src/File.php

   1 <?php
   2
   3 declare(strict_types=1);
   4
   5 namespace PhpMyAdmin;
   6
   7 use ZipArchive;
   8
   9 use function __;
  10 use function basename;
  11 use function bin2hex;
  12 use function bzopen;
  13 use function bzread;
  14 use function extension_loaded;
  15 use function fclose;
  16 use function feof;
  17 use function file_get_contents;
  18 use function fopen;
  19 use function fread;
  20 use function function_exists;
  21 use function gzopen;
  22 use function gzread;
  23 use function is_link;
  24 use function is_readable;
  25 use function is_string;
  26 use function is_uploaded_file;
  27 use function mb_strcut;
  28 use function move_uploaded_file;
  29 use function ob_end_clean;
  30 use function ob_start;
  31 use function sprintf;
  32 use function strlen;
  33 use function tempnam;
  34 use function trim;
  35 use function unlink;
  36
  37 use const UPLOAD_ERR_CANT_WRITE;
  38 use const UPLOAD_ERR_EXTENSION;
  39 use const UPLOAD_ERR_FORM_SIZE;
  40 use const UPLOAD_ERR_INI_SIZE;
  41 use const UPLOAD_ERR_NO_FILE;
  42 use const UPLOAD_ERR_NO_TMP_DIR;
  43 use const UPLOAD_ERR_OK;
  44 use const UPLOAD_ERR_PARTIAL;
  45
  46 /**
  47  * File wrapper class
  48  *
  49  * @todo when uploading a file into a blob field, should we also consider using
  50  *       chunks like in import? UPDATE `table` SET `field` = `field` + [chunk]
  51  */
  52 class File
  53 {
  54     /** @var string|null the temporary file name */
  55     protected string|null $name = null;
  56
  57     protected string|null $content = null;
  58
  59     /** @var Message|null the error message */
  60     protected Message|null $errorMessage = null;
  61
  62     /** @var bool whether the file is temporary or not */
  63     protected bool $isTemp = false;
  64
  65     protected string|null $compression = null;
  66
  67     protected int $offset = 0;
  68
  69     /** @var int size of chunk to read with every step */
  70     protected int $chunkSize = 32768;
  71
  72     /** @var resource|null file handle */
  73     protected $handle;
  74
  75     /** @var bool whether to decompress content before returning */
  76     protected bool $decompress = false;
  77
  78     /** @var string charset of file */
  79     protected string $charset = '';
  80
  81     private ZipExtension $zipExtension;
  82     private readonly Config $config;
  83
  84     /** @param bool|string $name file name or false */
  85     public function __construct(bool|string $name = false)
  86     {
  87         $this->config = Config::getInstance();
  88         if ($name && is_string($name)) {
  89             $this->setName($name);
  90         }
  91
  92         if (! extension_loaded('zip')) {
  93             return;
  94         }
  95
  96         $this->zipExtension = new ZipExtension(new ZipArchive());
  97     }
  98
  99     /**
 100      * destructor
 101      *
 102      * @see     File::cleanUp()
 103      */
 104     public function __destruct()
 105     {
 106         $this->cleanUp();
 107     }
 108
 109     /**
 110      * deletes file if it is temporary, usually from a moved upload file
 111      */
 112     public function cleanUp(): bool
 113     {
 114         if ($this->isTemp()) {
 115             return $this->delete();
 116         }
 117
 118         return true;
 119     }
 120
 121     /**
 122      * deletes the file
 123      */
 124     public function delete(): bool
 125     {
 126         return unlink((string) $this->getName());
 127     }
 128
 129     /**
 130      * checks or sets the temp flag for this file
 131      * file objects with temp flags are deleted with object destruction
 132      *
 133      * @param bool $isTemp sets the temp flag
 134      */
 135     public function isTemp(bool|null $isTemp = null): bool
 136     {
 137         if ($isTemp !== null) {
 138             $this->isTemp = $isTemp;
 139         }
 140
 141         return $this->isTemp;
 142     }
 143
 144     /**
 145      * accessor
 146      *
 147      * @param string|null $name file name
 148      */
 149     public function setName(string|null $name): void
 150     {
 151         $this->name = trim((string) $name);
 152     }
 153
 154     /**
 155      * Gets file content
 156      *
 157      * @return string|false the binary file content, or false if no content
 158      */
 159     public function getRawContent(): string|false
 160     {
 161         if ($this->content !== null) {
 162             return $this->content;
 163         }
 164
 165         if ($this->isUploaded() && ! $this->checkUploadedFile()) {
 166             return false;
 167         }
 168
 169         if (! $this->isReadable()) {
 170             return false;
 171         }
 172
 173         $this->content = file_get_contents((string) $this->getName());
 174
 175         return $this->content;
 176     }
 177
 178     /**
 179      * Gets file content
 180      *
 181      * @return string|false the binary file content as a string,
 182      *                      or false if no content
 183      */
 184     public function getContent(): string|false
 185     {
 186         $result = $this->getRawContent();
 187         if ($result === false) {
 188             return false;
 189         }
 190
 191         return '0x' . bin2hex($result);
 192     }
 193
 194     /**
 195      * Whether file is uploaded.
