From ec7d799b2fa4bf9fa5787965ce7c427e678b09bf Mon Sep 17 00:00:00 2001
From: epriestley <git@epriestley.com>
Date: Tue, 1 Jan 2013 18:22:48 -0800
Subject: [PATCH] Add "Core" config, with complex validation

Summary: This is more or less a copy of the validation which lives in `webroot/index.php` right now, but I don't want to wipe that out just yet because there's no way for normal users to see this new validation.

Test Plan: Tried to set "phabricator.base-uri" to crazy nonsense, was harshly rebuffed.

Reviewers: codeblock, btrahan

Reviewed By: codeblock

CC: aran

Maniphest Tasks: T2255

Differential Revision: https://secure.phabricator.com/D4316
---
 src/__phutil_library_map__.php                |  2 +
 .../option/PhabricatorCoreConfigOptions.php   | 86 +++++++++++++++++++
 2 files changed, 88 insertions(+)
 create mode 100644 src/applications/config/option/PhabricatorCoreConfigOptions.php

diff --git a/src/__phutil_library_map__.php b/src/__phutil_library_map__.php
index 38fa022b8b..55adce7447 100644
--- a/src/__phutil_library_map__.php
+++ b/src/__phutil_library_map__.php
@@ -708,6 +708,7 @@ phutil_register_library_map(array(
     'PhabricatorContentSource' => 'applications/metamta/contentsource/PhabricatorContentSource.php',
     'PhabricatorContentSourceView' => 'applications/metamta/contentsource/PhabricatorContentSourceView.php',
     'PhabricatorController' => 'applications/base/controller/PhabricatorController.php',
+    'PhabricatorCoreConfigOptions' => 'applications/config/option/PhabricatorCoreConfigOptions.php',
     'PhabricatorCountdownController' => 'applications/countdown/controller/PhabricatorCountdownController.php',
     'PhabricatorCountdownDAO' => 'applications/countdown/storage/PhabricatorCountdownDAO.php',
     'PhabricatorCountdownDeleteController' => 'applications/countdown/controller/PhabricatorCountdownDeleteController.php',
@@ -2051,6 +2052,7 @@ phutil_register_library_map(array(
     'PhabricatorConfigValidationException' => 'Exception',
     'PhabricatorContentSourceView' => 'AphrontView',
     'PhabricatorController' => 'AphrontController',
+    'PhabricatorCoreConfigOptions' => 'PhabricatorApplicationConfigOptions',
     'PhabricatorCountdownController' => 'PhabricatorController',
     'PhabricatorCountdownDAO' => 'PhabricatorLiskDAO',
     'PhabricatorCountdownDeleteController' => 'PhabricatorCountdownController',
diff --git a/src/applications/config/option/PhabricatorCoreConfigOptions.php b/src/applications/config/option/PhabricatorCoreConfigOptions.php
new file mode 100644
index 0000000000..727ae66ff4
--- /dev/null
+++ b/src/applications/config/option/PhabricatorCoreConfigOptions.php
@@ -0,0 +1,86 @@
+<?php
+
+final class PhabricatorCoreConfigOptions
+  extends PhabricatorApplicationConfigOptions {
+
+  public function getName() {
+    return pht("Core");
+  }
+
+  public function getDescription() {
+    return pht("Configure core options, including URIs.");
+  }
+
+  public function getOptions() {
+    return array(
+      $this->newOption('phabricator.base-uri', 'string', null)
+        ->setSummary(pht("URI where Phabricator is installed."))
+        ->setDescription(
+          pht(
+            "Set the URI where Phabricator is installed. Setting this ".
+            "improves security by preventing cookies from being set on other ".
+            "domains, and allows daemons to send emails with links that have ".
+            "the correct domain."))
+        ->addExample('http://phabricator.example.com/', 'Valid Setting'),
+      $this->newOption('phabricator.production-uri', 'string', null)
+        ->setSummary(
+          pht("Primary install URI, for multi-environment installs."))
+        ->setDescription(
+          pht(
+            "If you have multiple Phabricator environments (like a ".
+            "development/staging environment for working on testing ".
+            "Phabricator, and a production environment for deploying it), ".
+            "set the production environment URI here so that emails and other ".
+            "durable URIs will always generate with links pointing at the ".
+            "production environment. If unset, defaults to ".
+            "{{phabricator.base-uri}}. Most installs do not need to set ".
+            "this option."))
+        ->addExample('http://phabricator.example.com/', 'Valid Setting')
+    );
+  }
+
+  protected function didValidateOption(
+    PhabricatorConfigOption $option,
+    $value) {
+
+    $key = $option->getKey();
+    if ($key == 'phabricator.base-uri' ||
+        $key == 'phabricator.production-uri') {
+
+      $uri = new PhutilURI($value);
+      $protocol = $uri->getProtocol();
+      if ($protocol !== 'http' && $protocol !== 'https') {
+        throw new PhabricatorConfigValidationException(
+          pht(
+            "Config option '%s' is invalid. The URI must start with ".
+            "'http://' or 'https://'.",
+            $key));
+      }
+
+      $domain = $uri->getDomain();
+      if (strpos($domain, '.') === false) {
+        throw new PhabricatorConfigValidationException(
+          pht(
+            "Config option '%s' is invalid. The URI must contain a dot ('.'), ".
+            "like 'http://example.com/', not just a bare name like ".
+            "'http://example/'. Some web browsers will not set cookies on ".
+            "domains with no TLD.",
+            $key));
+      }
+
+      $path = $uri->getPath();
+      if ($path !== '' && $path !== '/') {
+        throw new PhabricatorConfigValidationException(
+          pht(
+            "Config option '%s' is invalid. The URI must NOT have a path, ".
+            "e.g. 'http://phabricator.example.com/' is OK, but ".
+            "'http://example.com/phabricator/' is not. Phabricator must be ".
+            "installed on an entire domain; it can not be installed on a ".
+            "path.",
+            $key));
+      }
+    }
+  }
+
+
+}