aboutsummaryrefslogtreecommitdiffstats
path: root/phpBB/includes/functions.php
diff options
context:
space:
mode:
Diffstat (limited to 'phpBB/includes/functions.php')
-rw-r--r--phpBB/includes/functions.php154
1 files changed, 85 insertions, 69 deletions
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index fb7aafe636..8f41e18db6 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -817,7 +817,7 @@ function phpbb_is_writable($file)
* @param string $path Path to check absoluteness of
* @return boolean
*/
-function is_absolute($path)
+function phpbb_is_absolute($path)
{
return ($path[0] == '/' || (DIRECTORY_SEPARATOR == '\\' && preg_match('#^[a-z]:[/\\\]#i', $path))) ? true : false;
}
@@ -830,6 +830,8 @@ function is_absolute($path)
*/
function phpbb_own_realpath($path)
{
+ global $request;
+
// Now to perform funky shizzle
// Switch to use UNIX slashes
@@ -837,7 +839,7 @@ function phpbb_own_realpath($path)
$path_prefix = '';
// Determine what sort of path we have
- if (is_absolute($path))
+ if (phpbb_is_absolute($path))
{
$absolute = true;
@@ -873,11 +875,12 @@ function phpbb_own_realpath($path)
$path_prefix = '';
}
}
- else if (isset($_SERVER['SCRIPT_FILENAME']) && !empty($_SERVER['SCRIPT_FILENAME']))
+ else if ($request->server('SCRIPT_FILENAME'))
{
// Warning: If chdir() has been used this will lie!
// Warning: This has some problems sometime (CLI can create them easily)
- $path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($_SERVER['SCRIPT_FILENAME'])) . '/' . $path;
+ $filename = htmlspecialchars_decode($request->server('SCRIPT_FILENAME'));
+ $path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($filename)) . '/' . $path;
$absolute = true;
$path_prefix = '';
}
@@ -1898,7 +1901,7 @@ function generate_pagination($base_url, $num_items, $per_page, $start_item, $add
$start_cnt = min(max(1, $on_page - 4), $total_pages - 5);
$end_cnt = max(min($total_pages, $on_page + 4), 6);
- $page_string .= ($start_cnt > 1) ? ' ... ' : $separator;
+ $page_string .= ($start_cnt > 1) ? '<span class="page-dots"> ... </span>' : $separator;
for ($i = $start_cnt + 1; $i < $end_cnt; $i++)
{
@@ -1909,7 +1912,7 @@ function generate_pagination($base_url, $num_items, $per_page, $start_item, $add
}
}
- $page_string .= ($end_cnt < $total_pages) ? ' ... ' : $separator;
+ $page_string .= ($end_cnt < $total_pages) ? '<span class="page-dots"> ... </span>' : $separator;
}
else
{
@@ -1948,6 +1951,7 @@ function generate_pagination($base_url, $num_items, $per_page, $start_item, $add
$tpl_prefix . 'PREVIOUS_PAGE' => ($on_page == 1) ? '' : $base_url . "{$url_delim}start=" . (($on_page - 2) * $per_page),
$tpl_prefix . 'NEXT_PAGE' => ($on_page == $total_pages) ? '' : $base_url . "{$url_delim}start=" . ($on_page * $per_page),
$tpl_prefix . 'TOTAL_PAGES' => $total_pages,
+ $tpl_prefix . 'CURRENT_PAGE' => $on_page,
));
return $page_string;
@@ -1996,6 +2000,12 @@ function append_sid($url, $params = false, $is_amp = true, $session_id = false)
{
global $_SID, $_EXTRA_URL, $phpbb_hook;
+ if ($params === '' || (is_array($params) && empty($params)))
+ {
+ // Do not append the ? if the param-list is empty anyway.
+ $params = false;
+ }
+
// Developers using the hook function need to globalise the $_SID and $_EXTRA_URL on their own and also handle it appropriately.
