Context Navigation

source: branches/1.1dev/lib/App.inc.php @ 758

Last change on this file since 758 was 758, checked in by anonymous, 2 years ago

File size: 34.2 KB

Line
1	<?php
2	/**
3	* App.inc.php
4	* Code by Strangecode :: www.strangecode.com :: This document contains copyrighted information
5	*/
6
7	/******************************************************************************
8	* CONFIG
9	******************************************************************************
10
11	This library has some functions that require globally defined values.
12	These are defined here.
13	*/
14
15	// Message Types
16	/** @constant MSG_NOTICE
17	An informational message: Welcome to asdf, Logout successful, etc. */
18	define('MSG_NOTICE', 0);
19
20	/** @constant MSG_SUCCESS
21	A success message: Message sent, You are logged-in, etc. */
22	define('MSG_SUCCESS', 1);
23
24	/** @constant MSG_WARNING
25	A warning message: Access denied, Email address invalid, Article not found, etc. */
26	define('MSG_WARNING', 2);
27
28	/** @constant MSG_ERR
29	Unrecoverable failure: Message could not be sent, File not found, etc. */
30	define('MSG_ERR', 4); // PHP user error style.
31	define('MSG_ERROR', 4);
32
33
34
35	/******************************************************************************
36	* FUNCTIONS
37	******************************************************************************
38
39	/**
40	* Add a message to the string globalmessage, which is printed in the header.
41	* Just a simple way to print messages to the user.
42	*
43	* @access public
44	*
45	* @param string $message The text description of the message.
46	* @param int $type The type of message: MSG_NOTICE,
47	* MSG_SUCCESS, MSG_WARNING, or MSG_ERR.
48	* @param string $file __FILE__.
49	* @param string $line __LINE__.
50	*/
51	function raiseMsg($message, $type=MSG_NOTICE, $file=null, $line=null)
52	{
53	$_SESSION['_messages'][] = array(
54	'type' => $type,
55	'message' => $message,
56	'file' => $file,
57	'line' => $line
58	);
59	}
60
61	/**
62	* Logs a message to a user defined log file. Additional actions to take for
63	* different types of message types can be specified (ERROR, NOTICE, etc).
64	*
65	* @access public
66	*
67	* @param string $message The text description of the message.
68	* @param int $priority The type of message priority (in descending order):
69	* LOG_EMERG system is unusable
70	* LOG_ALERT action must be taken immediately
71	* LOG_CRIT critical conditions
72	* LOG_ERR error conditions
73	* LOG_WARNING warning conditions
74	* LOG_NOTICE normal, but significant, condition
75	* LOG_INFO informational message
76	* LOG_DEBUG debug-level message
77	* @param string $file The file where the log event occurs.
78	* @param string $line The line of the file where the log event occurs.
79	*/
80	function logMsg($message, $priority=LOG_INFO, $file=null, $line=null)
81	{
82	global $CFG;
83	static $previous_events = array();
84
85	// If priority is not specified, assume the worst.
86	if (!priorityToString($priority)) {
87	logMsg(sprintf('Log priority %s not defined. (Message: %s)', $priority, $message), LOG_EMERG, $file, $line);
88	$priority = LOG_EMERG;
89	}
90
91	// If log file is not specified, create one in the codebase root.
92	if (!is_dir($CFG->log_directory) \|\| !is_writable($CFG->log_directory)) {
93	// We must use trigger_error rather than calling logMsg, which might lead to an infinite loop.
94	trigger_error(sprintf('Codebase error: log directory not found or writable: %s', $CFG->log_directory), E_USER_NOTICE);
95	$CFG->log_directory = '/tmp';
96	$CFG->log_filename = sprintf('%s_%s.log', getenv('USER'), getenv('HTTP_HOST'));
97	}
98
99	// In case __FILE__ and __LINE__ are not provided, note that fact.
100	$file = '' == $file ? 'unknown-file' : $file;
101	$line = '' == $line ? 'unknown-line' : $line;
102
103	// Strip HTML tags except any with more than 7 characters because that's probably not a HTML tag, e.g. <email@address.com>.
104	preg_match_all('/(<[^>\s]{7,})[^>]*>/', $message, $strip_tags_allow);
105	$message = strip_tags(preg_replace('/\s+/', ' ', $message), (!empty($strip_tags_allow[1]) ? join('> ', $strip_tags_allow[1]) . '>' : null));
106
107	// Serialize multi-line messages.
108	$message = preg_replace('/\s+/m', ' ', trim($message));
109
110	// Store this event under a unique key, counting each time it occurs so that it only gets reported a limited number of times.
