aboutsummaryrefslogtreecommitdiffstats
path: root/phpBB/includes/core
diff options
context:
space:
mode:
Diffstat (limited to 'phpBB/includes/core')
-rw-r--r--phpBB/includes/core/bootstrap.php100
-rw-r--r--phpBB/includes/core/core.php440
-rw-r--r--phpBB/includes/core/request.php562
-rw-r--r--phpBB/includes/core/security.php300
-rw-r--r--phpBB/includes/core/system.php213
-rw-r--r--phpBB/includes/core/system_info.php376
-rw-r--r--phpBB/includes/core/url.php740
7 files changed, 0 insertions, 2731 deletions
diff --git a/phpBB/includes/core/bootstrap.php b/phpBB/includes/core/bootstrap.php
deleted file mode 100644
index f44b48c7db..0000000000
--- a/phpBB/includes/core/bootstrap.php
+++ /dev/null
@@ -1,100 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-* Within this file only the framework with all components but no phpBB-specific things will be loaded
-*/
-
-/**
-*/
-if (!defined('IN_PHPBB'))
-{
- exit;
-}
-
-$starttime = explode(' ', microtime());
-$starttime = $starttime[1] + $starttime[0];
-
-// Report all errors, except notices
-error_reporting(E_ALL | E_STRICT); // ^ E_NOTICE
-date_default_timezone_set('UTC');
-
-// Initialize some standard variables, constants and classes we need
-require_once PHPBB_ROOT_PATH . 'includes/core/core.' . PHP_EXT;
-require_once PHPBB_ROOT_PATH . 'plugins/bootstrap.' . PHP_EXT;
-
-// Define STRIP if it is not already defined
-if (!defined('STRIP'))
-{
- // If we are on PHP >= 6.0.0 we do not need some code
- if (version_compare(PHP_VERSION, '6.0.0-dev', '>='))
- {
- /**
- * @ignore
- */
- define('STRIP', false);
- }
- else
- {
- @set_magic_quotes_runtime(0);
-
- // We do not allow register globals set
- if (@ini_get('register_globals') == '1' || strtolower(@ini_get('register_globals')) == 'on' || !function_exists('ini_get'))
- {
- die('phpBB will not work with register globals turned on. Please turn register globals off.');
- }
-
- define('STRIP', (@get_magic_quotes_gpc()) ? true : false);
- }
-}
-
-// we check for the cron script and change the root path
-if (defined('IN_CRON'))
-{
- @define('PHPBB_ROOT_PATH', dirname(__FILE__) . DIRECTORY_SEPARATOR);
-}
-
-// Set some default configuration parameter if the config file does not exist
-if (!file_exists(PHPBB_ROOT_PATH . 'config.' . PHP_EXT))
-{
- // phpbb::$base_config['config_set'] = false
- // This allows common.php or an installation script to do specific actions if the configuration is missing
-}
-else
-{
- require PHPBB_ROOT_PATH . 'config.' . PHP_EXT;
-}
-
-// Register autoload function
-spl_autoload_register('__phpbb_autoload');
-
-// Set error handler before a real one is there
-set_error_handler(array('phpbb', 'error_handler'));
-
-// Add constants
-include_once PHPBB_ROOT_PATH . 'includes/constants.' . PHP_EXT;
-
-// Add global functions
-// @todo remove functions_content, trim down functions.php
-require_once PHPBB_ROOT_PATH . 'includes/functions.' . PHP_EXT;
-require_once PHPBB_ROOT_PATH . 'includes/functions_content.' . PHP_EXT;
-
-// Add UTF8 tools
-require_once PHPBB_ROOT_PATH . 'includes/utf/utf_tools.' . PHP_EXT;
-
-// Add pre-defined system core files
-require_once PHPBB_ROOT_PATH . 'includes/core/request.' . PHP_EXT;
-
-phpbb::register('security', false, 'core/security');
-phpbb::register('url', false, 'core/url');
-phpbb::register('system', false, 'core/system');
-phpbb::register('server-vars', 'phpbb_system_info', 'core/system_info');
-
-// Make plugins structure available
-phpbb::register('plugins');
-
-?> \ No newline at end of file
diff --git a/phpBB/includes/core/core.php b/phpBB/includes/core/core.php
deleted file mode 100644
index 2b2c4bea13..0000000000
--- a/phpBB/includes/core/core.php
+++ /dev/null
@@ -1,440 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-*/
-
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
- exit();
-}
-
-/**
-* phpBB abstract class
-*
-* @package core
-* @author acydburn
-*/
-abstract class phpbb
-{
- /**
- * The phpBB template object
- */
- public static $template = NULL;
-
- /**
- * The phpBB user object
- */
- public static $user = NULL;
-
- /**
- * The phpBB database object
- */
- public static $db = NULL;
-
- /**
- * The phpBB cache system object
- */
- public static $acm = NULL;
-
- /**
- * The phpBB permission object
- */
- public static $acl = NULL;
-
- /**
- * The phpBB plugins object
- */
- public static $plugins = NULL;
-
- /**
- * The phpBB core url object
- * Responsible for handling URL-related tasks as well as redirects, etc.
- */
- public static $url = NULL;
-
- /**
- * The phpBB core security object.
- * Responsible for handling security-related tasks, for example password handling, random number generation...
- */
- public static $security = NULL;
-
- /**
- * The phpBB core system object
- * Responsible for handling file/server tasks.
- */
- public static $system = NULL;
-
- /**
- * The phpBB API object
- */
- public static $api = NULL;
-
- /**
- * @var array The phpBB configuration array
- */
- public static $config = array();
-
- /**
- * @var array The base configuration array
- */
- public static $base_config = array(
- 'table_prefix' => 'phpbb_',
- 'admin_folder' => 'adm',
- 'acm_type' => 'file',
-
- 'config_set' => false,
- 'extensions_set' => false,
-
- 'memory_usage' => 0,
-
- 'debug' => false,
- 'debug_extra' => false,
- 'installed' => false,
- );
-
- /**
- * @var array Last notice occurred in message handler
- */
- public static $last_notice = array(
- 'file' => '',
- 'line' => 0,
- 'message' => '',
- 'errno' => E_NOTICE,
- );
-
- /**#@+
- * Permission constant
- */
- const ACL_NEVER = 0;
- const ACL_YES = 1;
- const ACL_NO = -1;
- /**#@-*/
-
- /**#@+
- * Global constant for {@link phpbb::$system->chmod()}
- */
- const CHMOD_ALL = 7;
- const CHMOD_READ = 4;
- const CHMOD_WRITE = 2;
- const CHMOD_EXECUTE = 1;
- /**#@-*/
-
- /**#@+
- * Constant defining plugin mode for objects
- */
- const METHOD_ADD = 1;
- const METHOD_OVERRIDE = 2;
- const METHOD_INJECT = 4;
- /**#@-*/
-
- /**#@+
- * Constant defining plugin mode for functions
- */
- const FUNCTION_OVERRIDE = 1;
- const FUNCTION_INJECT = 2;
- /**#@-*/
-
- /**#@+
- * Constant to define user level. See {@link phpbb::$user phpbb::$user}
- */
- const USER_NORMAL = 0;
- const USER_INACTIVE = 1;
- const USER_IGNORE = 2;
- const USER_FOUNDER = 3;
- /**#@-*/
-
- /**
- * @var array a static array holding custom objects
- */
- public static $instances = NULL;
-
- /**
- * We do not want this class instantiable
- */
- private function ___construct() { }
-
- /**
- * A failover error handler to handle errors before we assign our own error handler
- *
- * @access public
- */
- public static function error_handler($errno, $errstr, $errfile, $errline)
- {
- throw new ErrorException($errstr, 0, $errno, $errfile, $errline);
- }
-
- /**
- * Set base configuration - called from config.php file
- */
- public static function set_config($config)
- {
- phpbb::$base_config = array_merge(phpbb::$base_config, $config);
- phpbb::$base_config['config_set'] = true;
-
- if (phpbb::$base_config['debug_extra'] && function_exists('memory_get_usage'))
- {
- phpbb::$base_config['memory_usage'] = memory_get_usage();
- }
-
- // Load Extensions
- if (!empty(phpbb::$base_config['extensions']) && !phpbb::$base_config['extensions_set'])
- {
- $load_extensions = explode(',', phpbb::$base_config['extensions']);
-
- foreach ($load_extensions as $extension)
- {
- @dl(trim($extension));
- }
-
- phpbb::$base_config['extensions_set'] = true;
- }
- }
-
- /**
- * Get instance of static property
- *
- * @param string $variable The name of the instance to retrieve.
- *
- * @return mixed The property (object/array/...) registered with this name
- * @access public
- */
- public static function get_instance($variable)
- {
- if (!self::registered($variable))
- {
- return self::register($variable);
- }
-
- // Please do not try to change it to (expr) ? (true) : (false) - it will not work. ;)
- if (property_exists('phpbb', $variable))
- {
- return self::$$variable;
- }
- else
- {
- return self::$instances[$variable];
- }
- }
-
- /**
- * Check if the variable is already assigned
- *
- * @param string $variable The name of the instance to check
- *
- * @return bool True if the instance is registered, false if not.
- * @access public
- */
- public static function registered($variable)
- {
- if (property_exists('phpbb', $variable))
- {
- return (self::$$variable !== NULL) ? true : false;
- }
-
- return (isset(self::$instances[$variable]) && self::$instances[$variable] !== NULL) ? true : false;
- }
-
- /**
- * Simpler method to access assigned instances.
- * (Overloading is not possible here due to the object being static and our use of PHP 5.2.x+.)
- *
- * @param string $variable The instance name to retrieve
- *
- * @return mixed The instance
- * @access public
- */
- public static function get($variable)
- {
- // No error checking done here... returned right away
- return self::$instances[$variable];
- }
-
- /**
- * Register new class/object.