// They could mimic most of what is within this function
if (!empty($phpbb_hook) && $phpbb_hook->call_hook(__FUNCTION__, $url, $params, $is_amp, $session_id))
@@ -2097,10 +2107,10 @@ function append_sid($url, $params = false, $is_amp = true, $session_id = false)
*/
function generate_board_url($without_script_path = false)
{
- global $config, $user;
+ global $config, $user, $request;
$server_name = $user->host;
- $server_port = (!empty($_SERVER['SERVER_PORT'])) ? (int) $_SERVER['SERVER_PORT'] : (int) getenv('SERVER_PORT');
+ $server_port = $request->server('SERVER_PORT', 0);
// Forcing server vars is the only way to specify/override the protocol
if ($config['force_server_vars'] || !$server_name)
@@ -2116,7 +2126,7 @@ function generate_board_url($without_script_path = false)
else
{
// Do not rely on cookie_secure, users seem to think that it means a secured cookie instead of an encrypted connection
- $cookie_secure = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 1 : 0;
+ $cookie_secure = $request->is_secure() ? 1 : 0;
$url = (($cookie_secure) ? 'https://' : 'http://') . $server_name;
$script_path = $user->page['root_script_path'];
@@ -2468,6 +2478,8 @@ function meta_refresh($time, $url, $disable_cd_check = false)
*/
function send_status_line($code, $message)
{
+ global $request;
+
if (substr(strtolower(@php_sapi_name()), 0, 3) === 'cgi')
{
// in theory, we shouldn't need that due to php doing it. Reality offers a differing opinion, though
@@ -2475,15 +2487,9 @@ function send_status_line($code, $message)
}
else
{
- if (!empty($_SERVER['SERVER_PROTOCOL']))
- {
- $version = $_SERVER['SERVER_PROTOCOL'];
- }
- else if (!empty($_SERVER['HTTP_VERSION']))
+ if ($request->server('SERVER_PROTOCOL'))
{
- // I cannot remember where I got this from.
- // This code path may never be reachable in reality.
- $version = $_SERVER['HTTP_VERSION'];
+ $version = $request->server('SERVER_PROTOCOL');
}
else
{
@@ -3151,61 +3157,44 @@ function add_log()
}
/**
-* Return a nicely formatted backtrace (parts from the php manual by diz at ysagoon dot com)
+* Return a nicely formatted backtrace.
+*
+* Turns the array returned by debug_backtrace() into HTML markup.
+* Also filters out absolute paths to phpBB root.
+*
+* @return string HTML markup
*/
function get_backtrace()
{
- global $phpbb_root_path;
-
$output = '<div style="font-family: monospace;">';
$backtrace = debug_backtrace();
- $path = phpbb_realpath($phpbb_root_path);
- foreach ($backtrace as $number => $trace)
- {
- // We skip the first one, because it only shows this file/function
- if ($number == 0)
- {
- continue;
- }
+ // We skip the first one, because it only shows this file/function
+ unset($backtrace[0]);
+ foreach ($backtrace as $trace)
+ {
// Strip the current directory from path
- if (empty($trace['file']))
- {
- $trace['file'] = '';
- }
- else
- {
- $trace['file'] = str_replace(array($path, '\\'), array('', '/'), $trace['file']);
- $trace['file'] = substr($trace['file'], 1);
- }
- $args = array();
+ $trace['file'] = (empty($trace['file'])) ? '(not given by php)' : htmlspecialchars(phpbb_filter_root_path($trace['file']));
+ $trace['line'] = (empty($trace['line'])) ? '(not given by php)' : $trace['line'];
- // If include/require/include_once is not called, do not show arguments - they may contain sensible information
- if (!in_array($trace['function'], array('include', 'require', 'include_once')))
+ // Only show function arguments for include etc.
+ // Other parameters may contain sensible information
+ $argument = '';
+ if (!empty($trace['args'][0]) && in_array($trace['function'], array('include', 'require', 'include_once', 'require_once')))
{
- unset($trace['args']);
- }
- else
- {
- // Path...