111	$msg_id = md5($message . $priority . $file . $line);
112	if ($CFG->log_ignore_repeated_events && isset($previous_events[$msg_id])) {
113	$previous_events[$msg_id]++;
114	if ($previous_events[$msg_id] == 2) {
115	logMsg(sprintf('%s (Event repeated %s or more times)', $message, $previous_events[$msg_id]), $priority, $file, $line);
116	}
117	return false;
118	} else {
119	$previous_events[$msg_id] = 1;
120	}
121
122	// Make sure to log in the system's locale.
123	$locale = setlocale(LC_TIME, 0);
124	setlocale(LC_TIME, 'C');
125
126	// Data to be stored for a log event.
127	$event = array(
128	'date' => date('Y-m-d H:i:s'),
129	'remote ip' => getRemoteAddr(),
130	'pid' => getmypid(),
131	'type' => priorityToString($priority),
132	'file:line' => "$file : $line",
133	'url' => (isset($_SERVER['REQUEST_URI']) ? $_SERVER['REQUEST_URI'] : ''),
134	'message' => $message
135	);
136	// Here's a shortened version of event data.
137	$event_short = $event;
138	$event_short['url'] = truncate($event_short['url'], 120);
139
140	// Restore original locale.
141	setlocale(LC_TIME, $locale);
142
143	// FILE ACTION
144	if ($CFG->log_file_priority && $priority <= $CFG->log_file_priority) {
145	$event_str = '[' . join('] [', $event_short) . ']';
146	error_log($event_str . "\n", 3, $CFG->log_directory . '/' . $CFG->log_filename);
147	}
148
149	// EMAIL ACTION
150	if ($CFG->log_email_priority && $priority <= $CFG->log_email_priority) {
151	if (empty($CFG->log_to_email)) {
152	$CFG->log_to_email = 'bug@strangecode.com';
153	}
154	$hostname = (isset($_SERVER['HTTP_HOST']) && '' != $_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : php_uname('n');
155	$subject = sprintf('[%s %s] %s', $hostname, $event['type'], mb_substr($event['message'], 0, 64));
156	$email_msg = sprintf("A log event of type '%s' occurred on %s\n\n", $event['type'], $hostname);
157	$headers = "From: codebase@strangecode.com\r\n";
158	foreach ($event as $k=>$v) {
159	$email_msg .= sprintf("%-11s%s\n", $k, $v);
160	}
161	mb_send_mail($CFG->log_to_email, $subject, $email_msg, $headers, '-f codebase@strangecode.com');
162	}
163
164	// SMS ACTION
165	if ($CFG->log_sms_priority && $priority <= $CFG->log_sms_priority) {
166	if (empty($CFG->log_to_email)) {
167	$CFG->log_to_sms = 'bug@strangecode.com';
168	}
169	$hostname = (isset($_SERVER['HTTP_HOST']) && '' != $_SERVER['HTTP_HOST']) ? $_SERVER['HTTP_HOST'] : php_uname('n');
170	$subject = sprintf('[%s %s]', $hostname, $priority);
171	$sms_msg = sprintf('%s [%s:%s]', mb_substr($event_short['message'], 0, 64), basename($file), $line);
172	$headers = 'From: ' . $CFG->site_email;
173	mb_send_mail($CFG->log_to_sms, $subject, $sms_msg, $headers);
174	}
175
176	// SCREEN ACTION
177	if ($CFG->log_screen_priority && $priority <= $CFG->log_screen_priority) {
178	echo "[{$event['date']}] [{$event['type']}] [{$event['file:line']}] [{$event['message']}]\n";
179	}
180	}
181
182	/**
183	* Returns the string representation of a LOG_* integer constant.
184	*
185	* @param int $priority The LOG_* integer constant.
186	*
187	* @return The string representation of $priority.
188	*/
189	function priorityToString ($priority) {
190	$priorities = array(
191	LOG_EMERG => 'emergency',
192	LOG_ALERT => 'alert',
193	LOG_CRIT => 'critical',
194	LOG_ERR => 'error',
195	LOG_WARNING => 'warning',
196	LOG_NOTICE => 'notice',
197	LOG_INFO => 'info',
198	LOG_DEBUG => 'debug'
199	);
200	if (isset($priorities[$priority])) {
201	return $priorities[$priority];
202	} else {
203	return false;
204	}
205	}
206
207	/**
208	* Set the URL to return to when dieBoomerangURL() is called.
209	*
210	* @param string $url A fully validated URL.
211	* @param bool $id An identification tag for this url.
212	* FIXME: url garbage collection?
