]> git.immae.eu Git - github/shaarli/Shaarli.git/blob - index.php
Documentation: release v0.9.6
[github/shaarli/Shaarli.git] / index.php
1 <?php
2 /**
3 * Shaarli - The personal, minimalist, super-fast, database free, bookmarking service.
4 *
5 * Friendly fork by the Shaarli community:
6 * - https://github.com/shaarli/Shaarli
7 *
8 * Original project by sebsauvage.net:
9 * - http://sebsauvage.net/wiki/doku.php?id=php:shaarli
10 * - https://github.com/sebsauvage/Shaarli
11 *
12 * Licence: http://www.opensource.org/licenses/zlib-license.php
13 *
14 * Requires: PHP 5.5.x
15 */
16
17 // Set 'UTC' as the default timezone if it is not defined in php.ini
18 // See http://php.net/manual/en/datetime.configuration.php#ini.date.timezone
19 if (date_default_timezone_get() == '') {
20 date_default_timezone_set('UTC');
21 }
22
23 /*
24 * PHP configuration
25 */
26
27 // http://server.com/x/shaarli --> /shaarli/
28 define('WEB_PATH', substr($_SERVER['REQUEST_URI'], 0, 1+strrpos($_SERVER['REQUEST_URI'], '/', 0)));
29
30 // High execution time in case of problematic imports/exports.
31 ini_set('max_input_time','60');
32
33 // Try to set max upload file size and read
34 ini_set('memory_limit', '128M');
35 ini_set('post_max_size', '16M');
36 ini_set('upload_max_filesize', '16M');
37
38 // See all error except warnings
39 error_reporting(E_ALL^E_WARNING);
40 // See all errors (for debugging only)
41 //error_reporting(-1);
42
43
44 // 3rd-party libraries
45 if (! file_exists(__DIR__ . '/vendor/autoload.php')) {
46 header('Content-Type: text/plain; charset=utf-8');
47 echo "Error: missing Composer configuration\n\n"
48 ."If you installed Shaarli through Git or using the development branch,\n"
49 ."please refer to the installation documentation to install PHP"
50 ." dependencies using Composer:\n"
51 ."- https://shaarli.readthedocs.io/en/master/Server-requirements/\n"
52 ."- https://shaarli.readthedocs.io/en/master/Download-and-Installation/";
53 exit;
54 }
55 require_once 'inc/rain.tpl.class.php';
56 require_once __DIR__ . '/vendor/autoload.php';
57
58 // Shaarli library
59 require_once 'application/ApplicationUtils.php';
60 require_once 'application/Cache.php';
61 require_once 'application/CachedPage.php';
62 require_once 'application/config/ConfigPlugin.php';
63 require_once 'application/FeedBuilder.php';
64 require_once 'application/FileUtils.php';
65 require_once 'application/History.php';
66 require_once 'application/HttpUtils.php';
67 require_once 'application/LinkDB.php';
68 require_once 'application/LinkFilter.php';
69 require_once 'application/LinkUtils.php';
70 require_once 'application/NetscapeBookmarkUtils.php';
71 require_once 'application/PageBuilder.php';
72 require_once 'application/TimeZone.php';
73 require_once 'application/Url.php';
74 require_once 'application/Utils.php';
75 require_once 'application/PluginManager.php';
76 require_once 'application/Router.php';
77 require_once 'application/Updater.php';
78 use \Shaarli\Languages;
79 use \Shaarli\ThemeUtils;
80 use \Shaarli\Config\ConfigManager;
81 use \Shaarli\LoginManager;
82 use \Shaarli\SessionManager;
83
84 // Ensure the PHP version is supported
85 try {
86 ApplicationUtils::checkPHPVersion('5.5', PHP_VERSION);
87 } catch(Exception $exc) {
88 header('Content-Type: text/plain; charset=utf-8');
89 echo $exc->getMessage();
90 exit;
91 }
92
93 define('SHAARLI_VERSION', ApplicationUtils::getVersion(__DIR__ .'/'. ApplicationUtils::$VERSION_FILE));
94
95 // Force cookie path (but do not change lifetime)
96 $cookie = session_get_cookie_params();
97 $cookiedir = '';
98 if (dirname($_SERVER['SCRIPT_NAME']) != '/') {
99 $cookiedir = dirname($_SERVER["SCRIPT_NAME"]).'/';
100 }
101 // Set default cookie expiration and path.
102 session_set_cookie_params($cookie['lifetime'], $cookiedir, $_SERVER['SERVER_NAME']);
103 // Set session parameters on server side.
104 // If the user does not access any page within this time, his/her session is considered expired.
105 define('INACTIVITY_TIMEOUT', 3600); // in seconds.
106 // Use cookies to store session.
107 ini_set('session.use_cookies', 1);
108 // Force cookies for session (phpsessionID forbidden in URL).
109 ini_set('session.use_only_cookies', 1);
110 // Prevent PHP form using sessionID in URL if cookies are disabled.
111 ini_set('session.use_trans_sid', false);
112
113 session_name('shaarli');
114 // Start session if needed (Some server auto-start sessions).
115 if (session_id() == '') {
116 session_start();
117 }
118
119 // Regenerate session ID if invalid or not defined in cookie.
120 if (isset($_COOKIE['shaarli']) && !SessionManager::checkId($_COOKIE['shaarli'])) {
121 session_regenerate_id(true);
122 $_COOKIE['shaarli'] = session_id();
123 }
124
125 $conf = new ConfigManager();
126 $loginManager = new LoginManager($GLOBALS, $conf);
127 $sessionManager = new SessionManager($_SESSION, $conf);
128
129 // LC_MESSAGES isn't defined without php-intl, in this case use LC_COLLATE locale instead.
130 if (! defined('LC_MESSAGES')) {
131 define('LC_MESSAGES', LC_COLLATE);
132 }
133
134 // Sniff browser language and set date format accordingly.
135 if (isset($_SERVER['HTTP_ACCEPT_LANGUAGE'])) {
136 autoLocale($_SERVER['HTTP_ACCEPT_LANGUAGE']);
137 }
138
139 new Languages(setlocale(LC_MESSAGES, 0), $conf);
140
141 $conf->setEmpty('general.timezone', date_default_timezone_get());
142 $conf->setEmpty('general.title', t('Shared links on '). escape(index_url($_SERVER)));
143 RainTPL::$tpl_dir = $conf->get('resource.raintpl_tpl').'/'.$conf->get('resource.theme').'/'; // template directory
144 RainTPL::$cache_dir = $conf->get('resource.raintpl_tmp'); // cache directory
145
146 $pluginManager = new PluginManager($conf);
147 $pluginManager->load($conf->get('general.enabled_plugins'));
148
149 date_default_timezone_set($conf->get('general.timezone', 'UTC'));
150
151 ob_start(); // Output buffering for the page cache.
152
153 // Prevent caching on client side or proxy: (yes, it's ugly)
154 header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
155 header("Cache-Control: no-store, no-cache, must-revalidate");
156 header("Cache-Control: post-check=0, pre-check=0", false);
157 header("Pragma: no-cache");
158
159 if (! is_file($conf->getConfigFileExt())) {
160 // Ensure Shaarli has proper access to its resources
161 $errors = ApplicationUtils::checkResourcePermissions($conf);
162
163 if ($errors != array()) {
164 $message = '<p>'. t('Insufficient permissions:') .'</p><ul>';
165
166 foreach ($errors as $error) {
167 $message .= '<li>'.$error.'</li>';
168 }
169 $message .= '</ul>';
170
171 header('Content-Type: text/html; charset=utf-8');
172 echo $message;
173 exit;
174 }
175
176 // Display the installation form if no existing config is found
177 install($conf, $sessionManager);
178 }
179
180 // a token depending of deployment salt, user password, and the current ip
181 define('STAY_SIGNED_IN_TOKEN', sha1($conf->get('credentials.hash') . $_SERVER['REMOTE_ADDR'] . $conf->get('credentials.salt')));
182
183 /**
184 * Checking session state (i.e. is the user still logged in)
185 *
186 * @param ConfigManager $conf The configuration manager.
187 *
188 * @return bool: true if the user is logged in, false otherwise.
189 */
190 function setup_login_state($conf)
191 {
192 if ($conf->get('security.open_shaarli')) {
193 return true;
194 }
195 $userIsLoggedIn = false; // By default, we do not consider the user as logged in;
196 $loginFailure = false; // If set to true, every attempt to authenticate the user will fail. This indicates that an important condition isn't met.
197 if (! $conf->exists('credentials.login')) {
198 $userIsLoggedIn = false; // Shaarli is not configured yet.
199 $loginFailure = true;
200 }
201 if (isset($_COOKIE['shaarli_staySignedIn']) &&
202 $_COOKIE['shaarli_staySignedIn']===STAY_SIGNED_IN_TOKEN &&
203 !$loginFailure)
204 {
205 fillSessionInfo($conf);
206 $userIsLoggedIn = true;
207 }
208 // If session does not exist on server side, or IP address has changed, or session has expired, logout.
209 if (empty($_SESSION['uid'])
210 || ($conf->get('security.session_protection_disabled') === false && $_SESSION['ip'] != allIPs())
211 || time() >= $_SESSION['expires_on'])
212 {
213 logout();
214 $userIsLoggedIn = false;
215 $loginFailure = true;
216 }
217 if (!empty($_SESSION['longlastingsession'])) {
218 $_SESSION['expires_on']=time()+$_SESSION['longlastingsession']; // In case of "Stay signed in" checked.
219 }
220 else {
221 $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Standard session expiration date.
