aboutsummaryrefslogtreecommitdiffstats
path: root/phpBB/includes
diff options
context:
space:
mode:
Diffstat (limited to 'phpBB/includes')
-rw-r--r--phpBB/includes/acp/acp_database.php14
-rw-r--r--phpBB/includes/auth/auth_apache.php27
-rw-r--r--phpBB/includes/captcha/plugins/phpbb_recaptcha_plugin.php3
-rw-r--r--phpBB/includes/functions.php28
-rw-r--r--phpBB/includes/functions_download.php39
-rw-r--r--phpBB/includes/functions_messenger.php4
-rw-r--r--phpBB/includes/questionnaire/questionnaire.php22
-rw-r--r--phpBB/includes/request/interface.php40
-rw-r--r--phpBB/includes/request/request.php71
-rw-r--r--phpBB/includes/request/type_cast_helper.php29
-rw-r--r--phpBB/includes/session.php30
11 files changed, 208 insertions, 99 deletions
diff --git a/phpBB/includes/acp/acp_database.php b/phpBB/includes/acp/acp_database.php
index 96542986d3..632578ef2d 100644
--- a/phpBB/includes/acp/acp_database.php
+++ b/phpBB/includes/acp/acp_database.php
@@ -486,6 +486,8 @@ class base_extractor
function base_extractor($download = false, $store = false, $format, $filename, $time)
{
+ global $request;
+
$this->download = $download;
$this->store = $store;
$this->time = $time;
@@ -530,7 +532,7 @@ class base_extractor
break;
case 'gzip':
- if ((isset($_SERVER['HTTP_ACCEPT_ENCODING']) && strpos($_SERVER['HTTP_ACCEPT_ENCODING'], 'gzip') !== false) && strpos(strtolower($_SERVER['HTTP_USER_AGENT']), 'msie') === false)
+ if (strpos($request->header('Accept-Encoding'), 'gzip') !== false && strpos(strtolower($request->header('User-Agent')), 'msie') === false)
{
ob_start('ob_gzhandler');
}
@@ -1580,7 +1582,7 @@ class mssql_extractor extends base_extractor
}
$this->flush($sql_data);
}
-
+
function write_data_mssqlnative($table_name)
{
global $db;
@@ -1606,7 +1608,7 @@ class mssql_extractor extends base_extractor
$row = new result_mssqlnative($result_fields);
$i_num_fields = $row->num_fields();
-
+
for ($i = 0; $i < $i_num_fields; $i++)
{
$ary_type[$i] = $row->field_type($i);
@@ -1619,7 +1621,7 @@ class mssql_extractor extends base_extractor
WHERE COLUMNPROPERTY(object_id('$table_name'), COLUMN_NAME, 'IsIdentity') = 1";
$result2 = $db->sql_query($sql);
$row2 = $db->sql_fetchrow($result2);
-
+
if (!empty($row2['has_identity']))
{
$sql_data .= "\nSET IDENTITY_INSERT $table_name ON\nGO\n";
@@ -1683,8 +1685,8 @@ class mssql_extractor extends base_extractor
$sql_data .= "\nSET IDENTITY_INSERT $table_name OFF\nGO\n";
}
$this->flush($sql_data);
- }
-
+ }
+
function write_data_odbc($table_name)
{
global $db;
diff --git a/phpBB/includes/auth/auth_apache.php b/phpBB/includes/auth/auth_apache.php
index a148403c6f..ff07936b36 100644
--- a/phpBB/includes/auth/auth_apache.php
+++ b/phpBB/includes/auth/auth_apache.php
@@ -28,9 +28,9 @@ if (!defined('IN_PHPBB'))
*/
function init_apache()
{
- global $user;
+ global $user, $request;
- if (!isset($_SERVER['PHP_AUTH_USER']) || $user->data['username'] !== $_SERVER['PHP_AUTH_USER'])
+ if (!$request->is_set('PHP_AUTH_USER', phpbb_request_interface::SERVER) || $user->data['username'] !== $request->server('PHP_AUTH_USER'))
{
return $user->lang['APACHE_SETUP_BEFORE_USE'];
