libraries/classes/Plugins/Transformations/Abs/ExternalTransformationsPlugin.php

   1 <?php
   2 /**
   3  * Abstract class for the external transformations plugins
   4  */
   5 declare(strict_types=1);
   6
   7 namespace PhpMyAdmin\Plugins\Transformations\Abs;
   8
   9 use PhpMyAdmin\Plugins\TransformationsPlugin;
  10 use stdClass;
  11 use function count;
  12 use function fclose;
  13 use function feof;
  14 use function fgets;
  15 use function fwrite;
  16 use function htmlspecialchars;
  17 use function is_resource;
  18 use function proc_close;
  19 use function proc_open;
  20
  21 /**
  22  * Provides common methods for all of the external transformations plugins.
  23  */
  24 abstract class ExternalTransformationsPlugin extends TransformationsPlugin
  25 {
  26     /**
  27      * Gets the transformation description of the specific plugin
  28      *
  29      * @return string
  30      */
  31     public static function getInfo()
  32     {
  33         return __(
  34             'LINUX ONLY: Launches an external application and feeds it the column'
  35             . ' data via standard input. Returns the standard output of the'
  36             . ' application. The default is Tidy, to pretty-print HTML code.'
  37             . ' For security reasons, you have to manually edit the file'
  38             . ' libraries/classes/Plugins/Transformations/Abs/ExternalTransformationsPlugin.php'
  39             . ' and list the tools you want to make available.'
  40             . ' The first option is then the number of the program you want to'
  41             . ' use. The second option should be blank for historical reasons.'
  42             . ' The third option, if set to 1, will convert the output using'
  43             . ' htmlspecialchars() (Default 1). The fourth option, if set to 1,'
  44             . ' will prevent wrapping and ensure that the output appears all on'
  45             . ' one line (Default 1).'
  46         );
  47     }
  48
  49     /**
  50      * Enables no-wrapping
  51      *
  52      * @param array $options transformation options
  53      *
  54      * @return bool
  55      */
  56     public function applyTransformationNoWrap(array $options = [])
  57     {
  58         if (! isset($options[3]) || $options[3] == '') {
  59             $nowrap = true;
  60         } elseif ($options[3] == '1' || $options[3] == 1) {
  61             $nowrap = true;
  62         } else {
  63             $nowrap = false;
  64         }
  65
  66         return $nowrap;
  67     }
  68
  69     /**
  70      * Does the actual work of each specific transformations plugin.
  71      *
  72      * @param string        $buffer  text to be transformed
  73      * @param array         $options transformation options
  74      * @param stdClass|null $meta    meta information
  75      *
  76      * @return string
  77      */
  78     public function applyTransformation($buffer, array $options = [], ?stdClass $meta = null)
  79     {
  80         // possibly use a global transform and feed it with special options
  81
  82         // further operations on $buffer using the $options[] array.
  83
  84         $allowed_programs = [];
  85
  86         // WARNING:
  87         //
  88         // It's up to administrator to allow anything here. Note that users may
  89         // specify any parameters, so when programs allow output redirection or
  90         // any other possibly dangerous operations, you should write wrapper
  91         // script that will publish only functions you really want.
  92         //
  93         // Add here program definitions like (note that these are NOT safe
  94         // programs):
  95         //
  96         //$allowed_programs[0] = '/usr/local/bin/tidy';
  97         //$allowed_programs[1] = '/usr/local/bin/validate';
  98
  99         // no-op when no allowed programs
 100         if (count($allowed_programs) === 0) {
 101             return $buffer;
 102         }
 103
 104         $cfg = $GLOBALS['cfg'];
 105         $options = $this->getOptions(
 106             $options,
 107             $cfg['DefaultTransformations']['External']
 108         );
 109
 110         if (isset($allowed_programs[$options[0]])) {
 111             $program = $allowed_programs[$options[0]];
 112         } else {
 113             $program = $allowed_programs[0];
 114         }
 115
 116         if (isset($options[1]) && strlen((string) $options[1]) > 0) {
 117             trigger_error(sprintf(
 118                 __(
 119                     'You are using the external transformation command line options field, which has been deprecated for security reasons. '
 120                     . 'Add all command line options directly to the definition in %s.'
 121                 ),
 122                 '[code]libraries/classes/Plugins/Transformations/Abs/ExternalTransformationsPlugin.php[/code]'
 123             ), E_USER_DEPRECATED);
 124         }
 125
 126         // needs PHP >= 4.3.0
 127         $newstring = '';
 128         $descriptorspec = [
 129             0 => [
 130                 'pipe',
 131                 'r',
 132             ],
 133             1 => [
 134                 'pipe',
 135                 'w',
 136             ],
 137         ];
 138         $process = proc_open($program . ' ' . $options[1], $descriptorspec, $pipes);
 139         if (is_resource($process)) {
 140             fwrite($pipes[0], $buffer);
 141             fclose($pipes[0]);
 142
 143             while (! feof($pipes[1])) {
 144                 $newstring .= fgets($pipes[1], 1024);
 145             }
 146             fclose($pipes[1]);
 147             // we don't currently use the return value
 148             proc_close($process);
 149         }
 150
 151         if ($options[2] == 1 || $options[2] == '2') {
 152             $retstring = htmlspecialchars($newstring);
 153         } else {
 154             $retstring = $newstring;
 155         }
 156
 157         return $retstring;
 158     }
 159
 160     /* ~~~~~~~~~~~~~~~~~~~~ Getters and Setters ~~~~~~~~~~~~~~~~~~~~ */
 161
 162     /**
 163      * Gets the transformation name of the specific plugin
 164      *
 165      * @return string
 166      */
 167     public static function getName()
 168     {
 169         return 'External';
 170     }
 171 }