 196      */
 197     public function isUploaded(): bool
 198     {
 199         if ($this->getName() === null) {
 200             return false;
 201         }
 202
 203         return is_uploaded_file($this->getName());
 204     }
 205
 206     /**
 207      * accessor
 208      *
 209      * @return string|null File::$_name
 210      */
 211     public function getName(): string|null
 212     {
 213         return $this->name;
 214     }
 215
 216     /**
 217      * Initializes object from uploaded file.
 218      *
 219      * @param string $name name of file uploaded
 220      */
 221     public function setUploadedFile(string $name): bool
 222     {
 223         $this->setName($name);
 224
 225         if (! $this->isUploaded()) {
 226             $this->setName(null);
 227             $this->errorMessage = Message::error(__('File was not an uploaded file.'));
 228
 229             return false;
 230         }
 231
 232         return true;
 233     }
 234
 235     /**
 236      * Loads uploaded file from table change request.
 237      *
 238      * @param string $key       the md5 hash of the column name
 239      * @param string $rownumber number of row to process
 240      */
 241     public function setUploadedFromTblChangeRequest(
 242         string $key,
 243         string $rownumber,
 244     ): bool {
 245         if (
 246             ! isset($_FILES['fields_upload'])
 247             || empty($_FILES['fields_upload']['name']['multi_edit'][$rownumber][$key])
 248         ) {
 249             return false;
 250         }
 251
 252         $file = $this->fetchUploadedFromTblChangeRequestMultiple($_FILES['fields_upload'], $rownumber, $key);
 253
 254         switch ($file['error']) {
 255             case UPLOAD_ERR_OK:
 256                 return $this->setUploadedFile($file['tmp_name']);
 257
 258             case UPLOAD_ERR_NO_FILE:
 259                 break;
 260             case UPLOAD_ERR_INI_SIZE:
 261                 $this->errorMessage = Message::error(__(
 262                     'The uploaded file exceeds the upload_max_filesize directive in php.ini.',
 263                 ));
 264                 break;
 265             case UPLOAD_ERR_FORM_SIZE:
 266                 $this->errorMessage = Message::error(__(
 267                     'The uploaded file exceeds the MAX_FILE_SIZE directive that was specified in the HTML form.',
 268                 ));
 269                 break;
 270             case UPLOAD_ERR_PARTIAL:
 271                 $this->errorMessage = Message::error(__(
 272                     'The uploaded file was only partially uploaded.',
 273                 ));
 274                 break;
 275             case UPLOAD_ERR_NO_TMP_DIR:
 276                 $this->errorMessage = Message::error(__('Missing a temporary folder.'));
 277                 break;
 278             case UPLOAD_ERR_CANT_WRITE:
 279                 $this->errorMessage = Message::error(__('Failed to write file to disk.'));
 280                 break;
 281             case UPLOAD_ERR_EXTENSION:
 282                 $this->errorMessage = Message::error(__('File upload stopped by extension.'));
 283                 break;
 284             default:
 285                 $this->errorMessage = Message::error(__('Unknown error in file upload.'));
 286         }
 287
 288         return false;
 289     }
 290
 291     /**
 292      * strips some dimension from the multi-dimensional array from $_FILES
 293      *
 294      * <code>
 295      * $file['name']['multi_edit'][$rownumber][$key] = [value]
 296      * $file['type']['multi_edit'][$rownumber][$key] = [value]
 297      * $file['size']['multi_edit'][$rownumber][$key] = [value]
 298      * $file['tmp_name']['multi_edit'][$rownumber][$key] = [value]
 299      * $file['error']['multi_edit'][$rownumber][$key] = [value]
 300      *
 301      * // becomes:
 302      *
 303      * $file['name'] = [value]
 304      * $file['type'] = [value]
 305      * $file['size'] = [value]
 306      * $file['tmp_name'] = [value]
 307      * $file['error'] = [value]
 308      * </code>
 309      *
 310      * @param mixed[] $file      the array
 311      * @param string  $rownumber number of row to process
 312      * @param string  $key       key to process
 313      *
 314      * @return mixed[]
 315      */
 316     public function fetchUploadedFromTblChangeRequestMultiple(