}
@@ -42,7 +42,7 @@ function init_apache()
*/
function login_apache(&$username, &$password)
{
- global $db;
+ global $db, $request;
// do not allow empty password
if (!$password)
@@ -63,7 +63,7 @@ function login_apache(&$username, &$password)
);
}
- if (!isset($_SERVER['PHP_AUTH_USER']))
+ if (!$request->is_set('PHP_AUTH_USER', phpbb_request_interface::SERVER))
{
return array(
'status' => LOGIN_ERROR_EXTERNAL_AUTH,
@@ -72,8 +72,8 @@ function login_apache(&$username, &$password)
);
}
- $php_auth_user = $_SERVER['PHP_AUTH_USER'];
- $php_auth_pw = $_SERVER['PHP_AUTH_PW'];
+ $php_auth_user = $request->server('PHP_AUTH_USER');
+ $php_auth_pw = $request->server('PHP_AUTH_PW');
if (!empty($php_auth_user) && !empty($php_auth_pw))
{
@@ -136,15 +136,15 @@ function login_apache(&$username, &$password)
*/
function autologin_apache()
{
- global $db;
+ global $db, $request;
- if (!isset($_SERVER['PHP_AUTH_USER']))
+ if (!$request->is_set('PHP_AUTH_USER', phpbb_request_interface::SERVER))
{
return array();
}
- $php_auth_user = $_SERVER['PHP_AUTH_USER'];
- $php_auth_pw = $_SERVER['PHP_AUTH_PW'];
+ $php_auth_user = $request->server('PHP_AUTH_USER');
+ $php_auth_pw = $request->server('PHP_AUTH_PW');
if (!empty($php_auth_user) && !empty($php_auth_pw))
{
@@ -228,11 +228,12 @@ function user_row_apache($username, $password)
*/
function validate_session_apache(&$user)
{
+ global $request;
+
// Check if PHP_AUTH_USER is set and handle this case
- if (isset($_SERVER['PHP_AUTH_USER']))
+ if ($request->is_set('PHP_AUTH_USER', phpbb_request_interface::SERVER))
{
- $php_auth_user = '';
- set_var($php_auth_user, $_SERVER['PHP_AUTH_USER'], 'string', true);
+ $php_auth_user = $request->server('PHP_AUTH_USER', '', true);
return ($php_auth_user === $user['username']) ? true : false;
}
diff --git a/phpBB/includes/captcha/plugins/phpbb_recaptcha_plugin.php b/phpBB/includes/captcha/plugins/phpbb_recaptcha_plugin.php
index 0c36456886..5cfb5df8fc 100644
--- a/phpBB/includes/captcha/plugins/phpbb_recaptcha_plugin.php
+++ b/phpBB/includes/captcha/plugins/phpbb_recaptcha_plugin.php
@@ -41,7 +41,8 @@ class phpbb_recaptcha extends phpbb_default_captcha
// PHP4 Constructor
function phpbb_recaptcha()
{
- $this->recaptcha_server = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? $this->recaptcha_server_secure : $this->recaptcha_server;
+ global $request;
+ $this->recaptcha_server = $request->is_secure() ? $this->recaptcha_server_secure : $this->recaptcha_server;
}
function init($type)
diff --git a/phpBB/includes/functions.php b/phpBB/includes/functions.php
index 9d27a24c92..ea96801129 100644
--- a/phpBB/includes/functions.php
+++ b/phpBB/includes/functions.php
@@ -830,6 +830,8 @@ function phpbb_is_absolute($path)
*/
function phpbb_own_realpath($path)
{
+ global $request;
+
// Now to perform funky shizzle
// Switch to use UNIX slashes
@@ -873,11 +875,11 @@ function phpbb_own_realpath($path)
$path_prefix = '';
}
}
- else if (isset($_SERVER['SCRIPT_FILENAME']) && !empty($_SERVER['SCRIPT_FILENAME']))
+ else if ($request->server('SCRIPT_FILENAME'))
{
// Warning: If chdir() has been used this will lie!
// Warning: This has some problems sometime (CLI can create them easily)
- $path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($_SERVER['SCRIPT_FILENAME'])) . '/' . $path;
+ $path = str_replace(DIRECTORY_SEPARATOR, '/', dirname($request->server('SCRIPT_FILENAME'))) . '/' . $path;
$absolute = true;
$path_prefix = '';
}
@@ -2097,10 +2099,10 @@ function append_sid($url, $params = false, $is_amp = true, $session_id = false)
*/
function generate_board_url($without_script_path = false)
{
- global $config, $user;
+ global $config, $user, $request;
$server_name = $user->host;
- $server_port = (!empty($_SERVER['SERVER_PORT'])) ? (int) $_SERVER['SERVER_PORT'] : (int) getenv('SERVER_PORT');
+ $server_port = $request->server('SERVER_PORT', 0);
// Forcing server vars is the only way to specify/override the protocol
if ($config['force_server_vars'] || !$server_name)
@@ -2116,7 +2118,7 @@ function generate_board_url($without_script_path = false)
else
{
// Do not rely on cookie_secure, users seem to think that it means a secured cookie instead of an encrypted connection
- $cookie_secure = (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] == 'on') ? 1 : 0;
+ $cookie_secure = $request->is_secure() ? 1 : 0;
$url = (($cookie_secure) ? 'https://' : 'http://') . $server_name;
$script_path = $user->page['root_script_path'];
@@ -2468,6 +2470,8 @@ function meta_refresh($time, $url, $disable_cd_check = false)
*/
function send_status_line($code, $message)
{
+ global $request;
+
if (substr(strtolower(@php_sapi_name()), 0, 3) === 'cgi')
{
// in theory, we shouldn't need that due to php doing it. Reality offers a differing opinion, though
@@ -2475,9 +2479,9 @@ function send_status_line($code, $message)
}
else
{
- if (!empty($_SERVER['SERVER_PROTOCOL']))
+ if ($request->server('SERVER_PROTOCOL'))
{
- $version = $_SERVER['SERVER_PROTOCOL'];
+ $version = $request->server('SERVER_PROTOCOL');
}
else
{
@@ -4196,7 +4200,7 @@ function phpbb_optionset($bit, $set, $data)
*/
function phpbb_http_login($param)
{
- global $auth, $user;
+ global $auth, $user, $request;
global $config;
$param_defaults = array(
@@ -4236,9 +4240,9 @@ function phpbb_http_login($param)
$username = null;
foreach ($username_keys as $k)
{
- if (isset($_SERVER[$k]))
+ if ($request->is_set($k, phpbb_request_interface::SERVER))
{
- $username = $_SERVER[$k];
+ $username = $request->server($k);
break;
}
}
@@ -4246,9 +4250,9 @@ function phpbb_http_login($param)
$password = null;
foreach ($password_keys as $k)
{
- if (isset($_SERVER[$k]))
+ if ($request->is_set($k, phpbb_request_interface::SERVER))
{
- $password = $_SERVER[$k];
+ $password = $request->server($k);
break;
}
}
diff --git a/phpBB/includes/functions_download.php b/phpBB/includes/functions_download.php
index 91a09608c7..3fa5a45a1c 100644
--- a/phpBB/includes/functions_download.php
+++ b/phpBB/includes/functions_download.php
@@ -274,7 +274,9 @@ function send_file_to_browser($attachment, $upload_dir, $category)
*/
function header_filename($file)
{
- $user_agent = (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : '';
+ global $request;
+
+ $user_agent = $request->header('User-Agent', '', true);
// There be dragons here.
// Not many follows the RFC...