213	*/
214	function setBoomerangURL($url=null, $id=null)
215	{
216	// A redirection will never happen immediately after setting the boomerangURL.
217	// Set the time so ensure this doesn't happen. See validBoomerangURL for more.
218
219	if (isset($url) && is_string($url)) {
220	// Delete any boomerang request keys in the query string (along with any trailing delimiters after the deletion).
221	$url = preg_replace(array('/([&?])boomerang=[^&?]+[&?]?/', '/[&?]$/'), array('$1', ''), $url);
222
223	if (isset($_SESSION['_boomerang']['url']) && is_array($_SESSION['_boomerang']['url']) && !empty($_SESSION['_boomerang']['url'])) {
224	// If the URL currently exists in the boomerang array, delete.
225	while ($existing_key = array_search($url, $_SESSION['_boomerang']['url'])) {
226	unset($_SESSION['_boomerang']['url'][$existing_key]);
227	}
228	}
229
230	if (isset($id)) {
231	$_SESSION['_boomerang']['url'][$id] = $url;
232	} else {
233	$_SESSION['_boomerang']['url'][] = $url;
234	}
235	logMsg(sprintf('setBoomerangURL added URL %s to session %s=%s', $url, session_name(), session_id()), LOG_DEBUG, __FILE__, __LINE__);
236	return true;
237	} else {
238	return false;
239	}
240	}
241
242	/**
243	* Return the URL set for the specified $id.
244	*
245	* @param string $id An identification tag for this url.
246	*/
247	function getBoomerangURL($id=null)
248	{
249	if (isset($id)) {
250	if (isset($_SESSION['_boomerang']['url'][$id])) {
251	return $_SESSION['_boomerang']['url'][$id];
252	} else {
253	return '';
254	}
255	} else if (is_array($_SESSION['_boomerang']['url'])) {
256	return end($_SESSION['_boomerang']['url']);
257	} else {
258	return false;
259	}
260	}
261
262	/**
263	* Delete the URL set for the specified $id.
264	*
265	* @param string $id An identification tag for this url.
266	*/
267	function deleteBoomerangURL($id=null)
268	{
269	if (isset($id) && isset($_SESSION['_boomerang']['url'][$id])) {
270	unset($_SESSION['_boomerang']['url'][$id]);
271	} else if (is_array($_SESSION['_boomerang']['url'])) {
272	array_pop($_SESSION['_boomerang']['url']);
273	}
274	}
275
276	/**
277	* Check if a valid boomerang URL value has been set.
278	* if it is not the current url, and has not been accessed within n seconds.
279	*
280	* @return bool True if it is set and not the current URL.
281	*/
282	function validBoomerangURL($id=null, $use_nonspecific_boomerang=false)
283	{
284	global $CFG;
285
286	if (!isset($_SESSION['_boomerang']['url'])) {
287	logMsg(sprintf('validBoomerangURL no URL set in session %s=%s', session_name(), session_id()), LOG_DEBUG, __FILE__, __LINE__);
288	return false;
289	}
290
291	// Time is the timestamp of a boomerangURL redirection, or setting of a boomerangURL.
292	// a boomerang redirection will always occur at least several seconds after the last boomerang redirect
293	// or a boomerang being set.
294	$boomerang_time = isset($_SESSION['_boomerang']['time']) ? $_SESSION['_boomerang']['time'] : 0;
295
296	if (isset($id) && isset($_SESSION['_boomerang']['url'][$id])) {
297	$url = $_SESSION['_boomerang']['url'][$id];
298	} else if (!isset($id) \|\| $use_nonspecific_boomerang) {
299	// Use non specific boomerang if available.
300	$url = end($_SESSION['_boomerang']['url']);
301	} else {
302	// If URL is not specified, use the $CFG->redirect_home config value.
303	$url = $CFG->redirect_home;
304	}
305
306	logMsg(sprintf('validBoomerangURL testing url: %s', $url), LOG_DEBUG, __FILE__, __LINE__);
307	if (empty($url)) {
308	return false;
309	}
310	if ($url == absoluteMe()) {
311	// The URL we are directing to is not the current page.
312	logMsg(sprintf('Boomerang URL not valid, same as absoluteMe: %s', $url), LOG_DEBUG, __FILE__, __LINE__);
313	return false;
314	}
315	if ($boomerang_time >= (time() - 2)) {
316	// Last boomerang direction was more than 2 seconds ago.
317	logMsg(sprintf('Boomerang URL not valid, boomerang_time too short: %s', time() - $boomerang_time), LOG_DEBUG, __FILE__, __LINE__);
318	return false;
319	}
320
321	return true;
322	}
323
324	/*
325	* Redirects a user by calling App::dieURL(). It will use:
326	* 1. the stored boomerang URL, it it exists
327	* 2. a specified $default_url, it it exists
328	* 3. the referring URL, it it exists.
