core.php

<?php

/*

    All Emoncms code is released under the GNU Affero General Public License.
    See COPYRIGHT.txt and LICENSE.txt.

    ---------------------------------------------------------------------
    Emoncms - open source energy visualisation
    Part of the OpenEnergyMonitor project:
    http://openenergymonitor.org

*/

// no direct access
defined('EMONCMS_EXEC') or die('Restricted access');

/**
 * Returns true if the TCP connection originates from a trusted proxy —
 * i.e. localhost or a private (RFC 1918) address. This means forwarded
 * headers (X-Forwarded-Host, X-Forwarded-Proto, etc.) were set by a local
 * process such as nginx, a Dataplicity/ngrok tunnel agent, or Home Assistant
 * ingress — not injected by a remote attacker.
 */
function is_trusted_proxy()
{
    $remote = isset($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : '';
    if ($remote === '127.0.0.1' || $remote === '::1') {
        return true;
    }
    // FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE causes
    // filter_var to return false for private/reserved ranges, true for public.
    // So a private/loopback address returns false here, meaning is_trusted_proxy() = true.
    return filter_var(
        $remote,
        FILTER_VALIDATE_IP,
        FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE
    ) === false;
}

function is_https()
{
    // Detect if we are running HTTPS or proxied HTTPS
    if (server('HTTPS') == 'on') {
        // Web server is running native HTTPS
        return true;
    } elseif (is_trusted_proxy() && server('HTTP_X_FORWARDED_PROTO') == "https") {
        // Web server is running behind a trusted local proxy which is running HTTPS
        return true;
    } elseif (is_trusted_proxy() && server('HTTP_X_FORWARDED_PORT') == 443) {
        // Web server is running behind a trusted local proxy which is running HTTPS
        return true;
    } elseif (is_trusted_proxy() && request_header('HTTP_X_FORWARDED_PROTO') == "https") {
        return true;
    }
    return false;
}

function get_application_path($manual_domain = false)
{
    if (is_https()) {
        $proto = "https";
    } else {
        $proto = "http";
    }

    if ($manual_domain) {
        return "$proto://".$manual_domain."/";
    }

    if (isset($_SERVER['HTTP_X_FORWARDED_HOST']) && is_trusted_proxy()) {
        // X-Forwarded-Host is only trusted when the connection comes from a local
        // proxy (localhost or LAN), e.g. nginx, Dataplicity, ngrok, HA ingress.
        // A remote attacker cannot spoof this as their REMOTE_ADDR will be public.
        $filepath = "$proto://" . server('HTTP_X_FORWARDED_HOST');
        if (isset($_SERVER['HTTP_X_INGRESS_PATH'])) {
            // web server is running in ingress mode in home assistant
            $filepath .= server('HTTP_X_INGRESS_PATH');
        }
        $filepath .= server('SCRIPT_NAME');
        $path = dirname($filepath) . "/";
    } else {
        $path = dirname("$proto://" . server('HTTP_HOST') . server('SCRIPT_NAME')) . "/";
    }

    return $path;
}

function db_check($mysqli, $database)
{
    $stmt = $mysqli->prepare("SELECT count(table_schema) FROM information_schema.tables WHERE table_schema = ?");
    $stmt->bind_param("s", $database);
    $stmt->execute();
    $stmt->bind_result($count);
    $stmt->fetch();
    $stmt->close();
    return $count > 0;
}

function controller($controller_name)
{
    $output = array('content'=>EMPTY_ROUTE);

    if ($controller_name) {
        $controller = $controller_name."_controller";
        $controllerScript = "Modules/".$controller_name."/".$controller.".php";
        if (is_file($controllerScript)) {
            load_language_files("Modules/".$controller_name."/locale");

            require_once $controllerScript;
            $output = $controller();
            if (!is_array($output) || !isset($output["content"])) {
                $output = array("content"=>$output);
            }
            $output['is_controller'] = true;
        } else {
            $output['is_controller'] = false;
        }
    }
    return $output;
}

function view($filepath, array $args = array())
{
    global $path;
    $args['path'] = $path;
    $content = '';
    if (file_exists($filepath)) {
        unset($args['filepath']);
        extract($args);
        ob_start();
        include "$filepath";
        $content = ob_get_clean();
    }
    return $content;
}
/**
 * strip slashes from GET values or null if not set
 *
 * @param string $index name of $_GET item
 *
 **/
function get($index, $error_if_missing = false, $default = null)
{
    $val = $default;
    if (isset($_GET[$index])) {
        $val = rawurldecode($_GET[$index]);
    } elseif ($error_if_missing) {
        header('Content-Type: text/plain');
        die("missing $index parameter");
    }
    if (!is_null($val)) {
        $val = stripslashes($val);
    }
    return $val;
}
/**
 * strip slashes from POST values or null if not set
 *
 * @param string $index name of $_POST item
 *
 **/
function post($index, $error_if_missing = false, $default = null)
{
    $val = $default;
    if (isset($_POST[$index])) {
        // PHP automatically converts POST names with brackets `field[]` to type array
        if (!is_array($_POST[$index])) {
            $val = rawurldecode($_POST[$index]); // does not decode the plus symbol into spaces
        } else {
            $val = htmlspecialchars(json_encode($_POST[$index]));
        }
    } elseif ($error_if_missing) {
        header('Content-Type: text/plain');
        die("missing $index parameter");
    }

    if (!is_null($val)) {
        if (is_array($val)) {
            $val = array_map("stripslashes", $val);
        } else {
            $val = stripslashes($val);
        }
    }
    return $val;
}
/**
 * strip slashes from POST or GET values or null if not set
 *
 * @param string $index name of $_POST or $_GET item
 *
 **/
function prop($index, $error_if_missing = false, $default = null)
{
    $val = $default;
    if (isset($_GET[$index])) {
        $val = $_GET[$index];
    } elseif (isset($_POST[$index])) {
        $val = $_POST[$index];
    } elseif ($error_if_missing) {
        header('Content-Type: text/plain');
        die("missing $index parameter");
    }

    if (!is_null($val)) {
        if (is_array($val)) {
            $val = array_map("stripslashes", $val);
        } else {
            $val = stripslashes($val);
        }
    }
    return $val;
}

function request_header($index)
{
    $val = null;
    $headers = apache_request_headers();
    if (isset($headers[$index])) {
        $val = $headers[$index];
    }
    return $val;
}


function server($index)
{
    $val = null;
    if (isset($_SERVER[$index])) {
        $val = $_SERVER[$index];
    }
    return $val;
}

function delete($index)
{
    parse_str(file_get_contents("php://input"), $_DELETE);//create array with posted (DELETE) method) values
    $val = null;
    if (isset($_DELETE[$index])) {
        $val = $_DELETE[$index];
    }

    if (is_array($val)) {
        $val = array_map("stripslashes", $val);
    } else {
        $val = stripslashes($val);
    }
    return $val;
}
function put($index)
{
    parse_str(file_get_contents("php://input"), $_PUT);//create array with posted (PUT method) values
    $val = null;
    if (isset($_PUT[$index])) {
        $val = $_PUT[$index];
    }

    if (is_array($val)) {
        $val = array_map("stripslashes", $val);
    } else {
        $val = stripslashes($val);
    }
    return $val;
}

function version()
{
    $version_file = json_decode(file_get_contents('./version.json'));
    return $version_file->version;
}


function load_db_schema()
{
    $schema = array();
    $dir = scandir("Modules");
    for ($i=2; $i<count($dir); $i++) {
        if (filetype("Modules/".$dir[$i])=='dir' || filetype("Modules/".$dir[$i])=='link') {
            if (is_file("Modules/".$dir[$i]."/".$dir[$i]."_schema.php")) {
                require "Modules/".$dir[$i]."/".$dir[$i]."_schema.php";
            }
        }
    }
    return $schema;
}
/**
 * binds the gettext translations to the correct file and domain/type
 *
 * @param string $path path to the directory containing the .mo files for each language
 * @param [string] $domain
 * @return void
 */
function load_language_files($path, $context = false)
{
    // Determine current language
    $lang = isset($GLOBALS['language']) ? $GLOBALS['language'] : 'en_GB'; // Default to English if not set

    // Skip if $lang is en_GB
    if ($lang == 'en_GB') {
        // No need to load English translations, they are the default
        return;
    }

    //echo "Loading language files for $lang in $path with domain $context<br>";

    // Build path to JSON translation file
    $json_file = rtrim($path, '/')."/$lang.json";
    if (file_exists($json_file)) {
        $translations = json_decode(file_get_contents($json_file), true);
        if (is_array($translations)) {
            if (!$context) {
                // If domain is messages, we can use the translations directly
                $GLOBALS['translations'] = $translations;
            } else {
                // For other context specific translations:
                if (!isset($GLOBALS['context_translations'])) {
                    $GLOBALS['context_translations'] = array();
                }
                $GLOBALS['context_translations'][$context] = $translations;
            }
        }
    }
}

function tr($text)
{
    return isset($GLOBALS['translations'][$text]) && $GLOBALS['translations'][$text] !== ''
        ? $GLOBALS['translations'][$text]
        : $text;
}

function ctx_tr($context, $text)
{
    if ($context && isset($GLOBALS['context_translations'][$context]) && isset($GLOBALS['context_translations'][$context][$text])) {
        // If context is set and translation exists in context, return it
        return $GLOBALS['context_translations'][$context][$text];
    }
    return $text;
}

function load_menu()
{
    global $menu;
    $dir = scandir("Modules");
    for ($i=2; $i<count($dir); $i++) {
        if (filetype("Modules/".$dir[$i])=='dir' || filetype("Modules/".$dir[$i])=='link') {
            if (is_file("Modules/".$dir[$i]."/".$dir[$i]."_menu.php")) {
                // Language file gets loaded here but immediately over-written by the next
                // Perhaps consider some form of caching or a different loading strategy
                load_language_files("Modules/".$dir[$i]."/locale");
                require "Modules/".$dir[$i]."/".$dir[$i]."_menu.php";
            }
        }
    }
}

function http_request($method, $url, $data)
{
    $options = array();

    if ($method=="GET") {
        $urlencoded = http_build_query($data);
        $url = "$url?$urlencoded";
    } elseif ($method=="POST") {
        $options[CURLOPT_POST] = 1;
        $options[CURLOPT_POSTFIELDS] = $data;
    }

    $options[CURLOPT_URL] = $url;
    $options[CURLOPT_RETURNTRANSFER] = 1;
    $options[CURLOPT_CONNECTTIMEOUT] = 2;
    $options[CURLOPT_TIMEOUT] = 5;

    $curl = curl_init();
    curl_setopt_array($curl, $options);
    $resp = curl_exec($curl);
    if (PHP_VERSION_ID < 80000) {
        // phpcs:ignore Generic.PHP.DeprecatedFunctions.Deprecated
        curl_close($curl);
    }
    return $resp;
}

function emoncms_error($message)
{
    return array("success"=>false, "message"=>$message);
}

function call_hook($function_name, $args)
{
    // @todo: make args parameter optional
    $dir = scandir("Modules");
    for ($i=2; $i<count($dir); $i++) {
        if (filetype("Modules/".$dir[$i])=='dir' || filetype("Modules/".$dir[$i])=='link') {
            if (is_file("Modules/".$dir[$i]."/".$dir[$i]."_hooks.php")) {
                require "Modules/".$dir[$i]."/".$dir[$i]."_hooks.php";
                if (function_exists($dir[$i].'_'.$function_name)==true) {
                    $hook = $dir[$i].'_'.$function_name;
                    return $hook($args);
                }
            }
        }
    }
}

// ---------------------------------------------------------------------------------------------------------
/**
 * return ip address of requesting machine
 * the ip address can be stored in different variables by the system.
 * which variable name may change dependant on different system setups.
 * this function *should return an acceptible value in most cases
 * @todo: more testing on different hardware/opperating systems/proxy servers etc.
 *
 * @return string
 */
function get_client_ip_env()
{
    $ipaddress = filter_var(getenv('REMOTE_ADDR'), FILTER_VALIDATE_IP);
    if (empty($ipaddress)) {
        $ipaddress = '';
    }
    return $ipaddress;
}

// ---------------------------------------------------------------------------------------------------------
// Generate secure key
// ---------------------------------------------------------------------------------------------------------
function generate_secure_key($length)
{
    if (function_exists('random_bytes')) {
        return bin2hex(random_bytes($length));
    } else {
        return bin2hex(openssl_random_pseudo_bytes($length));
    }
}

// ---------------------------------------------------------------------------------------------------------
// Generate a 16 bytes (128 bits) UUID - RFC 4122 compliant Version 4
// ---------------------------------------------------------------------------------------------------------
function guidv4()
{
    if (function_exists('random_bytes')) {
        $data = random_bytes(16);
    } else {
        $data = openssl_random_pseudo_bytes(16);
    }
    // Set version to 0100
    $data[6] = chr(ord($data[6]) & 0x0f | 0x40);
    // Set bits 6-7 to 10
    $data[8] = chr(ord($data[8]) & 0x3f | 0x80);

    // Output the 36 character UUID.
    return vsprintf('%s%s-%s-%s-%s-%s%s%s', str_split(bin2hex($data), 4));
}

// ---------------------------------------------------------------------------------------------------------
// Load JavaScript and CSS files with optional cache busting based on file modification time
// ---------------------------------------------------------------------------------------------------------
function load_js(string $file_path, bool $filemtime = true, $module = false): void {
    global $path;
    $version_string = "";
    if ($filemtime && file_exists($file_path)) {
        $version_string = "?v=" . filemtime($file_path);
    }
    $safe_path = htmlspecialchars($file_path, ENT_QUOTES, 'UTF-8');
    if ($module) {
        $module_str = 'type="module"';
    } else {
        $module_str = '';
    }
    echo '<script '.$module_str.' src="' . $path . $safe_path . $version_string . '"></script>' . "\n";
}

function load_css(string $file_path, bool $filemtime = true): void {
    global $path;
    $version_string = "";
    if ($filemtime && file_exists($file_path)) {
        $version_string = "?v=" . filemtime($file_path);
    }
    $safe_path = htmlspecialchars($file_path, ENT_QUOTES, 'UTF-8');
    echo '<link rel="stylesheet" href="' . $path . $safe_path . $version_string . '">' . "\n";
}

function js_import_map(string $base, array $files): void {
    global $path;
    $imports = [];
    foreach ($files as $file) {
        $file_path = $base . $file;
        $version_string = "";
        if (file_exists($file_path)) {
            $version_string = "?v=" . filemtime($file_path);
        }
        $specifier = $path . $file_path;
        $url = htmlspecialchars($path . $file_path . $version_string, ENT_QUOTES, 'UTF-8');
        $imports[$specifier] = $url;
    }
    $json = json_encode(['imports' => $imports]);
    echo "<script type=\"importmap\">{$json}</script>\n";
}