222 }
223 if (!$loginFailure) {
224 $userIsLoggedIn = true;
225 }
226
227 return $userIsLoggedIn;
228 }
229 $userIsLoggedIn = setup_login_state($conf);
230
231 // ------------------------------------------------------------------------------------------
232 // Session management
233
234 // Returns the IP address of the client (Used to prevent session cookie hijacking.)
235 function allIPs()
236 {
237 $ip = $_SERVER['REMOTE_ADDR'];
238 // Then we use more HTTP headers to prevent session hijacking from users behind the same proxy.
239 if (isset($_SERVER['HTTP_X_FORWARDED_FOR'])) { $ip=$ip.'_'.$_SERVER['HTTP_X_FORWARDED_FOR']; }
240 if (isset($_SERVER['HTTP_CLIENT_IP'])) { $ip=$ip.'_'.$_SERVER['HTTP_CLIENT_IP']; }
241 return $ip;
242 }
243
244 /**
245 * Load user session.
246 *
247 * @param ConfigManager $conf Configuration Manager instance.
248 */
249 function fillSessionInfo($conf)
250 {
251 $_SESSION['uid'] = sha1(uniqid('',true).'_'.mt_rand()); // Generate unique random number (different than phpsessionid)
252 $_SESSION['ip']=allIPs(); // We store IP address(es) of the client to make sure session is not hijacked.
253 $_SESSION['username']= $conf->get('credentials.login');
254 $_SESSION['expires_on']=time()+INACTIVITY_TIMEOUT; // Set session expiration.
255 }
256
257 /**
258 * Check that user/password is correct.
259 *
260 * @param string $login Username
261 * @param string $password User password
262 * @param ConfigManager $conf Configuration Manager instance.
263 *
264 * @return bool: authentication successful or not.
265 */
266 function check_auth($login, $password, $conf)
267 {
268 $hash = sha1($password . $login . $conf->get('credentials.salt'));
269 if ($login == $conf->get('credentials.login') && $hash == $conf->get('credentials.hash'))
270 { // Login/password is correct.
271 fillSessionInfo($conf);
272 logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login successful');
273 return true;
274 }
275 logm($conf->get('resource.log'), $_SERVER['REMOTE_ADDR'], 'Login failed for user '.$login);
276 return false;
277 }
278
279 // Returns true if the user is logged in.
280 function isLoggedIn()
281 {
282 global $userIsLoggedIn;
283 return $userIsLoggedIn;
284 }
285
286 // Force logout.
287 function logout() {
288 if (isset($_SESSION)) {
289 unset($_SESSION['uid']);
290 unset($_SESSION['ip']);
291 unset($_SESSION['username']);
292 unset($_SESSION['visibility']);
293 unset($_SESSION['untaggedonly']);
294 }
295 setcookie('shaarli_staySignedIn', FALSE, 0, WEB_PATH);
296 }
297
298 // ------------------------------------------------------------------------------------------
299 // Process login form: Check if login/password is correct.
300 if (isset($_POST['login']))
301 {
302 if (! $loginManager->canLogin($_SERVER)) {
303 die(t('I said: NO. You are banned for the moment. Go away.'));
304 }
305 if (isset($_POST['password'])
306 && $sessionManager->checkToken($_POST['token'])
307 && (check_auth($_POST['login'], $_POST['password'], $conf))
308 ) {
309 // Login/password is OK.
310 $loginManager->handleSuccessfulLogin($_SERVER);
311
312 // If user wants to keep the session cookie even after the browser closes:
313 if (!empty($_POST['longlastingsession'])) {
314 $_SESSION['longlastingsession'] = 31536000; // (31536000 seconds = 1 year)
315 $expiration = time() + $_SESSION['longlastingsession']; // calculate relative cookie expiration (1 year from now)
316 setcookie('shaarli_staySignedIn', STAY_SIGNED_IN_TOKEN, $expiration, WEB_PATH);
317 $_SESSION['expires_on'] = $expiration; // Set session expiration on server-side.
318
319 $cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
320 session_set_cookie_params($_SESSION['longlastingsession'],$cookiedir,$_SERVER['SERVER_NAME']); // Set session cookie expiration on client side
321 // Note: Never forget the trailing slash on the cookie path!
322 session_regenerate_id(true); // Send cookie with new expiration date to browser.
323 }
324 else // Standard session expiration (=when browser closes)
325 {
326 $cookiedir = ''; if(dirname($_SERVER['SCRIPT_NAME'])!='/') $cookiedir=dirname($_SERVER["SCRIPT_NAME"]).'/';
327 session_set_cookie_params(0,$cookiedir,$_SERVER['SERVER_NAME']); // 0 means "When browser closes"
328 session_regenerate_id(true);
329 }
330
331 // Optional redirect after login:
332 if (isset($_GET['post'])) {
333 $uri = '?post='. urlencode($_GET['post']);
334 foreach (array('description', 'source', 'title', 'tags') as $param) {
335 if (!empty($_GET[$param])) {
336 $uri .= '&'.$param.'='.urlencode($_GET[$param]);
337 }
338 }
339 header('Location: '. $uri);
340 exit;
341 }
342
343 if (isset($_GET['edit_link'])) {
344 header('Location: ?edit_link='. escape($_GET['edit_link']));
345 exit;
346 }
347
348 if (isset($_POST['returnurl'])) {
349 // Prevent loops over login screen.
350 if (strpos($_POST['returnurl'], 'do=login') === false) {
351 header('Location: '. generateLocation($_POST['returnurl'], $_SERVER['HTTP_HOST']));
352 exit;
353 }
354 }
355 header('Location: ?'); exit;
356 } else {
357 $loginManager->handleFailedLogin($_SERVER);
358 $redir = '&username='. urlencode($_POST['login']);
359 if (isset($_GET['post'])) {
360 $redir .= '&post=' . urlencode($_GET['post']);
361 foreach (array('description', 'source', 'title', 'tags') as $param) {
362 if (!empty($_GET[$param])) {
363 $redir .= '&' . $param . '=' . urlencode($_GET[$param]);
364 }
365 }
366 }
367 // Redirect to login screen.
368 echo '<script>alert("'. t("Wrong login/password.") .'");document.location=\'?do=login'.$redir.'\';</script>';
369 exit;
370 }
371 }
372
373 // ------------------------------------------------------------------------------------------
374 // Token management for XSRF protection
375 // Token should be used in any form which acts on data (create,update,delete,import...).
376 if (!isset($_SESSION['tokens'])) $_SESSION['tokens']=array(); // Token are attached to the session.
377
378 /**
379 * Daily RSS feed: 1 RSS entry per day giving all the links on that day.
380 * Gives the last 7 days (which have links).
381 * This RSS feed cannot be filtered.
382 *
383 * @param ConfigManager $conf Configuration Manager instance.
384 */
385 function showDailyRSS($conf) {
386 // Cache system
387 $query = $_SERVER['QUERY_STRING'];
388 $cache = new CachedPage(
389 $conf->get('config.PAGE_CACHE'),
390 page_url($_SERVER),
391 startsWith($query,'do=dailyrss') && !isLoggedIn()
392 );
393 $cached = $cache->cachedVersion();
394 if (!empty($cached)) {
395 echo $cached;
396 exit;
397 }
398
399 // If cached was not found (or not usable), then read the database and build the response:
400 // Read links from database (and filter private links if used it not logged in).
401 $LINKSDB = new LinkDB(
402 $conf->get('resource.datastore'),
403 isLoggedIn(),
404 $conf->get('privacy.hide_public_links'),
405 $conf->get('redirector.url'),
406 $conf->get('redirector.encode_url')
407 );
408
409 /* Some Shaarlies may have very few links, so we need to look
410 back in time until we have enough days ($nb_of_days).
411 */
412 $nb_of_days = 7; // We take 7 days.
413 $today = date('Ymd');
414 $days = array();
415
416 foreach ($LINKSDB as $link) {
417 $day = $link['created']->format('Ymd'); // Extract day (without time)
418 if (strcmp($day, $today) < 0) {
419 if (empty($days[$day])) {
420 $days[$day] = array();
421 }
422 $days[$day][] = $link;
423 }
424
425 if (count($days) > $nb_of_days) {
426 break; // Have we collected enough days?
427 }
428 }
429
430 // Build the RSS feed.
431 header('Content-Type: application/rss+xml; charset=utf-8');
432 $pageaddr = escape(index_url($_SERVER));
433 echo '<?xml version="1.0" encoding="UTF-8"?><rss version="2.0">';
434 echo '<channel>';
435 echo '<title>Daily - '. $conf->get('general.title') . '</title>';
436 echo '<link>'. $pageaddr .'</link>';
437 echo '<description>Daily shared links</description>';
438 echo '<language>en-en</language>';
439 echo '<copyright>'. $pageaddr .'</copyright>'. PHP_EOL;
440
441 // For each day.
442 foreach ($days as $day => $links) {
443 $dayDate = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $day.'_000000');
444 $absurl = escape(index_url($_SERVER).'?do=daily&day='.$day); // Absolute URL of the corresponding "Daily" page.
445
446 // We pre-format some fields for proper output.