329	* 4. redirect_home_url configuration variable.
330	*
331	* @access public
332	* @param string $id Identifier for this script.
333	* @param mixed $carry_args Additional arguments to carry in the URL automatically (see App::oHREF()).
334	* @param string $default_url A default URL if there is not a valid specified boomerang URL.
335	* @return bool False if the session is not running. No return otherwise.
336	* @author Quinn Comendant <quinn@strangecode.com>
337	* @since 31 Mar 2006 19:17:00
338	*/
339	function dieBoomerangURL($id=null, $carry_args=null, $default_url=null)
340	{
341	// Get URL from stored boomerang. Allow non specific URL if ID not valid.
342	if (validBoomerangURL($id, true)) {
343	if (isset($id) && isset($_SESSION['_boomerang']['url'][$id])) {
344	$url = $_SESSION['_boomerang']['url'][$id];
345	} else {
346	$url = end($_SESSION['_boomerang']['url']);
347	}
348	} else if (isset($default_url)) {
349	$url = $default_url;
350	} else if (!refererIsMe()) {
351	// Ensure that the redirecting page is not also the referrer.
352	$url = getenv('HTTP_REFERER');
353	} else {
354	$url = '';
355	}
356
357	logMsg(sprintf('dieBoomerangURL found URL: %s', $url), LOG_DEBUG, __FILE__, __LINE__);
358
359	// Delete stored boomerang.
360	deleteBoomerangURL($id);
361
362	// A redirection will never happen immediately twice.
363	// Set the time so ensure this doesn't happen.
364	$_SESSION['_boomerang']['time'] = time();
365	dieURL($url, $carry_args);
366	}
367
368	/**
369	* Uses an http header to redirect the client to the given $url. If sessions are not used
370	* and the session is not already defined in the given $url, the SID is appended as a URI query.
371	* As with all header generating functions, make sure this is called before any other output.
372	*
373	* @param string $url The URL the client will be redirected to.
374	* @param mixed $carry_args Additional url arguments to carry in the query,
375	* or FALSE to prevent carrying queries. Can be any of the following formats:
376	* -array('key1', key2', key3') <-- to save these keys if in the form data.
377	* -array('key1'=>'value', key2'='value') <-- to set keys to default values if not present in form data.
378	* -false <-- To not carry any queries. If URL already has queries those will be retained.
379	* @param bool $always_include_sid Force session id to be added to Location header.
380	*/
381	function dieURL($url, $carry_args=null, $always_include_sid=false)
382	{
383	global $CFG;
384
385	if ('' == $url) {
386	// If URL is not specified, use the redirect_home.
387	$url = $CFG->redirect_home;
388	}
389
390	if (preg_match('!^/!', $url)) {
391	// If relative URL is given, prepend correct local hostname.
392	$hostname = ('on' == getenv('HTTPS')) ? 'https://' . getenv('HTTP_HOST') : 'http://' . getenv('HTTP_HOST');
393	$url = $hostname . $url;
394	}
395
396	$url = url($url, $carry_args, $always_include_sid);
397
398	header(sprintf('Location: %s', $url));
399	logMsg(sprintf('dieURL dying to URL: %s', $url), LOG_DEBUG, __FILE__, __LINE__);
400	die;
401	}
402
403	/**
404	* Prints a hidden form element with the PHPSESSID when cookies are not used, as well
405	* as hidden form elements for GET_VARS that might be in use.
406	*
407	* @global string $carry_queries An array of keys to define which values to
408	* carry through from the POST or GET.
409	* $carry_queries = array('qry'); for example
410	*
411	* @param mixed $carry_args Additional url arguments to carry in the query,
412	* or FALSE to prevent carrying queries. Can be any of the following formats:
413	* -array('key1', key2', key3') <-- to save these keys if in the form data.
414	* -array('key1'=>'value', key2'='value') <-- to set keys to default values if not present in form data.
415	* -false <-- To not carry any queries. If URL already has queries those will be retained.
416	*/
417	function printHiddenSession($carry_args=null, $include_csrf_token=false)
418	{
419	static $_using_trans_sid;
420	global $carry_queries;
421
422	// Save the trans_sid setting.
423	if (!isset($_using_trans_sid)) {
424	$_using_trans_sid = ini_get('session.use_trans_sid');
425	}
426
427	// Initialize the carried queries.
