('ajax')->assign('current_url', fn_url(Registry::get('config.current_url'), $area, 'current'));
}
Registry::get('view')->display(Registry::get('runtime.root_template'));
Debugger::checkpoint('After TPL');
Debugger::display();
fn_set_hook('complete');
if (defined('AJAX_REQUEST')) {
// HHVM workaround. Destroy Ajax object manually if it has been created.
$ajax = Registry::get('ajax');
$ajax = null;
}
exit;
// stop execution
}
/**
* Get file contents from local or remote filesystem
*
* @param string $location file location
* @param string $base_dir
* @return string $result
*/
function fn_get_contents($location, $base_dir = '')
{
$result = '';
$path = $base_dir . $location;
if (!empty($base_dir) && !fn_check_path($path)) {
return $result;
}
// Location is regular file
if (is_file($path)) {
$result = @file_get_contents($path);
// Location is url
} elseif (strpos($path, '://') !== false) {
// Prepare url
$path = str_replace(' ', '%20', $path);
if (Bootstrap::getIniParam('allow_url_fopen') == true) {
$result = @file_get_contents($path);
} else {
$result = Http::get($path);
}
}
return $result;
}
}
if (Registry::get('config.demo_mode')) {
// ElFinder should not work in demo mode
$message = json_encode(array('error' => __('error_demo_mode')));
exit($message);
}
if (AREA == 'C') {
if (!Registry::get('runtime.customization_mode.live_editor')) {
die('Access denied');
}
}
$private_files_path = fn_get_files_dir_path();
$public_files_path = fn_get_public_files_path();
fn_mkdir($private_files_path);
fn_mkdir($public_files_path);
$start_path = '';
if (!empty($_REQUEST['init']) && !empty($_REQUEST['start_path'])) {
unset($_GET['target']);
$start_path = fn_normalize_path($private_files_path . $_REQUEST['start_path']);
if (strpos($start_path, $private_files_path) !== 0) {
$start_path = '';
}
}
$extra_path = str_replace(Storage::instance('images')->getAbsolutePath(''), '', $public_files_path);
$opts = array('roots' => array(array('driver' => 'Tygh\\ElFinder\\Volume', 'uploadDeny' => Registry::get('config.forbidden_mime_types'), 'fileMode' => DEFAULT_FILE_PERMISSIONS, 'dirMode' => DEFAULT_DIR_PERMISSIONS, 'uploadMaxSize' => Bootstrap::getIniParam('upload_max_filesize', true), 'alias' => __('private_files'), 'tmbPath' => '', 'path' => $private_files_path, 'startPath' => $start_path, 'mimeDetect' => 'internal', 'archiveMimes' => array('application/zip'), 'icon' => Registry::get('config.current_location') . '/js/lib/elfinder/img/volume_icon_local.png'), array('driver' => 'Tygh\\ElFinder\\Volume', 'uploadDeny' => Registry::get('config.forbidden_mime_types'), 'fileMode' => DEFAULT_FILE_PERMISSIONS, 'dirMode' => DEFAULT_DIR_PERMISSIONS, 'uploadMaxSize' => Bootstrap::getIniParam('upload_max_filesize', true), 'alias' => __('public_files'), 'tmbPath' => '', 'path' => $public_files_path, 'URL' => Storage::instance('images')->getUrl($extra_path), 'mimeDetect' => 'internal', 'archiveMimes' => array('application/zip'), 'icon' => Registry::get('config.current_location') . '/js/lib/elfinder/img/volume_icon_local.png')));
if ($mode == 'images') {
unset($opts['roots'][0]);
}
$connector = new \elFinderConnector(new Core($opts));
$connector->run();
exit;
/**
* Check if session.autostart is disabled
*
* @return bool true if disabled
*/
public function isSessionAutostartDisabled()
{
$checking_result = Bootstrap::getIniParam('session.auto_start') == true ? false : true;
return $checking_result;
}
/**
* Starts session
* @param array $request Request data
*/
public static function start($request = array())
{
$sess_id = self::getId();
if (empty($_COOKIE[self::$_name]) && empty($sess_id)) {
self::setId(self::_generateId());
}
// Force transfer session id to cookies if it passed via url
if (!empty($request[self::$_name])) {
self::setId($request[self::$_name], false);
}
session_name(self::$_name);
session_start();
// Session checker (for external services, returns "OK" if session exists, empty - otherwise)
if (!empty($request['check_session'])) {
die(!empty($_SESSION) ? 'OK' : '');
}
// Validate session
if (!defined('SKIP_SESSION_VALIDATION')) {
$validator_data = self::getValidatorData();
if (!isset($_SESSION['_validator_data'])) {
$_SESSION['_validator_data'] = $validator_data;
} else {
if ($_SESSION['_validator_data'] != $validator_data) {
session_regenerate_id();
$_SESSION = array();
}
}
}
// _SESSION superglobal variable populates here, so remove it from global scope if needed
if (Bootstrap::getIniParam('register_globals')) {
Bootstrap::unregisterGlobals('_SESSION');
}
}
/**
* Get file contents from local or remote filesystem
*
* @param string $location file location
* @param string $base_dir
* @return string $result
*/
function fn_get_contents($location, $base_dir = '')
{
$result = '';
$path = $base_dir . $location;
if (!empty($base_dir) && !fn_check_path($path)) {
return $result;
}
// Location is regular file
if (is_file($path)) {
$result = @file_get_contents($path);
// Location is url
} elseif (strpos($path, '://') !== false) {
// Prepare url
$url = new \Tygh\Tools\Url($path);
$path = $url->build($url->getIsEncoded());
if (Bootstrap::getIniParam('allow_url_fopen') == true) {
$result = @file_get_contents($path);
} else {
$result = Http::get($path);
}
}
return $result;
}