447 foreach ($links as &$link) {
448 $link['formatedDescription'] = format_description(
449 $link['description'],
450 $conf->get('redirector.url'),
451 $conf->get('redirector.encode_url')
452 );
453 $link['thumbnail'] = thumbnail($conf, $link['url']);
454 $link['timestamp'] = $link['created']->getTimestamp();
455 if (startsWith($link['url'], '?')) {
456 $link['url'] = index_url($_SERVER) . $link['url']; // make permalink URL absolute
457 }
458 }
459
460 // Then build the HTML for this day:
461 $tpl = new RainTPL;
462 $tpl->assign('title', $conf->get('general.title'));
463 $tpl->assign('daydate', $dayDate->getTimestamp());
464 $tpl->assign('absurl', $absurl);
465 $tpl->assign('links', $links);
466 $tpl->assign('rssdate', escape($dayDate->format(DateTime::RSS)));
467 $tpl->assign('hide_timestamps', $conf->get('privacy.hide_timestamps', false));
468 $html = $tpl->draw('dailyrss', true);
469
470 echo $html . PHP_EOL;
471 }
472 echo '</channel></rss><!-- Cached version of '. escape(page_url($_SERVER)) .' -->';
473
474 $cache->cache(ob_get_contents());
475 ob_end_flush();
476 exit;
477 }
478
479 /**
480 * Show the 'Daily' page.
481 *
482 * @param PageBuilder $pageBuilder Template engine wrapper.
483 * @param LinkDB $LINKSDB LinkDB instance.
484 * @param ConfigManager $conf Configuration Manager instance.
485 * @param PluginManager $pluginManager Plugin Manager instane.
486 */
487 function showDaily($pageBuilder, $LINKSDB, $conf, $pluginManager)
488 {
489 $day = date('Ymd', strtotime('-1 day')); // Yesterday, in format YYYYMMDD.
490 if (isset($_GET['day'])) {
491 $day = $_GET['day'];
492 }
493
494 $days = $LINKSDB->days();
495 $i = array_search($day, $days);
496 if ($i === false && count($days)) {
497 // no links for day, but at least one day with links
498 $i = count($days) - 1;
499 $day = $days[$i];
500 }
501 $previousday = '';
502 $nextday = '';
503
504 if ($i !== false) {
505 if ($i >= 1) {
506 $previousday=$days[$i - 1];
507 }
508 if ($i < count($days) - 1) {
509 $nextday = $days[$i + 1];
510 }
511 }
512 try {
513 $linksToDisplay = $LINKSDB->filterDay($day);
514 } catch (Exception $exc) {
515 error_log($exc);
516 $linksToDisplay = array();
517 }
518
519 // We pre-format some fields for proper output.
520 foreach($linksToDisplay as $key => $link) {
521 $taglist = explode(' ',$link['tags']);
522 uasort($taglist, 'strcasecmp');
523 $linksToDisplay[$key]['taglist']=$taglist;
524 $linksToDisplay[$key]['formatedDescription'] = format_description(
525 $link['description'],
526 $conf->get('redirector.url'),
527 $conf->get('redirector.encode_url')
528 );
529 $linksToDisplay[$key]['thumbnail'] = thumbnail($conf, $link['url']);
530 $linksToDisplay[$key]['timestamp'] = $link['created']->getTimestamp();
531 }
532
533 $dayDate = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $day.'_000000');
534 $data = array(
535 'pagetitle' => $conf->get('general.title') .' - '. format_date($dayDate, false),
536 'linksToDisplay' => $linksToDisplay,
537 'day' => $dayDate->getTimestamp(),
538 'dayDate' => $dayDate,
539 'previousday' => $previousday,
540 'nextday' => $nextday,
541 );
542
543 /* Hook is called before column construction so that plugins don't have
544 to deal with columns. */
545 $pluginManager->executeHooks('render_daily', $data, array('loggedin' => isLoggedIn()));
546
547 /* We need to spread the articles on 3 columns.
548 I did not want to use a JavaScript lib like http://masonry.desandro.com/
549 so I manually spread entries with a simple method: I roughly evaluate the
550 height of a div according to title and description length.
551 */
552 $columns = array(array(), array(), array()); // Entries to display, for each column.
553 $fill = array(0, 0, 0); // Rough estimate of columns fill.
554 foreach($data['linksToDisplay'] as $key => $link) {
555 // Roughly estimate length of entry (by counting characters)
556 // Title: 30 chars = 1 line. 1 line is 30 pixels height.
557 // Description: 836 characters gives roughly 342 pixel height.
558 // This is not perfect, but it's usually OK.
559 $length = strlen($link['title']) + (342 * strlen($link['description'])) / 836;
560 if ($link['thumbnail']) {
561 $length += 100; // 1 thumbnails roughly takes 100 pixels height.
562 }
563 // Then put in column which is the less filled:
564 $smallest = min($fill); // find smallest value in array.
565 $index = array_search($smallest, $fill); // find index of this smallest value.
566 array_push($columns[$index], $link); // Put entry in this column.
567 $fill[$index] += $length;
568 }
569
570 $data['cols'] = $columns;
571
572 foreach ($data as $key => $value) {
573 $pageBuilder->assign($key, $value);
574 }
575
576 $pageBuilder->assign('pagetitle', t('Daily') .' - '. $conf->get('general.title', 'Shaarli'));
577 $pageBuilder->renderPage('daily');
578 exit;
579 }
580
581 /**
582 * Renders the linklist
583 *
584 * @param pageBuilder $PAGE pageBuilder instance.
585 * @param LinkDB $LINKSDB LinkDB instance.
586 * @param ConfigManager $conf Configuration Manager instance.
587 * @param PluginManager $pluginManager Plugin Manager instance.
588 */
589 function showLinkList($PAGE, $LINKSDB, $conf, $pluginManager) {
590 buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager); // Compute list of links to display
591 $PAGE->renderPage('linklist');
592 }
593
594 /**
595 * Render HTML page (according to URL parameters and user rights)
596 *
597 * @param ConfigManager $conf Configuration Manager instance.
598 * @param PluginManager $pluginManager Plugin Manager instance,
599 * @param LinkDB $LINKSDB
600 * @param History $history instance
601 * @param SessionManager $sessionManager SessionManager instance
602 * @param LoginManager $loginManager LoginManager instance
603 */
604 function renderPage($conf, $pluginManager, $LINKSDB, $history, $sessionManager, $loginManager)
605 {
606 $updater = new Updater(
607 read_updates_file($conf->get('resource.updates')),
608 $LINKSDB,
609 $conf,
610 isLoggedIn()
611 );
612 try {
613 $newUpdates = $updater->update();
614 if (! empty($newUpdates)) {
615 write_updates_file(
616 $conf->get('resource.updates'),
617 $updater->getDoneUpdates()
618 );
619 }
620 }
621 catch(Exception $e) {
622 die($e->getMessage());
623 }
624
625 $PAGE = new PageBuilder($conf, $LINKSDB, $sessionManager->generateToken());
626 $PAGE->assign('linkcount', count($LINKSDB));
627 $PAGE->assign('privateLinkcount', count_private($LINKSDB));
628 $PAGE->assign('plugin_errors', $pluginManager->getErrors());
629
630 // Determine which page will be rendered.
631 $query = (isset($_SERVER['QUERY_STRING'])) ? $_SERVER['QUERY_STRING'] : '';
632 $targetPage = Router::findPage($query, $_GET, isLoggedIn());
633
634 if (
635 // if the user isn't logged in
636 !isLoggedIn() &&
637 // and Shaarli doesn't have public content...
638 $conf->get('privacy.hide_public_links') &&
639 // and is configured to enforce the login
640 $conf->get('privacy.force_login') &&
641 // and the current page isn't already the login page
642 $targetPage !== Router::$PAGE_LOGIN &&
643 // and the user is not requesting a feed (which would lead to a different content-type as expected)
644 $targetPage !== Router::$PAGE_FEED_ATOM &&
645 $targetPage !== Router::$PAGE_FEED_RSS
646 ) {
647 // force current page to be the login page
648 $targetPage = Router::$PAGE_LOGIN;
649 }
650
651 // Call plugin hooks for header, footer and includes, specifying which page will be rendered.
652 // Then assign generated data to RainTPL.
653 $common_hooks = array(
654 'includes',
655 'header',
656 'footer',
657 );
658
659 foreach($common_hooks as $name) {
660 $plugin_data = array();
661 $pluginManager->executeHooks('render_' . $name, $plugin_data,
662 array(
663 'target' => $targetPage,
664 'loggedin' => isLoggedIn()
665 )
666 );
667 $PAGE->assign('plugins_' . $name, $plugin_data);
668 }
669
670 // -------- Display login form.
671 if ($targetPage == Router::$PAGE_LOGIN)
672 {
673 if ($conf->get('security.open_shaarli')) { header('Location: ?'); exit; } // No need to login for open Shaarli
674 if (isset($_GET['username'])) {
675 $PAGE->assign('username', escape($_GET['username']));
676 }
677 $PAGE->assign('returnurl',(isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']):''));
678 // add default state of the 'remember me' checkbox
679 $PAGE->assign('remember_user_default', $conf->get('privacy.remember_user_default'));
680 $PAGE->assign('user_can_login', $loginManager->canLogin($_SERVER));
681 $PAGE->assign('pagetitle', t('Login') .' - '. $conf->get('general.title', 'Shaarli'));
682 $PAGE->renderPage('loginform');
683 exit;
684 }
685 // -------- User wants to logout.
686 if (isset($_SERVER['QUERY_STRING']) && startsWith($_SERVER['QUERY_STRING'], 'do=logout'))
687 {
688 invalidateCaches($conf->get('resource.page_cache'));
689 logout();
690 header('Location: ?');
691 exit;
692 }
693
694 // -------- Picture wall
695 if ($targetPage == Router::$PAGE_PICWALL)
696 {
697 // Optionally filter the results:
698 $links = $LINKSDB->filterSearch($_GET);
699 $linksToDisplay = array();
700
701 // Get only links which have a thumbnail.
702 foreach($links as $link)
703 {
704 $permalink='?'.$link['shorturl'];
705 $thumb=lazyThumbnail($conf, $link['url'],$permalink);
706 if ($thumb!='') // Only output links which have a thumbnail.
707 {
708 $link['thumbnail']=$thumb; // Thumbnail HTML code.
709 $linksToDisplay[]=$link; // Add to array.
710 }
711 }
712
713 $data = array(
714 'linksToDisplay' => $linksToDisplay,
715 );
716 $pluginManager->executeHooks('render_picwall', $data, array('loggedin' => isLoggedIn()));
717
718 foreach ($data as $key => $value) {
719 $PAGE->assign($key, $value);
720 }
721
722 $PAGE->assign('pagetitle', t('Picture wall') .' - '. $conf->get('general.title', 'Shaarli'));
723 $PAGE->renderPage('picwall');
724 exit;
725 }
726
727 // -------- Tag cloud
728 if ($targetPage == Router::$PAGE_TAGCLOUD)
729 {
730 $visibility = ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '';
731 $filteringTags = isset($_GET['searchtags']) ? explode(' ', $_GET['searchtags']) : [];
732 $tags = $LINKSDB->linksCountPerTag($filteringTags, $visibility);
733
734 // We sort tags alphabetically, then choose a font size according to count.
735 // First, find max value.
736 $maxcount = 0;
737 foreach ($tags as $value) {
738 $maxcount = max($maxcount, $value);
739 }
740
741 alphabetical_sort($tags, false, true);
742
743 $tagList = array();
744 foreach($tags as $key => $value) {
745 if (in_array($key, $filteringTags)) {
746 continue;
747 }
748 // Tag font size scaling:
749 // default 15 and 30 logarithm bases affect scaling,
750 // 22 and 6 are arbitrary font sizes for max and min sizes.
751 $size = log($value, 15) / log($maxcount, 30) * 2.2 + 0.8;
752 $tagList[$key] = array(
753 'count' => $value,
754 'size' => number_format($size, 2, '.', ''),
755 );
756 }
757
758 $searchTags = implode(' ', escape($filteringTags));
759 $data = array(
760 'search_tags' => $searchTags,
761 'tags' => $tagList,
762 );
763 $pluginManager->executeHooks('render_tagcloud', $data, array('loggedin' => isLoggedIn()));
764
765 foreach ($data as $key => $value) {
766 $PAGE->assign($key, $value);
767 }
768
769 $searchTags = ! empty($searchTags) ? $searchTags .' - ' : '';
770 $PAGE->assign('pagetitle', $searchTags. t('Tag cloud') .' - '. $conf->get('general.title', 'Shaarli'));
771 $PAGE->renderPage('tag.cloud');
772 exit;
773 }
774
775 // -------- Tag list
776 if ($targetPage == Router::$PAGE_TAGLIST)
777 {
778 $visibility = ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '';
779 $filteringTags = isset($_GET['searchtags']) ? explode(' ', $_GET['searchtags']) : [];
780 $tags = $LINKSDB->linksCountPerTag($filteringTags, $visibility);
781 foreach ($filteringTags as $tag) {
782 if (array_key_exists($tag, $tags)) {
783 unset($tags[$tag]);
784 }
785 }
786
787 if (! empty($_GET['sort']) && $_GET['sort'] === 'alpha') {
788 alphabetical_sort($tags, false, true);
789 }
790
791 $searchTags = implode(' ', escape($filteringTags));
792 $data = [
793 'search_tags' => $searchTags,
794 'tags' => $tags,
795 ];
796 $pluginManager->executeHooks('render_taglist', $data, ['loggedin' => isLoggedIn()]);
797
798 foreach ($data as $key => $value) {
799 $PAGE->assign($key, $value);
800 }
801
802 $searchTags = ! empty($searchTags) ? $searchTags .' - ' : '';
803 $PAGE->assign('pagetitle', $searchTags . t('Tag list') .' - '. $conf->get('general.title', 'Shaarli'));
804 $PAGE->renderPage('tag.list');
805 exit;
806 }
807
808 // Daily page.
809 if ($targetPage == Router::$PAGE_DAILY) {
810 showDaily($PAGE, $LINKSDB, $conf, $pluginManager);
811 }
812
813 // ATOM and RSS feed.
814 if ($targetPage == Router::$PAGE_FEED_ATOM || $targetPage == Router::$PAGE_FEED_RSS) {
815 $feedType = $targetPage == Router::$PAGE_FEED_RSS ? FeedBuilder::$FEED_RSS : FeedBuilder::$FEED_ATOM;
816 header('Content-Type: application/'. $feedType .'+xml; charset=utf-8');
817
818 // Cache system
819 $query = $_SERVER['QUERY_STRING'];
820 $cache = new CachedPage(
821 $conf->get('resource.page_cache'),
822 page_url($_SERVER),
823 startsWith($query,'do='. $targetPage) && !isLoggedIn()
824 );
825 $cached = $cache->cachedVersion();
826 if (!empty($cached)) {
827 echo $cached;
828 exit;
829 }
830
831 // Generate data.
832 $feedGenerator = new FeedBuilder($LINKSDB, $feedType, $_SERVER, $_GET, isLoggedIn());
833 $feedGenerator->setLocale(strtolower(setlocale(LC_COLLATE, 0)));
834 $feedGenerator->setHideDates($conf->get('privacy.hide_timestamps') && !isLoggedIn());
835 $feedGenerator->setUsePermalinks(isset($_GET['permalinks']) || !$conf->get('feed.rss_permalinks'));
836 $data = $feedGenerator->buildData();
837
838 // Process plugin hook.
839 $pluginManager->executeHooks('render_feed', $data, array(
840 'loggedin' => isLoggedIn(),
841 'target' => $targetPage,
842 ));
843
844 // Render the template.
845 $PAGE->assignAll($data);
846 $PAGE->renderPage('feed.'. $feedType);
847 $cache->cache(ob_get_contents());
848 ob_end_flush();
849 exit;
850 }
851
852 // Display opensearch plugin (XML)
853 if ($targetPage == Router::$PAGE_OPENSEARCH) {
854 header('Content-Type: application/xml; charset=utf-8');
855 $PAGE->assign('serverurl', index_url($_SERVER));
856 $PAGE->renderPage('opensearch');
857 exit;
858 }
859
860 // -------- User clicks on a tag in a link: The tag is added to the list of searched tags (searchtags=...)
861 if (isset($_GET['addtag']))
862 {
863 // Get previous URL (http_referer) and add the tag to the searchtags parameters in query.
864 if (empty($_SERVER['HTTP_REFERER'])) { header('Location: ?searchtags='.urlencode($_GET['addtag'])); exit; } // In case browser does not send HTTP_REFERER
865 parse_str(parse_url($_SERVER['HTTP_REFERER'],PHP_URL_QUERY), $params);
866
867 // Prevent redirection loop
868 if (isset($params['addtag'])) {
869 unset($params['addtag']);
870 }
871
872 // Check if this tag is already in the search query and ignore it if it is.
873 // Each tag is always separated by a space
874 if (isset($params['searchtags'])) {
875 $current_tags = explode(' ', $params['searchtags']);
876 } else {
877 $current_tags = array();
878 }
879 $addtag = true;
880 foreach ($current_tags as $value) {
881 if ($value === $_GET['addtag']) {
882 $addtag = false;
883 break;
884 }
885 }
886 // Append the tag if necessary
887 if (empty($params['searchtags'])) {
888 $params['searchtags'] = trim($_GET['addtag']);
889 }
890 elseif ($addtag) {
891 $params['searchtags'] = trim($params['searchtags']).' '.trim($_GET['addtag']);
892 }
893
894 unset($params['page']); // We also remove page (keeping the same page has no sense, since the results are different)
895 header('Location: ?'.http_build_query($params));
896 exit;
897 }
898
899 // -------- User clicks on a tag in result count: Remove the tag from the list of searched tags (searchtags=...)
900 if (isset($_GET['removetag'])) {
901 // Get previous URL (http_referer) and remove the tag from the searchtags parameters in query.
902 if (empty($_SERVER['HTTP_REFERER'])) {
903 header('Location: ?');
904 exit;
905 }
906
907 // In case browser does not send HTTP_REFERER
908 parse_str(parse_url($_SERVER['HTTP_REFERER'], PHP_URL_QUERY), $params);
909
910 // Prevent redirection loop
911 if (isset($params['removetag'])) {
912 unset($params['removetag']);
913 }
914
915 if (isset($params['searchtags'])) {
916 $tags = explode(' ', $params['searchtags']);
917 // Remove value from array $tags.
918 $tags = array_diff($tags, array($_GET['removetag']));
919 $params['searchtags'] = implode(' ',$tags);
920
921 if (empty($params['searchtags'])) {
922 unset($params['searchtags']);
923 }
924
925 unset($params['page']); // We also remove page (keeping the same page has no sense, since the results are different)
926 }
927 header('Location: ?'.http_build_query($params));
928 exit;
929 }
930
931 // -------- User wants to change the number of links per page (linksperpage=...)
932 if (isset($_GET['linksperpage'])) {
933 if (is_numeric($_GET['linksperpage'])) {
934 $_SESSION['LINKS_PER_PAGE']=abs(intval($_GET['linksperpage']));
935 }
936
937 if (! empty($_SERVER['HTTP_REFERER'])) {
938 $location = generateLocation($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'], array('linksperpage'));
939 } else {
940 $location = '?';
941 }
942 header('Location: '. $location);
943 exit;
944 }
945
946 // -------- User wants to see only private links (toggle)
947 if (isset($_GET['visibility'])) {
948 if ($_GET['visibility'] === 'private') {
949 // Visibility not set or not already private, set private, otherwise reset it
950 if (empty($_SESSION['visibility']) || $_SESSION['visibility'] !== 'private') {
951 // See only private links
952 $_SESSION['visibility'] = 'private';
953 } else {
954 unset($_SESSION['visibility']);
955 }
956 } elseif ($_GET['visibility'] === 'public') {
957 if (empty($_SESSION['visibility']) || $_SESSION['visibility'] !== 'public') {
958 // See only public links
959 $_SESSION['visibility'] = 'public';
960 } else {
961 unset($_SESSION['visibility']);
962 }
963 }
964
965 if (! empty($_SERVER['HTTP_REFERER'])) {
966 $location = generateLocation($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'], array('visibility'));
967 } else {
968 $location = '?';
969 }
970 header('Location: '. $location);
971 exit;
972 }
973
974 // -------- User wants to see only untagged links (toggle)
975 if (isset($_GET['untaggedonly'])) {
976 $_SESSION['untaggedonly'] = empty($_SESSION['untaggedonly']);
977
978 if (! empty($_SERVER['HTTP_REFERER'])) {
979 $location = generateLocation($_SERVER['HTTP_REFERER'], $_SERVER['HTTP_HOST'], array('untaggedonly'));
980 } else {
981 $location = '?';
982 }
983 header('Location: '. $location);
984 exit;
985 }
986
987 // -------- Handle other actions allowed for non-logged in users:
988 if (!isLoggedIn())
989 {
990 // User tries to post new link but is not logged in:
991 // Show login screen, then redirect to ?post=...
992 if (isset($_GET['post']))
993 {
994 header( // Redirect to login page, then back to post link.
995 'Location: ?do=login&post='.urlencode($_GET['post']).
996 (!empty($_GET['title'])?'&title='.urlencode($_GET['title']):'').
997 (!empty($_GET['description'])?'&description='.urlencode($_GET['description']):'').
998 (!empty($_GET['tags'])?'&tags='.urlencode($_GET['tags']):'').
999 (!empty($_GET['source'])?'&source='.urlencode($_GET['source']):'')
1000 );
1001 exit;
1002 }
1003
1004 showLinkList($PAGE, $LINKSDB, $conf, $pluginManager);
1005 if (isset($_GET['edit_link'])) {
1006 header('Location: ?do=login&edit_link='. escape($_GET['edit_link']));
1007 exit;
1008 }
1009
1010 exit; // Never remove this one! All operations below are reserved for logged in user.
1011 }
1012
1013 // -------- All other functions are reserved for the registered user:
1014
1015 // -------- Display the Tools menu if requested (import/export/bookmarklet...)
1016 if ($targetPage == Router::$PAGE_TOOLS)
1017 {
1018 $data = [
1019 'pageabsaddr' => index_url($_SERVER),
1020 'sslenabled' => is_https($_SERVER),
1021 ];
1022 $pluginManager->executeHooks('render_tools', $data);
1023
1024 foreach ($data as $key => $value) {
1025 $PAGE->assign($key, $value);
1026 }
1027
1028 $PAGE->assign('pagetitle', t('Tools') .' - '. $conf->get('general.title', 'Shaarli'));
1029 $PAGE->renderPage('tools');
1030 exit;
1031 }
1032
1033 // -------- User wants to change his/her password.
1034 if ($targetPage == Router::$PAGE_CHANGEPASSWORD)
1035 {
1036 if ($conf->get('security.open_shaarli')) {
1037 die(t('You are not supposed to change a password on an Open Shaarli.'));
1038 }
1039
1040 if (!empty($_POST['setpassword']) && !empty($_POST['oldpassword']))
1041 {
1042 if (!$sessionManager->checkToken($_POST['token'])) die(t('Wrong token.')); // Go away!
1043
1044 // Make sure old password is correct.
1045 $oldhash = sha1($_POST['oldpassword'].$conf->get('credentials.login').$conf->get('credentials.salt'));
1046 if ($oldhash!= $conf->get('credentials.hash')) {
1047 echo '<script>alert("'. t('The old password is not correct.') .'");document.location=\'?do=changepasswd\';</script>';
1048 exit;
1049 }
1050 // Save new password
1051 // Salt renders rainbow-tables attacks useless.
1052 $conf->set('credentials.salt', sha1(uniqid('', true) .'_'. mt_rand()));
1053 $conf->set('credentials.hash', sha1($_POST['setpassword'] . $conf->get('credentials.login') . $conf->get('credentials.salt')));
1054 try {
1055 $conf->write(isLoggedIn());
1056 }
1057 catch(Exception $e) {
1058 error_log(
1059 'ERROR while writing config file after changing password.' . PHP_EOL .
1060 $e->getMessage()
1061 );
1062
1063 // TODO: do not handle exceptions/errors in JS.
1064 echo '<script>alert("'. $e->getMessage() .'");document.location=\'?do=tools\';</script>';
1065 exit;
1066 }
1067 echo '<script>alert("'. t('Your password has been changed') .'");document.location=\'?do=tools\';</script>';
1068 exit;
1069 }
1070 else // show the change password form.
1071 {
1072 $PAGE->assign('pagetitle', t('Change password') .' - '. $conf->get('general.title', 'Shaarli'));
1073 $PAGE->renderPage('changepassword');
1074 exit;
1075 }
1076 }
1077
1078 // -------- User wants to change configuration
1079 if ($targetPage == Router::$PAGE_CONFIGURE)
1080 {
1081 if (!empty($_POST['title']) )
1082 {
1083 if (!$sessionManager->checkToken($_POST['token'])) {
1084 die(t('Wrong token.')); // Go away!
1085 }
1086 $tz = 'UTC';
1087 if (!empty($_POST['continent']) && !empty($_POST['city'])
1088 && isTimeZoneValid($_POST['continent'], $_POST['city'])
1089 ) {
1090 $tz = $_POST['continent'] . '/' . $_POST['city'];
1091 }
1092 $conf->set('general.timezone', $tz);
1093 $conf->set('general.title', escape($_POST['title']));
1094 $conf->set('general.header_link', escape($_POST['titleLink']));
1095 $conf->set('resource.theme', escape($_POST['theme']));
1096 $conf->set('security.session_protection_disabled', !empty($_POST['disablesessionprotection']));
1097 $conf->set('privacy.default_private_links', !empty($_POST['privateLinkByDefault']));
1098 $conf->set('feed.rss_permalinks', !empty($_POST['enableRssPermalinks']));
1099 $conf->set('updates.check_updates', !empty($_POST['updateCheck']));
1100 $conf->set('privacy.hide_public_links', !empty($_POST['hidePublicLinks']));
1101 $conf->set('api.enabled', !empty($_POST['enableApi']));
1102 $conf->set('api.secret', escape($_POST['apiSecret']));
1103 $conf->set('translation.language', escape($_POST['language']));
1104
1105 try {
1106 $conf->write(isLoggedIn());
1107 $history->updateSettings();
1108 invalidateCaches($conf->get('resource.page_cache'));
1109 }
1110 catch(Exception $e) {
1111 error_log(
1112 'ERROR while writing config file after configuration update.' . PHP_EOL .
1113 $e->getMessage()
1114 );
1115
1116 // TODO: do not handle exceptions/errors in JS.
1117 echo '<script>alert("'. $e->getMessage() .'");document.location=\'?do=configure\';</script>';
1118 exit;
1119 }
1120 echo '<script>alert("'. t('Configuration was saved.') .'");document.location=\'?do=configure\';</script>';
1121 exit;
1122 }
1123 else // Show the configuration form.
1124 {
1125 $PAGE->assign('title', $conf->get('general.title'));
1126 $PAGE->assign('theme', $conf->get('resource.theme'));
1127 $PAGE->assign('theme_available', ThemeUtils::getThemes($conf->get('resource.raintpl_tpl')));
1128 list($continents, $cities) = generateTimeZoneData(
1129 timezone_identifiers_list(),
1130 $conf->get('general.timezone')
1131 );
1132 $PAGE->assign('continents', $continents);
1133 $PAGE->assign('cities', $cities);
1134 $PAGE->assign('private_links_default', $conf->get('privacy.default_private_links', false));
1135 $PAGE->assign('session_protection_disabled', $conf->get('security.session_protection_disabled', false));
1136 $PAGE->assign('enable_rss_permalinks', $conf->get('feed.rss_permalinks', false));
1137 $PAGE->assign('enable_update_check', $conf->get('updates.check_updates', true));
1138 $PAGE->assign('hide_public_links', $conf->get('privacy.hide_public_links', false));
1139 $PAGE->assign('api_enabled', $conf->get('api.enabled', true));
1140 $PAGE->assign('api_secret', $conf->get('api.secret'));
1141 $PAGE->assign('languages', Languages::getAvailableLanguages());
1142 $PAGE->assign('language', $conf->get('translation.language'));
1143 $PAGE->assign('pagetitle', t('Configure') .' - '. $conf->get('general.title', 'Shaarli'));
1144 $PAGE->renderPage('configure');
1145 exit;
1146 }
1147 }
1148
1149 // -------- User wants to rename a tag or delete it
1150 if ($targetPage == Router::$PAGE_CHANGETAG)
1151 {
1152 if (empty($_POST['fromtag']) || (empty($_POST['totag']) && isset($_POST['renametag']))) {
1153 $PAGE->assign('fromtag', ! empty($_GET['fromtag']) ? escape($_GET['fromtag']) : '');
1154 $PAGE->assign('pagetitle', t('Manage tags') .' - '. $conf->get('general.title', 'Shaarli'));
1155 $PAGE->renderPage('changetag');
1156 exit;
1157 }
1158
1159 if (!$sessionManager->checkToken($_POST['token'])) {
1160 die(t('Wrong token.'));
1161 }
1162
1163 $alteredLinks = $LINKSDB->renameTag(escape($_POST['fromtag']), escape($_POST['totag']));
1164 $LINKSDB->save($conf->get('resource.page_cache'));
1165 foreach ($alteredLinks as $link) {
1166 $history->updateLink($link);
1167 }
1168 $delete = empty($_POST['totag']);
1169 $redirect = $delete ? 'do=changetag' : 'searchtags='. urlencode(escape($_POST['totag']));
1170 $count = count($alteredLinks);
1171 $alert = $delete
1172 ? sprintf(t('The tag was removed from %d link.', 'The tag was removed from %d links.', $count), $count)
1173 : sprintf(t('The tag was renamed in %d link.', 'The tag was renamed in %d links.', $count), $count);
1174 echo '<script>alert("'. $alert .'");document.location=\'?'. $redirect .'\';</script>';
1175 exit;
1176 }
1177
1178 // -------- User wants to add a link without using the bookmarklet: Show form.
1179 if ($targetPage == Router::$PAGE_ADDLINK)
1180 {
1181 $PAGE->assign('pagetitle', t('Shaare a new link') .' - '. $conf->get('general.title', 'Shaarli'));
1182 $PAGE->renderPage('addlink');
1183 exit;
1184 }
1185
1186 // -------- User clicked the "Save" button when editing a link: Save link to database.
1187 if (isset($_POST['save_edit']))
1188 {
1189 // Go away!
1190 if (! $sessionManager->checkToken($_POST['token'])) {
1191 die(t('Wrong token.'));
1192 }
1193
1194 // lf_id should only be present if the link exists.
1195 $id = isset($_POST['lf_id']) ? intval(escape($_POST['lf_id'])) : $LINKSDB->getNextId();
1196 // Linkdate is kept here to:
1197 // - use the same permalink for notes as they're displayed when creating them
1198 // - let users hack creation date of their posts
1199 // See: https://shaarli.readthedocs.io/en/master/Various-hacks/#changing-the-timestamp-for-a-shaare
1200 $linkdate = escape($_POST['lf_linkdate']);
1201 if (isset($LINKSDB[$id])) {
1202 // Edit
1203 $created = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $linkdate);
1204 $updated = new DateTime();
1205 $shortUrl = $LINKSDB[$id]['shorturl'];
1206 $new = false;
1207 } else {
1208 // New link
1209 $created = DateTime::createFromFormat(LinkDB::LINK_DATE_FORMAT, $linkdate);
1210 $updated = null;
1211 $shortUrl = link_small_hash($created, $id);
1212 $new = true;
1213 }
1214
1215 // Remove multiple spaces.
1216 $tags = trim(preg_replace('/\s\s+/', ' ', $_POST['lf_tags']));
1217 // Remove first '-' char in tags.
1218 $tags = preg_replace('/(^| )\-/', '$1', $tags);
1219 // Remove duplicates.
1220 $tags = implode(' ', array_unique(explode(' ', $tags)));
1221
1222 if (empty(trim($_POST['lf_url']))) {
1223 $_POST['lf_url'] = '?' . smallHash($linkdate . $id);
1224 }
1225 $url = whitelist_protocols(trim($_POST['lf_url']), $conf->get('security.allowed_protocols'));
1226
1227 $link = array(
1228 'id' => $id,
1229 'title' => trim($_POST['lf_title']),
1230 'url' => $url,
1231 'description' => $_POST['lf_description'],
1232 'private' => (isset($_POST['lf_private']) ? 1 : 0),
1233 'created' => $created,
1234 'updated' => $updated,
1235 'tags' => str_replace(',', ' ', $tags),
1236 'shorturl' => $shortUrl,
1237 );
1238
1239 // If title is empty, use the URL as title.
1240 if ($link['title'] == '') {
1241 $link['title'] = $link['url'];
1242 }
1243
1244 $pluginManager->executeHooks('save_link', $link);
1245
1246 $LINKSDB[$id] = $link;
1247 $LINKSDB->save($conf->get('resource.page_cache'));
1248 if ($new) {
1249 $history->addLink($link);
1250 } else {
1251 $history->updateLink($link);
1252 }
1253
1254 // If we are called from the bookmarklet, we must close the popup:
1255 if (isset($_GET['source']) && ($_GET['source']=='bookmarklet' || $_GET['source']=='firefoxsocialapi')) {
1256 echo '<script>self.close();</script>';
1257 exit;
1258 }
1259
1260 $returnurl = !empty($_POST['returnurl']) ? $_POST['returnurl'] : '?';
1261 $location = generateLocation($returnurl, $_SERVER['HTTP_HOST'], array('addlink', 'post', 'edit_link'));
1262 // Scroll to the link which has been edited.
1263 $location .= '#' . $link['shorturl'];
1264 // After saving the link, redirect to the page the user was on.
1265 header('Location: '. $location);
1266 exit;
1267 }
1268
1269 // -------- User clicked the "Cancel" button when editing a link.
1270 if (isset($_POST['cancel_edit']))
1271 {
1272 $id = isset($_POST['lf_id']) ? (int) escape($_POST['lf_id']) : false;
1273 if (! isset($LINKSDB[$id])) {
1274 header('Location: ?');
1275 }
1276 // If we are called from the bookmarklet, we must close the popup:
1277 if (isset($_GET['source']) && ($_GET['source']=='bookmarklet' || $_GET['source']=='firefoxsocialapi')) { echo '<script>self.close();</script>'; exit; }
1278 $link = $LINKSDB[$id];
1279 $returnurl = ( isset($_POST['returnurl']) ? $_POST['returnurl'] : '?' );
1280 // Scroll to the link which has been edited.
1281 $returnurl .= '#'. $link['shorturl'];
1282 $returnurl = generateLocation($returnurl, $_SERVER['HTTP_HOST'], array('addlink', 'post', 'edit_link'));
1283 header('Location: '.$returnurl); // After canceling, redirect to the page the user was on.
1284 exit;
1285 }
1286
1287 // -------- User clicked the "Delete" button when editing a link: Delete link from database.
1288 if ($targetPage == Router::$PAGE_DELETELINK)
1289 {
1290 if (! $sessionManager->checkToken($_GET['token'])) {
1291 die(t('Wrong token.'));
1292 }
1293
1294 $ids = trim($_GET['lf_linkdate']);
1295 if (strpos($ids, ' ') !== false) {
1296 // multiple, space-separated ids provided
1297 $ids = array_values(array_filter(preg_split('/\s+/', escape($ids))));
1298 } else {
1299 // only a single id provided
1300 $ids = [$ids];
1301 }
1302 // assert at least one id is given
1303 if(!count($ids)){
1304 die('no id provided');
1305 }
1306 foreach ($ids as $id) {
1307 $id = (int) escape($id);
1308 $link = $LINKSDB[$id];
1309 $pluginManager->executeHooks('delete_link', $link);
1310 unset($LINKSDB[$id]);
1311 }
1312 $LINKSDB->save($conf->get('resource.page_cache')); // save to disk
1313 $history->deleteLink($link);
1314
1315 // If we are called from the bookmarklet, we must close the popup:
1316 if (isset($_GET['source']) && ($_GET['source']=='bookmarklet' || $_GET['source']=='firefoxsocialapi')) { echo '<script>self.close();</script>'; exit; }
1317
1318 $location = '?';
1319 if (isset($_SERVER['HTTP_REFERER'])) {
1320 // Don't redirect to where we were previously if it was a permalink or an edit_link, because it would 404.
1321 $location = generateLocation(
1322 $_SERVER['HTTP_REFERER'],
1323 $_SERVER['HTTP_HOST'],
1324 ['delete_link', 'edit_link', $link['shorturl']]
1325 );
1326 }
1327
1328 header('Location: ' . $location); // After deleting the link, redirect to appropriate location
1329 exit;
1330 }
1331
1332 // -------- User clicked the "EDIT" button on a link: Display link edit form.
1333 if (isset($_GET['edit_link']))
1334 {
1335 $id = (int) escape($_GET['edit_link']);
1336 $link = $LINKSDB[$id]; // Read database
1337 if (!$link) { header('Location: ?'); exit; } // Link not found in database.
1338 $link['linkdate'] = $link['created']->format(LinkDB::LINK_DATE_FORMAT);
1339 $data = array(
1340 'link' => $link,
1341 'link_is_new' => false,
1342 'http_referer' => (isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']) : ''),
1343 'tags' => $LINKSDB->linksCountPerTag(),
1344 );
1345 $pluginManager->executeHooks('render_editlink', $data);
1346
1347 foreach ($data as $key => $value) {
1348 $PAGE->assign($key, $value);
1349 }
1350
1351 $PAGE->assign('pagetitle', t('Edit') .' '. t('Shaare') .' - '. $conf->get('general.title', 'Shaarli'));
1352 $PAGE->renderPage('editlink');
1353 exit;
1354 }
1355
1356 // -------- User want to post a new link: Display link edit form.
1357 if (isset($_GET['post'])) {
1358 $url = cleanup_url($_GET['post']);
1359
1360 $link_is_new = false;
1361 // Check if URL is not already in database (in this case, we will edit the existing link)
1362 $link = $LINKSDB->getLinkFromUrl($url);
1363 if (! $link)
1364 {
1365 $link_is_new = true;
1366 $linkdate = strval(date(LinkDB::LINK_DATE_FORMAT));
1367 // Get title if it was provided in URL (by the bookmarklet).
