X-Git-Url: https://git.mxchange.org/?a=blobdiff_plain;f=src%2FCore%2FTheme.php;h=ff3265c90aea3afe1e13d724cbaa5b779eabf642;hb=e80d68ba53776bed047d897f52db7e25b35a479d;hp=5479f8f46f8e2deeb097d1dd0c98d9401da0cccb;hpb=256e845c5dd606d6e0f1d401a0859b6f8728fb2d;p=friendica.git

diff --git a/src/Core/Theme.php b/src/Core/Theme.php
index 5479f8f46f..ff3265c90a 100644
--- a/src/Core/Theme.php
+++ b/src/Core/Theme.php
@@ -1,13 +1,29 @@
 <?php
-
 /**
- * @file src/Core/Theme.php
+ * @copyright Copyright (C) 2020, Friendica
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ *
  */
 
 namespace Friendica\Core;
 
-use Friendica\BaseObject;
+use Friendica\DI;
 use Friendica\Model\Profile;
+use Friendica\Util\Strings;
 
 require_once 'boot.php';
 
@@ -16,8 +32,30 @@ require_once 'boot.php';
  */
 class Theme
 {
+	public static function getAllowedList()
+	{
+		$allowed_themes_str = DI::config()->get('system', 'allowed_themes');
+		$allowed_themes_raw = explode(',', str_replace(' ', '', $allowed_themes_str));
+		$allowed_themes = [];
+		if (count($allowed_themes_raw)) {
+			foreach ($allowed_themes_raw as $theme) {
+				$theme = Strings::sanitizeFilePathItem(trim($theme));
+				if (strlen($theme) && is_dir("view/theme/$theme")) {
+					$allowed_themes[] = $theme;
+				}
+			}
+		}
+
+		return array_unique($allowed_themes);
+	}
+
+	public static function setAllowedList(array $allowed_themes)
+	{
+		DI::config()->set('system', 'allowed_themes', implode(',', array_unique($allowed_themes)));
+	}
+
 	/**
-	 * @brief Parse theme comment in search of theme infos.
+	 * Parse theme comment in search of theme infos.
 	 *
 	 * like
 	 * \code
@@ -33,6 +71,8 @@ class Theme
 	 */
 	public static function getInfo($theme)
 	{
+		$theme = Strings::sanitizeFilePathItem($theme);
+
 		$info = [
 			'name' => $theme,
 			'description' => "",
@@ -48,10 +88,9 @@ class Theme
 			return $info;
 		}
 
-		$a = \get_app();
 		$stamp1 = microtime(true);
 		$theme_file = file_get_contents("view/theme/$theme/theme.php");
-		$a->getProfiler()->saveTimestamp($stamp1, "file", System::callstack());
+		DI::profiler()->saveTimestamp($stamp1, "file", System::callstack());
 
 		$result = preg_match("|/\*.*\*/|msU", $theme_file, $matches);
 
@@ -86,7 +125,7 @@ class Theme
 	}
 
 	/**
-	 * @brief Returns the theme's screenshot.
+	 * Returns the theme's screenshot.
 	 *
 	 * The screenshot is expected as view/theme/$theme/screenshot.[png|jpg].
 	 *
@@ -96,96 +135,102 @@ class Theme
 	 */
 	public static function getScreenshot($theme)
 	{
+		$theme = Strings::sanitizeFilePathItem($theme);
+
 		$exts = ['.png', '.jpg'];
 		foreach ($exts as $ext) {
 			if (file_exists('view/theme/' . $theme . '/screenshot' . $ext)) {
-				return(System::baseUrl() . '/view/theme/' . $theme . '/screenshot' . $ext);
+				return DI::baseUrl() . '/view/theme/' . $theme . '/screenshot' . $ext;
 			}
 		}
-		return(System::baseUrl() . '/images/blank.png');
+		return DI::baseUrl() . '/images/blank.png';
 	}
 
-	// install and uninstall theme
 	public static function uninstall($theme)
 	{
-		Logger::log("Addons: uninstalling theme " . $theme);
+		$theme = Strings::sanitizeFilePathItem($theme);
+
+		// silently fail if theme was removed or if $theme is funky
+		if (file_exists("view/theme/$theme/theme.php")) {
+			include_once "view/theme/$theme/theme.php";
 