428	if (!isset($carry_queries['_carry_queries_init'])) {
429	if (!is_array($carry_queries)) {
430	$carry_queries = array($carry_queries);
431	}
432	$tmp = $carry_queries;
433	$carry_queries = array();
434	foreach ($tmp as $key) {
435	if (!empty($key) && getFormData($key, false)) {
436	$carry_queries[$key] = getFormData($key);
437	}
438	}
439	$carry_queries['_carry_queries_init'] = true;
440	}
441
442	// Get any additional query names to add to the $carry_queries array
443	// that are found as function arguments.
444	// If FALSE is a function argument, DO NOT carry the queries.
445	$do_carry_queries = true;
446	$one_time_carry_queries = array();
447	if (!is_null($carry_args)) {
448	if (is_array($carry_args) && !empty($carry_args)) {
449	foreach ($carry_args as $key=>$arg) {
450	// Get query from appropriate source.
451	if (false === $arg) {
452	$do_carry_queries = false;
453	} else if (false !== getFormData($arg, false)) {
454	$one_time_carry_queries[$arg] = getFormData($arg); // Set arg to form data if available.
455	} else if (!is_numeric($key) && '' != $arg) {
456	$one_time_carry_queries[$key] = getFormData($key, $arg); // Set to arg to default if specified (overwritten by form data).
457	}
458	}
459	} else if (false !== getFormData($carry_args, false)) {
460	$one_time_carry_queries[$carry_args] = getFormData($carry_args);
461	} else if (false === $carry_args) {
462	$do_carry_queries = false;
463	}
464	}
465
466	// For each existing POST value, we create a hidden input to carry it through a form.
467	if ($do_carry_queries) {
468	// Join the perm and temp carry_queries and filter out the _carry_queries_init element for the final query args.
469	$query_args = array_diff_assoc(array_merge($carry_queries, $one_time_carry_queries), array('_carry_queries_init' => true));
470	foreach ($query_args as $key=>$val) {
471	echo '<input type="hidden" name="' . $key . '" value="' . $val . '" />';
472	}
473	}
474
475	// Include the SID if cookies are disabled.
476	if (!isset($_COOKIE[session_name()]) && !$_using_trans_sid) {
477	echo '<input type="hidden" name="' . session_name() . '" value="' . session_id() . '" />';
478	}
479
480	// Include the csrf_token in the form.
481	// This token can be validated upon form submission with $app->verifyCSRFToken() or $app->requireValidCSRFToken()
482	if ($include_csrf_token) {
483	printf('<input type="hidden" name="csrf_token" value="%s" />', getCSRFToken());
484	}
485	}
486
487	/**
488	* Outputs a fully qualified URL with a query of all the used (ie: not empty)
489	* keys and values, including optional queries. This allows simple printing of
490	* links without needing to know which queries to add to it. If cookies are not
491	* used, the session id will be propogated in the URL.
492	*
493	* @global string $carry_queries An array of keys to define which values to
494	* carry through from the POST or GET.
495	* $carry_queries = array('qry'); for example.
496	*
497	* @param string $url The initial url
498	* @param mixed $carry_args Additional url arguments to carry in the query,
499	* or FALSE to prevent carrying queries. Can be any of the following formats:
500	* -array('key1', key2', key3') <-- to save these keys if in the form data.
501	* -array('key1'=>'value', key2'='value') <-- to set keys to default values if not present in form data.
502	* -false <-- To not carry any queries. If URL already has queries those will be retained.
503	*
504	* @param mixed $always_include_sid Always add the session id, even if using_trans_sid = true. This is required when
505	* URL starts with http, since PHP using_trans_sid doesn't do those and also for
506	* header('Location...') redirections.
507	*
508	* @return string url with attached queries and, if not using cookies, the session id
509	*/
510	function url($url='', $carry_args=null, $always_include_sid=false)
511	{
512	static $_using_trans_sid;
513	global $carry_queries;
514	global $CFG;
515
516	// Save the trans_sid setting.
517	if (!isset($_using_trans_sid)) {
518	$_using_trans_sid = ini_get('session.use_trans_sid');
519	}
520
521	// Initialize the carried queries.
522	if (!isset($carry_queries['_carry_queries_init'])) {
523	if (!is_array($carry_queries)) {
524	$carry_queries = array($carry_queries);
525	}
526	$tmp = $carry_queries;
527	$carry_queries = array();
528	foreach ($tmp as $key) {
529	if (!empty($key) && getFormData($key, false)) {
530	$carry_queries[$key] = getFormData($key);
531	}
532	}
533	$carry_queries['_carry_queries_init'] = true;
534	}
535
536	// Get any additional query arguments to add to the $carry_queries array.