1368 $title = empty($_GET['title']) ? '' : escape($_GET['title']);
1369 // Get description if it was provided in URL (by the bookmarklet). [Bronco added that]
1370 $description = empty($_GET['description']) ? '' : escape($_GET['description']);
1371 $tags = empty($_GET['tags']) ? '' : escape($_GET['tags']);
1372 $private = !empty($_GET['private']) && $_GET['private'] === "1" ? 1 : 0;
1373 // If this is an HTTP(S) link, we try go get the page to extract the title (otherwise we will to straight to the edit form.)
1374 if (empty($title) && strpos(get_url_scheme($url), 'http') !== false) {
1375 // Short timeout to keep the application responsive
1376 // The callback will fill $charset and $title with data from the downloaded page.
1377 get_http_response(
1378 $url,
1379 $conf->get('general.download_max_size', 4194304),
1380 $conf->get('general.download_timeout', 30),
1381 get_curl_download_callback($charset, $title)
1382 );
1383 if (! empty($title) && strtolower($charset) != 'utf-8') {
1384 $title = mb_convert_encoding($title, 'utf-8', $charset);
1385 }
1386 }
1387
1388 if ($url == '') {
1389 $url = '?' . smallHash($linkdate . $LINKSDB->getNextId());
1390 $title = $conf->get('general.default_note_title', t('Note: '));
1391 }
1392 $url = escape($url);
1393 $title = escape($title);
1394
1395 $link = array(
1396 'linkdate' => $linkdate,
1397 'title' => $title,
1398 'url' => $url,
1399 'description' => $description,
1400 'tags' => $tags,
1401 'private' => $private,
1402 );
1403 } else {
1404 $link['linkdate'] = $link['created']->format(LinkDB::LINK_DATE_FORMAT);
1405 }
1406
1407 $data = array(
1408 'link' => $link,
1409 'link_is_new' => $link_is_new,
1410 'http_referer' => (isset($_SERVER['HTTP_REFERER']) ? escape($_SERVER['HTTP_REFERER']) : ''),
1411 'source' => (isset($_GET['source']) ? $_GET['source'] : ''),
1412 'tags' => $LINKSDB->linksCountPerTag(),
1413 'default_private_links' => $conf->get('privacy.default_private_links', false),
1414 );
1415 $pluginManager->executeHooks('render_editlink', $data);
1416
1417 foreach ($data as $key => $value) {
1418 $PAGE->assign($key, $value);
1419 }
1420
1421 $PAGE->assign('pagetitle', t('Shaare') .' - '. $conf->get('general.title', 'Shaarli'));
1422 $PAGE->renderPage('editlink');
1423 exit;
1424 }
1425
1426 if ($targetPage == Router::$PAGE_EXPORT) {
1427 // Export links as a Netscape Bookmarks file
1428
1429 if (empty($_GET['selection'])) {
1430 $PAGE->assign('pagetitle', t('Export') .' - '. $conf->get('general.title', 'Shaarli'));
1431 $PAGE->renderPage('export');
1432 exit;
1433 }
1434
1435 // export as bookmarks_(all|private|public)_YYYYmmdd_HHMMSS.html
1436 $selection = $_GET['selection'];
1437 if (isset($_GET['prepend_note_url'])) {
1438 $prependNoteUrl = $_GET['prepend_note_url'];
1439 } else {
1440 $prependNoteUrl = false;
1441 }
1442
1443 try {
1444 $PAGE->assign(
1445 'links',
1446 NetscapeBookmarkUtils::filterAndFormat(
1447 $LINKSDB,
1448 $selection,
1449 $prependNoteUrl,
1450 index_url($_SERVER)
1451 )
1452 );
1453 } catch (Exception $exc) {
1454 header('Content-Type: text/plain; charset=utf-8');
1455 echo $exc->getMessage();
1456 exit;
1457 }
1458 $now = new DateTime();
1459 header('Content-Type: text/html; charset=utf-8');
1460 header(
1461 'Content-disposition: attachment; filename=bookmarks_'
1462 .$selection.'_'.$now->format(LinkDB::LINK_DATE_FORMAT).'.html'
1463 );
1464 $PAGE->assign('date', $now->format(DateTime::RFC822));
1465 $PAGE->assign('eol', PHP_EOL);
1466 $PAGE->assign('selection', $selection);
1467 $PAGE->renderPage('export.bookmarks');
1468 exit;
1469 }
1470
1471 if ($targetPage == Router::$PAGE_IMPORT) {
1472 // Upload a Netscape bookmark dump to import its contents
1473
1474 if (! isset($_POST['token']) || ! isset($_FILES['filetoupload'])) {
1475 // Show import dialog
1476 $PAGE->assign(
1477 'maxfilesize',
1478 get_max_upload_size(
1479 ini_get('post_max_size'),
1480 ini_get('upload_max_filesize'),
1481 false
1482 )
1483 );
1484 $PAGE->assign(
1485 'maxfilesizeHuman',
1486 get_max_upload_size(
1487 ini_get('post_max_size'),
1488 ini_get('upload_max_filesize'),
1489 true
1490 )
1491 );
1492 $PAGE->assign('pagetitle', t('Import') .' - '. $conf->get('general.title', 'Shaarli'));
1493 $PAGE->renderPage('import');
1494 exit;
1495 }
1496
1497 // Import bookmarks from an uploaded file
1498 if (isset($_FILES['filetoupload']['size']) && $_FILES['filetoupload']['size'] == 0) {
1499 // The file is too big or some form field may be missing.
1500 $msg = sprintf(
1501 t(
1502 'The file you are trying to upload is probably bigger than what this webserver can accept'
1503 .' (%s). Please upload in smaller chunks.'
1504 ),
1505 get_max_upload_size(ini_get('post_max_size'), ini_get('upload_max_filesize'))
1506 );
1507 echo '<script>alert("'. $msg .'");document.location=\'?do='.Router::$PAGE_IMPORT .'\';</script>';
1508 exit;
1509 }
1510 if (! $sessionManager->checkToken($_POST['token'])) {
1511 die('Wrong token.');
1512 }
1513 $status = NetscapeBookmarkUtils::import(
1514 $_POST,
1515 $_FILES,
1516 $LINKSDB,
1517 $conf,
1518 $history
1519 );
1520 echo '<script>alert("'.$status.'");document.location=\'?do='
1521 .Router::$PAGE_IMPORT .'\';</script>';
1522 exit;
1523 }
1524
1525 // Plugin administration page
1526 if ($targetPage == Router::$PAGE_PLUGINSADMIN) {
1527 $pluginMeta = $pluginManager->getPluginsMeta();
1528
1529 // Split plugins into 2 arrays: ordered enabled plugins and disabled.
1530 $enabledPlugins = array_filter($pluginMeta, function($v) { return $v['order'] !== false; });
1531 // Load parameters.
1532 $enabledPlugins = load_plugin_parameter_values($enabledPlugins, $conf->get('plugins', array()));
1533 uasort(
1534 $enabledPlugins,
1535 function($a, $b) { return $a['order'] - $b['order']; }
1536 );
1537 $disabledPlugins = array_filter($pluginMeta, function($v) { return $v['order'] === false; });
1538
1539 $PAGE->assign('enabledPlugins', $enabledPlugins);
1540 $PAGE->assign('disabledPlugins', $disabledPlugins);
1541 $PAGE->assign('pagetitle', t('Plugin administration') .' - '. $conf->get('general.title', 'Shaarli'));
1542 $PAGE->renderPage('pluginsadmin');
1543 exit;
1544 }
1545
1546 // Plugin administration form action
1547 if ($targetPage == Router::$PAGE_SAVE_PLUGINSADMIN) {
1548 try {
1549 if (isset($_POST['parameters_form'])) {
1550 unset($_POST['parameters_form']);
1551 foreach ($_POST as $param => $value) {
1552 $conf->set('plugins.'. $param, escape($value));
1553 }
1554 }
1555 else {
1556 $conf->set('general.enabled_plugins', save_plugin_config($_POST));
1557 }
1558 $conf->write(isLoggedIn());
1559 $history->updateSettings();
1560 }
1561 catch (Exception $e) {
1562 error_log(
1563 'ERROR while saving plugin configuration:.' . PHP_EOL .
1564 $e->getMessage()
1565 );
1566
1567 // TODO: do not handle exceptions/errors in JS.
1568 echo '<script>alert("'. $e->getMessage() .'");document.location=\'?do='. Router::$PAGE_PLUGINSADMIN .'\';</script>';
1569 exit;
1570 }
1571 header('Location: ?do='. Router::$PAGE_PLUGINSADMIN);
1572 exit;
1573 }
1574
1575 // Get a fresh token
1576 if ($targetPage == Router::$GET_TOKEN) {
1577 header('Content-Type:text/plain');
1578 echo $sessionManager->generateToken($conf);
1579 exit;
1580 }
1581
1582 // -------- Otherwise, simply display search form and links:
1583 showLinkList($PAGE, $LINKSDB, $conf, $pluginManager);
1584 exit;
1585 }
1586
1587 /**
1588 * Template for the list of links (<div id="linklist">)
1589 * This function fills all the necessary fields in the $PAGE for the template 'linklist.html'
1590 *
1591 * @param pageBuilder $PAGE pageBuilder instance.
1592 * @param LinkDB $LINKSDB LinkDB instance.
1593 * @param ConfigManager $conf Configuration Manager instance.
1594 * @param PluginManager $pluginManager Plugin Manager instance.