- * Any additional parameter will be forwarded to the class instantiation.
- *
- * @param string $variable The resulting instance name.
- * If a property with the given name exists, it will be assigned.
- * Else it will be put in the {@link $instances intances} array
- * @param string $class Define a custom class name.
- * This is useful if the class used does not abide to the rules (phpbb_{$class}).
- * @param string|array $includes Define additional files/includes required for this class to be correctly set up. Files are expected to be in /includes/.
- * @param mixed $arguments,... Any number of additional arguments passed to the constructor of the object to create
- *
- * @return mixed The instance of the created object
- * @access public
- */
- public static function register($variable, $class = false, $includes = false)
- {
- if (self::registered($variable))
- {
- return self::get_instance($variable);
- }
-
- $arguments = (func_num_args() > 3) ? array_slice(func_get_args(), 3) : array();
- $class = ($class === false) ? 'phpbb_' . $variable : $class;
-
- if ($includes !== false)
- {
- if (!is_array($includes))
- {
- $includes = array($includes);
- }
-
- foreach ($includes as $file)
- {
- require_once PHPBB_ROOT_PATH . 'includes/' . $file . '.' . PHP_EXT;
- }
- }
-
- $reflection = new ReflectionClass($class);
-
- if (!$reflection->isInstantiable())
- {
- throw new Exception('Assigned classes need to be instantiated.');
- }
-
- if (!property_exists('phpbb', $variable))
- {
- self::$instances[$variable] = (sizeof($arguments)) ? call_user_func_array(array($reflection, 'newInstance'), $arguments) : $reflection->newInstance();
- }
- else
- {
- self::$$variable = (sizeof($arguments)) ? call_user_func_array(array($reflection, 'newInstance'), $arguments) : $reflection->newInstance();
- }
-
- return self::get_instance($variable);
- }
-
- /**
- * Instead of registering we also can assign a variable. This is helpful if we have an application builder or use a factory.
- *
- * @param string $variable The resulting instance name.
- * If a property with the given name exists, it will be assigned.
- * Else it will be put in the {@link $instances intances} array
- * @param mixed $object The variable to assign to the instance
- *
- * @return mixed The instance
- * @access public
- */
- public static function assign($variable, $object)
- {
- if (self::registered($variable))
- {
- return self::get_instance($variable);
- }
-
- if (!property_exists('phpbb', $variable))
- {
- self::$instances[$variable] = $object;
- }
- else
- {
- self::$$variable = $object;
- }
-
- return self::get_instance($variable);
- }
-
- /**
- * Unset/unregister a specific object.
- *
- * @param string $variable The name of the instance to unset
- * @access public
- */
- public static function unregister($variable)
- {
- if (!self::registered($variable))
- {
- return;
- }
-
- if (!property_exists('phpbb', $variable))
- {
- unset(self::$instances[$variable]);
- }
- else
- {
- self::$$variable = NULL;
- }
- }
-
- /**
- * Function to return to a clean state, unregistering everything. This is helpful for unit tests if you want to return to a "clean state"
- *
- * @access public
- */
- public static function reset()
- {
- $class_vars = array_keys(get_class_vars('phpbb'));
- $class_vars = array_merge(array_keys(self::$instances), $class_vars);
-
- foreach ($class_vars as $variable)
- {
- self::unregister($variable);
- }
- }
-}
-
-/**
-* phpBB SPL Autoload Function. A phpbb_ prefix will be stripped from the class name.
-*
-* The files this function tries to include are:
-* includes/{$class_name}/bootstrap.php
-* includes/{$class_name}/index.php
-* Additionally, every _ within $class_name is replaced by / for the following directories:
-* includes/{$class_name}.php
-* includes/classes/{$class_name}.php
-*
-* @param string $class_name The class name. An existing phpbb_ prefix will be removed.
-*/
-function __phpbb_autoload($class_name)
-{
- if (strpos($class_name, 'phpbb_') === 0)
- {
- $class_name = substr($class_name, 6);
- }
-
- $class_name = basename($class_name);
-
- $filenames = array(
- 'includes/' . $class_name . '/bootstrap',
- 'includes/' . $class_name . '/index',
- 'includes/' . $class_name,
- 'includes/classes/' . $class_name,
- );
-
- if (strpos($class_name, '_') !== false)
- {
- $class_name = str_replace('_', '/', $class_name);
-
- $filenames = array_merge($filenames, array(
- 'includes/' . $class_name,
- 'includes/classes/' . $class_name,
- ));
- }
-
- foreach ($filenames as $filename)
- {
- if (file_exists(PHPBB_ROOT_PATH . $filename . '.' . PHP_EXT))
- {
- include PHPBB_ROOT_PATH . $filename . '.' . PHP_EXT;
- return;
- }
- }
-}
-
-/*
-class phpbb_exception extends Exception
-{
-}
-*/
-?> \ No newline at end of file
diff --git a/phpBB/includes/core/request.php b/phpBB/includes/core/request.php
deleted file mode 100644
index 7f3f158dc0..0000000000
--- a/phpBB/includes/core/request.php
+++ /dev/null
@@ -1,562 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-*/
-
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
- exit;
-}
-
-/**
-* Replacement for a superglobal (like $_GET or $_POST) which calls
-* trigger_error on any operation, overloads the [] operator using SPL.
-*
-* @package core
-* @author naderman
-*/
-class deactivated_super_global implements ArrayAccess, Countable, IteratorAggregate
-{
- /**
- * @var string Holds the error message
- */
- private $message;
-
- /**
- * Constructor generates an error message fitting the super global to be used within the other functions.
- *
- * @param string $name Name of the super global this is a replacement for - e.g. '_GET'
- */
- public function __construct($name)
- {
- $this->message = 'Illegal use of $' . $name . '. You must use the request class or request_var() to access input data. Found in %s on line %d. This error message was generated';
- }
-
- /**
- * Calls trigger_error with the file and line number the super global was used in
- *
- * @access private
- */
- private function error()
- {
- $file = '';
- $line = 0;
-
- $backtrace = debug_backtrace();
- if (isset($backtrace[1]))
- {
- $file = $backtrace[1]['file'];
- $line = $backtrace[1]['line'];
- }
- trigger_error(sprintf($this->message, $file, $line), E_USER_ERROR);
- }
-
- /**#@+
- * Part of the ArrayAccess implementation, will always result in a FATAL error
- *
- * @access public
- */
- public function offsetExists($offset)
- {
- $this->error();
- }
-
- public function offsetGet($offset)
- {
- $this->error();
- }
-
- public function offsetSet($offset, $value)
- {
- $this->error();
- }
-
- public function offsetUnset($offset)
- {
- $this->error();
- }
- /**#@-*/
-
- /**
- * Part of the Countable implementation, will always result in a FATAL error
- *
- * @access public
- */
- public function count()
- {
- $this->error();
- }
-
- /**
- * Part of the Traversable/IteratorAggregate implementation, will always result in a FATAL error
- *
- * @access public
- */
- public function getIterator()
- {
- $this->error();
- }
-}
-
-/**
-* All application input is accessed through this class.
-*
-* It provides a method to disable access to input data through super globals.
-* This should force MOD authors to read about data validation.
-*
-* @package core
-* @author naderman
-*/
-class phpbb_request
-{
- /**#@+
- * Constant defining the super global
- */
- const POST = 0;
- const GET = 1;
- const REQUEST = 2;
- const COOKIE = 3;
- /**#@-*/
-
- /**
- * @var
- */
- protected static $initialised = false;
-
- /**
- * @var
- */
- protected static $super_globals_disabled = false;
-
- /**
- * @var array The names of super global variables that this class should protect if super globals are disabled
- */
- protected static $super_globals = array(phpbb_request::POST => '_POST', phpbb_request::GET => '_GET', phpbb_request::REQUEST => '_REQUEST', phpbb_request::COOKIE => '_COOKIE');
-
- /**
- * @var array An associative array that has the value of super global constants as keys and holds their data as values.
- */
- protected static $input;
-
- /**
- * Initialises the request class, that means it stores all input data in {@link $input self::$input}
- *
- * @access public
- */
- public static function init()
- {
- if (!self::$initialised)
- {
- foreach (self::$super_globals as $const => $super_global)
- {
- if ($const == phpbb_request::REQUEST)
- {
- continue;
- }
-
- self::$input[$const] = isset($GLOBALS[$super_global]) ? $GLOBALS[$super_global] : array();
- }
-
- // @todo far away from ideal... just a quick hack to let request_var() work again. The problem is that $GLOBALS['_REQUEST'] no longer exist.
- self::$input[phpbb_request::REQUEST] = array_merge(self::$input[phpbb_request::POST], self::$input[phpbb_request::GET]);
-
- self::$initialised = true;
- }
- }
-
- /**
- * Resets the request class.
- * This will simply forget about all input data and read it again from the
- * super globals, if super globals were disabled, all data will be gone.
- *
- * @access public
- */
- public static function reset()
- {
- self::$input = array();
- self::$initialised = false;
- self::$super_globals_disabled = false;
- }
-
- /**
- * Getter for $super_globals_disabled
- *
- * @return bool Whether super globals are disabled or not.
- * @access public
- */
- public static function super_globals_disabled()
- {
- return self::$super_globals_disabled;
- }
-
- /**
- * Disables access of super globals specified in $super_globals.
- * This is achieved by overwriting the super globals with instances of {@link deactivated_super_global deactivated_super_global}
- *
- * @access public
- */
- public static function disable_super_globals()
- {
- if (!self::$initialised)
- {
- self::init();
- }
-
- foreach (self::$super_globals as $const => $super_global)
- {
- unset($GLOBALS[$super_global]);
- $GLOBALS[$super_global] = new deactivated_super_global($super_global);
- }
-
- self::$super_globals_disabled = true;
- }
-
- /**
- * Enables access of super globals specified in $super_globals if they were disabled by {@link disable_super_globals disable_super_globals}.
