crm.clientright.ru/modules/ITS4YouEmailMarketing/models/CustomFunctions.php

<?php
/* * *******************************************************************************
 * The content of this file is subject to the ITS4YouEmailMarketing license.
 * ("License"); You may not use this file except in compliance with the License
 * The Initial Developer of the Original Code is IT-Solutions4You s.r.o.
 * Portions created by IT-Solutions4You s.r.o. are Copyright(C) IT-Solutions4You s.r.o.
 * All Rights Reserved.
 * ****************************************************************************** */

class ITS4YouEmailMarketing_CustomFunctions_Model extends Vtiger_Base_Model
{
    protected $content;
    protected $allowedFunctions = array(
        'number_format',
        'nl2br',
        'substr',
        'trim',
        'str_replace',
        'strpos',
        'ucfirst',
        'ucwords',
        'html_entity_decode',
        'htmlentities',
        'htmlspecialchars_decode',
        'htmlspecialchars',
        'lcfirst',
        'strtolower',
        'strtoupper',
        'strtr',
        'mktime',
        'date',
        'time',
        'round',
        'abs',
        'ceil',
        'floor',
        'rand',
    );
    protected $customFunctionUrl = 'modules/ITS4YouEmailMarketing/resources/functions/*.php';
    protected $allowedFunctionUrl = 'modules/ITS4YouEmailMarketing/resources/functions/AllowedFunctions.txt';

    /**
     * @param string $content
     * @return self
     */
    public static function getInstance($content)
    {
        $self = new self();
        $self->setContent($content);

        return $self;
    }

    /**
     * @return string
     */
    public function getContent()
    {
        return $this->content;
    }

    /**
     * @param string $value
     */
    public function setContent($value)
    {
        $this->content = $value;
    }

    /**
     * @param string $after
     */
    public function replaceCustomFunctions($after = '')
    {
        $after = strtoupper($after);

        if (is_numeric(strpos($this->content, '[CUSTOMFUNCTION' . $after . '|'))) {
            $allowedFunctions = $this->getAllowedFunctions();
            $files = $this->getFiles();

            foreach ($files as $file) {
                include_once $file;
            }

            $startFunctions = explode('[CUSTOMFUNCTION' . $after . '|', $this->content);
            $content = $startFunctions[0];

            foreach ($startFunctions as $function) {
                $endFunction = explode('|CUSTOMFUNCTION' . $after . ']', $function);
                $html = $endFunction[0];

                if (!empty($html)) {
                    $Params = $this->getCustomfunctionParams($html);
                    $func = $Params[0];
                    unset($Params[0]);

                    if (in_array($func, $allowedFunctions)) {
                        $content .= call_user_func_array($func, $Params);
                    }
                }

                $content .= $endFunction[1];
            }

            $this->setContent($content);
        }
    }

    public function getFiles()
    {
        return glob($this->customFunctionUrl);
    }

    /**
     * @return array
     */
    public function getAllowedFunctions()
    {
        $functionName = '';
        $allAllowedFunctions = $this->allowedFunctions;
        $files = $this->getFiles();

        foreach ($files as $file) {
            $filename = $file;
            $source = fread(fopen($filename, 'r'), filesize($filename));
            $tokens = token_get_all($source);

            foreach ($tokens as $token) {
                if (is_array($token)) {
                    if ($token[0] == T_FUNCTION) {
                        $ready = true;
                    } elseif ($ready) {
                        if ($token[0] == T_STRING && $functionName == '') {
                            $functionName = $token[1];
                        }
                    }
                } elseif ($ready && $token == '{') {
                    $ready = false;
                    $allAllowedFunctions[] = trim($functionName);
                    $functionName = '';
                }
            }
        }

        if (file_exists($this->allowedFunctionUrl)) {
            $ownAllowedFunctionsContent = file_get_contents($this->allowedFunctionUrl);
            $ownAllowedFunctions = explode(',', $ownAllowedFunctionsContent);

            foreach ($ownAllowedFunctions as $ownAllowedFunction) {
                $ownAllowedFunction = trim($ownAllowedFunction);

                if (!in_array($ownAllowedFunction, $allAllowedFunctions)) {
                    $allAllowedFunctions[] = $ownAllowedFunction;
                }
            }
        }

        return $allAllowedFunctions;
    }

    /**
     * @param string $val
     * @return array
     */
    public function getCustomfunctionParams($val)
    {
        $Params = array();
        $end = false;

        do {
            if (strstr($val, '|')) {
                if ($val[0] == '"') {
                    $delimiter = '"|';
                    $val = substr($val, 1);
                } elseif (substr($val, 0, 6) == '&quot;') {
                    $delimiter = '&quot;|';
                    $val = substr($val, 6);
                } else {
                    $delimiter = '|';
                }
                list($Params[], $val) = explode($delimiter, $val, 2);
            } else {
                $Params[] = $val;
                $end = true;
            }
        } while (!$end);

        return $Params;
    }
}