537	// If FALSE is a function argument, DO NOT carry the queries.
538	$do_carry_queries = true;
539	$one_time_carry_queries = array();
540	if (!is_null($carry_args)) {
541	if (is_array($carry_args) && !empty($carry_args)) {
542	foreach ($carry_args as $key=>$arg) {
543	// Get query from appropriate source.
544	if (false === $arg) {
545	$do_carry_queries = false;
546	} else if (false !== getFormData($arg, false)) {
547	$one_time_carry_queries[$arg] = getFormData($arg); // Set arg to form data if available.
548	} else if (!is_numeric($key) && '' != $arg) {
549	$one_time_carry_queries[$key] = getFormData($key, $arg); // Set to arg to default if specified (overwritten by form data).
550	}
551	}
552	} else if (false !== getFormData($carry_args, false)) {
553	$one_time_carry_queries[$carry_args] = getFormData($carry_args);
554	} else if (false === $carry_args) {
555	$do_carry_queries = false;
556	}
557	}
558
559	// Get the first delimiter that is needed in the url.
560	$delim = preg_match('/\?/', $url) ? ini_get('arg_separator.output') : '?';
561
562	$q = '';
563	if ($do_carry_queries) {
564	// Join the perm and temp carry_queries and filter out the _carry_queries_init element for the final query args.
565	$query_args = array_diff_assoc(urlEncodeArray(array_merge($carry_queries, $one_time_carry_queries)), array('_carry_queries_init' => true));
566	foreach ($query_args as $key=>$val) {
567	// Check value is set and value does not already exist in the url.
568	if (!preg_match('/[?&]' . preg_quote($key) . '=/', $url)) {
569	$q .= $delim . $key . '=' . $val;
570	$delim = ini_get('arg_separator.output');
571	}
572	}
573	}
574
575	// Include the necessary SID if the following is true:
576	// - no cookie in http request OR cookies disabled in config
577	// - sessions are enabled
578	// - the link stays on our site
579	// - transparent SID propagation with session.use_trans_sid is not being used OR url begins with protocol (using_trans_sid has no effect here)
580	// OR
581	// - we must include the SID because we say so (it's used in a context where cookies will not be effective, ie. moving from http to https)
582	// AND
583	// - the SID is not already in the query.
584	if (
585	(
586	(
587	(
588	!isset($_COOKIE[session_name()])
589	\|\| !$CFG->session_use_cookies
590	)
591	&& $CFG->session_use_trans_sid
592	&& $CFG->enable_session
593	&& isMyDomain($url)
594	&&
595	(
596	!$_using_trans_sid
597	\|\| preg_match('!^(http\|https)://!i', $url)
598	)
599	)
600	\|\| $always_include_sid
601	)
602	&& !preg_match('/[?&]' . preg_quote(session_name()) . '=/', $url)
603	) {
604	$url .= $q . $delim . session_name() . '=' . session_id();
605	// logMsg(sprintf('oHREF appending session id to URL: %s', $url), LOG_DEBUG, __FILE__, __LINE__);
606	} else {
607	$url .= $q;
608	}
609
610	return $url;
611	}
612
613	/**
614	* Returns a URL processed with App::url and htmlentities for printing in html.
615	*
616	* @access public
617	* @param string $url Input URL to parse.
618	* @return string URL with App::url() and htmlentities() applied.
619	* @author Quinn Comendant <quinn@strangecode.com>
620	* @since 09 Dec 2005 17:58:45
621	*/
622	function oHREF($url, $carry_args=null, $always_include_sid=false)
623	{
624	$url = url($url, $carry_args, $always_include_sid);
625	// Replace any & not followed by an html or unicode entity with it's & equivalent.
626	$url = preg_replace('/&(?![\w\d#]{1,10};)/', '&', $url);
627	return $url;
628	}
629
630	/*
631	* Generate a csrf_token if it doesn't exist or is expired, save it to the session and return its value.
632	* Otherwise just return the current token.
633	* Details on the synchronizer token pattern:
634	* https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet#General_Recommendation:_Synchronizer_Token_Pattern
635	*
636	* @access public
637	* @param bool $force_new_token Generate a new token, replacing any existing token in the session (used by $app->resetCSRFToken())
638	* @return string The new or current csrf_token
639	* @author Quinn Comendant <quinn@strangecode.com>
640	* @version 1.0
641	* @since 15 Nov 2014 17:57:17
642	*/
643	function getCSRFToken($force_new_token=false)
644	{
645	if ($force_new_token \|\| !isset($_SESSION['csrf_token']) \|\| (removeSignature($_SESSION['csrf_token']) + 86400 < time())) {
646	// No token, or token is expired; generate one and return it.
