Lines 92.34% 205 / 222
Methods 62.06% 18 / 29
Classes 0.00% 0 / 1
Covered by tests of size
Name Lines Methods CRAP
 create 92.30% 12 / 13 0.00% 0 / 1 3.00
 delete 92.30% 12 / 13 0.00% 0 / 1 3.00
 update 87.50% 14 / 16 0.00% 0 / 1 4.03
 activate 94.73% 18 / 19 0.00% 0 / 1 4.00
 newsMessageFromPayload 100.00% 24 / 24 100.00% 1 / 1 1
 [phpMyFAQ\Controller\Administration\Api\AbstractAdministrationApiController] initializeFromContainer 80.00% 4 / 5 0.00% 0 / 1 2.03
 [phpMyFAQ\Controller\AbstractController] __construct 100.00% 2 / 2 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] setContainer 100.00% 2 / 2 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] render 100.00% 5 / 5 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] renderView 0.00% 0 / 3 0.00% 0 / 1 2
 [phpMyFAQ\Controller\AbstractController] json 100.00% 1 / 1 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] getJsonObject 75.00% 3 / 4 0.00% 0 / 1 2.06
 [phpMyFAQ\Controller\AbstractController] getTwigWrapper 100.00% 10 / 10 100.00% 1 / 1 3
 [phpMyFAQ\Controller\AbstractController] hasValidToken 85.71% 6 / 7 0.00% 0 / 1 5.07
 [phpMyFAQ\Controller\AbstractController] isSecured 100.00% 10 / 10 100.00% 1 / 1 5
 [phpMyFAQ\Controller\AbstractController] isPublicAuthenticationPath 100.00% 23 / 23 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] userIsAuthenticated 100.00% 2 / 2 100.00% 1 / 1 2
 [phpMyFAQ\Controller\AbstractController] userIsSuperAdmin 100.00% 2 / 2 100.00% 1 / 1 2
 [phpMyFAQ\Controller\AbstractController] userHasGroupPermission 100.00% 8 / 8 100.00% 1 / 1 6
 [phpMyFAQ\Controller\AbstractController] userHasUserPermission 100.00% 7 / 7 100.00% 1 / 1 5
 [phpMyFAQ\Controller\AbstractController] userHasPermission 100.00% 5 / 5 100.00% 1 / 1 3
 [phpMyFAQ\Controller\AbstractController] userHasAnyPermission 100.00% 10 / 10 100.00% 1 / 1 4
 [phpMyFAQ\Controller\AbstractController] verifySessionCsrfToken 70.00% 7 / 10 0.00% 0 / 1 4.43
 [phpMyFAQ\Controller\AbstractController] captchaCodeIsValid 85.71% 6 / 7 0.00% 0 / 1 2.01
 [phpMyFAQ\Controller\AbstractController] isApiEnabled 100.00% 1 / 1 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] addExtension 100.00% 1 / 1 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] addFilter 100.00% 1 / 1 100.00% 1 / 1 1
 [phpMyFAQ\Controller\AbstractController] getRateLimiter 100.00% 4 / 4 100.00% 1 / 1 3
 [phpMyFAQ\Controller\AbstractController] createFallbackContainer 71.42% 5 / 7 0.00% 0 / 1 2.09
35final class NewsController extends AbstractAdministrationApiController
36{
37    /**
38     * @throws \Exception
39     */
40    #[Route(path: 'news/create', name: 'admin.api.news.create', methods: ['POST'])]
41    public function create(Request $request): JsonResponse
42    {
43        $this->userHasPermission(PermissionType::NEWS_ADD);
44
45        $data = $this->getJsonObject($request);
46
47        $news = new News($this->configuration);
48
49        if (!Token::getInstance($this->session)->verifyToken(
50            page: 'save-news',
51            requestToken: (string) ($data->csrfToken ?? ''),
52        )) {
53            return $this->json(['error' => Translation::get(key: 'msgNoPermission')], Response::HTTP_UNAUTHORIZED);
54        }
55
56        $newsMessage = $this->newsMessageFromPayload($data);
57
58        if ($news->create($newsMessage)) {
59            $this->adminLog->log($this->currentUser, AdminLogType::NEWS_ADD->value);
60
61            return $this->json(['success' => Translation::get(key: 'ad_news_updatesuc')], Response::HTTP_OK);
62        }
63
64        return $this->json(['error' => Translation::get(key: 'ad_news_insertfail')], Response::HTTP_BAD_GATEWAY);
65    }
66
67    /**
68     * @throws \Exception
69     */
70    #[Route(path: 'news/delete', name: 'admin.api.news.delete', methods: ['DELETE'])]
71    public function delete(Request $request): JsonResponse
72    {
73        $this->userHasPermission(PermissionType::NEWS_DELETE);
74
75        $data = $this->getJsonObject($request);
76