 317         array $file,
 318         string $rownumber,
 319         string $key,
 320     ): array {
 321         return [
 322             'name' => $file['name']['multi_edit'][$rownumber][$key],
 323             'type' => $file['type']['multi_edit'][$rownumber][$key],
 324             'size' => $file['size']['multi_edit'][$rownumber][$key],
 325             'tmp_name' => $file['tmp_name']['multi_edit'][$rownumber][$key],
 326             'error' => $file['error']['multi_edit'][$rownumber][$key],
 327         ];
 328     }
 329
 330     /**
 331      * sets the name if the file to the one selected in the tbl_change form
 332      *
 333      * @param string      $key       the md5 hash of the column name
 334      * @param string|null $rownumber number of row to process
 335      */
 336     public function setSelectedFromTblChangeRequest(
 337         string $key,
 338         string|null $rownumber = null,
 339     ): bool {
 340         if (
 341             ! empty($_REQUEST['fields_uploadlocal']['multi_edit'][$rownumber][$key])
 342             && is_string($_REQUEST['fields_uploadlocal']['multi_edit'][$rownumber][$key])
 343         ) {
 344             // ... whether with multiple rows ...
 345             return $this->setLocalSelectedFile($_REQUEST['fields_uploadlocal']['multi_edit'][$rownumber][$key]);
 346         }
 347
 348         return false;
 349     }
 350
 351     /**
 352      * Returns possible error message.
 353      *
 354      * @return Message|null error message
 355      */
 356     public function getError(): Message|null
 357     {
 358         return $this->errorMessage;
 359     }
 360
 361     /**
 362      * Checks whether there was any error.
 363      */
 364     public function isError(): bool
 365     {
 366         return $this->errorMessage !== null;
 367     }
 368
 369     /**
 370      * checks the superglobals provided if the tbl_change form is submitted
 371      * and uses the submitted/selected file
 372      *
 373      * @param string $key       the md5 hash of the column name
 374      * @param string $rownumber number of row to process
 375      */
 376     public function checkTblChangeForm(string $key, string $rownumber): bool
 377     {
 378         if ($this->setUploadedFromTblChangeRequest($key, $rownumber)) {
 379             // well done ...
 380             $this->errorMessage = null;
 381
 382             return true;
 383         }
 384
 385         if ($this->setSelectedFromTblChangeRequest($key, $rownumber)) {
 386             // well done ...
 387             $this->errorMessage = null;
 388
 389             return true;
 390         }
 391
 392         // all failed, whether just no file uploaded/selected or an error
 393
 394         return false;
 395     }
 396
 397     /**
 398      * Sets named file to be read from UploadDir.
 399      *
 400      * @param string $name file name
 401      */
 402     public function setLocalSelectedFile(string $name): bool
 403     {
 404         if ($this->config->settings['UploadDir'] === '') {
 405             return false;
 406         }
 407
 408         $this->setName(
 409             Util::userDir($this->config->settings['UploadDir']) . Core::securePath($name),
 410         );
 411         if (@is_link((string) $this->getName())) {
 412             $this->errorMessage = Message::error(__('File is a symbolic link'));
 413             $this->setName(null);
 414
 415             return false;
 416         }
 417
 418         if (! $this->isReadable()) {
 419             $this->errorMessage = Message::error(__('File could not be read!'));
 420             $this->setName(null);
 421
 422             return false;
 423         }
 424
 425         return true;
 426     }
 427
 428     /**
 429      * Checks whether file can be read.
 430      */
 431     public function isReadable(): bool
 432     {
 433         // suppress warnings from being displayed, but not from being logged
 434         // any file access outside of open_basedir will issue a warning
 435         return @is_readable((string) $this->getName());
 436     }
 437
 438     /**
 439      * If we are on a server with open_basedir, we must move the file
 440      * before opening it. The FAQ 1.11 explains how to create the "./tmp"
 441      * directory - if needed
 442      *
 443      * @todo move check of $cfg['TempDir'] into Config?