647	return $_SESSION['csrf_token'] = addSignature(time(), null, 64);
648	}
649	// Current token is not expired; return it.
650	return $_SESSION['csrf_token'];
651	}
652
653	/*
654	* Generate a new token, replacing any existing token in the session. Call this function after $app->requireValidCSRFToken() for a new token to be required for each request.
655	*
656	* @access public
657	* @return void
658	* @author Quinn Comendant <quinn@strangecode.com>
659	* @since 14 Oct 2021 17:35:19
660	*/
661	function resetCSRFToken()
662	{
663	getCSRFToken(true);
664	}
665
666	/*
667	* Compares the given csrf_token with the current or previous one saved in the session.
668	*
669	* @access public
670	* @param string $user_submitted_csrf_token The user-submitted token to compare with the session token.
671	* @return bool True if the tokens match, false otherwise.
672	* @author Quinn Comendant <quinn@strangecode.com>
673	* @version 1.0
674	* @since 15 Nov 2014 18:06:55
675	*/
676	function verifyCSRFToken($user_submitted_csrf_token)
677	{
678
679	if ('' == trim($user_submitted_csrf_token)) {
680	logMsg(sprintf('Empty string failed CSRF verification.', null), LOG_NOTICE, __FILE__, __LINE__);
681	return false;
682	}
683	if (!verifySignature($user_submitted_csrf_token, null, 64)) {
684	logMsg(sprintf('Input failed CSRF verification (invalid signature in %s).', $user_submitted_csrf_token), LOG_WARNING, __FILE__, __LINE__);
685	return false;
686	}
687	$csrf_token = getCSRFToken();
688	if ($user_submitted_csrf_token != $csrf_token) {
689	logMsg(sprintf('Input failed CSRF verification (%s not in %s).', $user_submitted_csrf_token, $csrf_token), LOG_WARNING, __FILE__, __LINE__);
690	return false;
691	}
692	logMsg(sprintf('Verified CSRF token %s', $user_submitted_csrf_token), LOG_DEBUG, __FILE__, __LINE__);
693	return true;
694	}
695
696	/*
697	* Bounce user if they submit a token that doesn't match the one saved in the session.
698	* Because this function calls dieURL() it must be called before any other HTTP header output.
699	*
700	* @access public
701	* @param string $message Optional message to display to the user (otherwise default message will display). Set to an empty string to display no message.
702	* @param int $type The type of message: MSG_NOTICE,
703	* MSG_SUCCESS, MSG_WARNING, or MSG_ERR.
704	* @param string $file __FILE__.
705	* @param string $line __LINE__.
706	* @return void
707	* @author Quinn Comendant <quinn@strangecode.com>
708	* @version 1.0
709	* @since 15 Nov 2014 18:10:17
710	*/
711	function requireValidCSRFToken($message=null, $type=MSG_NOTICE, $file=null, $line=null)
712	{
713	if (!verifyCSRFToken(getFormData('csrf_token'))) {
714	$message = isset($message) ? $message : _("Sorry, the form token expired. Please try again.");
715	raiseMsg($message, $type, $file, $line);
716	dieBoomerangURL();
717	}
718	}
719
720	/**
721	* This function has changed to do nothing. SSL redirection should happen at the server layer, doing so here may result in a redirect loop.
722	*/
723	function sslOn()
724	{
725	logMsg(sprintf('sslOn was called and ignored.', null), LOG_DEBUG, __FILE__, __LINE__);
726	}
727
728	/**
729	* This function has changed to do nothing. There is no reason to prefer a non-SSL connection, and doing so may result in a redirect loop.
730	*/
731	function sslOff()
732	{
733	logMsg(sprintf('sslOff was called and ignored.', null), LOG_DEBUG, __FILE__, __LINE__);
734	}
735
736	/**
737	* If the given $url is on the same web site, return true. This can be used to
738	* prevent from sending sensitive info in a get query (like the SID) to another
739	* domain. $method can be "ip" or "domain". The domain method might be preferred
740	* if your domain spans mutiple IP's (load sharing servers)
741	*
742	* @param string $url the URI to test.
743	* @param mixed $method the method to use. Either 'domain' or 'ip'.
744	*
745	* @return bool true if given $url is this domain or has no domain (is a
746	* relative url), false if it's another
747	*/
748	function isMyDomain($url)
749	{
750	if (!preg_match('\|\w{1,}\.\w{2,5}/\|', $url)) {
751	// If we can't find a domain we assume the URL is relative.
