<?php
/**
 * Class vRequest
 * Gets filtered request values.
 *
 * @package    VirtueMart
 * @subpackage Helpers
 * @author Max Milbers
 * @copyright Copyright (c) 2014 - 2022 iStraxx UG (haftungsbeschränkt). All rights reserved.
 * @license MIT, see http://opensource.org/licenses/MIT
 *  Permission is hereby granted, free of charge, to any person obtaining a copy
 *  of this software and associated documentation files (the "Software"), to deal
 *  in the Software without restriction, including without limitation the rights
 *  to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 *  copies of the Software, and to permit persons to whom the Software is
 *  furnished to do so, subject to the following conditions:
 *
 *  The above copyright notice and this permission notice shall be included in
 *  all copies or substantial portions of the Software.
 *
 *  THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 *  IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 *  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 *  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 *  THE SOFTWARE.
 *
 *  http://virtuemart.net
 */

defined('FILTER_FLAG_NO_ENCODE') or define ('FILTER_FLAG_NO_ENCODE',!FILTER_FLAG_ENCODE_LOW);

class vRequest {


	public static function getUword($field, $default='', $custom=''){
		$source = self::getVar($field,$default);
		return self::filterUword($source,$custom);
	}

	//static $filters = array( '' =>);
	public static function uword($field, $default='', $custom=''){
		$source = self::getVar($field,$default);
		return self::filterUword($source,$custom);
	}

	public static function filterUword($source, $custom,$replace=''){
		if(function_exists('mb_ereg_replace')){
			//$source is string that will be filtered, $custom is string that contains custom characters
			return mb_ereg_replace('[^\w'.preg_quote($custom).']', $replace, $source);
		} else {
			return preg_replace("~[^\w".preg_quote($custom,'~')."]~", $replace, $source);	//We use Tilde as separator, and give the preq_quote function the used separator
		}
	}

	/**
	 * This function does not allow unicode, replacement for JPath::clean
	 * and makesafe
	 * @param      $string
	 * @param bool $forceNoUni
	 * @return mixed|string
	 */
	static function filterPath($str) {

		if (empty($str)) {
			vmError('filterPath empty string check your paths ');
			vmTrace('Critical error, empty string in filterPath');
			return VMPATH_ROOT;
		}
		$str = trim($str);

		// Delete all '?'
		$str = str_replace('?', '', $str);

		// Replace double byte whitespaces by single byte (East Asian languages)
		$str = preg_replace('/\xE3\x80\x80/', ' ', $str);

		$unicodeslugs = VmConfig::get('transliteratePaths',false);
		if($unicodeslugs){
			$lang = vmLanguage::getLanguage();
			$str = $lang->transliterate($str);
		}

		//This is a path, so remove all strange slashes
		$str = str_replace('/', DS, $str);

		//Clean from possible injection
		while(strpos($str,'..')!==false){
			$str  = str_replace('..', '', $str);
		};
		$str  = preg_replace('#[/\\\\]+#', DS, $str);
		$str = vRequest::vmSpecialChars($str);

		return $str;
	}

	public static function getBool($name, $default = 0){
		$tmp = self::get($name, $default, FILTER_SANITIZE_NUMBER_INT);
		if($tmp){
			$tmp = true;
		} else {
			$tmp = false;
		}
		return $tmp;
	}

	public static function getInt($name, $default = 0, $source = 0){
		return self::get($name, $default, FILTER_SANITIZE_NUMBER_INT,FILTER_FLAG_NO_ENCODE, $source);
	}

	public static function getFloat($name,$default=0.0, $source = 0){
		return self::get($name,$default,FILTER_SANITIZE_NUMBER_FLOAT,FILTER_FLAG_ALLOW_SCIENTIFIC|FILTER_FLAG_ALLOW_FRACTION, $source);
	}

	/**
	 * - Strips all characters <32 and over 127
	 * - Strips all html.
	 */
	public static function getCmd($name, $default = '', $source = 0){
		$str =  self::get($name, $default, FILTER_SANITIZE_SPECIAL_CHARS,FILTER_FLAG_STRIP_LOW|FILTER_FLAG_STRIP_HIGH, $source);
		if($str!==null){
			$str = trim($str, ' ' . chr(194) . chr(160));
			$str = vRequest::vmSpecialChars(strip_tags(vRequest::vmSpecialChars_decode($str)));
		}
		return $str;
	}