- if (!empty($trace['args'][0]))
- {
- $argument = htmlspecialchars($trace['args'][0]);
- $argument = str_replace(array($path, '\\'), array('', '/'), $argument);
- $argument = substr($argument, 1);
- $args[] = "'{$argument}'";
- }
+ $argument = htmlspecialchars(phpbb_filter_root_path($trace['args'][0]));
}
$trace['class'] = (!isset($trace['class'])) ? '' : $trace['class'];
$trace['type'] = (!isset($trace['type'])) ? '' : $trace['type'];
$output .= '<br />';
- $output .= '<b>FILE:</b> ' . htmlspecialchars($trace['file']) . '<br />';
+ $output .= '<b>FILE:</b> ' . $trace['file'] . '<br />';
$output .= '<b>LINE:</b> ' . ((!empty($trace['line'])) ? $trace['line'] : '') . '<br />';
- $output .= '<b>CALL:</b> ' . htmlspecialchars($trace['class'] . $trace['type'] . $trace['function']) . '(' . ((sizeof($args)) ? implode(', ', $args) : '') . ')<br />';
+ $output .= '<b>CALL:</b> ' . htmlspecialchars($trace['class'] . $trace['type'] . $trace['function']);
+ $output .= '(' . (($argument !== '') ? "'$argument'" : '') . ')<br />';
}
$output .= '</div>';
return $output;
@@ -3286,7 +3275,7 @@ function get_censor_preg_expression($word, $use_unicode = true)
// Unescape the asterisk to simplify further conversions
$word = str_replace('\*', '*', preg_quote($word, '#'));
- if ($use_unicode && pcre_utf8_support())
+ if ($use_unicode && phpbb_pcre_utf8_support())
{
// Replace asterisk(s) inside the pattern, at the start and at the end of it with regexes
$word = preg_replace(array('#(?<=[\p{Nd}\p{L}_])\*+(?=[\p{Nd}\p{L}_])#iu', '#^\*+#', '#\*+$#'), array('([\x20]*?|[\p{Nd}\p{L}_-]*?)', '[\p{Nd}\p{L}_-]*?', '[\p{Nd}\p{L}_-]*?'), $word);
@@ -3754,9 +3743,8 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
if (strpos($errfile, 'cache') === false && strpos($errfile, 'template.') === false)
{
- // remove complete path to installation, with the risk of changing backslashes meant to be there
- $errfile = str_replace(array(phpbb_realpath($phpbb_root_path), '\\'), array('', '/'), $errfile);
- $msg_text = str_replace(array(phpbb_realpath($phpbb_root_path), '\\'), array('', '/'), $msg_text);
+ $errfile = phpbb_filter_root_path($errfile);
+ $msg_text = phpbb_filter_root_path($msg_text);
$error_name = ($errno === E_WARNING) ? 'PHP Warning' : 'PHP Notice';
echo '<b>[phpBB Debug] ' . $error_name . '</b>: in file <b>' . $errfile . '</b> on line <b>' . $errline . '</b>: <b>' . $msg_text . '</b><br />' . "\n";
@@ -3935,6 +3923,29 @@ function msg_handler($errno, $msg_text, $errfile, $errline)
}
/**
+* Removes absolute path to phpBB root directory from error messages
+* and converts backslashes to forward slashes.
+*
+* @param string $errfile Absolute file path
+* (e.g. /var/www/phpbb3/phpBB/includes/functions.php)
+* Please note that if $errfile is outside of the phpBB root,
+* the root path will not be found and can not be filtered.