752	return true;
753	} else {
754	return preg_match('/' . preg_quote(getenv('HTTP_HOST')) . '/', $url);
755	}
756	}
757
758	/**
759	* Loads a list of tables in the current database into an array, and returns
760	* true if the requested table is found. Use this function to enable/disable
761	* funtionality based upon the current available db tables.
762	*
763	* @param string $table The name of the table to search.
764	*
765	* @return bool true if given $table exists.
766	*/
767	function dbTableExists($table)
768	{
769	static $existing_tables;
770
771	// Save the trans_sid setting.
772	if (!isset($existing_tables)) {
773	// Get DB tables.
774	$existing_tables = array();
775	$qid = dbQuery("SHOW TABLES");
776	while (list($row) = mysql_fetch_row($qid)) {
777	$existing_tables[] = $row;
778	}
779	}
780
781	// Test if requested table is in database.
782	return in_array($table, $existing_tables);
783	}
784
785	/**
786	* Takes a URL and returns it without the query or anchor portion
787	*
788	* @param string $url any kind of URI
789	*
790	* @return string the URI with ? or # and everything after removed
791	*/
792	function stripQuery($url)
793	{
794	return preg_replace('![?#].*!', '', $url);
795	}
796
797	/**
798	* Returns the remote IP address, taking into consideration proxy servers.
799	*
800	* @param bool $dolookup If true we resolve to IP to a host name,
801	* if false we don't.
802	*
803	* @return string IP address if $dolookup is false or no arg
804	* Hostname if $dolookup is true
805	*/
806	function getRemoteAddr($dolookup=false)
807	{
808	$ip = getenv('HTTP_CLIENT_IP');
809	if (empty($ip) \|\| $ip == 'unknown' \|\| $ip == 'localhost' \|\| $ip == '127.0.0.1') {
810	$ip = getenv('HTTP_X_FORWARDED_FOR');
811	if (empty($ip) \|\| $ip == 'unknown' \|\| $ip == 'localhost' \|\| $ip == '127.0.0.1') {
812	$ip = getenv('REMOTE_ADDR');
813	}
814	}
815	return $dolookup && '' != $ip ? gethostbyaddr($ip) : $ip;
816	}
817
818	/**
819	* Tests whether a given iP address can be found in an array of IP address networks.
820	* Elements of networks array can be single IP addresses or an IP address range in CIDR notation
821	* See: http://en.wikipedia.org/wiki/Classless_inter-domain_routing
822	*
823	* @access public
824	*
825	* @param string IP address to search for.
826	* @param array Array of networks to search within.
827	*
828	* @return mixed Returns the network that matched on success, false on failure.
829	*/
830	function ipInRange($my_ip, $ip_pool)
831	{
832	if (!is_array($ip_pool)) {
833	$ip_pool = array($ip_pool);
834	}
835
836	$my_ip_binary = sprintf('%032b', ip2long($my_ip));
837	foreach ($ip_pool as $ip) {
838	if (preg_match('![\d\.]{7,15}/\d{1,2}!', $ip)) {
839	// IP is in CIDR notation.
840	list($cidr_ip, $cidr_bitmask) = split('/', $ip);
841	$cidr_ip_binary = sprintf('%032b', ip2long($cidr_ip));
842	if (substr($my_ip_binary, 0, $cidr_bitmask) === substr($cidr_ip_binary, 0, $cidr_bitmask)) {
843	// IP address is within the specified IP range.
844	return $ip;
845	}
846	} else {
847	if ($my_ip === $ip) {
848	// IP address exactly matches.
849	return $ip;
850	}
851	}
852	}
853
854	return false;
855	}
856
857	/**
858	* Returns a fully qualified URL to the current script, including the query.
859	*
860	* @return string a full url to the current script
861	*/
862	function absoluteMe()
863	{
864	$protocol = ('on' == getenv('HTTPS')) ? 'https://' : 'http://';
865	return $protocol . getenv('HTTP_HOST') . getenv('REQUEST_URI');
866	}
867
868	/**
869	* Compares the current url with the referring url.
870	*
871	* @param string $compary_query Include the query string in the comparison.
872	*
873	* @return bool true if the current script (or specified valid_referer)
874	* is the referrer. false otherwise.
875	*/
876	function refererIsMe($exclude_query=false)
877	{
878	if ($exclude_query) {
879	return (stripQuery(absoluteMe()) == stripQuery(getenv('HTTP_REFERER')));
880	} else {
881	return (absoluteMe() == getenv('HTTP_REFERER'));
882	}
883	}
884
885	?>

Note: See TracBrowser for help on using the repository browser.

Download in other formats: