]> git.mxchange.org Git - friendica.git/blob - src/Module/Admin/Themes/Embed.php
Fix security vulnerability in admin modules
[friendica.git] / src / Module / Admin / Themes / Embed.php
1 <?php
2 /**
3  * @copyright Copyright (C) 2020, Friendica
4  *
5  * @license GNU AGPL version 3 or any later version
6  *
7  * This program is free software: you can redistribute it and/or modify
8  * it under the terms of the GNU Affero General Public License as
9  * published by the Free Software Foundation, either version 3 of the
10  * License, or (at your option) any later version.
11  *
12  * This program is distributed in the hope that it will be useful,
13  * but WITHOUT ANY WARRANTY; without even the implied warranty of
14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  * GNU Affero General Public License for more details.
16  *
17  * You should have received a copy of the GNU Affero General Public License
18  * along with this program.  If not, see <https://www.gnu.org/licenses/>.
19  *
20  */
21
22 namespace Friendica\Module\Admin\Themes;
23
24 use Friendica\Core\Renderer;
25 use Friendica\DI;
26 use Friendica\Module\BaseAdmin;
27 use Friendica\Util\Strings;
28
29 class Embed extends BaseAdmin
30 {
31         public static function init(array $parameters = [])
32         {
33                 $theme = Strings::sanitizeFilePathItem($parameters['theme']);
34                 if (is_file("view/theme/$theme/config.php")) {
35                         DI::app()->setCurrentTheme($theme);
36                 }
37         }
38
39         public static function post(array $parameters = [])
40         {
41                 self::checkAdminAccess();
42
43                 $theme = Strings::sanitizeFilePathItem($parameters['theme']);
44                 if (is_file("view/theme/$theme/config.php")) {
45                         require_once "view/theme/$theme/config.php";
46                         if (function_exists('theme_admin_post')) {
47                                 self::checkFormSecurityTokenRedirectOnError('/admin/themes/' . $theme . '/embed?mode=minimal', 'admin_theme_settings');
48                                 theme_admin_post(DI::app());
49                         }
50                 }
51
52                 if (DI::mode()->isAjax()) {
53                         return;
54                 }
55
56                 DI::baseUrl()->redirect('admin/themes/' . $theme . '/embed?mode=minimal');
57         }
58
59         public static function content(array $parameters = [])
60         {
61                 parent::content($parameters);
62
63                 $theme = Strings::sanitizeFilePathItem($parameters['theme']);
64                 if (!is_dir("view/theme/$theme")) {
65                         notice(DI::l10n()->t('Unknown theme.'));
66                         return '';
67                 }
68
69                 $admin_form = '';
70                 if (is_file("view/theme/$theme/config.php")) {
71                         require_once "view/theme/$theme/config.php";
72
73                         if (function_exists('theme_admin')) {
74                                 $admin_form = theme_admin(DI::app());
75                         }
76                 }
77
78                 // Overrides normal theme style include to strip user param to show embedded theme settings
79                 Renderer::$theme['stylesheet'] = 'view/theme/' . $theme . '/style.pcss';
80
81                 $t = Renderer::getMarkupTemplate('admin/addons/embed.tpl');
82                 return Renderer::replaceMacros($t, [
83                         '$action' => '/admin/themes/' . $theme . '/embed?mode=minimal',
84                         '$form' => $admin_form,
85                         '$form_security_token' => self::getFormSecurityToken("admin_theme_settings"),
86                 ]);
87         }
88 }