-		include_once "view/theme/$theme/theme.php";
-		if (function_exists("{$theme}_uninstall")) {
 			$func = "{$theme}_uninstall";
-			$func();
+			if (function_exists($func)) {
+				$func();
+			}
+		}
+
+		$allowed_themes = Theme::getAllowedList();
+		$key = array_search($theme, $allowed_themes);
+		if ($key !== false) {
+			unset($allowed_themes[$key]);
+			Theme::setAllowedList($allowed_themes);
 		}
 	}
 
 	public static function install($theme)
 	{
-		// silently fail if theme was removed
+		$theme = Strings::sanitizeFilePathItem($theme);
 
+		// silently fail if theme was removed or if $theme is funky
 		if (!file_exists("view/theme/$theme/theme.php")) {
 			return false;
 		}
 
-		Logger::log("Addons: installing theme $theme");
+		try {
+			include_once "view/theme/$theme/theme.php";
 
-		include_once "view/theme/$theme/theme.php";
-
-		if (function_exists("{$theme}_install")) {
 			$func = "{$theme}_install";
-			$func();
+			if (function_exists($func)) {
+				$func();
+			}
+
+			$allowed_themes = Theme::getAllowedList();
+			$allowed_themes[] = $theme;
+			Theme::setAllowedList($allowed_themes);
+
 			return true;
-		} else {
-			Logger::log("Addons: FAILED installing theme $theme");
+		} catch (\Exception $e) {
+			Logger::error('Theme installation failed', ['theme' => $theme, 'error' => $e->getMessage()]);
 			return false;
 		}
 	}
 
 	/**
-	 * @brief Get the full path to relevant theme files by filename
+	 * Get the full path to relevant theme files by filename
 	 *
-	 * This function search in the theme directory (and if not present in global theme directory)
-	 * if there is a directory with the file extension and  for a file with the given
-	 * filename.
+	 * This function searches in order in the current theme directory, in the current theme parent directory, and lastly
+	 * in the base view/ folder.
 	 *
 	 * @param string $file Filename
-	 * @param string $root Full root path
 	 * @return string Path to the file or empty string if the file isn't found
-	 * @throws \Friendica\Network\HTTPException\InternalServerErrorException
+	 * @throws \Exception
 	 */
-	public static function getPathForFile($file, $root = '')
+	public static function getPathForFile($file)
 	{
-		$file = basename($file);
+		$a = DI::app();
+
+		$theme = $a->getCurrentTheme();
+
+		$parent = Strings::sanitizeFilePathItem($a->theme_info['extends'] ?? $theme);
 
-		// Make sure $root ends with a slash / if it's not blank
-		if ($root !== '' && $root[strlen($root) - 1] !== '/') {
-			$root = $root . '/';
-		}
-		$theme_info = \get_app()->theme_info;
-		if (is_array($theme_info) && array_key_exists('extends', $theme_info)) {
-			$parent = $theme_info['extends'];
-		} else {
-			$parent = 'NOPATH';
-		}
-		$theme = \get_app()->getCurrentTheme();
-		$thname = $theme;
-		$ext = substr($file, strrpos($file, '.') + 1);
 		$paths = [
-			"{$root}view/theme/$thname/$ext/$file",
-			"{$root}view/theme/$parent/$ext/$file",
-			"{$root}view/$ext/$file",
+			"view/theme/$theme/$file",
+			"view/theme/$parent/$file",
+			"view/$file",
 		];
-		foreach ($paths as $p) {
-			// strpos() is faster than strstr when checking if one string is in another (http://php.net/manual/en/function.strstr.php)
-			if (strpos($p, 'NOPATH') !== false) {
-				continue;
-			} elseif (file_exists($p)) {
-				return $p;
+
+		foreach ($paths as $path) {
+			if (file_exists($path)) {
+				return $path;
 			}
 		}
+
 		return '';
 	}
 
 	/**
-	 * @brief Return relative path to theme stylesheet file
+	 * Return relative path to theme stylesheet file
 	 *
 	 * Provide a sane default if nothing is chosen or the specified theme does not exist.
 	 *
@@ -195,11 +240,13 @@ class Theme
 	 */
 	public static function getStylesheetPath($theme)
 	{
+		$theme = Strings::sanitizeFilePathItem($theme);
+
 		if (!file_exists('view/theme/' . $theme . '/style.php')) {
 			return 'view/theme/' . $theme . '/style.css';
 		}
 
-		$a = BaseObject::getApp();
+		$a = DI::app();
 
 		$query_params = [];