- * This is achieved by making the super globals point to the data stored within this class in {@link $input input}.
- *
- * @access public
- */
- public static function enable_super_globals()
- {
- if (!self::$initialised)
- {
- self::init();
- }
-
- if (self::$super_globals_disabled)
- {
- foreach (self::$super_globals as $const => $super_global)
- {
- $GLOBALS[$super_global] = self::$input[$const];
- }
-
- self::$super_globals_disabled = false;
- }
- }
-
- /**
- * Recursively applies addslashes to a variable.
- *
- * @param mixed &$var Variable passed by reference to which slashes will be added.
- * @access protected
- */
- protected static function addslashes_recursively(&$var)
- {
- if (is_string($var))
- {
- $var = addslashes($var);
- }
- else if (is_array($var))
- {
- $var_copy = $var;
- foreach ($var_copy as $key => $value)
- {
- if (is_string($key))
- {
- $key = addslashes($key);
- }
- self::addslashes_recursively($var[$key]);
- }
- }
- }
-
- /**
- * This function allows overwriting or setting a value in one of the super global arrays.
- *
- * Changes which are performed on the super globals directly will not have any effect on the results of
- * other methods this class provides. Using this function should be avoided if possible! It will
- * consume twice the the amount of memory of the value
- *
- * @param string $var_name The name of the variable that shall be overwritten
- * @param mixed $value The value which the variable shall contain.
- * If this is null the variable will be unset.
- * @param phpbb_request::POST|phpbb_request::GET|phpbb_request::REQUEST|phpbb_request::COOKIE $super_global Specifies which super global shall be changed
- *
- * @access public
- */
- public static function overwrite($var_name, $value, $super_global = phpbb_request::REQUEST)
- {
- if (!self::$initialised)
- {
- self::init();
- }
-
- if (!isset(self::$super_globals[$super_global]))
- {
- return;
- }
-
- if (STRIP)
- {
- self::addslashes_recursively($value);
- }
-
- // setting to null means unsetting
- if ($value === null)
- {
- unset(self::$input[$super_global][$var_name]);
- if (!self::super_globals_disabled())
- {
- unset($GLOBALS[self::$super_globals[$super_global]][$var_name]);
- }
- }
- else
- {
- self::$input[$super_global][$var_name] = $value;
- if (!self::super_globals_disabled())
- {
- $GLOBALS[self::$super_globals[$super_global]][$var_name] = $value;
- }
- }
-
- if (!self::super_globals_disabled())
- {
- unset($GLOBALS[self::$super_globals[$super_global]][$var_name]);
- $GLOBALS[self::$super_globals[$super_global]][$var_name] = $value;
- }
- }
-
- /**
- * Set variable $result. Used by {@link request_var() the request_var function}
- *
- * @param mixed &$result The variable to fill
- * @param mixed $var The contents to fill with
- * @param mixed $type The variable type. Will be used with {@link settype()}
- * @param bool $multibyte Indicates whether string values may contain UTF-8 characters.
- * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks.
- *
- * @access public
- */
- public static function set_var(&$result, $var, $type, $multibyte = false)
- {
- settype($var, $type);
- $result = $var;
-
- if ($type == 'string')
- {
- $result = trim(utf8_htmlspecialchars(str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result)));
-
- if (!empty($result))
- {
- // Make sure multibyte characters are wellformed
- if ($multibyte)
- {
- if (!preg_match('/^./u', $result))
- {
- $result = '';
- }
- }
- else
- {
- // no multibyte, allow only ASCII (0-127)
- $result = preg_replace('/[\x80-\xFF]/', '?', $result);
- }
- }
-
- $result = (STRIP) ? stripslashes($result) : $result;
- }
- }
-
- /**
- * Recursively sets a variable to a given type using {@link set_var() set_var}
- * This function is only used from within {@link phpbb_request::variable phpbb_request::variable}.
- *
- * @param string $var The value which shall be sanitised (passed by reference).
- * @param mixed $default Specifies the type $var shall have.
- * If it is an array and $var is not one, then an empty array is returned.
- * Otherwise var is cast to the same type, and if $default is an array all keys and values are cast recursively using this function too.
- * @param bool $multibyte Indicates whether string values may contain UTF-8 characters.
- * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks.
- *
- * @access protected
- */
- protected static function recursive_set_var(&$var, $default, $multibyte)
- {
- if (is_array($var) !== is_array($default))
- {
- $var = (is_array($default)) ? array() : $default;
- return;
- }
-
- if (!is_array($default))
- {
- $type = gettype($default);
- self::set_var($var, $var, $type, $multibyte);
- }
- else
- {
- // make sure there is at least one key/value pair to use get the
- // types from
- if (!sizeof($default))
- {
- $var = array();
- return;
- }
-
- list($default_key, $default_value) = each($default);
- $value_type = gettype($default_value);
- $key_type = gettype($default_key);
-
- $_var = $var;
- $var = array();
-
- foreach ($_var as $k => $v)
- {
- self::set_var($k, $k, $key_type, $multibyte);
-
- self::recursive_set_var($v, $default_value, $multibyte);
- self::set_var($var[$k], $v, $value_type, $multibyte);
- }
- }
- }
-
- /**
- * Central type safe input handling function.
- * All variables in GET or POST requests should be retrieved through this function to maximise security.
- *
- * @param string|array $var_name The form variable's name from which data shall be retrieved.
- * If the value is an array this may be an array of indizes which will give
- * direct access to a value at any depth. E.g. if the value of "var" is array(1 => "a")
- * then specifying array("var", 1) as the name will return "a".
- * @param mixed $default A default value that is returned if the variable was not set.
- * This function will always return a value of the same type as the default.
- * @param bool $multibyte If $default is a string this paramater has to be true if the variable may contain any UTF-8 characters
- * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks
- * @param phpbb_request::POST|phpbb_request::GET|phpbb_request::REQUEST|phpbb_request::COOKIE $super_global Specifies which super global should be used
- *
- * @return mixed The value of $_REQUEST[$var_name] run through {@link set_var set_var} to ensure that the type is the
- * the same as that of $default. If the variable is not set $default is returned.
- * @access public
- */
- public static function variable($var_name, $default, $multibyte = false, $super_global = phpbb_request::REQUEST)
- {
- $path = false;
-
- if (!self::$initialised)
- {
- self::init();
- }
-
- // deep direct access to multi dimensional arrays
- if (is_array($var_name))
- {
- $path = $var_name;
- // make sure at least the variable name is specified
- if (!sizeof($path))
- {
- return (is_array($default)) ? array() : $default;
- }
- // the variable name is the first element on the path
- $var_name = array_shift($path);
- }
-
- if (!isset(self::$input[$super_global][$var_name]))
- {
- return (is_array($default)) ? array() : $default;
- }
- $var = self::$input[$super_global][$var_name];
-
- // make sure cookie does not overwrite get/post
- if ($super_global != phpbb_request::COOKIE && isset(self::$input[phpbb_request::COOKIE][$var_name]))
- {
- if (!isset(self::$input[phpbb_request::GET][$var_name]) && !isset(self::$input[phpbb_request::POST][$var_name]))
- {
- return (is_array($default)) ? array() : $default;
- }
- $var = isset(self::$input[phpbb_request::POST][$var_name]) ? self::$input[phpbb_request::POST][$var_name] : self::$input[phpbb_request::GET][$var_name];
- }
-
- if ($path)
- {
- // walk through the array structure and find the element we are looking for
- foreach ($path as $key)
- {
- if (is_array($var) && isset($var[$key]))
- {
- $var = $var[$key];
- }
- else
- {
- return (is_array($default)) ? array() : $default;
- }
- }
- }
-
- self::recursive_set_var($var, $default, $multibyte);
-
- return $var;
- }
-
- /**
- * Checks whether a certain variable was sent via POST.
- * To make sure that a request was sent using POST you should call this function
- * on at least one variable.
- *
- * @param string $name The name of the form variable which should have a
- * _p suffix to indicate the check in the code that creates the form too.
- *
- * @return bool True if the variable was set in a POST request, false otherwise.
- * @access public
- */
- public static function is_set_post($name)
- {
- return self::is_set($name, phpbb_request::POST);
- }
-
- /**
- * Checks whether a certain variable is set in one of the super global
- * arrays.
- *
- * @param string $var Name of the variable
- * @param phpbb_request::POST|phpbb_request::GET|phpbb_request::REQUEST|phpbb_request::COOKIE $super_global
- * Specifies the super global which shall be checked
- *
- * @return bool True if the variable was sent as input
- * @access public
- */
- public static function is_set($var, $super_global = phpbb_request::REQUEST)
- {
- if (!self::$initialised)
- {
- self::init();
- }
-
- return isset(self::$input[$super_global][$var]);
- }
-
- /**
- * Returns all variable names for a given super global
- *
- * @param phpbb_request::POST|phpbb_request::GET|phpbb_request::REQUEST|phpbb_request::COOKIE $super_global
- * The super global from which names shall be taken
- *
- * @return array All variable names that are set for the super global.
- * Pay attention when using these, they are unsanitised!
- * @access public
- */
- public static function variable_names($super_global = phpbb_request::REQUEST)
- {
- if (!self::$initialised)
- {
- self::init();
- }
-
- if (!isset(self::$input[$super_global]))
- {
- return array();
- }
-
- return array_keys(self::$input[$super_global]);
- }
-}
-
-?> \ No newline at end of file
diff --git a/phpBB/includes/core/security.php b/phpBB/includes/core/security.php
deleted file mode 100644
index f5aca65e8d..0000000000
--- a/phpBB/includes/core/security.php
+++ /dev/null
@@ -1,300 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-*/
-
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
- exit();
-}
-/**
-* Class for generating random numbers, unique ids, unique keys, seeds, hashes...
-* @package core
-*/
-class phpbb_security extends phpbb_plugin_support
-{
- /**
- * @var array required phpBB objects
- */
- public $phpbb_required = array();
-
- /**
- * @var array Optional phpBB objects
- */
- public $phpbb_optional = array('config');
-
- /**
- * @var string Used hash type. The default type is $P$, phpBB uses a different one.
- */
- public $hash_type = '$H$';
-
- /**
- * @var bool Is true if random seed got updated.
- */
- private $dss_seeded = false;
-
- /**
- * Constructor
- * @access public
- */
- public function __construct() {}
-
- /**
- * Generates an alphanumeric random string of given length
- *
- * @param int $num_chars Number of characters to return
- * @return string Random string of $num_chars characters.
- * @access public
- */
- public function gen_rand_string($num_chars = 8)
- {
- $rand_str = $this->unique_id();
- $rand_str = str_replace('0', 'Z', strtoupper(base_convert($rand_str, 16, 35)));
-
- return substr($rand_str, 0, $num_chars);
- }
-
- /**
- * Return unique id
- *
- * @param string $extra Additional entropy
- * @return string Unique id
- * @access public
- */
- public function unique_id($extra = 'c')
- {
- if (!isset(phpbb::$config['rand_seed']))
- {
- $val = md5(md5($extra) . microtime());
- $val = md5(md5($extra) . $val . $extra);
- return substr($val, 4, 16);
- }
-
-
- $val = phpbb::$config['rand_seed'] . microtime();
- $val = md5($val);
- phpbb::$config['rand_seed'] = md5(phpbb::$config['rand_seed'] . $val . $extra);
-
- if (!$this->dss_seeded && phpbb::$config['rand_seed_last_update'] < time() - rand(1, 10))
- {
- set_config('rand_seed', phpbb::$config['rand_seed'], true);
- set_config('rand_seed_last_update', time(), true);
-
- $this->dss_seeded = true;
- }
-
- return substr($val, 4, 16);
- }
-
- /**
- * Hash passwords
- *
- * @version Version 0.1
- *
- * Portable PHP password hashing framework.
- *
- * Written by Solar Designer <solar at openwall.com> in 2004-2006 and placed in
- * the public domain.
- *
- * There's absolutely no warranty.
- *
- * The homepage URL for this framework is:
- *
- * http://www.openwall.com/phpass/
- *
- * Please be sure to update the Version line if you edit this file in any way.
- * It is suggested that you leave the main version number intact, but indicate
- * your project name (after the slash) and add your own revision information.
- *
- * Please do not change the "private" password hashing method implemented in
- * here, thereby making your hashes incompatible. However, if you must, please
- * change the hash type identifier (the "$P$") to something different.
- *
- * Obviously, since this code is in the public domain, the above are not
- * requirements (there can be none), but merely suggestions.
- *
- * @param string $password Password to hash
- * @return string Hashed password
- * @access public
- */
- public function hash_password($password)
- {
- $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
-
- $random_state = $this->unique_id();
- $random = '';
- $count = 6;
-
- if (($fh = @fopen('/dev/urandom', 'rb')))
- {
- $random = fread($fh, $count);
- fclose($fh);
- }
-
- if (strlen($random) < $count)
- {
- $random = '';
-
- for ($i = 0; $i < $count; $i += 16)
- {
- $random_state = md5($this->unique_id() . $random_state);
- $random .= pack('H*', md5($random_state));
- }
- $random = substr($random, 0, $count);
- }
-
- $hash = $this->_hash_crypt_private($password, $this->_hash_gensalt_private($random, $itoa64), $itoa64);
- $result = (strlen($hash) == 34) ? $hash : md5($password);
-
- return $result;
- }
-
- /**
- * Check for correct password
- *
- * If the hash length is != 34, then a md5($password) === $hash comparison is done. The correct hash length is 34.
- *
- * @param string $password The password in plain text
- * @param string $hash The stored password hash
- *
- * @return bool Returns true if the password is correct, false if not.
- * @access public
- */
- public function check_password($password, $hash)
- {
- $itoa64 = './0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
- if (strlen($hash) == 34)
- {
- $result = ($this->_hash_crypt_private($password, $hash, $itoa64) === $hash) ? true : false;
- }
- else
- {
- $result = (md5($password) === $hash) ? true : false;
- }
-
- return $result;
- }
-
- /**
- * Generate salt for hash generation
- * @access private
- */
- private function _hash_gensalt_private($input, &$itoa64, $iteration_count_log2 = 6)
- {
- if ($iteration_count_log2 < 4 || $iteration_count_log2 > 31)
- {
- $iteration_count_log2 = 8;
- }
-
- $output = $this->hash_type;
- $output .= $itoa64[min($iteration_count_log2 + 5, 30)];
- $output .= $this->_hash_encode64($input, 6, $itoa64);
-
- return $output;
- }
-
- /**
- * Encode hash
- * @access private
- */
- private function _hash_encode64($input, $count, &$itoa64)
- {
- $output = '';
- $i = 0;
-
- do
- {
- $value = ord($input[$i++]);
- $output .= $itoa64[$value & 0x3f];
-
- if ($i < $count)
- {
- $value |= ord($input[$i]) << 8;
- }
-
- $output .= $itoa64[($value >> 6) & 0x3f];
-
- if ($i++ >= $count)
- {
- break;
- }
-
- if ($i < $count)
- {
- $value |= ord($input[$i]) << 16;
- }
-
- $output .= $itoa64[($value >> 12) & 0x3f];
-
- if ($i++ >= $count)
- {
- break;
- }
-
- $output .= $itoa64[($value >> 18) & 0x3f];
- }
- while ($i < $count);
-
- return $output;
- }
-
- /**
- * The crypt function/replacement
- * @access private
- */
- private function _hash_crypt_private($password, $setting, &$itoa64)
- {
- $output = '*';
-
- // Check for correct hash
- if (substr($setting, 0, 3) != $this->hash_type)
- {
- return $output;
- }
-
- $count_log2 = strpos($itoa64, $setting[3]);
-
- if ($count_log2 < 7 || $count_log2 > 30)
- {
- return $output;
- }
-
- $count = 1 << $count_log2;
- $salt = substr($setting, 4, 8);
-
- if (strlen($salt) != 8)
- {
- return $output;
- }
-
- /**
- * We're kind of forced to use MD5 here since it's the only
- * cryptographic primitive available in all versions of PHP
- * currently in use. To implement our own low-level crypto
- * in PHP would result in much worse performance and
- * consequently in lower iteration counts and hashes that are
- * quicker to crack (by non-PHP code).
- */
- $hash = md5($salt . $password, true);
- do
- {
- $hash = md5($hash . $password, true);
- }
- while (--$count);
-
- $output = substr($setting, 0, 12);
- $output .= $this->_hash_encode64($hash, 16, $itoa64);
-
- return $output;
- }
-}
-
-?> \ No newline at end of file
diff --git a/phpBB/includes/core/system.php b/phpBB/includes/core/system.php
deleted file mode 100644
index 5bb42e9ed4..0000000000
--- a/phpBB/includes/core/system.php
+++ /dev/null
@@ -1,213 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-*/
-
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
- exit();
-}
-
-/**
-* System-specific methods. For example chmod(), unlink()...
-*
-* @package core
-*/
-class phpbb_system extends phpbb_plugin_support
-{
- /**
- * @var array required phpBB objects
- */
- public $phpbb_required = array();
-
- /**
- * @var array Optional phpBB objects
- */
- public $phpbb_optional = array();
-
- /**
- * @var array Holding some information for chmod()
- */
- private $chmod_info = array();
-
- /**
- * Method for chmodding directories and files for internal use.
- *
- * This function determines owner and group whom the file belongs to and user and group of PHP and then set safest possible file permissions.
- * The function determines owner and group from common.php file and sets the same to the provided file.
- * The function uses bit fields to build the permissions.
- * The function sets the appropiate execute bit on directories.
- *
- * Supported constants representing bit fields are:
- *
- * phpbb::CHMOD_ALL - all permissions (7)
- * phpbb::CHMOD_READ - read permission (4)
- * phpbb::CHMOD_WRITE - write permission (2)
- * phpbb::CHMOD_EXECUTE - execute permission (1)
- *
- * NOTE: The function uses POSIX extension and fileowner()/filegroup() functions. If any of them is disabled, this function tries to build proper permissions, by calling is_readable() and is_writable() functions.
- *
- * @param string $filename The file/directory to be chmodded
- * @param int $perms Permissions to set
- *
- * @return bool true on success, otherwise false
- * @author faw, phpBB Group
- * @access public
- */
- public function chmod($filename, $perms = phpbb::CHMOD_READ)
- {
- // Return if the file no longer exists.
- if (!file_exists($filename))
- {
- return false;
- }
-
- // Determine some common vars
- if (empty($this->chmod_info))
- {
- if (!function_exists('fileowner') || !function_exists('filegroup'))
- {
- // No need to further determine owner/group - it is unknown
- $this->chmod_info['process'] = false;
- }
- else
- {
- // Determine owner/group of common.php file and the filename we want to change here
- $common_php_owner = fileowner(PHPBB_ROOT_PATH . 'common.' . PHP_EXT);
- $common_php_group = filegroup(PHPBB_ROOT_PATH . 'common.' . PHP_EXT);
-
- // And the owner and the groups PHP is running under.
- $php_uid = (function_exists('posix_getuid')) ? @posix_getuid() : false;
- $php_gids = (function_exists('posix_getgroups')) ? @posix_getgroups() : false;
-
- if (!$php_uid || empty($php_gids) || !$common_php_owner || !$common_php_group)
- {
- $this->chmod_info['process'] = false;
- }
- else
- {
- $this->chmod_info = array(
- 'process' => true,
- 'common_owner' => $common_php_owner,
- 'common_group' => $common_php_group,
- 'php_uid' => $php_uid,
- 'php_gids' => $php_gids,
- );
- }
- }
- }
-
- if ($this->chmod_info['process'])
- {
- $file_uid = fileowner($filename);
- $file_gid = filegroup($filename);
-
- // Change owner
- if (@chown($filename, $this->chmod_info['common_owner']))
- {
- clearstatcache();
- $file_uid = fileowner($filename);
- }
-
- // Change group
- if (@chgrp($filename, $this->chmod_info['common_group']))
- {
- clearstatcache();
- $file_gid = filegroup($filename);
- }
-
- // If the file_uid/gid now match the one from common.php we can process further, else we are not able to change something
- if ($file_uid != $this->chmod_info['common_owner'] || $file_gid != $this->chmod_info['common_group'])
- {
- $this->chmod_info['process'] = false;
- }
- }
-
- // Still able to process?
- if ($this->chmod_info['process'])
- {
- if ($file_uid == $this->chmod_info['php_uid'])
- {
- $php = 'owner';
- }
- else if (in_array($file_gid, $this->chmod_info['php_gids']))
- {
- $php = 'group';
- }
- else
- {
- // Since we are setting the everyone bit anyway, no need to do expensive operations
- $this->chmod_info['process'] = false;
- }
- }
-
- // We are not able to determine or change something
- if (!$this->chmod_info['process'])
- {
- $php = 'other';
- }
-
- // Owner always has read/write permission
- $owner = phpbb::CHMOD_READ | phpbb::CHMOD_WRITE;
- if (is_dir($filename))
- {
- $owner |= phpbb::CHMOD_EXECUTE;
-
- // Only add execute bit to the permission if the dir needs to be readable
- if ($perms & phpbb::CHMOD_READ)
- {
- $perms |= phpbb::CHMOD_EXECUTE;
- }
- }
-
- switch ($php)
- {
- case 'owner':
- $result = @chmod($filename, ($owner << 6) + (0 << 3) + (0 << 0));
-
- clearstatcache();
-
- if (!is_null($php) || (is_readable($filename) && is_writable($filename)))
- {
- break;
- }
-
- case 'group':
- $result = @chmod($filename, ($owner << 6) + ($perms << 3) + (0 << 0));
-
- clearstatcache();
-
- if (!is_null($php) || ((!($perms & phpbb::CHMOD_READ) || is_readable($filename)) && (!($perms & phpbb::CHMOD_WRITE) || is_writable($filename))))
- {
- break;
- }
-
- case 'other':
- $result = @chmod($filename, ($owner << 6) + ($perms << 3) + ($perms << 0));
-
- clearstatcache();
-
- if (!is_null($php) || ((!($perms & phpbb::CHMOD_READ) || is_readable($filename)) && (!($perms & phpbb::CHMOD_WRITE) || is_writable($filename))))
- {
- break;
- }
-
- default:
- return false;
- break;
- }
-
- return $result;
- }
-
-}
-
-?> \ No newline at end of file
diff --git a/phpBB/includes/core/system_info.php b/phpBB/includes/core/system_info.php
deleted file mode 100644
index 56a5d3bcd0..0000000000
--- a/phpBB/includes/core/system_info.php
+++ /dev/null
@@ -1,376 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-*/
-
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
- exit();
-}
-
-/**
-* Get system/server information variables.
-*
-* @package core
-*/
-class phpbb_system_info extends phpbb_plugin_support implements ArrayAccess
-{
- /**
- * @var array required phpBB objects
- */
- public $phpbb_required = array('config', 'url');
-
- /**
- * @var array Optional phpBB objects
- */
- public $phpbb_optional = array();
-
- /**
- * @var array Array for storing/accessing information
- */
- private $data = array();
-
- /**#@+
- * Part of the ArrayAccess implementation.
- * @access public
- */
- public function offsetSet($offset, $value)
- {
- $this->data[$offset] = $value;
- }
-
- public function offsetExists($offset)
- {
- return isset($this->data[$offset]);
- }
-
- public function offsetUnset($offset)
- {
- unset($this->data[$offset]);
- }
- /**#@-*/
-
- /**
- * Get system information - Part of the ArrayAccess implementation.
- *
- * System information ought to be received from {@link $data phpbb::$user->system[key]}.
- * The key used is mapped to a method with get_ as prefix.
- * For example getting phpbb::$user->system['host'] results in calling the method get_host().
- *
- * @param string $offset The key to get.
- * @return mixed The result
- * @access public
- */
- public function offsetGet($offset)
- {
- if (isset($this->data[$offset]))
- {
- return $this->data[$offset];
- }
-
- $identifier = 'get_' . strtolower($offset);
-
- // Not static, because we are not able to use late static bindings
- $this->data[$offset] = $this->$identifier();
- return $this->data[$offset];
- }
-
- /**
- * Get valid hostname/port. HTTP_HOST is used, SERVER_NAME if HTTP_HOST not present.
- *
- * @return string Host (lowercase, not specialchared)
- * @access protected
- */
- protected function get_host()
- {
- // Get hostname
- $host = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME'));
-
- // Should be a string and lowered
- $host = (string) strtolower($host);
-
- // If host is equal the cookie domain or the server name (if config is set), then we assume it is valid
- if ((isset(phpbb::$config['cookie_domain']) && $host === phpbb::$config['cookie_domain']) || (isset(phpbb::$config['server_name']) && $host === phpbb::$config['server_name']))
- {
- return $host;
- }
-
- // Is the host actually a IP? If so, we use the IP... (IPv4)
- if (long2ip(ip2long($host)) === $host)
- {
- return $host;
- }
-
- // Now return the hostname (this also removes any port definition). The http:// is prepended to construct a valid URL, hosts never have a scheme assigned
- $host = @parse_url('http://' . $host, PHP_URL_HOST);
-
- // Remove any portions not removed by parse_url (#)
- $host = str_replace('#', '', $host);
-
- // If, by any means, the host is now empty, we will use a "best approach" way to guess one
- if (empty($host))
- {
- if (!empty(phpbb::$config['server_name']))
- {
- $host = phpbb::$config['server_name'];
- }
- else if (!empty(phpbb::$config['cookie_domain']))
- {
- $host = (strpos(phpbb::$config['cookie_domain'], '.') === 0) ? substr(phpbb::$config['cookie_domain'], 1) : phpbb::$config['cookie_domain'];
- }
- else
- {
- // Set to OS hostname or localhost
- $host = (function_exists('php_uname')) ? strtolower(php_uname('n')) : 'localhost';
- }
- }
-
- // It may be still no valid host, but for sure only a hostname (we may further expand on the cookie domain... if set)
- return $host;
- }
-
- /**
- * Extract current session page, relative from current root path (PHPBB_ROOT_PATH)
- *
- * The array returned consist of the following key/value pairs:
- * page_name: The current basename'd page name, for example: index.php (urlencoded, htmlspecialchared)
- * page_dir: The current directory within the phpBB root, for example: adm
- * query_string: The current query string, for example: i=10&b=2 (the parameter 'sid' is never included)
- * script_path: The script path from the webroot to the current directory, for example: /phpBB3/adm/
- * The script path is always prefixed with / and ends in /. Specialchared, whitespace replaced with %20.
- * root_script_path: The script path from the webroot to the phpBB root, for example: /phpBB3/
- * The root script path is always prefixed with / and ends in /. Specialchared, whitespace replaced with %20.
- * page: Current page from phpBB root, for example: adm/index.php?i=10&b=2
- * forum: Current forum id (determined by {@link request_var() request_var('f', 0)})
- *
- * @return array Array containing page information.
- * @plugin-support return
- * @access protected
- */
- protected function get_page()
- {
- $page_array = array();
-
- // First of all, get the request uri...
- $script_name = (!empty($_SERVER['PHP_SELF'])) ? $_SERVER['PHP_SELF'] : getenv('PHP_SELF');
- $args = (!empty($_SERVER['QUERY_STRING'])) ? explode('&', $_SERVER['QUERY_STRING']) : explode('&', getenv('QUERY_STRING'));
-
- // If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
- if (!$script_name)
- {
- $script_name = (!empty($_SERVER['REQUEST_URI'])) ? $_SERVER['REQUEST_URI'] : getenv('REQUEST_URI');
- $script_name = (($pos = strpos($script_name, '?')) !== false) ? substr($script_name, 0, $pos) : $script_name;
- $page_array['failover'] = 1;
- }
-
- // Replace backslashes and doubled slashes (could happen on some proxy setups)
- $script_name = str_replace(array('\\', '//'), '/', $script_name);
-
- // Now, remove the sid and let us get a clean query string...
- $use_args = array();
-
- // Since some browser do not encode correctly we need to do this with some "special" characters...
- // " -> %22, ' => %27, < -> %3C, > -> %3E
- $find = array('"', "'", '<', '>');
- $replace = array('%22', '%27', '%3C', '%3E');
-
- foreach ($args as $argument)
- {
- if (strpos($argument, 'sid=') === 0)
- {
- continue;
- }
-
- $use_args[] = str_replace($find, $replace, $argument);
- }
- unset($args);
-
- // The following examples given are for an request uri of {path to the phpbb directory}/adm/index.php?i=10&b=2
-
- // The current query string
- $query_string = trim(implode('&', $use_args));
-
- // basenamed page name (for example: index.php)
- $page_name = basename($script_name);
- $page_name = urlencode(htmlspecialchars($page_name));
-
- // current directory within the phpBB root (for example: adm)
- $root_dirs = explode('/', str_replace('\\', '/', phpbb::$url->realpath(PHPBB_ROOT_PATH)));
- $page_dirs = explode('/', str_replace('\\', '/', phpbb::$url->realpath('./')));
- $intersection = array_intersect_assoc($root_dirs, $page_dirs);
-
- $root_dirs = array_diff_assoc($root_dirs, $intersection);
- $page_dirs = array_diff_assoc($page_dirs, $intersection);
-
- $page_dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);
-
- if ($page_dir && substr($page_dir, -1, 1) == '/')
- {
- $page_dir = substr($page_dir, 0, -1);
- }
-
- // Current page from phpBB root (for example: adm/index.php?i=10&b=2)
- $page = (($page_dir) ? $page_dir . '/' : '') . $page_name . (($query_string) ? "?$query_string" : '');
-
- // The script path from the webroot to the current directory (for example: /phpBB3/adm/) : always prefixed with / and ends in /
- $script_path = trim(str_replace('\\', '/', dirname($script_name)));
-
- // The script path from the webroot to the phpBB root (for example: /phpBB3/)
- $script_dirs = explode('/', $script_path);
- array_splice($script_dirs, -sizeof($page_dirs));
- $root_script_path = implode('/', $script_dirs) . (sizeof($root_dirs) ? '/' . implode('/', $root_dirs) : '');
-
- // We are on the base level (phpBB root == webroot), lets adjust the variables a bit...
- if (!$root_script_path)
- {
- $root_script_path = ($page_dir) ? str_replace($page_dir, '', $script_path) : $script_path;
- }
-
- $script_path .= (substr($script_path, -1, 1) == '/') ? '' : '/';
- $root_script_path .= (substr($root_script_path, -1, 1) == '/') ? '' : '/';
-
- $page_array += array(
- 'page_name' => $page_name,
- 'page_dir' => $page_dir,
-
- 'query_string' => $query_string,
- 'script_path' => str_replace(' ', '%20', htmlspecialchars($script_path)),
- 'root_script_path' => str_replace(' ', '%20', htmlspecialchars($root_script_path)),
-
- 'page' => $page,
- 'forum' => request_var('f', 0),
- );
-
- return ($this->method_inject(__FUNCTION__, 'return')) ? $this->call_inject(__FUNCTION__, array('return', $page_array)) : $page_array;
- }
-
- /**
- * Get user agent string.
- *
- * @return string User agent, determined from $_SERVER['HTTP_USER_AGENT']. Specialchared.
- * @access protected
- */
- protected function get_browser()
- {
- return (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : '';
- }
-
- /**
- * Get current referer
- *
- * @return string Referer, determined from $_SERVER['HTTP_REFERER']. Specialchared.
- * @access protected
- */
- protected function get_referer()
- {
- return (!empty($_SERVER['HTTP_REFERER'])) ? htmlspecialchars((string) $_SERVER['HTTP_REFERER']) : '';
- }
-
- /**
- * Get server port
- *
- * @return int Sertver port, determined from $_SERVER/$_ENV['SERVER_PORT'].
- * @access protected
- */
- protected function get_port()
- {
- return (!empty($_SERVER['SERVER_PORT'])) ? (int) $_SERVER['SERVER_PORT'] : (int) getenv('SERVER_PORT');
- }
-
- /**
- * Get forwarded-for string.
- * If the forwarded for check is enabled in phpBB the ip's are checked for valid data and invalid data being removed.
- *
- * @return string Forwarded-for string, determined from $_SERVER['HTTP_X_FORWARDED_FOR'].
- * @access protected
- */
- protected function get_forwarded_for()
- {
- $forwarded_for = (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) ? (string) $_SERVER['HTTP_X_FORWARDED_FOR'] : '';
-
- // if the forwarded for header shall be checked we have to validate its contents
- if (phpbb::$config['forwarded_for_check'])
- {
- $forwarded_for = preg_replace('#, +#', ', ', $forwarded_for);
-
- // split the list of IPs
- $ips = explode(', ', $forwarded_for);
- foreach ($ips as $ip)
- {
- // check IPv4 first, the IPv6 is hopefully only going to be used very seldomly
- if (!empty($ip) && !preg_match(get_preg_expression('ipv4'), $ip) && !preg_match(get_preg_expression('ipv6'), $ip))
- {
- // contains invalid data, don't use the forwarded for header
- return '';
- }
- }
- }
- else
- {
- return '';
- }
- }
-
- /**
- * Get remote ip
- *
- * @return string Remote IP, determined from $_SERVER['REMOTE_ADDR']. Specialchared.
- * @access protected
- */
- protected function get_ip()
- {
- return (!empty($_SERVER['REMOTE_ADDR'])) ? htmlspecialchars($_SERVER['REMOTE_ADDR']) : '';
- }
-
- /**
- * Get server load.
- *
- * Server load is retrieved if load limitation is enabled in phpBB and server supports {@link sys_getloadavg() sys_getloadavg}
- * or file /proc/loadavg exists on the server.
- *
- * @return double Server load.
- * @access protected
- */
- protected function get_load()
- {
- $load = false;
-
- // Load limit check (if applicable)
- if (phpbb::$config['limit_load'] || phpbb::$config['limit_search_load'])
- {
- if ((function_exists('sys_getloadavg') && $load = sys_getloadavg()) || ($load = explode(' ', @file_get_contents('/proc/loadavg'))))
- {
- $load = array_slice($load, 0, 1);
- $load = floatval($load[0]);
- }
- else
- {
- set_config('limit_load', '0');
- set_config('limit_search_load', '0');
- }
- }
-
- return $load;
- }
-
- /**
- * Get current request method.
- *
- * @return string Request method, determined from $_SERVER['REQUEST_METHOD']. Specialchared, lowercase.
- * @access protected
- */
- protected function get_request_method()
- {
- return (isset($_SERVER['REQUEST_METHOD'])) ? strtolower(htmlspecialchars((string) $_SERVER['REQUEST_METHOD'])) : '';
- }
-}
-
-?> \ No newline at end of file
diff --git a/phpBB/includes/core/url.php b/phpBB/includes/core/url.php
deleted file mode 100644
index c182998b87..0000000000
--- a/phpBB/includes/core/url.php
+++ /dev/null
@@ -1,740 +0,0 @@
-<?php
-/**
-*
-* @package core
-* @version $Id$
-* @copyright (c) 2008 phpBB Group
-* @license http://opensource.org/licenses/gpl-license.php GNU Public License
-*
-*/
-
-/**
-* @ignore
-*/
-if (!defined('IN_PHPBB'))
-{
- exit();
-}
-
-/**
-* Class responsible for URL handling, URL building, redirects, meta refreshs and session id handling.
-* Basically everything url/sid-related.
-*
-* @package core
-*/
-class phpbb_url extends phpbb_plugin_support
-{
- /**
- * @var array required phpBB objects
- */
- public $phpbb_required = array('user', 'config');
-
- /**
- * @var array Optional phpBB objects
- */
- public $phpbb_optional = array('template');
-
- public function __construct() {}
-
- /**
- * Checks if a path ($path) is absolute or relative
- *
- * @param string $path Path to check absoluteness of
- * @return bool True if path is absolute
- * @access public
- */
- public function is_absolute($path)
- {
- return ($path[0] == '/' || (DIRECTORY_SEPARATOR == '\\' && preg_match('#^[a-z]:/#i', $path))) ? true : false;
- }
-
- /**
- * Mimic PHP realpath implementation
- *
- * @author Chris Smith <chris@project-minerva.org>
- * @copyright 2006 Project Minerva Team
- * @param string $path The path which we should attempt to resolve.
- * @return mixed realpath
- * @access private
- */
- private function own_realpath($path)
- {
- // Switch to use UNIX slashes
- $path = str_replace(DIRECTORY_SEPARATOR, '/', $path);
- $path_prefix = '';
-
- // Determine what sort of path we have
- if ($this->is_absolute($path))
- {
- $absolute = true;
-
- if ($path[0] == '/')
- {
- // Absolute path, *NIX style
- $path_prefix = '';
- }
- else
- {
- // Absolute path, Windows style
- // Remove the drive letter and colon
- $path_prefix = $path[0] . ':';
- $path = substr($path, 2);
- }
- }
- else
- {
- // Relative Path
- // Prepend the current working directory
- if (function_exists('getcwd'))
- {
- // This is the best method, hopefully it is enabled!
- $path = str_replace(DIRECTORY_SEPARATOR, '/', getcwd()) . '/' . $path;
- $absolute = true;
- if (preg_match('#^[a-z]:#i', $path))
- {
- $path_prefix = $path[0] . ':';
- $path = substr($path, 2);
- }
- else
- {
- $path_prefix = '';
- }
- }
- else if (!empty($_SERVER['SCRIPT_FILENAME']))
- {
- // Warning: If chdir() has been used this will lie!
- // Warning: This has some problems sometime (CLI can create them easily)
- $path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($_SERVER['SCRIPT_FILENAME'])) . '/' . $path;
- $absolute = true;
- $path_prefix = '';
- }
- else
- {
- // We have no way of getting the absolute path, just run on using relative ones.
- $absolute = false;
- $path_prefix = '.';
- }
- }
-
- // Remove any repeated slashes
- $path = preg_replace('#/{2,}#', '/', $path);
-
- // Remove the slashes from the start and end of the path
- $path = trim($path, '/');
-
- // Break the string into little bits for us to nibble on
- $bits = explode('/', $path);
-
- // Remove any . in the path, renumber array for the loop below
- $bits = array_values(array_diff($bits, array('.')));
-
- // Lets get looping, run over and resolve any .. (up directory)
- for ($i = 0, $max = sizeof($bits); $i < $max; $i++)
- {
- // @todo Optimise
- if ($bits[$i] == '..' )
- {
- if (isset($bits[$i - 1]))
- {
- if ($bits[$i - 1] != '..')
- {
- // We found a .. and we are able to traverse upwards, lets do it!
- unset($bits[$i]);
- unset($bits[$i - 1]);
- $i -= 2;
- $max -= 2;
- $bits = array_values($bits);
- }
- }
- else if ($absolute) // ie. !isset($bits[$i - 1]) && $absolute
- {
- // We have an absolute path trying to descend above the root of the filesystem
- // ... Error!
- return false;
- }
- }
- }
-
- // Prepend the path prefix
- array_unshift($bits, $path_prefix);
-
- $resolved = '';
-
- $max = sizeof($bits) - 1;
-
- // Check if we are able to resolve symlinks, Windows cannot.
- $symlink_resolve = (function_exists('readlink')) ? true : false;
-
- foreach ($bits as $i => $bit)
- {
- if (@is_dir("$resolved/$bit") || ($i == $max && @is_file("$resolved/$bit")))
- {
- // Path Exists
- if ($symlink_resolve && is_link("$resolved/$bit") && ($link = readlink("$resolved/$bit")))
- {
- // Resolved a symlink.
- $resolved = $link . (($i == $max) ? '' : '/');
- continue;
- }
- }
- else
- {
- // Something doesn't exist here!
- // This is correct realpath() behaviour but sadly open_basedir and safe_mode make this problematic
- // return false;
- }
- $resolved .= $bit . (($i == $max) ? '' : '/');
- }
-
- // @todo If the file exists fine and open_basedir only has one path we should be able to prepend it
- // because we must be inside that basedir, the question is where...
- // @internal The slash in is_dir() gets around an open_basedir restriction
- if (!@file_exists($resolved) || (!is_dir($resolved . '/') && !is_file($resolved)))
- {
- return false;
- }
-
- // Put the slashes back to the native operating systems slashes
- $resolved = str_replace('/', DIRECTORY_SEPARATOR, $resolved);
-
- // Check for DIRECTORY_SEPARATOR at the end (and remove it!)
- if (substr($resolved, -1) == DIRECTORY_SEPARATOR)
- {
- return substr($resolved, 0, -1);
- }
-
- // We got here, in the end!
- return $resolved;
- }
-
- /**
- * A wrapper for realpath
- *
- * @param string $path The path which we should attempt to resolve.
- * @staticvar string $_phpbb_realpath_exist This is set to false if the PHP function realpath() is not accessible or returns incorrect results
- *
- * @return string Real path
- * @access public
- */
- public function realpath($path)
- {
- static $_phpbb_realpath_exist;
-
- if (!isset($_phpbb_realpath_exist))
- {
- $_phpbb_realpath_exist = (!function_exists('realpath')) ? false : true;
- }
-
- if (!$_phpbb_realpath_exist)
- {
- return $this->own_realpath($path);
- }
-
- $realpath = realpath($path);
-
- // Strangely there are provider not disabling realpath but returning strange values. :o
- // We at least try to cope with them.
- if ($realpath === $path || $realpath === false)
- {
- $_phpbb_realpath_exist = false;
- return $this->own_realpath($path);
- }
-
- // Check for DIRECTORY_SEPARATOR at the end (and remove it!)
- if (substr($realpath, -1) == DIRECTORY_SEPARATOR)
- {
- $realpath = substr($realpath, 0, -1);
- }
-
- return $realpath;
- }
-
- /**
- * URL wrapper
- * All urls are run through this... either after {@link append_sid() append_sid} or directly
- *
- * @param string $url URL to process
- * @return string URL
- * @access public
- */
- public function get($url)
- {
- return $url;
- }
-
- /**
- * Append session id to url.
- *
- * Examples:
- * <code>
- * append_sid(PHPBB_ROOT_PATH . 'viewtopic.' . PHP_EXT . '?t=1&amp;f=2'); // VALID
- * append_sid(PHPBB_ROOT_PATH . 'viewtopic.' . PHP_EXT, 't=1&amp;f=2'); // VALID
- * append_sid('viewtopic', 't=1&amp;f=2'); // short notation of the above example - VALID
- * append_sid('viewtopic', 't=1&f=2', false); // Instead of &amp; use &
- * append_sid('viewtopic', array('t' => 1, 'f' => 2)); // Instead of parameter in string notation, use an array
- * </code>
- *
- * @param string $url The url the session id needs to be appended to (without parameter)
- * @param string|array $params String or array of additional url parameter.
- * @param bool $is_amp Is url using &amp; (true) or & (false)
- * @param string $session_id Possibility to use a custom session id instead of the global one. This also forces the use of a session id.
- *
- * @plugin-support default, return
- * @return string URL
- * @access public
- */
- public function append_sid($url, $params = false, $is_amp = true, $session_id = false)
- {
- static $parsed_urls = array();
-
- // The following code is used to make sure such calls like append_sid('viewtopic') (ommitting phpbb_root_path and php_ext) work as intended
- if (isset($parsed_urls[$url]))
- {
- // Set an url like 'viewtopic' to PHPBB_ROOT_PATH . 'viewtopic.' . PHP_EXT
- $url = $parsed_urls[$url];
- }
- else
- {
- // If we detect an url without root path and extension, and also not a relative or absolute path, we add it and put it to the parsed urls
- if (strpos($url, '.' . PHP_EXT) === false && $url[0] != '.' && $url[0] != '/')
- {
- $parsed_urls[$url] = $url = PHPBB_ROOT_PATH . $url . '.' . PHP_EXT;
- }
- }
-
- if (empty($params))
- {
- $params = false;
- }
-
- $params_is_array = is_array($params);
-
- // Get anchor
- $anchor = '';
- if (strpos($url, '#') !== false)
- {
- list($url, $anchor) = explode('#', $url, 2);
- $anchor = '#' . $anchor;
- }
- else if (!$params_is_array && strpos($params, '#') !== false)
- {
- list($params, $anchor) = explode('#', $params, 2);
- $anchor = '#' . $anchor;
- }
-
- // Handle really simple cases quickly
- if ($session_id === false && !phpbb::$user->need_sid && empty(phpbb::$user->extra_url) && !$params_is_array && !$anchor)
- {
- if ($params === false)
- {
- return $this->get($url);
- }
-
- $url_delim = (strpos($url, '?') === false) ? '?' : (($is_amp) ? '&amp;' : '&');
- return $this->get($url . ($params !== false ? $url_delim . $params : ''));
- }
-
- // Assign sid if session id is not specified
- if (phpbb::$user->need_sid && $session_id === false)
- {
- $session_id = phpbb::$user->session_id;
- }
-
- $amp_delim = ($is_amp) ? '&amp;' : '&';
- $url_delim = (strpos($url, '?') === false) ? '?' : $amp_delim;
-
- // Appending custom url parameter?
- $append_url = (!empty(phpbb::$user->extra_url)) ? implode($amp_delim, phpbb::$user->extra_url) : '';
-
- if ($this->method_inject(__FUNCTION__)) $this->call_inject(__FUNCTION__, array('default', &$url, &$params, &$session_id, &$append_url, &$anchor, &$amp_delim, &$url_delim));
-
- if ($this->method_inject(__FUNCTION__, 'return'))
- {
- $url = $this->call_inject(__FUNCTION__, array('return', $url, $params, $session_id, $append_url, $anchor, $amp_delim, $url_delim));
- return $this->get($url);
- }
-
- // Use the short variant if possible ;)
- if ($params === false)
- {
- // Append session id
- if (!$session_id)
- {
- return $this->get($url . (($append_url) ? $url_delim . $append_url : '') . $anchor);
- }
- else
- {
- return $this->get($url . (($append_url) ? $url_delim . $append_url . $amp_delim : $url_delim) . 'sid=' . $session_id . $anchor);
- }
- }
-
- // Build string if parameters are specified as array
- if ($params_is_array)
- {
- $output = array();
-
- foreach ($params as $key => $item)
- {
- if ($item === NULL)
- {
- continue;
- }
-
- if ($key == '#')
- {
- $anchor = '#' . $item;
- continue;
- }
-
- $output[] = $key . '=' . $item;
- }
-
- $params = implode($amp_delim, $output);
- }
-
- // Append session id and parameter
- return $this->get($url . (($append_url) ? $url_delim . $append_url : '') . (($params) ? (($append_url) ? $amp_delim : $url_delim) . $params : '') . ((!$session_id) ? '' : $amp_delim . 'sid=' . $session_id) . $anchor);
- }
-
- /**
- * Generate board url (example: http://www.example.com/phpBB)
- *
- * @param bool $without_script_path If set to true the script path gets not appended (example: http://www.example.com instead of http://www.example.com/phpBB)
- * @return string Board URL
- * @access public
- */
- public function generate_board_url($without_script_path = false)
- {
- $server_name = phpbb::$user->system['host'];
- $server_port = phpbb::$user->system['port'];
-
- // Forcing server vars is the only way to specify/override the protocol
- if (phpbb::$config['force_server_vars'] || !$server_name)
- {
- $server_protocol = (phpbb::$config['server_protocol']) ? phpbb::$config['server_protocol'] : ((phpbb::$config['cookie_secure']) ? 'https://' : 'http://');
- $server_name = phpbb::$config['server_name'];
- $server_port = (int) phpbb::$config['server_port'];
- $script_path = phpbb::$config['script_path'];
-
- $url = $server_protocol . $server_name;
- $cookie_secure = phpbb::$config['cookie_secure'];
- }
- else
- {
- // Do not rely on cookie_secure, users seem to think that it means a secured cookie instead of an encrypted connection
- $cookie_secure = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 1 : 0;
- $url = (($cookie_secure) ? 'https://' : 'http://') . $server_name;
-
- $script_path = phpbb::$user->page['root_script_path'];
- }
-
- if ($server_port && (($cookie_secure && $server_port <> 443) || (!$cookie_secure && $server_port <> 80)))
- {
- // HTTP HOST can carry a port number (we fetch $user->system['host'], but for old versions this may be true)
- if (strpos($server_name, ':') === false)
- {
- $url .= ':' . $server_port;
- }
- }
-
- if (!$without_script_path)
- {
- $url .= $script_path;
- }
-
- // Strip / from the end
- if (substr($url, -1, 1) == '/')
- {
- $url = substr($url, 0, -1);
- }
-
- return $url;
- }
-
- /**
- * Redirects the user to another page then exits the script nicely
- * This function is intended for urls within the board. It's not meant to redirect to cross-domains.
- *
- * @param string $url The url to redirect to
- * @param bool $return If true, do not redirect but return the sanitized URL.
- * @param bool $disable_cd_check If true, redirect() will support redirects to an external domain.
- * If false, the redirect points to the boards url if it does not match the current domain.
- *
- * @return mixed Sanitized URL if $return is true
- * @access public
- */
- public function redirect($url, $return = false, $disable_cd_check = false)
- {
- if (empty(phpbb::$user->lang))
- {
- phpbb::$user->add_lang('common');
- }
-
- if (!$return)
- {
- garbage_collection();
- }
-
- // Make sure no &amp;'s are in, this will break the redirect
- $url = str_replace('&amp;', '&', $url);
-
- // Determine which type of redirect we need to handle...
- $url_parts = parse_url($url);
-
- if ($url_parts === false)
- {
- // Malformed url, redirect to current page...
- $url = $this->generate_board_url() . '/' . phpbb::$user->page['page'];
- }
- else if (!empty($url_parts['scheme']) && !empty($url_parts['host']))
- {
- // Attention: only able to redirect within the same domain if $disable_cd_check is false (yourdomain.com -> www.yourdomain.com will not work)
- if (!$disable_cd_check && $url_parts['host'] !== phpbb::$user->system['host'])
- {
- $url = $this->generate_board_url();
- }
- }
- else if ($url[0] == '/')
- {
- // Absolute uri, prepend direct url...
- $url = $this->generate_board_url(true) . $url;
- }
- else
- {
- // Relative uri
- $pathinfo = pathinfo($url);
-
- // Is the uri pointing to the current directory?
- if ($pathinfo['dirname'] == '.')
- {
- $url = str_replace('./', '', $url);
-
- // Strip / from the beginning
- if ($url && substr($url, 0, 1) == '/')
- {
- $url = substr($url, 1);
- }
-
- if (phpbb::$user->page['page_dir'])
- {
- $url = $this->generate_board_url() . '/' . phpbb::$user->page['page_dir'] . '/' . $url;
- }
- else
- {
- $url = $this->generate_board_url() . '/' . $url;
- }
- }
- else
- {
- // Used ./ before, but PHPBB_ROOT_PATH is working better with urls within another root path
- $root_dirs = explode('/', str_replace('\\', '/', $this->realpath(PHPBB_ROOT_PATH)));
- $page_dirs = explode('/', str_replace('\\', '/', $this->realpath($pathinfo['dirname'])));
- $intersection = array_intersect_assoc($root_dirs, $page_dirs);
-
- $root_dirs = array_diff_assoc($root_dirs, $intersection);
- $page_dirs = array_diff_assoc($page_dirs, $intersection);
-
- $dir = str_repeat('../', sizeof($root_dirs)) . implode('/', $page_dirs);
-
- // Strip / from the end
- if ($dir && substr($dir, -1, 1) == '/')
- {
- $dir = substr($dir, 0, -1);
- }
-
- // Strip / from the beginning
- if ($dir && substr($dir, 0, 1) == '/')
- {
- $dir = substr($dir, 1);
- }
-
- $url = str_replace($pathinfo['dirname'] . '/', '', $url);
-
- // Strip / from the beginning
- if (substr($url, 0, 1) == '/')
- {
- $url = substr($url, 1);
- }
-
- $url = (!empty($dir) ? $dir . '/' : '') . $url;
- $url = $this->generate_board_url() . '/' . $url;
- }
- }
-
- // Make sure no linebreaks are there... to prevent http response splitting for PHP < 4.4.2
- if (strpos(urldecode($url), "\n") !== false || strpos(urldecode($url), "\r") !== false || strpos($url, ';') !== false)
- {
- trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
- }
-
- // Now, also check the protocol and for a valid url the last time...
- $allowed_protocols = array('http', 'https', 'ftp', 'ftps');
- $url_parts = parse_url($url);
-
- if ($url_parts === false || empty($url_parts['scheme']) || !in_array($url_parts['scheme'], $allowed_protocols))
- {
- trigger_error('Tried to redirect to potentially insecure url.', E_USER_ERROR);
- }
-
- if ($return)
- {
- return $url;
- }
-
- // Redirect via an HTML form for PITA webservers
- if (@preg_match('#Microsoft|WebSTAR|Xitami#', getenv('SERVER_SOFTWARE')))
- {
- header('Refresh: 0; URL=' . $url);
-
- echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">';
- echo '<html xmlns="http://www.w3.org/1999/xhtml" dir="' . phpbb::$user->lang['DIRECTION'] . '" lang="' . phpbb::$user->lang['USER_LANG'] . '" xml:lang="' . phpbb::$user->lang['USER_LANG'] . '">';
- echo '<head>';
- echo '<meta http-equiv="content-type" content="text/html; charset=utf-8" />';
- echo '<meta http-equiv="refresh" content="0; url=' . str_replace('&', '&amp;', $url) . '" />';
- echo '<title>' . phpbb::$user->lang['REDIRECT'] . '</title>';
- echo '</head>';
- echo '<body>';
- echo '<div style="text-align: center;">' . phpbb::$user->lang('URL_REDIRECT', '<a href="' . str_replace('&', '&amp;', $url) . '">', '</a>') . '</div>';
- echo '</body>';
- echo '</html>';
-
- exit;
- }
-
- // Behave as per HTTP/1.1 spec for others
- header('Location: ' . $url);
- exit;
- }
-
- /**
- * Meta refresh assignment
- *
- * If the template object is present, the META template variable holds the meta refresh, else a normal redirect is done.
- *
- * @param int $time The time in seconds when to redirect
- * @param string $url The URL to redirect to
- * @param bool $disable_cd_check If true, redirect() will support redirects to an external domain.
- * If false, the redirect points to the boards url if it does not match the current domain.
- *
- * @return string Sanitized URL
- * @plugin-support return
- * @access public
- */
- public function meta_refresh($time, $url, $disable_cd_check = false)
- {
- if (phpbb::registered('template'))
- {
- $result_url = $this->redirect($url, true, $disable_cd_check);
- $result_url = str_replace('&', '&amp;', $result_url);
-
- // For XHTML compatibility we change back & to &amp;
- phpbb::$template->assign_var('META', '<meta http-equiv="refresh" content="' . $time . ';url=' . $result_url . '" />');
- }
- else
- {
- $this->redirect($url, false, $disable_cd_check);
- }
-
- return ($this->method_inject(__FUNCTION__, 'return')) ? $this->call_inject(__FUNCTION__, array('return', $result_url, $time, $url, $disable_cd_check)) : $result_url;
- }
-
- /**
- * Re-Apply session id after page reloads
- *
- * @param string $url URL to re-apply session id to
- * @return string URL with re-applied session id
- * @access public
- */
- public function reapply_sid($url)
- {
- if ($url === 'index.' . PHP_EXT)
- {
- return $this->append_sid('index.' . PHP_EXT);
- }
- else if ($url === PHPBB_ROOT_PATH . 'index.' . PHP_EXT)
- {
- return $this->append_sid('index');
- }
-
- // Remove previously added sid
- if (strpos($url, '?sid=') !== false)
- {
- $url = preg_replace('/(\?)sid=[a-z0-9]+(&amp;|&)?/', '\1', $url);
- }
- else if (strpos($url, '&sid=') !== false)
- {
- $url = preg_replace('/&sid=[a-z0-9]+(&)?/', '\1', $url);
- }
- else if (strpos($url, '&amp;sid=') !== false)
- {
- $url = preg_replace('/&amp;sid=[a-z0-9]+(&amp;)?/', '\1', $url);
- }
-
- return $this->append_sid($url);
- }
-
- /**
- * Returns url from the session/current page with an re-appended SID with optionally stripping vars from the url
- *
- * @param array|string $strip_vars An array containing variables to be stripped from the URL.
- * @return string Current page URL with re-applied SID and optionally stripped parameter
- * @access public
- */
- public function build_url($strip_vars = false)
- {
- // Append SID
- $redirect = $this->append_sid(phpbb::$user->page['page'], false, false);
-
- // Add delimiter if not there...
- if (strpos($redirect, '?') === false)
- {
- $redirect .= '?';
- }
-
- // Strip vars...
- if ($strip_vars !== false && strpos($redirect, '?') !== false)
- {
- if (!is_array($strip_vars))
- {
- $strip_vars = array($strip_vars);
- }
-
- $query = $_query = array();
-
- $args = substr($redirect, strpos($redirect, '?') + 1);
- $args = ($args) ? explode('&', $args) : array();
- $redirect = substr($redirect, 0, strpos($redirect, '?'));
-
- foreach ($args as $argument)
- {
- $arguments = explode('=', $argument);
- $key = $arguments[0];
- unset($arguments[0]);
-
- $query[$key] = implode('=', $arguments);
- }
-
- // Strip the vars off
- foreach ($strip_vars as $strip)
- {
- if (isset($query[$strip]))
- {
- unset($query[$strip]);
- }
- }
-
- // Glue the remaining parts together... already urlencoded
- foreach ($query as $key => $value)
- {
- $_query[] = $key . '=' . $value;
- }
- $query = implode('&', $_query);
-
- $redirect .= ($query) ? '?' . $query : '';
- }
-
- return PHPBB_ROOT_PATH . str_replace('&', '&amp;', $redirect);
- }
-}
-
-?> \ No newline at end of file