Skip to content

Commit

Permalink
Extract duplicated URL processing code
Browse files Browse the repository at this point in the history
  • Loading branch information
davialexandre committed Oct 30, 2018
1 parent 041e535 commit 0f1c746
Showing 1 changed file with 40 additions and 22 deletions.
62 changes: 40 additions & 22 deletions CRM/Core/BAO/Navigation.php
Original file line number Diff line number Diff line change
Expand Up @@ -493,22 +493,7 @@ public static function getMenuName(&$value, &$skipMenuItems) {

$makeLink = FALSE;
if (!empty($url)) {
// Skip processing fully-formed urls
if (substr($url, 0, 4) !== 'http' && $url[0] !== '/' && $url[0] !== '#') {
//CRM-7656 --make sure to separate out url path from url params,
//as we'r going to validate url path across cross-site scripting.
$parsedUrl = parse_url($url);
if (empty($parsedUrl['query'])) {
$parsedUrl['query'] = NULL;
}
if (empty($parsedUrl['fragment'])) {
$parsedUrl['fragment'] = NULL;
}
$url = CRM_Utils_System::url($parsedUrl['path'], $parsedUrl['query'], FALSE, $parsedUrl['fragment'], TRUE);
}
elseif (strpos($url, '&') === FALSE) {
$url = htmlspecialchars($url);
}
$url = self::makeFullyFormedUrl($url);
$makeLink = TRUE;
}

Expand Down Expand Up @@ -598,12 +583,7 @@ public static function createNavigation() {
$homeIcon = '<span class="crm-logo-sm" ></span>';
self::retrieve($homeParams, $homeNav);
if ($homeNav) {
$path = parse_url($homeNav['url'], PHP_URL_PATH);
$q = parse_url($homeNav['url'], PHP_URL_QUERY);
$fragment = parse_url($homeNav['url'], PHP_URL_FRAGMENT);

$homeURL = CRM_Utils_System::url($path, $q, FALSE, $fragment);

$homeURL = self::makeFullyFormedUrl($homeNav['url']);
$homeLabel = $homeNav['label'];
// CRM-6804 (we need to special-case this as we don’t ts()-tag variables)
if ($homeLabel == 'Home') {
Expand All @@ -629,6 +609,44 @@ public static function createNavigation() {
return $prepandString . $navigation;
}

/**
* Turns relative URLs (like civicrm/foo/bar) into fully-formed
* ones (i.e. example.com/wp-admin?q=civicrm/dashboard).
*
* If the URL is already fully-formed, nothing will be done.
*
* @param string $url
*
* @return string
*/
private static function makeFullyFormedUrl($url) {
if (self::isNotFullyFormedUrl($url)) {
//CRM-7656 --make sure to separate out url path from url params,
//as we'r going to validate url path across cross-site scripting.
$path = parse_url($url, PHP_URL_PATH);
$q = parse_url($url, PHP_URL_QUERY);
$fragment = parse_url($url, PHP_URL_FRAGMENT);
return CRM_Utils_System::url($path, $q, FALSE, $fragment);
}

if (strpos($url, '&amp;') === FALSE) {
return htmlspecialchars($url);
}

return $url;
}

/**
* Checks if the given URL is not fully-formed
*
* @param string $url
*
* @return bool
*/
private static function isNotFullyFormedUrl($url) {
return substr($url, 0, 4) !== 'http' && $url[0] !== '/' && $url[0] !== '#';
}

/**
* Reset navigation for all contacts or a specified contact.
*
Expand Down

0 comments on commit 0f1c746

Please sign in to comment.