Template/Update (Part 14)

* convert ajax for site features
   (Profiler exclusions, favorites, custom weights, settings-cookie, contact)

endpoints/account/exclude.php

@@ -0,0 +1,76 @@
+<?php
+
+namespace Aowow;
+
+if (!defined('AOWOW_REVISION'))
+    die('illegal access');
+
+
+/*
+ * accessed from character profiles, when setting exclusions on collections
+ * always returns emptry string
+ */
+
+class AccountExcludeResponse extends TextResponse
+{
+    protected bool  $requiresLogin = true;
+
+    protected array $expectedPOST  = array(
+        'mode'   => ['filter' => FILTER_VALIDATE_INT, 'options' => ['min_range' => 1, 'max_range' => 1]],
+        'reset'  => ['filter' => FILTER_VALIDATE_INT, 'options' => ['min_range' => 1, 'max_range' => 1]],
+        'id'     => ['filter' => FILTER_CALLBACK,     'options' => [self::class, 'checkIdList']        ],
+        'type'   => ['filter' => FILTER_VALIDATE_INT                                                   ],
+        'groups' => ['filter' => FILTER_VALIDATE_INT                                                   ]
+    );
+
+    protected function generate() : void
+    {
+        if (User::isBanned())
+            return;
+
+        if ($this->_post['mode'] == 1)                      // directly set exludes
+            $this->excludeById();
+
+        else if ($this->_post['reset'] == 1)                // defaults to unavailable
+            $this->resetExcludes();
+
+        else if ($this->_post['groups'])                    // exclude by group mask
+            $this->updateGroups();
+    }
+
+    private function excludeById() : void
+    {
+        if (!$this->assertPOST('type', 'id'))
+            return;
+
+        if ($validIds = Type::validateIds($this->_post['type'], $this->_post['id']))
+        {
+            // ready for some bullshit? here it comes!
+            // we don't get signaled whether an id should be added to or removed from either includes or excludes
+            // so we throw everything into one table and toggle the mode if its already in here
+
+            $includes = DB::Aowow()->selectCol('SELECT `typeId` FROM ?_profiler_excludes WHERE `type` = ?d AND `typeId` IN (?a)', $this->_post['type'], $validIds);
+
+            foreach ($validIds as $typeId)
+                DB::Aowow()->query('INSERT INTO ?_account_excludes (`userId`, `type`, `typeId`, `mode`) VALUES (?a) ON DUPLICATE KEY UPDATE `mode` = (`mode` ^ 0x3)',
+                    [User::$id, $this->_post['type'], $typeId, in_array($typeId, $includes) ? 2 : 1]
+            );
+        }
+        else
+            trigger_error('AccountExcludeResponse::excludeById - validation failed [type: '.$this->_post['type'].', typeId: '.implode(',', $this->_post['id']).']', E_USER_NOTICE);
+    }
+
+    private function resetExcludes() : void
+    {
+        DB::Aowow()->query('DELETE FROM ?_account_excludes WHERE `userId` = ?d', User::$id);
+        DB::Aowow()->query('UPDATE ?_account SET `excludeGroups` = ?d WHERE `id` = ?d', PR_EXCLUDE_GROUP_UNAVAILABLE, User::$id);
+    }
+
+    private function updateGroups() : void
+    {
+        if ($this->assertPOST('groups'))                    // clamp to real groups
+            DB::Aowow()->query('UPDATE ?_account SET `excludeGroups` = ?d WHERE `id` = ?d', $this->_post['groups'] & PR_EXCLUDE_GROUP_ANY, User::$id);
+    }
+}
+
+?>

endpoints/account/favorites.php

@@ -0,0 +1,52 @@
+<?php
+
+namespace Aowow;
+
+if (!defined('AOWOW_REVISION'))
+    die('illegal access');
+
+
+/*
+ * accessed from db detail pages, when clicking on the fav star near the h1 element
+ * always returns emptry string
+ */
+
+class AccountFavoritesResponse extends TextResponse
+{
+    protected bool  $requiresLogin = true;
+
+    protected array $expectedPOST  = array(
+        'add'        => ['filter' => FILTER_VALIDATE_INT],
+        'remove'     => ['filter' => FILTER_VALIDATE_INT],
+        'id'         => ['filter' => FILTER_VALIDATE_INT],
+     // 'sessionKey' => ['filter' => FILTER_VALIDATE_REGEXP, 'options' => ['regexp' => '/^[a-zA-Z0-9]{40}$/']] // usage of sessionKey omitted
+    );
+
+    protected function generate() : void
+    {
+        if (User::isBanned())
+            return;
+
+        if ($this->_post['remove'])
+            $this->removeFavorite();
+
+        else if ($this->_post['add'])
+            $this->addFavorite();
+    }
+
+    private function removeFavorite() : void
+    {
+        if ($this->assertPOST('id', 'remove'))
+            DB::Aowow()->query('DELETE FROM ?_account_favorites WHERE `userId` = ?d AND `type` = ?d AND `typeId` = ?d', User::$id, $this->_post['remove'], $this->_post['id']);
+    }
+
+    private function addFavorite() : void
+    {
+        if ($this->assertPOST('id', 'add') && Type::validateIds($this->_post['add'], $this->_post['id']))
+            DB::Aowow()->query('INSERT INTO ?_account_favorites (`userId`, `type`, `typeId`) VALUES (?d, ?d, ?d)', User::$id, $this->_post['add'], $this->_post['id']);
+        else
+            trigger_error('AccountFavoritesResponse::addFavorite() - failed to add [userId: '.User::$id.', type: '.$this->_post['add'].', typeId: '.$this->_post['id'], E_USER_NOTICE);
+    }
+}
+
+?>

endpoints/account/weightscales.php

@@ -0,0 +1,117 @@
+<?php
+
+namespace Aowow;
+
+if (!defined('AOWOW_REVISION'))
+    die('illegal access');
+
+
+/*
+ * accessed via ajax
+ * returns scaleId if successful, 0 if not
+ */
+
+class AccountWeightscalesResponse extends TextResponse
+{
+    private const /* int */ MAX_SCALES = 5;                 // more or less hard-defined in LANG.message_weightscalesaveerror
+
+    protected bool  $requiresLogin = true;
+    protected mixed $result        = 0;                     // default to error
+
+    protected array $expectedPOST  = array(
+        'save'   => ['filter' => FILTER_VALIDATE_INT, 'options' => ['min_range' => 1, 'max_range' => 1]],
+        'delete' => ['filter' => FILTER_VALIDATE_INT, 'options' => ['min_range' => 1, 'max_range' => 1]],
+        'id'     => ['filter' => FILTER_VALIDATE_INT                                                   ],
+        'name'   => ['filter' => FILTER_CALLBACK,     'options' => [self::class, 'checkName']          ],
+        'scale'  => ['filter' => FILTER_CALLBACK,     'options' => [self::class, 'checkScale']         ]
+    );
+
+    protected function generate() : void
+    {
+        if (User::isBanned())
+            return;
+
+        if ($this->_post['save'] && $this->_post['id'])
+            $this->updateWeights();
+
+        else if ($this->_post['save'])
+            $this->createWeights();
+
+        else if ($this->_post['delete'])
+            $this->deleteWeights();
+    }
+
+    private function createWeights() : void
+    {
+        if (!$this->assertPOST('name', 'scale'))
+            return;
+
+        $nScales = DB::Aowow()->selectCell('SELECT COUNT(`id`) FROM ?_account_weightscales WHERE `userId` = ?d', User::$id);
+        if ($nScales >= self::MAX_SCALES)
+            return;
+
+        if ($id = DB::Aowow()->query('INSERT INTO ?_account_weightscales (`userId`, `name`) VALUES (?d, ?)', User::$id, $this->_post['name']))
+            if ($this->storeScaleData($id))
+                $this->result = $id;
+    }
+
+    private function updateWeights() : void
+    {
+        if (!$this->assertPOST('name', 'scale', 'id'))
+            return;
+
+        // not in DB or not owned by user
+        if (!DB::Aowow()->selectCell('SELECT 1 FROM ?_account_weightscales WHERE `userId` = ?d AND `id` = ?d', User::$id, $this->_post['id']))
+        {
+            trigger_error('AccountWeightscalesResponse::updateWeights - scale #'.$this->_post['id'].' not in db or not owned by user #'.User::$id, E_USER_ERROR);
+            return;
+        }
+
+        DB::Aowow()->query('UPDATE ?_account_weightscales SET `name` = ? WHERE `id` = ?d', $this->_post['name'], $this->_post['id']);
+        $this->storeScaleData($this->_post['id']);
+
+        // return edited id on success
+        $this->result = $this->_post['id'];
+    }
+
+    private function deleteWeights() : void
+    {
+        if ($this->assertPOST('id'))
+            DB::Aowow()->query('DELETE FROM ?_account_weightscales WHERE `id` = ?d AND `userId` = ?d', $this->_post['id'], User::$id);
+
+        $this->result = '';
+    }
+
+    private function storeScaleData(int $scaleId) : bool
+    {
+        if (!is_int(DB::Aowow()->query('DELETE FROM ?_account_weightscale_data WHERE `id` = ?d', $scaleId)))
+            return false;
+
+        foreach ($this->_post['scale'] as [$k, $v])
+            if (in_array($k, Util::$weightScales))          // $v is known to be a positive int due to regex check
+                if (!is_int(DB::Aowow()->query('INSERT INTO ?_account_weightscale_data VALUES (?d, ?, ?d)', $scaleId, $k, $v)))
+                    return false;
+
+        return true;
+    }
+
+
+    /*************************************/
+    /* additional request data callbacks */
+    /*************************************/
+
+    protected static function checkScale(string $val) : array
+    {
+        if (preg_match('/^((\w+:\d+)(,\w+:\d+)*)$/', $val))
+            return array_map(fn($x) => explode(':', $x), explode(',', $val));
+
+        return [];
+    }
+
+    protected static function checkName(string $val) : string
+    {
+        return mb_substr(preg_replace('/[^[:print:]]/', '', trim(urldecode($val))), 0, 32);
+    }
+}
+
+?>

endpoints/contactus/contactus.php

@@ -5,28 +5,21 @@ namespace Aowow;
 if (!defined('AOWOW_REVISION'))
     die('illegal access');
 
-class AjaxContactus extends AjaxHandler
+
+class ContactusBaseResponse extends TextResponse
 {
-    protected $_post = array(
+    protected array $expectedPOST = array(
-        'mode'       => ['filter' => FILTER_SANITIZE_NUMBER_INT                                      ],
+        'mode'       => ['filter' => FILTER_VALIDATE_INT                                         ],
-        'reason'     => ['filter' => FILTER_SANITIZE_NUMBER_INT                                      ],
+        'reason'     => ['filter' => FILTER_VALIDATE_INT                                         ],
-        'ua'         => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxHandler::checkTextLine'],
+        'ua'         => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine']],
-        'appname'    => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxHandler::checkTextLine'],
+        'appname'    => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine']],
-        'page'       => ['filter' => FILTER_SANITIZE_URL                                             ],
+        'page'       => ['filter' => FILTER_SANITIZE_URL                                         ],
-        'desc'       => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxHandler::checkTextBlob'],
+        'desc'       => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextBlob']],
-        'id'         => ['filter' => FILTER_SANITIZE_NUMBER_INT                                      ],
+        'id'         => ['filter' => FILTER_VALIDATE_INT                                         ],
-        'relatedurl' => ['filter' => FILTER_SANITIZE_URL                                             ],
+        'relatedurl' => ['filter' => FILTER_SANITIZE_URL                                         ],
-        'email'      => ['filter' => FILTER_SANITIZE_EMAIL                                           ]
+        'email'      => ['filter' => FILTER_SANITIZE_EMAIL                                       ]
     );
 
-    public function __construct(array $params)
-    {
-        parent::__construct($params);
-
-        // always this one
-        $this->handler = 'handleContactUs';
-    }
-
     /* responses
         0: success
         1: captcha invalid
@@ -35,15 +28,21 @@ class AjaxContactus extends AjaxHandler
         7: already reported
         $: prints response
     */
-    protected function handleContactUs() : string
+    protected function generate() : void
     {
+        if (!$this->assertPOST('mode', 'reason'))
+        {
+            $this->result = 4;
+            return;
+        }
+
         $report = new Report($this->_post['mode'], $this->_post['reason'], $this->_post['id']);
         if ($report->create($this->_post['desc'], $this->_post['ua'], $this->_post['appname'], $this->_post['page'], $this->_post['relatedurl'], $this->_post['email']))
-            return 0;
+            $this->result = 0;
         else if (($e = $report->getError()) > 0)
-            return $e;
+            $this->result = $e;
         else
-            return Lang::main('intError');
+            $this->result = Lang::main('intError');
     }
 }
 

endpoints/cookie/cookie.php

@@ -0,0 +1,54 @@
+<?php
+
+namespace Aowow;
+
+if (!defined('AOWOW_REVISION'))
+    die('illegal access');
+
+
+class CookieBaseResponse extends TextResponse
+{
+    protected bool  $requiresLogin = true;
+
+    protected array $expectedGET   = array(
+        'purge' => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkEmptySet']]
+    );
+
+    public function __construct(private string $param)
+    {
+        // note that parent::__construct has to come after this
+        if ($param && preg_match('/^[\w-]+$/i', $param))
+            $this->expectedGET = [$param => ['filter' => FILTER_CALLBACK, 'options' => [self::class, 'checkTextLine']]];
+
+        // NOW we know, what to expect and sanitize
+        parent::__construct($param);
+    }
+
+    /* responses
+        0: success
+        $: silent error
+    */
+    protected function generate() : void
+    {
+        if (!$this->param && $this->_get['purge'])
+        {
+            if (User::$id && DB::Aowow()->query('UPDATE ?_account_cookies SET `data` = "purged" WHERE `userId` = ?d AND `name` LIKE "announcement-%"', User::$id) !== null)
+                $this->result = 0;
+
+            return;
+        }
+
+        if (!$this->param || !$this->assertGET($this->param))
+        {
+            trigger_error('CookieBaseResponse - malformed request received', E_USER_ERROR);
+            return;
+        }
+
+        if (DB::Aowow()->query('REPLACE INTO ?_account_cookies VALUES (?d, ?, ?)', User::$id, $this->param, $this->_get[$this->param]))
+            $this->result = 0;
+        else
+            trigger_error('CookieBaseResponse - write to db failed', E_USER_ERROR);
+    }
+}
+
+?>

includes/ajaxHandler/account.class.php

@@ -1,173 +0,0 @@
-<?php
-
-namespace Aowow;
-
-if (!defined('AOWOW_REVISION'))
-    die('illegal access');
-
-class AjaxAccount extends AjaxHandler
-{
-    protected $validParams = ['exclude', 'weightscales', 'favorites'];
-    protected $_post       = array(
-        'groups'     => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'save'       => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'delete'     => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'id'         => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxHandler::checkIdList'],
-        'name'       => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxAccount::checkName'  ],
-        'scale'      => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxAccount::checkScale' ],
-        'reset'      => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'mode'       => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'type'       => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'add'        => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-        'remove'     => ['filter' => FILTER_SANITIZE_NUMBER_INT],
-     // 'sessionKey' => ['filter' => FILTER_SANITIZE_NUMBER_INT]
-    );
-
-    public function __construct(array $params)
-    {
-        parent::__construct($params);
-
-        if (!$this->params || !User::isLoggedIn())
-            return;
-
-        // select handler
-        if ($this->params[0] == 'exclude')
-            $this->handler = 'handleExclude';
-        else if ($this->params[0] == 'weightscales')
-            $this->handler = 'handleWeightscales';
-        else if ($this->params[0] == 'favorites')
-            $this->handler = 'handleFavorites';
-    }
-
-    protected function handleExclude() : void
-    {
-        if ($this->_post['mode'] == 1)                      // directly set exludes
-        {
-            $type = $this->_post['type'];
-            $ids  = $this->_post['id'];
-
-            if ($validIds = Type::validateIds($this->_post['type'], $this->_post['id']))
-            {
-                // ready for some bullshit? here it comes!
-                // we don't get signaled whether an id should be added to or removed from either includes or excludes
-                // so we throw everything into one table and toggle the mode if its already in here
-
-                $includes = DB::Aowow()->selectCol('SELECT `typeId` FROM ?_profiler_excludes WHERE `type` = ?d AND `typeId` IN (?a)', $this->_post['type'], $validIds);
-
-                foreach ($validIds as $typeId)
-                    DB::Aowow()->query('INSERT INTO ?_account_excludes (`userId`, `type`, `typeId`, `mode`) VALUES (?a) ON DUPLICATE KEY UPDATE `mode` = (`mode` ^ 0x3)',
-                        [User::$id, $this->_post['type'], $typeId, in_array($typeId, $includes) ? 2 : 1]
-                );
-            }
-            else
-                trigger_error('AjaxAccount::handleExclude - invalid type #'.$type.(empty($ids) ? ' or id-list empty' : ''), E_USER_ERROR);
-
-            return;
-        }
-        else if ($this->_post['reset'] == 1)                // defaults to unavailable
-        {
-            $mask = PR_EXCLUDE_GROUP_UNAVAILABLE;
-            DB::Aowow()->query('DELETE FROM ?_account_excludes WHERE userId = ?d', User::$id);
-        }
-        else                                                // clamp to real groups
-            $mask = $this->_post['groups'] & PR_EXCLUDE_GROUP_ANY;
-
-        DB::Aowow()->query('UPDATE ?_account SET excludeGroups = ?d WHERE id = ?d', $mask, User::$id);
-    }
-
-    protected function handleWeightscales() : string
-    {
-        if ($this->_post['save'])
-        {
-            if (!$this->_post['scale'])
-            {
-                trigger_error('AjaxAccount::handleWeightscales - scaleId empty', E_USER_ERROR);
-                return '0';
-            }
-
-            $id = 0;
-
-            if ($this->_post['id'] && ($id = $this->_post['id'][0]))
-            {
-                if (!DB::Aowow()->selectCell('SELECT 1 FROM ?_account_weightscales WHERE `userId` = ?d AND `id` = ?d', User::$id, $id))
-                {
-                    trigger_error('AjaxAccount::handleWeightscales - scale #'.$id.' not in db or owned by user #'.User::$id, E_USER_ERROR);
-                    return '0';
-                }
-
-                DB::Aowow()->query('UPDATE ?_account_weightscales SET `name` = ? WHERE `id` = ?d', $this->_post['name'], $id);
-            }
-            else
-            {
-                $nScales = DB::Aowow()->selectCell('SELECT COUNT(`id`) FROM ?_account_weightscales WHERE `userId` = ?d', User::$id);
-                if ($nScales >= 5)                          // more or less hard-defined in LANG.message_weightscalesaveerror
-                    return '0';
-
-                $id = DB::Aowow()->query('INSERT INTO ?_account_weightscales (`userId`, `name`) VALUES (?d, ?)', User::$id, $this->_post['name']);
-            }
-
-            DB::Aowow()->query('DELETE FROM ?_account_weightscale_data WHERE `id` = ?d', $id);
-
-            foreach (explode(',', $this->_post['scale']) as $s)
-            {
-                [$k, $v] = explode(':', $s);
-                if (!in_array($k, Util::$weightScales) || $v < 1)
-                    continue;
-
-                DB::Aowow()->query('INSERT INTO ?_account_weightscale_data VALUES (?d, ?, ?d)', $id, $k, $v);
-            }
-
-            return (string)$id;
-        }
-        else if ($this->_post['delete'] && $this->_post['id'] && $this->_post['id'][0])
-        {
-            DB::Aowow()->query('DELETE FROM ?_account_weightscales WHERE `id` = ?d AND `userId` = ?d', $this->_post['id'][0], User::$id);
-            return '';
-        }
-
-        trigger_error('AjaxAccount::handleWeightscales - malformed request received', E_USER_ERROR);
-        return '0';
-    }
-
-    protected function handleFavorites() : void
-    {
-        // omit usage of sessionKey
-        if (count($this->_post['id']) != 1 || empty($this->_post['id'][0]))
-        {
-            trigger_error('AjaxAccount::handleFavorites - malformed request received', E_USER_ERROR);
-            return;
-        }
-
-        $typeId = $this->_post['id'][0];
-
-        if ($type = $this->_post['add'])
-        {
-            if (!Type::validateIds($this->_post['add'], $this->_post['id']))
-            {
-                trigger_error('AjaxAccount::handleFavorites - invalid typeId #'.$typeId.' for type #'.$type, E_USER_ERROR);
-                return;
-            }
-
-            DB::Aowow()->query('INSERT INTO ?_account_favorites (`userId`, `type`, `typeId`) VALUES (?d, ?d, ?d)', User::$id, $type, $typeId);
-        }
-        else if ($type = $this->_post['remove'])
-            DB::Aowow()->query('DELETE FROM ?_account_favorites WHERE `userId` = ?d AND `type` = ?d AND `typeId` = ?d', User::$id, $type, $typeId);
-    }
-
-    protected static function checkScale(string $val) : string
-    {
-        if (preg_match('/^((\w+:\d+)(,\w+:\d+)*)$/', $val))
-            return $val;
-
-        return '';
-    }
-
-    protected static function checkName(string $val) : string
-    {
-        $var = trim(urldecode($val));
-
-        return filter_var($var, FILTER_SANITIZE_SPECIAL_CHARS, FILTER_FLAG_STRIP_LOW);
-    }
-}
-
-?>