@@ -292,14 +294,14 @@ function header_filename($file)
*/
function download_allowed()
{
- global $config, $user, $db;
+ global $config, $user, $db, $request;
if (!$config['secure_downloads'])
{
return true;
}
- $url = (!empty($_SERVER['HTTP_REFERER'])) ? trim($_SERVER['HTTP_REFERER']) : trim(getenv('HTTP_REFERER'));
+ $url = trim($request->header('Referer'));
if (!$url)
{
@@ -404,8 +406,10 @@ function download_allowed()
*/
function set_modified_headers($stamp, $browser)
{
+ global $request;
+
// let's see if we have to send the file at all
- $last_load = isset($_SERVER['HTTP_IF_MODIFIED_SINCE']) ? strtotime(trim($_SERVER['HTTP_IF_MODIFIED_SINCE'])) : false;
+ $last_load = $request->header('Modified-Since') ? strtotime(trim($request->header('Modified-Since'))) : false;
if ((strpos(strtolower($browser), 'msie 6.0') === false) && (strpos(strtolower($browser), 'msie 8.0') === false))
{
if ($last_load !== false && $last_load >= $stamp)
@@ -473,12 +477,12 @@ function phpbb_http_byte_range($filesize)
{
$request_array = phpbb_find_range_request();
}
-
+
return (empty($request_array)) ? false : phpbb_parse_range_request($request_array, $filesize);
}
/**
-* Searches for HTTP range request in super globals.
+* Searches for HTTP range request in request headers.
*
* @return mixed false if no request found
* array of strings containing the requested ranges otherwise
@@ -486,23 +490,16 @@ function phpbb_http_byte_range($filesize)
*/
function phpbb_find_range_request()
{
- $globals = array(
- array('_SERVER', 'HTTP_RANGE'),
- array('_ENV', 'HTTP_RANGE'),
- );
+ global $request;
- foreach ($globals as $array)
- {
- $global = $array[0];
- $key = $array[1];
+ $value = $request->header('Range');
- // Make sure range request starts with "bytes="
- if (isset($GLOBALS[$global][$key]) && strpos($GLOBALS[$global][$key], 'bytes=') === 0)
- {
- // Strip leading 'bytes='
- // Multiple ranges can be separated by a comma
- return explode(',', substr($GLOBALS[$global][$key], 6));
- }
+ // Make sure range request starts with "bytes="
+ if (strpos($value, 'bytes=') === 0)
+ {
+ // Strip leading 'bytes='
+ // Multiple ranges can be separated by a comma
+ return explode(',', substr($value, 6));
}
return false;
diff --git a/phpBB/includes/functions_messenger.php b/phpBB/includes/functions_messenger.php
index 507f523866..a9241884bb 100644
--- a/phpBB/includes/functions_messenger.php
+++ b/phpBB/includes/functions_messenger.php
@@ -334,7 +334,7 @@ class messenger
*/
function error($type, $msg)
{
- global $user, $phpEx, $phpbb_root_path, $config;
+ global $user, $phpEx, $phpbb_root_path, $config, $request;
// Session doesn't exist, create it
if (!isset($user->session_id) || $user->session_id === '')
@@ -342,7 +342,7 @@ class messenger
$user->session_begin();
}
- $calling_page = (!empty($_SERVER['PHP_SELF'])) ? $_SERVER['PHP_SELF'] : $_ENV['PHP_SELF'];
+ $calling_page = $request->server('PHP_SELF');
$message = '';
switch ($type)
diff --git a/phpBB/includes/questionnaire/questionnaire.php b/phpBB/includes/questionnaire/questionnaire.php
index b9231547cd..ed61cf82d0 100644
--- a/phpBB/includes/questionnaire/questionnaire.php
+++ b/phpBB/includes/questionnaire/questionnaire.php
@@ -148,23 +148,15 @@ class phpbb_questionnaire_system_data_provider
*/
function get_data()
{
- // Start discovering the IPV4 server address, if available
- $server_address = '0.0.0.0';
-
- if (!empty($_SERVER['SERVER_ADDR']))
- {
- $server_address = $_SERVER['SERVER_ADDR'];
- }
+ global $request;
- // Running on IIS?