 444      */
 445     public function checkUploadedFile(): bool
 446     {
 447         if ($this->isReadable()) {
 448             return true;
 449         }
 450
 451         $tmpSubdir = $this->config->getUploadTempDir();
 452         if ($tmpSubdir === null) {
 453             // cannot create directory or access, point user to FAQ 1.11
 454             $this->errorMessage = Message::error(__(
 455                 'Error moving the uploaded file, see [doc@faq1-11]FAQ 1.11[/doc].',
 456             ));
 457
 458             return false;
 459         }
 460
 461         $newFileToUpload = (string) tempnam(
 462             $tmpSubdir,
 463             basename((string) $this->getName()),
 464         );
 465
 466         // suppress warnings from being displayed, but not from being logged
 467         // any file access outside of open_basedir will issue a warning
 468         ob_start();
 469         $moveUploadedFileResult = move_uploaded_file(
 470             (string) $this->getName(),
 471             $newFileToUpload,
 472         );
 473         ob_end_clean();
 474         if (! $moveUploadedFileResult) {
 475             $this->errorMessage = Message::error(__('Error while moving uploaded file.'));
 476
 477             return false;
 478         }
 479
 480         $this->setName($newFileToUpload);
 481         $this->isTemp(true);
 482
 483         if (! $this->isReadable()) {
 484             $this->errorMessage = Message::error(__('Cannot read uploaded file.'));
 485
 486             return false;
 487         }
 488
 489         return true;
 490     }
 491
 492     /**
 493      * Detects what compression the file uses
 494      *
 495      * @return string|false false on error, otherwise string MIME type of
 496      *                      compression, none for none
 497      *
 498      * @todo   move file read part into readChunk() or getChunk()
 499      * @todo   add support for compression plugins
 500      */
 501     protected function detectCompression(): string|false
 502     {
 503         // suppress warnings from being displayed, but not from being logged
 504         // f.e. any file access outside of open_basedir will issue a warning
 505         ob_start();
 506         $file = fopen((string) $this->getName(), 'rb');
 507         ob_end_clean();
 508
 509         if (! $file) {
 510             $this->errorMessage = Message::error(__('File could not be read!'));
 511
 512             return false;
 513         }
 514
 515         $this->compression = Util::getCompressionMimeType($file);
 516
 517         return $this->compression;
 518     }
 519
 520     /**
 521      * Sets whether the content should be decompressed before returned
 522      *
 523      * @param bool $decompress whether to decompress
 524      */
 525     public function setDecompressContent(bool $decompress): void
 526     {
 527         $this->decompress = $decompress;
 528     }
 529
 530     /**
 531      * Returns the file handle
 532      *
 533      * @return resource|null file handle
 534      */
 535     public function getHandle()
 536     {
 537         if ($this->handle === null) {
 538             $this->open();
 539         }
 540
 541         return $this->handle;
 542     }
 543
 544     /**
 545      * Sets the file handle
 546      *
 547      * @param resource $handle file handle
 548      */
 549     public function setHandle($handle): void
 550     {
 551         $this->handle = $handle;
 552     }
 553
 554     /**
 555      * Sets error message for unsupported compression.
 556      */
 557     public function errorUnsupported(): void
 558     {
 559         $this->errorMessage = Message::error(sprintf(
 560             __(
 561                 'You attempted to load file with unsupported compression (%s). '
 562                 . 'Either support for it is not implemented or disabled by your '
 563                 . 'configuration.',
 564             ),
 565             $this->getCompression(),
 566         ));
 567     }
 568
 569     /**
 570      * Attempts to open the file.