	/**
	 * - Strips all characters <32
	 * - Strips all html.
	 */
	public static function getWord($name, $default = ''){
		$str =  self::get($name, $default, FILTER_SANITIZE_SPECIAL_CHARS,FILTER_FLAG_STRIP_LOW);
		if($str!==null){
			$str = trim($str, ' ' . chr(194) . chr(160));
			$str = vRequest::vmSpecialChars(strip_tags(vRequest::vmSpecialChars_decode($str)));
		}
		return $str;
	}

	/**
	 * - Encodes all characters that has a numerical value <32.
	 * - encodes <> and similar, so html and scripts do not work
	 */
	public static function getVar($name, $default = null){
		return self::get($name, $default, FILTER_SANITIZE_SPECIAL_CHARS,FILTER_FLAG_ENCODE_LOW );
	}

	/**
	 * - Encodes all characters that has a numerical value <32.
	 * - strips html
	 */
	public static function getString($name, $default = '', $source = 0){

		$str = self::get($name, $default, FILTER_UNSAFE_RAW,FILTER_FLAG_ENCODE_LOW, $source);

		if($str!==null){
			if (is_array($str)){
				foreach($str as $k=>$s){
					if(is_array($s)){
						foreach($s as $kk=>$sk){
							$str[$kk] = self::getString($kk, $default, $s);
						}
					} else {
						$s = trim($s, ' ' . chr(194) . chr(160));
						$str[$k] = vRequest::vmSpecialChars(strip_tags(vRequest::vmSpecialChars_decode($s)));
						//$str[$k] = self::getString($k, $default, $str);
					}

				}
				return $str;
			} else {
				// replace no-break-space 'whitespace'
				$str = trim($str, ' ' . chr(194) . chr(160));
				$str = vRequest::vmSpecialChars(strip_tags(vRequest::vmSpecialChars_decode($str)));
				return $str;
			}
		}

	}

	public static function recurseFilterText(&$tmp){

		foreach($tmp as $k =>$v){
			if(is_array($v)){
				self::recurseFilterText($v);
			} else {
				$tmp[$k] = JComponentHelper::filterText($v);
			}
		}
	}

	/**
	 * - Encodes all characters that has a numerical value <32.
	 * - keeps "secure" html
	 */
	public static function getHtml($name, $default = '', $input = 0){
		$tmp = self::get($name, $default,FILTER_UNSAFE_RAW,FILTER_FLAG_NO_ENCODE, $input);

		if(is_array($tmp)){
			self::recurseFilterText($tmp);
			return $tmp;
		} else {
			return JComponentHelper::filterText($tmp);
		}
	}

	public static function getEmail($name, $default = ''){
		return self::get($name, $default, FILTER_VALIDATE_EMAIL,FILTER_FLAG_STRIP_LOW|FILTER_FLAG_STRIP_HIGH);
	}

	public static function filterUrl($url){

		if(!is_array($url)){
			$url = urldecode($url);
		} else {
			foreach($url as $k => $u){
				$url[$k] = self::filterUrl($u);
			}
		}
		$url = strip_tags($url);

		//$url = self::filter($url,FILTER_SANITIZE_URL,'');
		return self::filter($url,FILTER_SANITIZE_SPECIAL_CHARS,FILTER_FLAG_ENCODE_LOW);
	}

	public static $request = null;
	public static $get = null;
	public static $filteredVars = array();
	public static $varRouter = null;

	/**
	 * Main filter function, called by the others with set Parameters
	 * The standard filter is non restrictiv.
	 *
	 * @author Max Milbers
	 * @param $name
	 * @param null $default
	 * @param int $filter
	 * @param int $flags
	 * @return mixed|null
	 */
	public static function get($name, $default = false, $filter = FILTER_UNSAFE_RAW, $flags = FILTER_FLAG_NO_ENCODE, $source = 0){
		vmSetStartTime('getfilter');

		if($name === ''){
			vmTrace('empty name in vRequest::get', FALSE, 5);
			return $default;
		} else {

			if($source!==0 and is_array($source)){
				$sourceVar = $source;
				if(isset($sourceVar[$name])) {
					$v = $sourceVar[$name];
					$v = self::filter($v,$filter,$flags);
				} else {
					$v = $default;
				}
				return $v;
			}

			$key = $filter.'.'.$flags;
			if(isset(self::$filteredVars[$source][$name][$key])){
				//vmTime('Using cache '.$name,'getfilter');
				return self::$filteredVars[$source][$name][$key];
			}

			if($source==0){

				if(!isset(self::$request)){
					vRequest::setRouterVars();
				}
				$sourceVar = self::$request;