77        $news = new News($this->configuration);
78
79        if (!Token::getInstance($this->session)->verifyToken(
80            page: 'delete-news',
81            requestToken: (string) ($data->csrfToken ?? ''),
82        )) {
83            return $this->json(['error' => Translation::get(key: 'msgNoPermission')], Response::HTTP_UNAUTHORIZED);
84        }
85
86        $deleteId = (int) Filter::filterVar($data->id ?? null, FILTER_VALIDATE_INT);
87
88        if ($news->delete($deleteId)) {
89            $this->adminLog->log($this->currentUser, AdminLogType::NEWS_DELETE->value . ':' . $deleteId);
90
91            return $this->json(['success' => Translation::get(key: 'ad_news_delsuc')], Response::HTTP_OK);
92        }
93
94        return $this->json(['error' => Translation::get(key: 'ad_news_updatefail')], Response::HTTP_BAD_GATEWAY);
95    }
96
97    /**
98     * @throws \Exception
99     */
100    #[Route(path: 'news/update', name: 'admin.api.news.update', methods: ['PUT'])]
101    public function update(Request $request): JsonResponse
102    {
103        $this->userHasPermission(PermissionType::NEWS_EDIT);
104
105        $data = $this->getJsonObject($request);
106
107        $news = new News($this->configuration);
108
109        if (!Token::getInstance($this->session)->verifyToken(
110            page: 'update-news',
111            requestToken: (string) ($data->csrfToken ?? ''),
112        )) {
113            return $this->json(['error' => Translation::get(key: 'msgNoPermission')], Response::HTTP_UNAUTHORIZED);
114        }
115
116        $newsId = Filter::filterVar($data->id ?? null, FILTER_VALIDATE_INT);
117
118        if (!is_int($newsId)) {
119            return $this->json(['error' => Translation::get(key: 'ad_news_updatefail')], Response::HTTP_BAD_REQUEST);
120        }
121
122        $newsMessage = $this->newsMessageFromPayload($data)->setId($newsId);
123
124        if ($news->update($newsMessage)) {
125            $this->adminLog->log($this->currentUser, AdminLogType::NEWS_EDIT->value . ':' . $newsId);
126
127            return $this->json(['success' => Translation::get(key: 'ad_news_updatesuc')], Response::HTTP_OK);
128        }
129
130        return $this->json(['error' => Translation::get(key: 'ad_news_updatefail')], Response::HTTP_BAD_GATEWAY);
131    }
132
133    /**
134     * @throws \Exception
135     */
136    #[Route(path: 'news/activate', name: 'admin.api.news.activate', methods: ['PUT'])]
137    public function activate(Request $request): JsonResponse
138    {
139        $this->userHasPermission(PermissionType::NEWS_EDIT);
140        $data = $this->getJsonObject($request);
141
142        $news = new News($this->configuration);
143
144        if (!Token::getInstance($this->session)->verifyToken(
145            page: 'activate-news',
146            requestToken: (string) ($data->csrfToken ?? ''),
147        )) {
148            return $this->json(['error' => Translation::get(key: 'msgNoPermission')], Response::HTTP_UNAUTHORIZED);
149        }
150
151        $newsId = Filter::filterVar($data->id ?? null, FILTER_VALIDATE_INT);
152
153        if (!is_int($newsId)) {
154            return $this->json(['error' => Translation::get(key: 'ad_news_updatefail')], Response::HTTP_BAD_REQUEST);
155        }
156
157        $status = (bool) Filter::filterVar($data->status ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
158
159        if ($status) {
160            $news->activate($newsId);
161            $this->adminLog->log($this->currentUser, AdminLogType::NEWS_EDIT->value . ':' . $newsId);
162
163            return $this->json(['success' => Translation::get(key: 'ad_news_updatesuc')], Response::HTTP_OK);
164        }
165
166        $news->deactivate($newsId);
167        $this->adminLog->log($this->currentUser, AdminLogType::NEWS_EDIT->value . ':' . $newsId);
168
169        return $this->json(['success' => Translation::get(key: 'ad_news_updatesuc')], Response::HTTP_OK);
170    }
171
172    /**
173     * Builds a news message entity from the validated request payload.