+* @return string Relative file path
+* (e.g. /includes/functions.php)
+*/
+function phpbb_filter_root_path($errfile)
+{
+ static $root_path;
+
+ if (empty($root_path))
+ {
+ $root_path = phpbb_realpath(dirname(__FILE__) . '/../');
+ }
+
+ return str_replace(array($root_path, '\\'), array('[ROOT]', '/'), $errfile);
+}
+
+/**
* Queries the session table to get information about online guests
* @param int $item_id Limits the search to the item with this id
* @param string $item The name of the item which is stored in the session table as session_{$item}_id
@@ -4202,7 +4213,7 @@ function phpbb_optionset($bit, $set, $data)
*/
function phpbb_http_login($param)
{
- global $auth, $user;
+ global $auth, $user, $request;
global $config;
$param_defaults = array(
@@ -4242,9 +4253,9 @@ function phpbb_http_login($param)
$username = null;
foreach ($username_keys as $k)
{
- if (isset($_SERVER[$k]))
+ if ($request->is_set($k, phpbb_request_interface::SERVER))
{
- $username = $_SERVER[$k];
+ $username = htmlspecialchars_decode($request->server($k));
break;
}
}
@@ -4252,9 +4263,9 @@ function phpbb_http_login($param)
$password = null;
foreach ($password_keys as $k)
{
- if (isset($_SERVER[$k]))
+ if ($request->is_set($k, phpbb_request_interface::SERVER))
{
- $password = $_SERVER[$k];
+ $password = htmlspecialchars_decode($request->server($k));
break;
}
}
@@ -4545,11 +4556,10 @@ function page_header($page_title = '', $display_online_list = true, $item_id = 0
'S_SEARCH_HIDDEN_FIELDS' => build_hidden_fields($s_search_hidden_fields),
+ 'T_ASSETS_PATH' => "{$web_path}assets",
'T_THEME_PATH' => "{$web_path}styles/" . $user->theme['theme_path'] . '/theme',
'T_TEMPLATE_PATH' => "{$web_path}styles/" . $user->theme['template_path'] . '/template',
'T_SUPER_TEMPLATE_PATH' => (isset($user->theme['template_inherit_path']) && $user->theme['template_inherit_path']) ? "{$web_path}styles/" . $user->theme['template_inherit_path'] . '/template' : "{$web_path}styles/" . $user->theme['template_path'] . '/template',
- 'T_IMAGESET_PATH' => "{$web_path}styles/" . $user->theme['imageset_path'] . '/imageset',
- 'T_IMAGESET_LANG_PATH' => "{$web_path}styles/" . $user->theme['imageset_path'] . '/imageset/' . $user->lang_name,
'T_IMAGES_PATH' => "{$web_path}images/",
'T_SMILIES_PATH' => "{$web_path}{$config['smilies_path']}/",
'T_AVATAR_PATH' => "{$web_path}{$config['avatar_path']}/",
@@ -4557,14 +4567,14 @@ function page_header($page_title = '', $display_online_list = true, $item_id = 0
'T_ICONS_PATH' => "{$web_path}{$config['icons_path']}/",
'T_RANKS_PATH' => "{$web_path}{$config['ranks_path']}/",
'T_UPLOAD_PATH' => "{$web_path}{$config['upload_path']}/",
- 'T_STYLESHEET_LINK' => (!$user->theme['theme_storedb']) ? "{$web_path}styles/" . $user->theme['theme_path'] . '/theme/stylesheet.css' : append_sid("{$phpbb_root_path}style.$phpEx", 'id=' . $user->theme['style_id'] . '&amp;lang=' . $user->lang_name),
+ 'T_STYLESHEET_LINK' => "{$web_path}styles/" . $user->theme['theme_path'] . '/theme/stylesheet.css',
+ 'T_STYLESHEET_LANG_LINK' => "{$web_path}styles/" . $user->theme['theme_path'] . '/theme/' . $user->lang_name . '/stylesheet.css',
'T_STYLESHEET_NAME' => $user->theme['theme_name'],
'T_THEME_NAME' => $user->theme['theme_path'],
+ 'T_THEME_LANG_NAME' => $user->data['user_lang'],
'T_TEMPLATE_NAME' => $user->theme['template_path'],
'T_SUPER_TEMPLATE_NAME' => (isset($user->theme['template_inherit_path']) && $user->theme['template_inherit_path']) ? $user->theme['template_inherit_path'] : $user->theme['template_path'],
- 'T_IMAGESET_NAME' => $user->theme['imageset_path'],
- 'T_IMAGESET_LANG_NAME' => $user->data['user_lang'],
'T_IMAGES' => 'images',
'T_SMILIES' => $config['smilies_path'],
'T_AVATAR' => $config['avatar_path'],
@@ -4585,6 +4595,12 @@ function page_header($page_title = '', $display_online_list = true, $item_id = 0
header('Expires: 0');
header('Pragma: no-cache');
+ if (!empty($user->data['is_bot']))
+ {
+ // Let reverse proxies know we detected a bot.
+ header('X-PHPBB-IS-BOT: yes');
+ }
+
return;
}
@@ -4743,7 +4759,7 @@ function phpbb_user_session_handler()
*
* @return bool Returns true if PCRE (the regular expressions library) supports UTF-8 encoding
*/
-function pcre_utf8_support()
+function phpbb_pcre_utf8_support()
{
static $utf8_pcre_properties = null;
if (is_null($utf8_pcre_properties))