includes/ajaxHandler/cookie.class.php

@@ -1,47 +0,0 @@
-<?php
-
-namespace Aowow;
-
-if (!defined('AOWOW_REVISION'))
-    die('illegal access');
-
-class AjaxCookie extends AjaxHandler
-{
-    public function __construct(array $params)
-    {
-        // note that parent::__construct has to come after this
-        if (!$params || !User::isLoggedIn())
-            return;
-
-        $this->_get = array(
-            $params[0] => ['filter' => FILTER_CALLBACK, 'options' => 'Aowow\AjaxHandler::checkTextLine'],
-        );
-
-        // NOW we know, what to expect and sanitize
-        parent::__construct($params);
-
-        // always this one
-        $this->handler = 'handleCookie';
-    }
-
-    /* responses
-        0: success
-        $: silent error
-    */
-    protected function handleCookie() : string
-    {
-        if (User::isLoggedIn() && $this->params && $this->_get[$this->params[0]])
-        {
-            if (DB::Aowow()->query('REPLACE INTO ?_account_cookies VALUES (?d, ?, ?)', User::$id, $this->params[0], $this->_get[$this->params[0]]))
-                return '0';
-            else
-                trigger_error('AjaxCookie::handleCookie - write to db failed', E_USER_ERROR);
-        }
-        else
-            trigger_error('AjaxCookie::handleCookie - malformed request received', E_USER_ERROR);
-
-        return '';
-    }
-}
-
-?>