image_styles_admin.inc 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306
  1. <?php
  2. /**
  3. * @file Include file for image_styles_admin routines that do not need to be
  4. * loaded on each request.
  5. */
  6. /**
  7. * Menu callback: Duplicates an image style and redirects to the image styles
  8. * overview page.
  9. *
  10. * @param array $style
  11. * An image style array.
  12. *
  13. * @see image_style_name_validate()
  14. */
  15. function image_styles_admin_duplicate_page_callback($style) {
  16. $duplicate_style = image_styles_admin_duplicate($style);
  17. drupal_set_message(t('Style %name has been duplicated to %new_name.', array(
  18. '%name' => isset($style['label']) ? $style['label'] : $style['name'],
  19. '%new_name' => isset($duplicate_style['label']) ? $duplicate_style['label'] : $duplicate_style['name'])));
  20. drupal_goto('admin/config/media/image-styles');
  21. }
  22. /**
  23. * Duplicates an image style and saves it.
  24. *
  25. * @param array $style
  26. * An image style array.
  27. * @param string|null $new_style_name
  28. * The preferred name for the new style. If left empty, the new name will be
  29. * based on the name of the style to duplicate. In both cases and when
  30. * necessary, the new name will be made unique by adding some suffix to it.
  31. * @param string|null $new_style_label
  32. * The preferred label for the new style. If left empty, the new label will be
  33. * based on the label of the style to duplicate. If that one is also empty,
  34. * no label will be defined for the new style, so Drupal (>=7.23) will create
  35. * one.
  36. *
  37. * @return array
  38. * An image style array with the newly created copy of the given style.
  39. *
  40. * @see image_style_name_validate()
  41. */
  42. function image_styles_admin_duplicate($style, $new_style_name = NULL, $new_style_label = NULL) {
  43. // Find a unique name for the copy.
  44. // Step 1: Find the base: name without things like '-copy' or '-copy-1'
  45. $style_name_base = empty($new_style_name) ? $style['name'] : $new_style_name;
  46. if (preg_match('/-copy(-\d+)?$/', $style_name_base)) {
  47. $style_name_base = substr($style_name_base, 0, strpos($style_name_base, '-copy'));
  48. }
  49. // Step 2: Add -copy to it (if the name comes from the current style).
  50. if (empty($new_style_name)) {
  51. $style_name_base .= '-copy';
  52. }
  53. // Step 3: Ensure the new name will be unique.
  54. $i = 0;
  55. $style_name = $style_name_base;
  56. $styles = image_styles();
  57. while (isset($styles[$style_name])) {
  58. $i++;
  59. $style_name = $style_name_base . '-' . $i;
  60. }
  61. $style['name'] = $style_name;
  62. // Step 4: Find a new label for the copy.
  63. if (isset($new_style_label) || isset($style['label'])) {
  64. $style_label = empty($new_style_label) ? $style['label'] : $new_style_label;
  65. $copy = t('copy');
  66. if (preg_match("/ $copy( \d+)?$/", $style_label)) {
  67. $style_label = substr($style_label, 0, strpos($style_label, " $copy"));
  68. }
  69. // Step 4a: Add " copy" to it (if the name comes from the current style).
  70. if (empty($new_style_label)) {
  71. $style_label .= " $copy";
  72. }
  73. // Step 4b: Make "unique" (based on the number added to the name)
  74. if ($i > 0) {
  75. $style['label'] .= " $i";
  76. }
  77. }
  78. // Unset isid to save it as a new style.
  79. unset($style['isid']);
  80. $style = image_style_save($style);
  81. // Save copies of each effect with the new image style ID (isid).
  82. foreach ($style['effects'] as &$effect) {
  83. // Unset ieid to save it as a new effect.
  84. unset($effect['ieid']);
  85. $effect['isid'] = $style['isid'];
  86. $effect = image_effect_save($effect);
  87. }
  88. return $style;
  89. }
  90. /**
  91. * drupal_get_form callback: form to export an image style.
  92. *
  93. * @param array $form
  94. * @param array $form_state
  95. * @param array $style
  96. * An image style array.
