[Summary view] [Print] [Text view]

   1  <?php
   2  
   3  /**
   4   * Joomla! Content Management System
   5   *
   6   * @copyright  (C) 2011 Open Source Matters, Inc. <https://www.joomla.org>
   7   * @license    GNU General Public License version 2 or later; see LICENSE.txt
   8   */
   9  
  10  namespace Joomla\CMS\Form\Rule;
  11  
  12  use Joomla\CMS\Form\Form;
  13  use Joomla\CMS\Form\FormRule;
  14  use Joomla\CMS\Language\Text;
  15  use Joomla\Registry\Registry;
  16  use Joomla\String\StringHelper;
  17  use Joomla\Uri\UriHelper;
  18  
  19  // phpcs:disable PSR1.Files.SideEffects
  20  \defined('JPATH_PLATFORM') or die;
  21  // phpcs:enable PSR1.Files.SideEffects
  22  
  23  /**
  24   * Form Rule class for the Joomla Platform.
  25   *
  26   * @since  1.7.0
  27   */
  28  class UrlRule extends FormRule
  29  {
  30      /**
  31       * Method to test an external or internal url for all valid parts.
  32       *
  33       * @param   \SimpleXMLElement  $element  The SimpleXMLElement object representing the `<field>` tag for the form field object.
  34       * @param   mixed              $value    The form field value to validate.
  35       * @param   string             $group    The field name group control value. This acts as an array container for the field.
  36       *                                       For example if the field has name="foo" and the group value is set to "bar" then the
  37       *                                       full field name would end up being "bar[foo]".
  38       * @param   Registry           $input    An optional Registry object with the entire data set to validate against the entire form.
  39       * @param   Form               $form     The form object for which the field is being tested.
  40       *
  41       * @return  boolean  True if the value is valid, false otherwise.
  42       *
  43       * @since   1.7.0
  44       * @link    https://www.w3.org/Addressing/URL/url-spec.txt
  45       * @see     \Joomla\String\StringHelper
  46       */
  47      public function test(\SimpleXMLElement $element, $value, $group = null, Registry $input = null, Form $form = null)
  48      {
  49          // If the field is empty and not required, the field is valid.
  50          $required = ((string) $element['required'] === 'true' || (string) $element['required'] === 'required');
  51  
  52          if (!$required && empty($value)) {
  53              return true;
  54          }
  55  
  56          $urlParts = UriHelper::parse_url($value);
  57  
  58          // See https://www.w3.org/Addressing/URL/url-spec.txt
  59          // Use the full list or optionally specify a list of permitted schemes.
  60          if ($element['schemes'] == '') {
  61              $scheme = array('http', 'https', 'ftp', 'ftps', 'gopher', 'mailto', 'news', 'prospero', 'telnet', 'rlogin', 'sftp', 'tn3270', 'wais',
  62                  'mid', 'cid', 'nntp', 'tel', 'urn', 'ldap', 'file', 'fax', 'modem', 'git');
  63          } else {
  64              $scheme = explode(',', $element['schemes']);
  65          }
  66  
  67          /*
  68           * Note that parse_url() does not always parse accurately without a scheme,
  69           * but at least the path should be set always. Note also that parse_url()
  70           * returns False for seriously malformed URLs instead of an associative array.
  71           * @link https://www.php.net/manual/en/function.parse-url.php
  72           */
  73          if ($urlParts === false || !\array_key_exists('scheme', $urlParts)) {
  74              /*
  75               * The function parse_url() returned false (seriously malformed URL) or no scheme
  76               * was found and the relative option is not set: in both cases the field is not valid.
  77               */
  78              if ($urlParts === false || !$element['relative']) {
  79                  $element->addAttribute('message', Text::sprintf('JLIB_FORM_VALIDATE_FIELD_URL_SCHEMA_MISSING', $value, implode(', ', $scheme)));
  80  
  81                  return false;
  82              }
  83  
  84              // The best we can do for the rest is make sure that the path exists and is valid UTF-8.
  85              if (!\array_key_exists('path', $urlParts) || !StringHelper::valid((string) $urlParts['path'])) {
  86                  return false;
  87              }
  88  
  89              // The internal URL seems to be good.
  90              return true;
  91          }
  92  
  93          // Scheme found, check all parts found.
  94          $urlScheme = (string) $urlParts['scheme'];
  95          $urlScheme = strtolower($urlScheme);
  96  
  97          if (\in_array($urlScheme, $scheme) == false) {
  98              return false;
  99          }
 100  
 101          // For some schemes here must be two slashes.
 102          $scheme = array('http', 'https', 'ftp', 'ftps', 'gopher', 'wais', 'prospero', 'sftp', 'telnet', 'git');
 103  
 104          if (\in_array($urlScheme, $scheme) && substr($value, \strlen($urlScheme), 3) !== '://') {
 105              return false;
 106          }
 107  
 108          // The best we can do for the rest is make sure that the strings are valid UTF-8
 109          // and the port is an integer.
 110          if (\array_key_exists('host', $urlParts) && !StringHelper::valid((string) $urlParts['host'])) {
 111              return false;
 112          }
 113  
 114          if (\array_key_exists('port', $urlParts) && !\is_int((int) $urlParts['port'])) {
 115              return false;
 116          }
 117  
 118          if (\array_key_exists('path', $urlParts) && !StringHelper::valid((string) $urlParts['path'])) {
 119              return false;
 120          }
 121  
 122          return true;
 123      }
 124  }