			} else if($source=='GET') {
				if (isset(self::$get)) {
					$sourceVar = self::$get;
				} else {
					$sourceVar = $_GET;
					if(VmConfig::isSite()){
						if (self::$varRouter===null) {
							$router = JFactory::getApplication()->getRouter();
							self::$varRouter = $router->getVars();
						}
						vmdebug('In $_GET and router '.$key, $sourceVar, self::$varRouter);
						if(empty($_GET)){
							$sourceVar = self::$varRouter;
						} else if (empty(self::$varRouter)) {
							$sourceVar = $_GET;
						} else if (is_array(self::$varRouter) and is_array($_GET) ) {
							//self::$get = $sourceVar = array_merge(self::$varRouter, $_GET);
							$sourceVar = array_merge($_GET, self::$varRouter);
							vmdebug('Merging $get vars '.$key, $sourceVar);
						}
					}
				}
			} else if ($source=='POST') {
				$sourceVar = $_POST;
			} else if(!empty($source)) {
				$sourceVar = $source;
			}

			if(isset($sourceVar[$name])) {
				$v = $sourceVar[$name];
				$v = self::filter($v,$filter,$flags);
				self::$filteredVars[$source][$name][$key] = $v;
			} else {
				$v = $default;  //default must not be cached
			}

			//vmdebug('Set cache',self::$filteredVars[$source]);
			//vmTime('Get filter '.$key,'getfilter');
			return $v;

		}
	}

	public static $routerSet = false;

	public static function setRouterVars(){

		//if(self::$routerSet) return;
		$routerDebug = VmConfig::get('debug_enable_router',0);
		if($routerDebug)vmdebug('Set router vars');
		if(VmConfig::isSite()) {
			$router = JFactory::getApplication()->getRouter();
			self::$varRouter = $router->getVars();
		}

		self::$request = $_REQUEST;
		self::$get = $_GET;
		if(VmConfig::isSite()) {


			if(empty($_GET)){
				self::$get = self::$varRouter;
				if($routerDebug)vmdebug('setRouterVars $_GET empty ', self::$get);
			} else if (empty(self::$varRouter)) {
				self::$get = $_GET;
				if($routerDebug)vmdebug('setRouterVars $varRouter empty ', self::$get);
			} else if ( is_array(self::$varRouter) and is_array($_GET) ) {
				if($routerDebug)self::$get = array_merge(self::$varRouter, $_GET);
				self::$get = array_merge($_GET, self::$varRouter);
				if($routerDebug)vmdebug('setRouterVars Merging $get vars ', $_GET, self::$varRouter, self::$get);
			}
			self::$request = array_merge( self::$request, self::$get);
			self::$request = array_merge( self::$request, $_POST);
			if($routerDebug) vmdebug('Set router vars Post, Get, self::$get and self::$request', $_POST ,$_GET, self::$get, self::$request);
		}

		self::$filteredVars[0] = array();
		if(isset(self::$filteredVars['POST'])) self::$filteredVars['POST'] = array();
		if(isset(self::$filteredVars['GET'])) self::$filteredVars['GET'] = array();

		self::$routerSet = true;

	}

	public static function filter($var, $filter, $flags, $array=false){
		if($array or is_array($var)){
			if(!is_array($var)) $var = array($var);
			self::recurseFilter($var, $filter, $flags);
			return $var;
		}
		else {
			return filter_var($var, $filter, $flags);
		}
	}

	public static function recurseFilter(&$var, $filter, $flags = FILTER_FLAG_STRIP_LOW){
		foreach($var as $k=>&$v){
			if(!empty($k) and !is_numeric($k)){
				$t = filter_var($k, FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_STRIP_LOW);
				if($t!=$k){
					$var[$t] = $v;
					unset($var[$k]);
					vmdebug('unset invalid key',$k,$t);
				}
			}
			if(!empty($v)){
				if( is_array($v) ){	//and count($v)>1){
					self::recurseFilter($v, $filter, $flags);
				} else {
					$v = filter_var($v, $filter, $flags);
				}
			}

		}
		//filter_var_array($var, $filter);
	}

	/**
	 * Gets the request and filters it directly. It uses the standard php function filter_var_array,
	 * The standard filter allows all chars, also the special ones. But removes dangerous html tags.
	 *
	 * @author Max Milbers
	 * @param array $filter
	 * @return mixed cleaned $_REQUEST
	 */
	public static function getRequest( $filter = FILTER_SANITIZE_SPECIAL_CHARS, $flags = FILTER_FLAG_ENCODE_LOW ){
		if (self::$varRouter===null) {
			$router = JFactory::getApplication()->getRouter();
			self::$varRouter = $router->getVars();
		}
		$source = $_REQUEST;
		if(!empty(self::$varRouter)){
			$source = array_merge(self::$varRouter,$_REQUEST);
		}
		return self::filter($source, $filter, $flags,true);
		//return  filter_var_array($_REQUEST, $filter);
	}
	
	public static function getPost( $filter = FILTER_SANITIZE_SPECIAL_CHARS, $flags = FILTER_FLAG_ENCODE_LOW ){
		return self::filter($_POST, $filter, $flags,true);
	}
	
	public static function getGet( $filter = FILTER_SANITIZE_SPECIAL_CHARS, $flags = FILTER_FLAG_ENCODE_LOW ){

		if (self::$varRouter===null) {
			$router = JFactory::getApplication()->getRouter();
			self::$varRouter = $router->getVars();
		}
		$source = $_GET;
		if(!empty(self::$varRouter)){
			$source = array_merge($_GET,self::$varRouter);
		}

		return self::filter($source, $filter, $flags,true);
	}
	
	public static function getFiles( $name, $filter = FILTER_SANITIZE_SPECIAL_CHARS, $flags = FILTER_FLAG_STRIP_LOW){
		if(empty($_FILES[$name])) return false;
		return  self::filter($_FILES[$name], $filter, $flags);
	}

	public static function setVar($name, $value = null){

		$tmp = null;
		if(isset(self::$filteredVars[0][$name])){
			$tmp = current(self::$filteredVars[0][$name]);
			self::$filteredVars[0][$name] = array();
			if(isset(self::$filteredVars['POST'])) self::$filteredVars['POST'][$name] = array();
			if(isset(self::$filteredVars['GET'])) self::$filteredVars['GET'][$name] = array();
		} else if(isset($_REQUEST[$name])){
			$tmp = self::filter ($_REQUEST[$name], FILTER_UNSAFE_RAW, FILTER_FLAG_ENCODE_LOW);
		}

		$_REQUEST[$name] = $value;
		self::$request[$name] = $value;

		return $tmp;

	}

	public static function vmSpecialChars($c){
		if (version_compare(phpversion(), '5.4.0', '<')) {
			// php version isn't high enough
			$c = htmlspecialchars ($c,ENT_QUOTES,'UTF-8',false);	//ENT_SUBSTITUTE only for php5.4 and higher
		} else {
			$c = htmlspecialchars ($c,ENT_QUOTES|ENT_SUBSTITUTE,'UTF-8',false);
		}
		return $c;
	}

	public static function vmSpecialChars_decode($c){
		if (version_compare(phpversion(), '5.4.0', '<')) {
			// php version isn't high enough
			$c = htmlspecialchars_decode ($c,ENT_QUOTES);	//ENT_SUBSTITUTE only for php5.4 and higher
		} else {
			$c = htmlspecialchars_decode ($c,ENT_QUOTES|ENT_SUBSTITUTE);
		}
		return $c;
	}

	public static function vmHtmlEntities($str){
		return htmlentities($str, ENT_COMPAT, "UTF-8", false);
	}

	/**
	 * Checks for a form token in the request.
	 *
	 * @return  boolean  True if token valid
	 */
	public static function vmCheckToken($redirectMsg=0){

		$token = self::getFormToken();

		if (!self::uword($token, false)){

			if ($rToken = self::uword('token', false)){
				if($rToken == $token){
					return true;
				}
			}

			$session = JFactory::getSession();

			if ($session->isNew()){
				// Redirect to login screen.
				$app = JFactory::getApplication();
				vmInfo('JLIB_ENVIRONMENT_SESSION_EXPIRED');
				$app->redirect(JRoute::_('index.php'));
				$app->close();
				return false;
			}
			else {
				if($redirectMsg===0){
					$redirectMsg = 'Invalid Token, in ' . vRequest::getCmd('options') .' view='.vRequest::getCmd('view'). ' task='.vRequest::getCmd('task');
					//jexit('Invalid Token, in ' . vRequest::getCmd('options') .' view='.vRequest::getCmd('view'). ' task='.vRequest::getCmd('task'));
				}
				// Redirect to login screen.
				$app = JFactory::getApplication();
				$session->close();
				vmWarn($redirectMsg);
				$app->redirect(JRoute::_('index.php'));
				$app->close();
				return false;
			}
		}
		else {
			return true;
		}
	}

	public static function getFormToken($fNew = false){

		$sess = JFactory::getSession();
		$user = JFactory::getUser();

		if(empty($user->id)) $user->id = 0;

		$token = $sess->get('session.token');
		if ($token === null || $fNew) {
			$token = vmCrypt::getToken();
			$sess->set('session.token', $token);
		}
		$hash = self::getHash($user->id . $token);

		return $hash;
	}

	public static function getHash($seed) {
		return md5(VmConfig::getSecret() . $seed);
	}
}