- if (!empty($_SERVER['LOCAL_ADDR']))
- {
- $server_address = $_SERVER['LOCAL_ADDR'];
- }
+ // Start discovering the IPV4 server address, if available
+ // Try apache, IIS, fall back to 0.0.0.0
+ $server_address = $request->server('SERVER_ADDR', $request->server('LOCAL_ADDR', '0.0.0.0'));
return array(
'os' => PHP_OS,
- 'httpd' => $_SERVER['SERVER_SOFTWARE'],
+ 'httpd' => $request->server('SERVER_SOFTWARE'),
// we don't want the real IP address (for privacy policy reasons) but only
// a network address to see whether your installation is running on a private or public network.
'private_ip' => $this->is_private_ip($server_address),
@@ -482,7 +474,7 @@ class phpbb_questionnaire_phpbb_data_provider
}
}
- global $db;
+ global $db, $request;
$result['dbms'] = $dbms;
$result['acm_type'] = $acm_type;
@@ -492,7 +484,7 @@ class phpbb_questionnaire_phpbb_data_provider
// Try to get user agent vendor and version
$match = array();
- $user_agent = (!empty($_SERVER['HTTP_USER_AGENT'])) ? (string) $_SERVER['HTTP_USER_AGENT'] : '';
+ $user_agent = $request->header('User-Agent');
$agents = array('firefox', 'msie', 'opera', 'chrome', 'safari', 'mozilla', 'seamonkey', 'konqueror', 'netscape', 'gecko', 'navigator', 'mosaic', 'lynx', 'amaya', 'omniweb', 'avant', 'camino', 'flock', 'aol');
// We check here 1 by 1 because some strings occur after others (for example Mozilla [...] Firefox/)
diff --git a/phpBB/includes/request/interface.php b/phpBB/includes/request/interface.php
index 7b5b600100..c0b8768b24 100644
--- a/phpBB/includes/request/interface.php
+++ b/phpBB/includes/request/interface.php
@@ -29,6 +29,7 @@ interface phpbb_request_interface
const GET = 1;
const REQUEST = 2;
const COOKIE = 3;
+ const SERVER = 4;
/**#@-*/
/**
@@ -60,11 +61,34 @@ interface phpbb_request_interface
* Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks
* @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global
* Specifies which super global should be used
+ * @param bool $html_encode When true, html encoding will be applied
*
* @return mixed The value of $_REQUEST[$var_name] run through {@link set_var set_var} to ensure that the type is the
* the same as that of $default. If the variable is not set $default is returned.
*/
- public function variable($var_name, $default, $multibyte = false, $super_global = phpbb_request_interface::REQUEST);
+ public function variable($var_name, $default, $multibyte = false, $super_global = phpbb_request_interface::REQUEST, $html_encode = true);
+
+ /**
+ * Shortcut method to retrieve SERVER variables.
+ *
+ * @param string|array $var_name See phpbb_request_interface::variable
+ * @param mixed $default See phpbb_request_interface::variable
+ * @param bool $html_encode See phpbb_request_interface::variable
+ *
+ * @return mixed The server variable value.
+ */
+ public function server($var_name, $default = '', $html_encode = false);
+
+ /**
+ * Shortcut method to retrieve the value of client HTTP headers.
+ *
+ * @param string|array $header_name The name of the header to retrieve.
+ * @param mixed $default See phpbb_request_interface::variable
+ * @param bool $html_encode See phpbb_request_interface::variable
+ *
+ * @return mixed The header value.
+ */
+ public function header($var_name, $default = '', $html_encode = false);
/**
* Checks whether a certain variable was sent via POST.
@@ -91,6 +115,20 @@ interface phpbb_request_interface
public function is_set($var, $super_global = phpbb_request_interface::REQUEST);
/**
+ * Checks whether the current request is an AJAX request (XMLHttpRequest)
+ *
+ * @return bool True if the current request is an ajax request
+ */
+ public function is_ajax();
+
+ /**
+ * Checks if the current request is happening over HTTPS.
+ *
+ * @return bool True if the request is secure.