174     */
175    private function newsMessageFromPayload(\stdClass $data): NewsMessage
176    {
177        $header = Filter::filterVar($data->newsHeader ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
178        $content = Filter::filterVar($data->news ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
179        $author = Filter::filterVar($data->authorName ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
180        $email = (string) Filter::filterEmail($data->authorEmail ?? '', default: '');
181        $active = Filter::filterVar($data->active ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
182        $comment = Filter::filterVar($data->comment ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
183        $link = Filter::filterVar($data->link ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
184        $linkTitle = Filter::filterVar($data->linkTitle ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
185        $newsLang = Filter::filterVar($data->langTo ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
186        $target = Filter::filterVar($data->target ?? '', FILTER_SANITIZE_SPECIAL_CHARS, '');
187
188        $newsMessage = new NewsMessage();
189        $newsMessage
190            ->setLanguage($newsLang)
191            ->setHeader($header)
192            ->setMessage(html_entity_decode($content))
193            ->setAuthor($author)
194            ->setEmail($email)
195            ->setActive((bool) $active)
196            ->setComment((bool) $comment)
197            ->setLink($link)
198            ->setLinkTitle($linkTitle)
199            ->setLinkTarget($target)
200            ->setCreated(new DateTime());
201
202        return $newsMessage;
203    }
204}

Inherited from phpMyFAQ\Controller\Administration\Api\AbstractAdministrationApiController

31    protected function initializeFromContainer(): void
32    {
33        parent::initializeFromContainer();
34
35        $adminLog = $this->container->get(id: 'phpmyfaq.admin.admin-log');
36        if (!$adminLog instanceof AdminLog) {
37            throw new \LogicException('AdminLog service not found in container.');
38        }
39
40        $this->adminLog = $adminLog;
41    }

Inherited from phpMyFAQ\Controller\AbstractController

83    public function __construct()
84    {
85        $this->container = ContainerRegistry::get() ?? $this->createFallbackContainer();
86        $this->initializeFromContainer();
87    }
93    public function setContainer(ContainerInterface $container): void
94    {
95        $this->container = $container;
96        $this->initializeFromContainer();
97    }
137    public function render(string $file, array $context = [], ?Response $response = null): Response
138    {
139        $response ??= new Response();
140        $twigWrapper = $this->getTwigWrapper();
141        $templateWrapper = $twigWrapper->loadTemplate($file);
142
143        $response->setContent($templateWrapper->render($context));
144
145        return $response;
146    }
154    public function renderView(string $pathToTwigFile, array $templateVars = []): string
155    {
156        $twigWrapper = $this->getTwigWrapper();
157        $templateWrapper = $twigWrapper->loadTemplate($pathToTwigFile);
158
159        return $templateWrapper->render($templateVars);
160    }
167    public function json(mixed $data, int $status = 200, array $headers = []): JsonResponse
168    {
169        return new JsonResponse($data, $status, $headers);
170    }
182    protected function getJsonObject(Request $request): \stdClass
183    {
184        /* @mago-expect analysis:mixed-assignment - json_decode() is mixed by nature; validated to stdClass below */
185        $data = json_decode($request->getContent(), associative: false, depth: 512, flags: JSON_THROW_ON_ERROR);
186
187        if (!$data instanceof \stdClass) {
188            throw new JsonException('The request body must be a JSON object.');
189        }
190
191        return $data;
192    }
197    public function getTwigWrapper(): TwigWrapper
198    {
199        $twigWrapper = new TwigWrapper(
200            (string) PMF_ROOT_DIR . '/assets/templates',
201            false,
202            $this->configuration->getTemplateSet(),
203        );
204
205        foreach ($this->twigExtensions as $twigExtension) {
206            $twigWrapper->addExtension($twigExtension);
207        }
208
209        foreach ($this->twigFilters as $twigFilter) {
210            $twigWrapper->addFilter($twigFilter);
211        }
212
213        return $twigWrapper;
214    }
219    protected function hasValidToken(): void
220    {
221        $configuredToken = $this->configuration->get(item: 'api.apiClientToken');
222        if (!is_string($configuredToken) || $configuredToken === '') {
223            throw new UnauthorizedHttpException(challenge: '"x-pmf-token" is not valid.');
224        }
225
226        $request = Request::createFromGlobals();
227        $requestToken = $request->headers->get(key: 'x-pmf-token');
228        if (!is_string($requestToken) || !hash_equals($configuredToken, $requestToken)) {
229            throw new UnauthorizedHttpException(challenge: '"x-pmf-token" is not valid.');
230        }
231    }
236    protected function isSecured(): void
237    {
238        if ($this->currentUser->isLoggedIn()) {
239            return;
240        }
241
242        if (!$this->configuration->get(item: 'security.enableLoginOnly')) {
243            return;
244        }
245
246        $request = Request::createFromGlobals();
247        $pathInfo = rtrim($request->getPathInfo(), characters: '/');
248        $pathInfo = $pathInfo === '' ? '/' : $pathInfo;
249
250        if ($this->isPublicAuthenticationPath($pathInfo)) {
251            return;
252        }
253
254        throw new UnauthorizedHttpException(challenge: 'You are not allowed to view this content.');
255    }
257    private function isPublicAuthenticationPath(string $pathInfo): bool
258    {
259        $publicAuthenticationPaths = [
260            '/login',
261            '/authenticate',
262            '/forgot-password',
263            '/token',
264            '/check',
265            '/contact.html',
266            '/imprint.html',
267            '/privacy.html',
268            '/terms.html',
269            '/accessibility.html',
270            '/auth/azure/authorize',
271            '/auth/azure/callback',
272            '/auth/azure/callback.php',
273            '/auth/keycloak/authorize',
274            '/auth/keycloak/callback',
275            '/auth/keycloak/logout',
276            '/services/azure/callback',
277            '/services/azure/callback.php',
278            '/api/webauthn/prepare-login',
279            '/api/webauthn/login',
280        ];
281
282        return in_array($pathInfo, $publicAuthenticationPaths, strict: true);
283    }
288    public function userIsAuthenticated(): void
289    {
290        if (!$this->currentUser->isLoggedIn()) {
291            throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
292        }
293    }
298    protected function userIsSuperAdmin(): void
299    {
300        if (!$this->currentUser->isSuperAdmin()) {
301            throw new UnauthorizedHttpException(challenge: 'User is not super admin.');
302        }
303    }
308    protected function userHasGroupPermission(): void
309    {
310        if (!$this->currentUser->isLoggedIn()) {
311            throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
312        }
313
314        $currentUser = $this->currentUser;
315        if (
316            !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::USER_ADD->value)
317            || !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::USER_EDIT->value)
318            || !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::USER_DELETE->value)
319            || !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::GROUP_EDIT->value)
320        ) {
321            throw new ForbiddenException(message: 'User has no group permission.');
322        }
323    }
328    protected function userHasUserPermission(): void
329    {
330        if (!$this->currentUser->isLoggedIn()) {
331            throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
332        }
333
334        $currentUser = $this->currentUser;
335        if (
336            !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::USER_ADD->value)
337            || !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::USER_EDIT->value)
338            || !$currentUser->perm->hasPermission($currentUser->getUserId(), PermissionType::USER_DELETE->value)
339        ) {
340            throw new ForbiddenException(message: 'User has no user permission.');
341        }
342    }
347    protected function userHasPermission(PermissionType $permissionType): void
348    {
349        if (!$this->currentUser->isLoggedIn()) {
350            throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
351        }
352
353        $currentUser = $this->currentUser;
354        if (!$currentUser?->perm->hasPermission($currentUser->getUserId(), $permissionType->value)) {
355            throw new ForbiddenException(message: sprintf('User has no "%s" permission.', $permissionType->name));
356        }
357    }
364    protected function userHasAnyPermission(PermissionType ...$permissionTypes): void
365    {
366        if (!$this->currentUser->isLoggedIn()) {
367            throw new UnauthorizedHttpException(challenge: 'User is not authenticated.');
368        }
369
370        $currentUser = $this->currentUser;
371        foreach ($permissionTypes as $permissionType) {
372            if ($currentUser->perm->hasPermission($currentUser->getUserId(), $permissionType->value)) {
373                return;
374            }
375        }
376
377        throw new ForbiddenException(message: sprintf('User has none of the required permissions: %s.', implode(', ', array_map(
378            static fn(PermissionType $type): string => $type->name,
379            $permissionTypes,
380        ))));
381    }
389    protected function verifySessionCsrfToken(string $page, #[\SensitiveParameter] string $requestToken): bool
390    {
391        if ($requestToken === '') {
392            return false;
393        }
394
395        $sessionKey = sprintf('pmf-csrf-token.%s', $page);
396        $storedToken = $this->session->get($sessionKey);
397
398        if (!$storedToken instanceof Token) {
399            return false;
400        }
401
402        if (time() > $storedToken->getExpiry()) {
403            $this->session->remove($sessionKey);
404            return false;
405        }
406
407        return hash_equals($storedToken->getSessionToken(), $requestToken);
408    }
414    protected function captchaCodeIsValid(Request $request): bool
415    {
416        $captcha = Captcha::getInstance($this->configuration);
417        $captcha->setUserIsLoggedIn($this->currentUser->isLoggedIn());
418
419        $data = json_decode($request->getContent(), associative: false, depth: 512, flags: JSON_THROW_ON_ERROR);
420
421        $code = Filter::filterVar($data->captcha ?? '', FILTER_SANITIZE_SPECIAL_CHARS);
422        if ($this->configuration->get(item: 'security.enableGoogleReCaptchaV2')) {
423            $code = Filter::filterVar($data->{'g-recaptcha-response'} ?? '', FILTER_SANITIZE_SPECIAL_CHARS);
424        }
425
426        return $captcha->checkCaptchaCode((string) $code);
427    }
429    public function isApiEnabled(): bool
430    {
431        return (bool) $this->configuration->get(item: 'api.enableAccess');
432    }
434    public function addExtension(ExtensionInterface $extension): void
435    {
436        $this->twigExtensions[] = $extension;
437    }
439    public function addFilter(TwigFilter $twigFilter): void
440    {
441        $this->twigFilters[] = $twigFilter;
442    }
444    protected function getRateLimiter(): ?RateLimiter
445    {
446        if (!$this->container->has('phpmyfaq.http.rate-limiter')) {
447            return null;
448        }
449
450        $rateLimiter = $this->container->get('phpmyfaq.http.rate-limiter');
451
452        return $rateLimiter instanceof RateLimiter ? $rateLimiter : null;
453    }
455    private function createFallbackContainer(): ContainerBuilder
456    {
457        $containerBuilder = new ContainerBuilder();
458        $phpFileLoader = new PhpFileLoader($containerBuilder, new FileLocator(__DIR__));
459        try {
460            $phpFileLoader->load(resource: '../../services.php');
461        } catch (\Exception $exception) {
462            error_log($exception->getMessage());
463        }
464
465        // Register Forms services
466        FormsServiceProvider::register($containerBuilder);
467
468        return $containerBuilder;
469    }