Source for file BackendController.php
Documentation is available at BackendController.php
require_once BASEDIR.
'/inc/utility/SimpleXMLExtended.php';
require_once BASEDIR.
'/inc/utility/CaramelException.php';
require_once BASEDIR.
'/inc/model/DatabaseModel.php';
require_once BASEDIR.
'/inc/model/ConfigurationModel.php';
require_once BASEDIR.
'/inc/view/TemplateView.php';
* BackendController class
* @author Felix Rupp <kontakt@felixrupp.com>
* @copyright Copyright (c) 2011, Felix Rupp, Nicole Reinhardt
* @license http://www.opensource.org/licenses/mit-license.php MIT-License
* @license http://www.gnu.org/licenses/gpl.html GNU GPL
* @var ConfigurationModel $_config Holds an instance of a Config
* @var DatabaseModel $_dataBase Holds the Database
* @var TemplateView $_templateView Holds an instance of our TemplatingEngine
* @var boolean $_navigation Boolean: Show navigation or not
private $_navigation =
FALSE;
* @var boolean $_login Boolean: Show loginform or not
* @var boolean $_welcome Boolean: Show welcome page or not
private $_welcome =
FALSE;
* @var String VERSION Constant for system version
* @var String VERSION Constant for version date
const VERSION_DATE =
"2012-09-10";
* @var String SYSTEM_SALT System Salt for bcrypt hashing
const SYSTEM_SALT =
'Mv7DAYvR782k5PgANTYG262P3h6b4p757e2k2jA788ESdAHKP2wBfV93SK3u87Ks';
# Get TemplatingEngine for Backend
} // End of constructor declaration
* This method assigns needed content to our template engine and renders the template.
if($this->getSession() ==
FALSE) { # No session, so please show login
if(isset
($_POST) && isset
($_POST["username"]) && isset
($_POST["password"])) {
if($_POST["username"]==
$loginInformation["username"]) {
if($this->bcryptCheck($loginInformation["email"], $_POST["password"], $loginInformation["password"])) {
$_SESSION["loggedin"] =
TRUE;
$_SESSION["timestamp"] =
time();
$this->_navigation =
TRUE;
$this->_navigation =
FALSE;
$this->_templateView->assign("error", "The password you provided seems to be wrong. Please try again.");
$this->_navigation =
FALSE;
$this->_templateView->assign("error", "The username you provided seems to be wrong. Please try again.");
$this->_navigation =
FALSE;
else { # Already logged in
$this->_navigation =
TRUE;
if(isset
($_GET["q"]) &&
$_GET["q"]==
"logout") {
$this->_navigation =
FALSE;
if(isset
($_GET["q"]) &&
$_GET["q"]==
"newpage") {
$this->_navigation =
TRUE;
$this->_templateView->assign("newpage", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"editpages" &&
!isset
($_GET["id"]) &&
!isset
($_GET["delete"])) {
$this->_navigation =
TRUE;
$this->_templateView->assign("pages", $allPages);
$this->_templateView->assign("editpages", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"moveup" && isset
($_GET["id"])) {
$id = (int)
trim($_GET["id"]);
$this->_navigation =
TRUE;
$this->_templateView->assign("pages", $allPages);
$this->_templateView->assign("editpages", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"movedown" && isset
($_GET["id"])) {
$id = (int)
trim($_GET["id"]);
$this->_navigation =
TRUE;
$this->_templateView->assign("pages", $allPages);
$this->_templateView->assign("editpages", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"editpages" && isset
($_GET["id"]) &&
!isset
($_GET["delete"])) {
$id = (int)
trim($_GET["id"]);
$this->_navigation =
TRUE;
$this->_templateView->assign("page", $page);
$this->_templateView->assign("editonepage", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"editpages" && isset
($_GET["id"]) && isset
($_GET["delete"])) {
$id = (int)
trim($_GET["id"]);
$this->_navigation =
TRUE;
$this->_templateView->assign("pages", $allPages);
$this->_templateView->assign("editpages", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"editadmin") {
$this->_navigation =
TRUE;
$this->_templateView->assign("admin", $admin);
$this->_templateView->assign("editadmin", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"edittemplates") {
$template =
$this->getTemplateConfig();
$this->_navigation =
TRUE;
$this->_templateView->assign("template", $template);
$this->_templateView->assign("edittemplates", TRUE);
if(isset
($_GET["q"]) &&
$_GET["q"]==
"editglobal") {
$globals =
$this->getGlobalConfig();
$this->_navigation =
TRUE;
$this->_templateView->assign("globals", $globals);
$this->_templateView->assign("editglobal", TRUE);
if(isset
($_POST["newpage"])) {
$recordContents["navigation"] =
trim($_POST["navigation"]);
$recordContents["title"] =
trim($_POST["title"]);
$recordContents["titletag"] =
trim($_POST["titletag"]);
$recordContents["metadescription"] =
trim($_POST["metadescription"]);
$recordContents["metakeywords"] =
trim($_POST["metakeywords"]);
$recordContents["metaauthor"] =
trim($_POST["metaauthor"]);
$recordContents["content"] =
trim($_POST["content"]);
$this->_navigation =
TRUE;
$this->_templateView->assign("pages", $allPages);
$this->_templateView->assign("editpages", TRUE);
if(isset
($_POST["editonepage"]) && isset
($_POST["pageid"])) {
$id = (int)
trim($_POST["pageid"]);
$page["path"]["value"] =
trim($_POST["path"]);
$page["stylesheet"]["value"] =
trim($_POST["stylesheet"]);
$page["scriptfile"]["value"] =
trim($_POST["scriptfile"]);
foreach($_POST as $key =>
$value) {
if($key!=
"editonepage" &&
$key!=
"submit" &&
$key!=
"pageid" &&
$key!=
"path" &&
$key !=
"stylesheet" &&
$key !=
"scriptfile") {
$page["records"][$lang][$key]["value"] =
$value;
else if($key ==
"visible") {
$page["records"][$lang][$key]["value"] =
"true";
$this->_navigation =
TRUE;
$this->_templateView->assign("page", $page);
$this->_templateView->assign("editonepage", TRUE);
if(isset
($_POST["edittemplates"])) {
$newTemplate =
$_POST["template"];
$this->_navigation =
TRUE;
$template =
$this->getTemplateConfig();
$this->_templateView->assign("template", $template);
$this->_templateView->assign("edittemplates", TRUE);
if(isset
($_POST["editglobal"])) {
$globals =
$this->getGlobalConfig();
$globals["speaking_urls"]["value"] =
"false";
$globals["language_selector_in_footer"]["value"] =
"false";
foreach($_POST as $key =>
$value) {
if($key !=
"editglobal" &&
$key !=
"submit") {
$globals[$key]["value"] =
$value;
if($key ==
"speaking_urls") {
$globals["speaking_urls"]["value"] =
"true";
# Cover language_selector_in_footer
if($key ==
"language_selector_in_footer") {
$globals["language_selector_in_footer"]["value"] =
"true";
$globals =
$this->getGlobalConfig();
$this->_navigation =
TRUE;
$this->_templateView->assign("globals", $globals);
$this->_templateView->assign("editglobal", TRUE);
if(isset
($_POST["editadmin"])) {
foreach($_POST as $key =>
$value) {
if($key !=
"editadmin" &&
$key !=
"submit" &&
$key !=
"admin_password" &&
$key !=
"password_verification") {
$admin[$key]["value"] =
$value;
if($key==
"admin_password" &&
$value!=
"" &&
$_POST["password_verification"]!=
"") {
if($value==
$_POST["password_verification"] &&
strlen($_POST["admin_email"])>
1) { # verifiy password, save only when email is provided
$admin["admin_password"]["value"] =
$this->bcryptEncode($_POST["admin_email"], $value);
$this->_navigation =
TRUE;
$this->_templateView->assign("admin", $admin);
$this->_templateView->assign("editadmin", TRUE);
$this->_templateView->assign("navigation", $this->_navigation);
$this->_templateView->assign("login", $this->_login);
$this->_templateView->assign("welcome", $this->_welcome);
} // End of method declaration
* Method to initialize login session
} // End of method declaration
* Print out version-information in index.php
* @return Version information comment
$comment =
"<!-- \n######### Caramel CMS\n######### Version: ".
self::VERSION.
"\n######### Release: ".
self::VERSION_DATE.
"\n\n######### Dual-licensed under the MIT-License: http://www.opensource.org/licenses/mit-license.php and the GNU GPL: http://www.gnu.org/licenses/gpl.html\n\n######### Copyright (c) Felix Rupp, Nicole Reinhardt\n\n######### http://www.caramel-cms.com/\n -->\n";
} // End of method declaration
* Print out head-tag in index.php
* @return Complete head-tag
$meta =
$this->getMeta();
$headTag =
"\n<meta charset=\"utf-8\">\n\n".
$meta.
"\n\n<title>Caramel CMS Backend</title>\n\n";
$headTag .=
$this->_templateView->addCssJs();
$headTag .=
"<script type=\"text/javascript\" src=\"".
TEMPLATEDIR.
"/Backend/js/ckeditor/ckeditor.js\"></script>\n";
$headTag .=
"<script type=\"text/javascript\" src=\"".
TEMPLATEDIR.
"/Backend/js/ckeditor/adapters/jquery.js\"></script>\n";
} // End of method declaration
* This action logs the user off
if($this->getSession()==
TRUE) {
} // End of method declaration
##################################################
##################################################
* Check if session is active or not
* @return TRUE or FALSE, wether a session is active or not
private function getSession() {
if(!isset
($_SESSION["loggedin"]) ||
$_SESSION["loggedin"]==
FALSE) {
} // End of method declaration
* Get parameters of GET-query before ampersand
* @return New querystring for building correct URL
private function getParametersBefore() {
$serverQueryString =
$_SERVER['QUERY_STRING'];
if($speakingUrls ==
"false") {
$newQueryString =
'?'.
substr($serverQueryString,0,7).
'&';
if($speakingUrls ==
"true") {
$newQueryString =
substr($_SERVER['REQUEST_URI'], 0, strpos($_SERVER['REQUEST_URI'], $this->getLanguage())+
strlen($this->getLanguage()));
} // End of method declaration
* Get parameters of GET-query behind ampersand
* @return New querystring for building correct URL
private function getParametersBehind() {
$serverQueryString =
$_SERVER['QUERY_STRING'];
if($speakingUrls ==
"false") {
$newQueryString =
$ampZeichen.
substr($serverQueryString,8);
$newQueryString =
'&'.
substr($serverQueryString,0);
elseif($speakingUrls ==
"true") {
if(isset
($_GET['display'])) {
$newQueryString =
'/'.
substr($serverQueryString,16).
'/';
$newQueryString =
'/'.
substr($serverQueryString,16);
} // End of method declaration
* Print out base url in index.php
private function getBaseUrl() {
if($speakingUrls ==
"true") {
} // End of method declaration
* Print out meta-tags in index.php
* @return Meta-tags for author, keywords and description
private function getMeta() {
$metaAuthor =
"<meta name=\"author\" content=\"Felix Rupp, Nicole Reinhardt\">";
$metaGenerator =
"<meta name=\"generator\" content=\"Caramel CMS ".
self::VERSION.
"\">";
$metaTags =
$metaAuthor.
"\n".
$metaGenerator.
"\n";
} // End of method declaration
* This method returns a correct formatted array with all global settings
* @return Array with global configuration
private function getGlobalConfig() {
} // End of method declaration
* This method returns a correct formatted array with our template settings
* @return Array with template configuration
private function getTemplateConfig() {
$acceptedValues =
array();
## Find all possible templates
$dirIterator =
new DirectoryIterator(BASEDIR.
'/template/');
foreach($dirIterator as $dirItem) {
if($dirItem->isDir() &&
!$dirItem->isDot() &&
strpos($dirItem->getPathname(), "Backend")==
FALSE) { # All folders without dots and NOT Backend-Template
if(is_file($dirItem->getPathname().
"/index.tpl.php")) {
$acceptedValues[] =
substr($dirItem->getPathname(), strrpos($dirItem->getPathname(), "/")+
1, strlen($dirItem->getPathname()));
$templateArray["template"]["label"] =
"Template";
$templateArray["template"]["value"] =
$template;
$templateArray["template"]["blank"] =
"false";
$templateArray["template"]["acceptedValues"] =
$acceptedValues;
} // End of method declaration
* Method to hash via bcrypt.
* @param String $email eMail adress
* @param String $password Password to encode
* @return BCrypt hashed password.
private function bcryptEncode($email, $password) {
$result =
$this->checkBlowfish();
$salt =
'q8JJ4Ere8w75fCQ3yMZj5A8Yr632zm8keZDSbphjY43r3Z9cY4L5A6V4vK75p4xP';
$string =
hash_hmac("whirlpool", str_pad ($password, strlen ($password)*
4, sha1($email), STR_PAD_BOTH ), self::SYSTEM_SALT, true );
return crypt($string, '$2a$'.
$rounds.
'$'.
$salt);
} // End of method declaration
* Method to check bcrypt encoded passwords
* @param String $email eMail adress
* @param String $password Password given to check
* @param String $stored Password to check against
* @return Boolean value. True if password is valid.
private function bcryptCheck($email, $password, $stored) {
$result =
$this->checkBlowfish();
return crypt($string, substr($stored, 0, 30)) ==
$stored;
} // End of method declaration
* Method to check if Blowfish algorithm is available on this server.
* @throws CaramelException
private function checkBlowfish() {
} // End of method declaration
} // End of class declaration