  97. *
  98. * @return array
  99. */
  100. function image_styles_admin_export_form($form, $form_state, $style) {
  101. drupal_set_title(format_string('%page_name @style_name',
  102. array('%page_name' => t('Export image style'), '@style_name' => isset($style['label']) ? $style['label'] : $style['name'])),
  103. PASS_THROUGH);
  104. $form['serialized_style'] = array(
  105. '#type' => 'textarea',
  106. '#rows' => 5,
  107. '#title' => t('Image style export data'),
  108. '#default_value' => image_styles_admin_style_to_string($style),
  109. '#attributes' => array('readonly' =>'readonly'),
  110. '#description' => t('Copy the contents of this field to the clipboard and, on another site, paste it in the textarea of an %page_title page.',
  111. array('%page_title' => t('Import image style'))),
  112. );
  113. return $form;
  114. }
  115. /**
  116. * drupal_get_form callback: form to import an image style.
  117. */
  118. function image_styles_admin_import_form($form/*, $form_state*/) {
  119. $form['serialized_style'] = array(
  120. '#type' => 'textarea',
  121. '#rows' => 5,
  122. '#title' => t('Image style import data'),
  123. '#default_value' => '',
  124. '#required' => TRUE,
  125. '#description' => t('Paste the contents of the textarea of an %page_title page into this field.', array('%page_title' => t('Export image style'))),
  126. );
  127. $form['actions'] = array('#type' => 'actions');
  128. $form['actions']['submit'] = array(
  129. '#type' => 'submit',
  130. '#value' => t('Import'),
  131. );
  132. return $form;
  133. }
  134. /**
  135. * Callback to validate the import style form.
  136. */
  137. function image_styles_admin_import_form_validate($form, &$form_state) {
  138. $import = image_styles_admin_unify_newlines($form_state['values']['serialized_style']);
  139. if (image_styles_admin_import_extract_style($import) === FALSE) {
  140. form_set_error('serialized_style', t('The %field cannot be imported as an image style.', array('%field' => t('Image style import data'))));
  141. }
  142. }
  143. /**
  144. * Callback to process form submission of the import style form.
  145. */
  146. function image_styles_admin_import_form_submit($form, &$form_state) {
  147. $import = image_styles_admin_unify_newlines($form_state['values']['serialized_style']);
  148. $style = image_styles_admin_import_extract_style($import);
  149. // Import the style by "duplicating" it, but prevent adding the -copy suffix
  150. // by passing the requested name and label as 2nd and 3rd parameter.
  151. $new_style = image_styles_admin_duplicate($style, $style['name'], isset($style['label']) ? $style['label'] : NULL);
  152. if ($new_style['name'] === $style['name']) {
  153. drupal_set_message(t('Style %name has been imported.', array('%name' => $style['name'])));
  154. }
  155. else {
  156. drupal_set_message(t('Style %name has been imported as %new_name.', array(
  157. '%name' => isset($style['label']) ? $style['label'] : $style['name'],
  158. '%new_name' => isset($new_style['label']) ? $new_style['label'] : $new_style['name'])));
  159. }
  160. drupal_goto('admin/config/media/image-styles');
  161. }
  162. /**
  163. * Converts image style data into a json string so it can be exported.
  164. *
  165. * @param array $style
  166. * An image style array.
  167. *
  168. * @return string
  169. * The image style converted to a string. Keys that are not needed for import
  170. * are not serialized.
  171. */
  172. function image_styles_admin_style_to_string($style) {
  173. $style = array_intersect_key($style, array('name' => 0, 'label' => 0, 'effects' => 0));
  174. foreach ($style['effects'] as &$effect) {
  175. $effect = array_intersect_key($effect, array('weight' => 0, 'name' => 0, 'data' => 0));
  176. }
  177. array_walk_recursive($style, function(&$value) {
  178. if (is_string($value)) {
  179. $value = image_styles_admin_unify_newlines($value);
  180. }
  181. });
  182. return json_encode($style);
  183. }
  184. /**
  185. * Unifies newlines in the string to the Unix newline standard.
  186. *
  187. * #2636314: textareas may convert newlines to the underlying OS style: convert
  188. * all new lines to Unix style before stringifying an image style.
  189. *
  190. * @param string $str
  191. *
  192. * @return string
  193. */
  194. function image_styles_admin_unify_newlines($str) {
  195. $str = str_replace("\r\n", "\n", $str);
  196. $str = str_replace("\r", "\n", $str);
  197. return $str;
  198. }
  199. /**
  200. * Decodes and validates a json string into image style data.
  201. *
  202. * Some notes on any security implications for creating styles like this:
  203. * - json_decode() is considered safe regardless of the contents give to it.
  204. * - Not expected array entries are subsequently removed (array_intersect_key)
  205. * thus the return will not contain unexpected array entries
  206. * - Values with known types are checked.
  207. * - Effect data array is not checked as it cannot be checked. Possibly unsafe
  208. * but:
  209. * - Proper checking and/or converting to int/float/bool while processing an
  210. * image derivative is the responsibility of the image effect.
  211. * - Effect data is only shown to a user on the edit form and in the image
  212. * effect summary theme. Proper escaping and/or converting to int/float/bool
  213. * in the theme before rendering it is again the responsibility of the image
  214. * effect. On the form it is the form api that will do so.
  215. * - Effect data may contain PHP code and if the image effect is allowing this
  216. * it may get [php_]eval()'ed. The image effects themselves should check for
  217. * the 'use PHP for settings' permission on the create/edit form and check
  218. * that the PHP module is enabled on execution (that is: during image
  219. * derivative creation).
  220. * However, we cannot do so on importing as we cannot know if the imported
  221. * image style contains image effects that allow PHP code. Therefore, we use a
  222. * separate access right for importing styles that is to be considered having
  223. * the same security implications as the 'use PHP for settings' right (from
  224. * the PHP module) and thus should only be given to highly trusted users.
  225. *
  226. * @param string $import
  227. * The json representation of an image style array.
  228. *
  229. * @return array|false
  230. * An image style array or false if the string could not be decoded into
  231. * image style data.
  232. */
  233. function image_styles_admin_import_extract_style($import) {
  234. $style = json_decode($import, TRUE);
  235. // Check if the contents of the textarea could be unserialized into an array.
  236. if (!is_array($style)) {
  237. return FALSE;
  238. }
  239. // Filter out keys that we do not process.
  240. $style = array_intersect_key($style, array('name' => 0, 'label' => 0, 'effects' => 0));
  241. // 'name' is required and must be "machine name" string.
  242. if (!isset($style['name']) || !is_string($style['name']) || preg_match('/[0-9a-z_\-]+/', $style['name']) !== 1) {
  243. return FALSE;
  244. }
  245. // Optional 'label' must be a string.
  246. if (isset($style['label']) && !is_string($style['label'])) {
  247. return FALSE;
  248. }
  249. // 'effects' is required and must be an array.
  250. if (!isset($style['effects']) || !is_array($style['effects'])) {
  251. return FALSE;
  252. }
  253. // Check effects elements
  254. foreach ($style['effects'] as &$effect) {
  255. // an effect must be an array.
  256. if (!is_array($effect)) {
  257. return FALSE;
  258. }
  259. // Check if the required keys are available, we will ignore the other.
  260. $effect = array_intersect_key($effect, array('weight' => 0, 'name' => 0, 'data' => 0));
  261. if (count($effect) !== 3) {
  262. return FALSE;
  263. }
  264. // effect weight must be an integer (data type in table is int, not float).
  265. if (!is_int($effect['weight']) && $effect['weight'] !== (string) (int) $effect['weight']) {
  266. return FALSE;
  267. }
  268. // effect name must be a string
  269. if (!is_string($effect['name'])) {
  270. return FALSE;
  271. }
  272. // Check whether the effect data is an array.
  273. if (!is_array($effect['data'])) {
  274. return FALSE;
  275. }
  276. }
  277. return $style;
  278. }