+ */
+ public function is_secure();
+
+ /**
* Returns all variable names for a given super global
*
* @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global
diff --git a/phpBB/includes/request/request.php b/phpBB/includes/request/request.php
index 7d284a9bf7..8659ee8998 100644
--- a/phpBB/includes/request/request.php
+++ b/phpBB/includes/request/request.php
@@ -32,7 +32,8 @@ class phpbb_request implements phpbb_request_interface
phpbb_request_interface::POST => '_POST',
phpbb_request_interface::GET => '_GET',
phpbb_request_interface::REQUEST => '_REQUEST',
- phpbb_request_interface::COOKIE => '_COOKIE'
+ phpbb_request_interface::COOKIE => '_COOKIE',
+ phpbb_request_interface::SERVER => '_SERVER',
);
/**
@@ -193,11 +194,12 @@ class phpbb_request implements phpbb_request_interface
* Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks
* @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global
* Specifies which super global should be used
+ * @param bool $html_encode When true, html encoding will be applied
*
* @return mixed The value of $_REQUEST[$var_name] run through {@link set_var set_var} to ensure that the type is the
* the same as that of $default. If the variable is not set $default is returned.
*/
- public function variable($var_name, $default, $multibyte = false, $super_global = phpbb_request_interface::REQUEST)
+ public function variable($var_name, $default, $multibyte = false, $super_global = phpbb_request_interface::REQUEST, $html_encode = true)
{
$path = false;
@@ -236,12 +238,55 @@ class phpbb_request implements phpbb_request_interface
}
}
- $this->type_cast_helper->recursive_set_var($var, $default, $multibyte);
+ $this->type_cast_helper->recursive_set_var($var, $default, $multibyte, $html_encode);
return $var;
}
/**
+ * Shortcut method to retrieve SERVER variables.
+ *
+ * Also fall back to getenv(), some CGI setups may need it (probably not, but
+ * whatever).
+ *
+ * @param string|array $var_name See phpbb_request_interface::variable
+ * @param mixed $Default See phpbb_request_interface::variable
+ * @param bool $html_encode See phpbb_request_interface::variable
+ *
+ * @return mixed The server variable value.
+ */
+ public function server($var_name, $default = '', $html_encode = false)
+ {
+ $multibyte = true;
+
+ if ($this->is_set($var_name, phpbb_request_interface::SERVER))
+ {
+ return $this->variable($var_name, $default, $multibyte, phpbb_request_interface::SERVER, $html_encode);
+ }
+ else
+ {
+ $var = getenv($var_name);
+ $this->type_cast_helper->recursive_set_var($var, $default, $multibyte, $html_encode);
+ return $var;
+ }
+ }
+
+ /**
+ * Shortcut method to retrieve the value of client HTTP headers.
+ *
+ * @param string|array $header_name The name of the header to retrieve.
+ * @param mixed $default See phpbb_request_interface::variable
+ * @param bool $html_encode See phpbb_request_interface::variable
+ *
+ * @return mixed The header value.
+ */
+ public function header($header_name, $default = '', $html_encode = true)
+ {
+ $var_name = 'HTTP_' . str_replace('-', '_', strtoupper($header_name));
+ return $this->server($var_name, $default, $html_encode);
+ }
+
+ /**
* Checks whether a certain variable was sent via POST.
* To make sure that a request was sent using POST you should call this function
* on at least one variable.
@@ -272,6 +317,26 @@ class phpbb_request implements phpbb_request_interface
}
/**
+ * Checks whether the current request is an AJAX request (XMLHttpRequest)
+ *
+ * @return bool True if the current request is an ajax request
+ */
+ public function is_ajax()
+ {
+ return $this->header('X-Requested-With') == 'XMLHttpRequest';
+ }
+
+ /**
+ * Checks if the current request is happening over HTTPS.
+ *
+ * @return bool True if the request is secure.
+ */
+ public function is_secure()
+ {
+ return $this->server('HTTPS') == 'on';
+ }
+
+ /**
* Returns all variable names for a given super global
*
* @param phpbb_request_interface::POST|GET|REQUEST|COOKIE $super_global
diff --git a/phpBB/includes/request/type_cast_helper.php b/phpBB/includes/request/type_cast_helper.php
index 29855a9804..f84d71fa1c 100644
--- a/phpBB/includes/request/type_cast_helper.php
+++ b/phpBB/includes/request/type_cast_helper.php
@@ -88,20 +88,26 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
/**
* Set variable $result to a particular type.
*
- * @param mixed &$result The variable to fill
- * @param mixed $var The contents to fill with
- * @param mixed $type The variable type. Will be used with {@link settype()}
- * @param bool $multibyte Indicates whether string values may contain UTF-8 characters.
- * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks.
+ * @param mixed &$result The variable to fill
+ * @param mixed $var The contents to fill with
+ * @param mixed $type The variable type. Will be used with {@link settype()}
+ * @param bool $multibyte Indicates whether string values may contain UTF-8 characters.
+ * Default is false, causing all bytes outside the ASCII range (0-127) to be replaced with question marks.
+ * @param bool $html_encode When true, html encoding will be applied
*/
- public function set_var(&$result, $var, $type, $multibyte = false)
+ public function set_var(&$result, $var, $type, $multibyte = false, $html_encode = true)
{
settype($var, $type);
$result = $var;
if ($type == 'string')
{
- $result = trim(htmlspecialchars(str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result), ENT_COMPAT, 'UTF-8'));
+ $result = trim(str_replace(array("\r\n", "\r", "\0"), array("\n", "\n", ''), $result));
+
+ if ($html_encode)
+ {
+ $result = htmlspecialchars($result, ENT_COMPAT, 'UTF-8');
+ }
if ($multibyte)
{
@@ -140,8 +146,9 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
* @param bool $multibyte Indicates whether string keys and values may contain UTF-8 characters.
* Default is false, causing all bytes outside the ASCII range (0-127) to
* be replaced with question marks.
+ * @param bool $html_encode When true, html encoding will be applied
*/
- public function recursive_set_var(&$var, $default, $multibyte)
+ public function recursive_set_var(&$var, $default, $multibyte, $html_encode = true)
{
if (is_array($var) !== is_array($default))
{
@@ -152,7 +159,7 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
if (!is_array($default))
{
$type = gettype($default);
- $this->set_var($var, $var, $type, $multibyte);
+ $this->set_var($var, $var, $type, $multibyte, $html_encode);
}
else
{
@@ -173,9 +180,9 @@ class phpbb_request_type_cast_helper implements phpbb_request_type_cast_helper_i
foreach ($_var as $k => $v)
{
- $this->set_var($k, $k, $key_type, $multibyte, $multibyte);
+ $this->set_var($k, $k, $key_type, $multibyte, $multibyte, $html_encode);
- $this->recursive_set_var($v, $default_value, $multibyte);
+ $this->recursive_set_var($v, $default_value, $multibyte, $html_encode);
$var[$k] = $v;
}
}
diff --git a/phpBB/includes/session.php b/phpBB/includes/session.php
index e36f44ddfa..9faf9eee60 100644
--- a/phpBB/includes/session.php
+++ b/phpBB/includes/session.php
@@ -41,16 +41,18 @@ class session
*/
static function extract_current_page($root_path)
{
+ global $request;
+
$page_array = array();
// First of all, get the request uri...
- $script_name = (!empty($_SERVER['PHP_SELF'])) ? $_SERVER['PHP_SELF'] : getenv('PHP_SELF');
- $args = (!empty($_SERVER['QUERY_STRING'])) ? explode('&', $_SERVER['QUERY_STRING']) : explode('&', getenv('QUERY_STRING'));
+ $script_name = $request->server('PHP_SELF');
+ $args = explode('&', $request->server('QUERY_STRING'));
// If we are unable to get the script name we use REQUEST_URI as a failover and note it within the page array for easier support...
if (!$script_name)
{
- $script_name = (!empty($_SERVER['REQUEST_URI'])) ? $_SERVER['REQUEST_URI'] : getenv('REQUEST_URI');
+ $script_name = $request->server('REQUEST_URI');
$script_name = (($pos = strpos($script_name, '?')) !== false) ? substr($script_name, 0, $pos) : $script_name;
$page_array['failover'] = 1;
}
@@ -141,10 +143,10 @@ class session
*/
function extract_current_hostname()
{
- global $config;
+ global $config, $request;
// Get hostname
- $host = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME'));
+ $host = $request->header('Host', $request->server('SERVER_NAME'));
// Should be a string and lowered
$host = (string) strtolower($host);
@@ -212,9 +214,9 @@ class session
$this->time_now = time();
$this->cookie_data = array('u' => 0, 'k' => '');
$this->update_session_page = $update_session_page;
- $this->browser = (!empty($_SERVER['HTTP_USER_AGENT'])) ? htmlspecialchars((string) $_SERVER['HTTP_USER_AGENT']) : '';
- $this->referer = (!empty($_SERVER['HTTP_REFERER'])) ? htmlspecialchars((string) $_SERVER['HTTP_REFERER']) : '';
- $this->forwarded_for = (!empty($_SERVER['HTTP_X_FORWARDED_FOR'])) ? htmlspecialchars((string) $_SERVER['HTTP_X_FORWARDED_FOR']) : '';
+ $this->browser = $request->header('User-Agent', '', true);
+ $this->referer = $request->header('Referer', '', true);
+ $this->forwarded_for = $request->header('X-Forwarded-For', '', true);
$this->host = $this->extract_current_hostname();
$this->page = $this->extract_current_page($phpbb_root_path);
@@ -268,7 +270,7 @@ class session
// Why no forwarded_for et al? Well, too easily spoofed. With the results of my recent requests
// it's pretty clear that in the majority of cases you'll at least be left with a proxy/cache ip.
- $this->ip = (!empty($_SERVER['REMOTE_ADDR'])) ? (string) $_SERVER['REMOTE_ADDR'] : '';
+ $this->ip = $request->server('REMOTE_ADDR');
$this->ip = preg_replace('# {2,}#', ' ', str_replace(',', ' ', $this->ip));
// split the list of IPs
@@ -382,7 +384,7 @@ class session
$referer_valid = true;
// we assume HEAD and TRACE to be foul play and thus only whitelist GET
- if (@$config['referer_validation'] && isset($_SERVER['REQUEST_METHOD']) && strtolower($_SERVER['REQUEST_METHOD']) !== 'get')
+ if (@$config['referer_validation'] && strtolower($request->server('REQUEST_METHOD')) !== 'get')
{
$referer_valid = $this->validate_referer($check_referer_path);
}
@@ -1449,7 +1451,7 @@ class session
*/
function validate_referer($check_script_path = false)
{
- global $config;
+ global $config, $request;
// no referer - nothing to validate, user's fault for turning it off (we only check on POST; so meta can't be the reason)
if (empty($this->referer) || empty($this->host))
@@ -1467,7 +1469,7 @@ class session
else if ($check_script_path && rtrim($this->page['root_script_path'], '/') !== '')
{
$ref = substr($ref, strlen($host));
- $server_port = (!empty($_SERVER['SERVER_PORT'])) ? (int) $_SERVER['SERVER_PORT'] : (int) getenv('SERVER_PORT');
+ $server_port = $request->server('SERVER_PORT', 0);
if ($server_port !== 80 && $server_port !== 443 && stripos($ref, ":$server_port") === 0)
{
@@ -1592,9 +1594,9 @@ class user extends session
* If re-enabled we need to make sure only those languages installed are checked
* Commented out so we do not loose the code.
- if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE']))
+ if ($request->header('Accept-Language'))
{
- $accept_lang_ary = explode(',', $_SERVER['HTTP_ACCEPT_LANGUAGE']);
+ $accept_lang_ary = explode(',', $request->header('Accept-Language'));
foreach ($accept_lang_ary as $accept_lang)
{