 571      */
 572     public function open(): bool
 573     {
 574         if (! $this->decompress) {
 575             $this->handle = @fopen((string) $this->getName(), 'r');
 576         }
 577
 578         switch ($this->getCompression()) {
 579             case false:
 580                 return false;
 581
 582             case 'application/bzip2':
 583                 if (! $this->config->settings['BZipDump'] || ! function_exists('bzopen')) {
 584                     $this->errorUnsupported();
 585
 586                     return false;
 587                 }
 588
 589                 $this->handle = @bzopen($this->getName(), 'r');
 590                 break;
 591             case 'application/gzip':
 592                 if (! $this->config->settings['GZipDump'] || ! function_exists('gzopen')) {
 593                     $this->errorUnsupported();
 594
 595                     return false;
 596                 }
 597
 598                 $this->handle = @gzopen((string) $this->getName(), 'r');
 599                 break;
 600             case 'application/zip':
 601                 if ($this->config->settings['ZipDump'] && function_exists('zip_open')) {
 602                     return $this->openZip();
 603                 }
 604
 605                 $this->errorUnsupported();
 606
 607                 return false;
 608
 609             case 'none':
 610                 $this->handle = @fopen((string) $this->getName(), 'r');
 611                 break;
 612             default:
 613                 $this->errorUnsupported();
 614
 615                 return false;
 616         }
 617
 618         return $this->handle !== false;
 619     }
 620
 621     /**
 622      * Opens file from zip
 623      *
 624      * @param string|null $specificEntry Entry to open
 625      */
 626     public function openZip(string|null $specificEntry = null): bool
 627     {
 628         $result = $this->zipExtension->getContents($this->getName(), $specificEntry);
 629         if ($result['error'] !== '') {
 630             $this->errorMessage = Message::rawError($result['error']);
 631
 632             return false;
 633         }
 634
 635         $this->content = $result['data'];
 636         $this->offset = 0;
 637
 638         return true;
 639     }
 640
 641     /**
 642      * Checks whether we've reached end of file
 643      */
 644     public function eof(): bool
 645     {
 646         if ($this->handle !== null) {
 647             return feof($this->handle);
 648         }
 649
 650         return $this->offset == strlen($this->content ?? '');
 651     }
 652
 653     /**
 654      * Closes the file
 655      */
 656     public function close(): void
 657     {
 658         if ($this->handle !== null) {
 659             fclose($this->handle);
 660             $this->handle = null;
 661         } else {
 662             $this->content = '';
 663             $this->offset = 0;
 664         }
 665
 666         $this->cleanUp();
 667     }
 668
 669     /**
 670      * Reads data from file
 671      *
 672      * @param int $size Number of bytes to read
 673      */
 674     public function read(int $size): string
 675     {
 676         if ($this->compression === 'application/zip') {
 677             $result = mb_strcut($this->content ?? '', $this->offset, $size);
 678             $this->offset += strlen($result);
 679
 680             return $result;
 681         }
 682
 683         if ($this->handle === null) {
 684             return '';
 685         }
 686
 687         if ($this->compression === 'application/bzip2') {
 688             return (string) bzread($this->handle, $size);
 689         }
 690
 691         if ($this->compression === 'application/gzip') {
 692             return (string) gzread($this->handle, $size);
 693         }
 694
 695         return (string) fread($this->handle, $size);
 696     }
 697
 698     /**
 699      * Returns the character set of the file
 700      *
 701      * @return string character set of the file
 702      */
 703     public function getCharset(): string
 704     {
 705         return $this->charset;
 706     }
 707
 708     /**
 709      * Sets the character set of the file
 710      *
 711      * @param string $charset character set of the file
 712      */
 713     public function setCharset(string $charset): void
 714     {
 715         $this->charset = $charset;
 716     }
 717
 718     /**
 719      * Returns compression used by file.
 720      *
 721      * @return string MIME type of compression, none for none
 722      */
 723     public function getCompression(): string
 724     {
 725         return $this->compression ?? $this->detectCompression();
 726     }
 727
 728     /**
 729      * Returns the offset
 730      *
 731      * @return int the offset
 732      */
 733     public function getOffset(): int
 734     {
 735         return $this->offset;
 736     }
 737
 738     /**
 739      * Returns the chunk size
 740      *
 741      * @return int the chunk size
 742      */
 743     public function getChunkSize(): int
 744     {
 745         return $this->chunkSize;
 746     }
 747
 748     /**
 749      * Sets the chunk size
 750      *
 751      * @param int $chunkSize the chunk size
 752      */
 753     public function setChunkSize(int $chunkSize): void
 754     {
 755         $this->chunkSize = $chunkSize;
 756     }
 757
 758     /**
 759      * Returns the length of the content in the file
 760      *
 761      * @return int the length of the file content
 762      */
 763     public function getContentLength(): int
 764     {
 765         return strlen($this->content ?? '');
 766     }
 767 }