1595 */
1596 function buildLinkList($PAGE,$LINKSDB, $conf, $pluginManager)
1597 {
1598 // Used in templates
1599 if (isset($_GET['searchtags'])) {
1600 if (! empty($_GET['searchtags'])) {
1601 $searchtags = escape(normalize_spaces($_GET['searchtags']));
1602 } else {
1603 $searchtags = false;
1604 }
1605 } else {
1606 $searchtags = '';
1607 }
1608 $searchterm = !empty($_GET['searchterm']) ? escape(normalize_spaces($_GET['searchterm'])) : '';
1609
1610 // Smallhash filter
1611 if (! empty($_SERVER['QUERY_STRING'])
1612 && preg_match('/^[a-zA-Z0-9-_@]{6}($|&|#)/', $_SERVER['QUERY_STRING'])) {
1613 try {
1614 $linksToDisplay = $LINKSDB->filterHash($_SERVER['QUERY_STRING']);
1615 } catch (LinkNotFoundException $e) {
1616 $PAGE->render404($e->getMessage());
1617 exit;
1618 }
1619 } else {
1620 // Filter links according search parameters.
1621 $visibility = ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '';
1622 $request = [
1623 'searchtags' => $searchtags,
1624 'searchterm' => $searchterm,
1625 ];
1626 $linksToDisplay = $LINKSDB->filterSearch($request, false, $visibility, !empty($_SESSION['untaggedonly']));
1627 }
1628
1629 // ---- Handle paging.
1630 $keys = array();
1631 foreach ($linksToDisplay as $key => $value) {
1632 $keys[] = $key;
1633 }
1634
1635
1636
1637 // Select articles according to paging.
1638 $pagecount = ceil(count($keys) / $_SESSION['LINKS_PER_PAGE']);
1639 $pagecount = $pagecount == 0 ? 1 : $pagecount;
1640 $page= empty($_GET['page']) ? 1 : intval($_GET['page']);
1641 $page = $page < 1 ? 1 : $page;
1642 $page = $page > $pagecount ? $pagecount : $page;
1643 // Start index.
1644 $i = ($page-1) * $_SESSION['LINKS_PER_PAGE'];
1645 $end = $i + $_SESSION['LINKS_PER_PAGE'];
1646 $linkDisp = array();
1647 while ($i<$end && $i<count($keys))
1648 {
1649 $link = $linksToDisplay[$keys[$i]];
1650 $link['description'] = format_description(
1651 $link['description'],
1652 $conf->get('redirector.url'),
1653 $conf->get('redirector.encode_url')
1654 );
1655 $classLi = ($i % 2) != 0 ? '' : 'publicLinkHightLight';
1656 $link['class'] = $link['private'] == 0 ? $classLi : 'private';
1657 $link['timestamp'] = $link['created']->getTimestamp();
1658 if (! empty($link['updated'])) {
1659 $link['updated_timestamp'] = $link['updated']->getTimestamp();
1660 } else {
1661 $link['updated_timestamp'] = '';
1662 }
1663 $taglist = preg_split('/\s+/', $link['tags'], -1, PREG_SPLIT_NO_EMPTY);
1664 uasort($taglist, 'strcasecmp');
1665 $link['taglist'] = $taglist;
1666 // Check for both signs of a note: starting with ? and 7 chars long.
1667 if ($link['url'][0] === '?' &&
1668 strlen($link['url']) === 7) {
1669 $link['url'] = index_url($_SERVER) . $link['url'];
1670 }
1671
1672 $linkDisp[$keys[$i]] = $link;
1673 $i++;
1674 }
1675
1676 // Compute paging navigation
1677 $searchtagsUrl = $searchtags === '' ? '' : '&searchtags=' . urlencode($searchtags);
1678 $searchtermUrl = empty($searchterm) ? '' : '&searchterm=' . urlencode($searchterm);
1679 $previous_page_url = '';
1680 if ($i != count($keys)) {
1681 $previous_page_url = '?page=' . ($page+1) . $searchtermUrl . $searchtagsUrl;
1682 }
1683 $next_page_url='';
1684 if ($page>1) {
1685 $next_page_url = '?page=' . ($page-1) . $searchtermUrl . $searchtagsUrl;
1686 }
1687
1688 // Fill all template fields.
1689 $data = array(
1690 'previous_page_url' => $previous_page_url,
1691 'next_page_url' => $next_page_url,
1692 'page_current' => $page,
1693 'page_max' => $pagecount,
1694 'result_count' => count($linksToDisplay),
1695 'search_term' => $searchterm,
1696 'search_tags' => $searchtags,
1697 'visibility' => ! empty($_SESSION['visibility']) ? $_SESSION['visibility'] : '',
1698 'redirector' => $conf->get('redirector.url'), // Optional redirector URL.
1699 'links' => $linkDisp,
1700 );
1701
1702 // If there is only a single link, we change on-the-fly the title of the page.
1703 if (count($linksToDisplay) == 1) {
1704 $data['pagetitle'] = $linksToDisplay[$keys[0]]['title'] .' - '. $conf->get('general.title');
1705 } elseif (! empty($searchterm) || ! empty($searchtags)) {
1706 $data['pagetitle'] = t('Search: ');
1707 $data['pagetitle'] .= ! empty($searchterm) ? $searchterm .' ' : '';
1708 $bracketWrap = function ($tag) {
1709 return '['. $tag .']';
1710 };
1711 $data['pagetitle'] .= ! empty($searchtags)
1712 ? implode(' ', array_map($bracketWrap, preg_split('/\s+/', $searchtags))).' '
1713 : '';
1714 $data['pagetitle'] .= '- '. $conf->get('general.title');
1715 }
1716
1717 $pluginManager->executeHooks('render_linklist', $data, array('loggedin' => isLoggedIn()));
1718
1719 foreach ($data as $key => $value) {
1720 $PAGE->assign($key, $value);
1721 }
1722
1723 return;
1724 }
1725
1726 /**
1727 * Compute the thumbnail for a link.
1728 *
1729 * With a link to the original URL.
1730 * Understands various services (youtube.com...)
1731 * Input: $url = URL for which the thumbnail must be found.
1732 * $href = if provided, this URL will be followed instead of $url
1733 * Returns an associative array with thumbnail attributes (src,href,width,height,style,alt)
1734 * Some of them may be missing.
1735 * Return an empty array if no thumbnail available.
1736 *
1737 * @param ConfigManager $conf Configuration Manager instance.
1738 * @param string $url
1739 * @param string|bool $href
1740 *
1741 * @return array
1742 */
1743 function computeThumbnail($conf, $url, $href = false)
1744 {
1745 if (!$conf->get('thumbnail.enable_thumbnails')) return array();
1746 if ($href==false) $href=$url;
1747
1748 // For most hosts, the URL of the thumbnail can be easily deduced from the URL of the link.
1749 // (e.g. http://www.youtube.com/watch?v=spVypYk4kto ---> http://img.youtube.com/vi/spVypYk4kto/default.jpg )
1750 // ^^^^^^^^^^^ ^^^^^^^^^^^
1751 $domain = parse_url($url,PHP_URL_HOST);
1752 if ($domain=='youtube.com' || $domain=='www.youtube.com')
1753 {
1754 parse_str(parse_url($url,PHP_URL_QUERY), $params); // Extract video ID and get thumbnail
1755 if (!empty($params['v'])) return array('src'=>'https://img.youtube.com/vi/'.$params['v'].'/default.jpg',
1756 'href'=>$href,'width'=>'120','height'=>'90','alt'=>'YouTube thumbnail');
1757 }
1758 if ($domain=='youtu.be') // Youtube short links
1759 {
1760 $path = parse_url($url,PHP_URL_PATH);
1761 return array('src'=>'https://img.youtube.com/vi'.$path.'/default.jpg',
1762 'href'=>$href,'width'=>'120','height'=>'90','alt'=>'YouTube thumbnail');
1763 }
1764 if ($domain=='pix.toile-libre.org') // pix.toile-libre.org image hosting
1765 {
1766 parse_str(parse_url($url,PHP_URL_QUERY), $params); // Extract image filename.
1767 if (!empty($params) && !empty($params['img'])) return array('src'=>'http://pix.toile-libre.org/upload/thumb/'.urlencode($params['img']),
1768 'href'=>$href,'style'=>'max-width:120px; max-height:150px','alt'=>'pix.toile-libre.org thumbnail');
1769 }
1770
1771 if ($domain=='imgur.com')
1772 {
1773 $path = parse_url($url,PHP_URL_PATH);
1774 if (startsWith($path,'/a/')) return array(); // Thumbnails for albums are not available.
1775 if (startsWith($path,'/r/')) return array('src'=>'https://i.imgur.com/'.basename($path).'s.jpg',
1776 'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1777 if (startsWith($path,'/gallery/')) return array('src'=>'https://i.imgur.com'.substr($path,8).'s.jpg',
1778 'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1779
1780 if (substr_count($path,'/')==1) return array('src'=>'https://i.imgur.com/'.substr($path,1).'s.jpg',
1781 'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1782 }
1783 if ($domain=='i.imgur.com')
1784 {
1785 $pi = pathinfo(parse_url($url,PHP_URL_PATH));
1786 if (!empty($pi['filename'])) return array('src'=>'https://i.imgur.com/'.$pi['filename'].'s.jpg',
1787 'href'=>$href,'width'=>'90','height'=>'90','alt'=>'imgur.com thumbnail');
1788 }
1789 if ($domain=='dailymotion.com' || $domain=='www.dailymotion.com')
1790 {
1791 if (strpos($url,'dailymotion.com/video/')!==false)
1792 {
1793 $thumburl=str_replace('dailymotion.com/video/','dailymotion.com/thumbnail/video/',$url);
1794 return array('src'=>$thumburl,
1795 'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'DailyMotion thumbnail');
1796 }
1797 }
1798 if (endsWith($domain,'.imageshack.us'))
1799 {
1800 $ext=strtolower(pathinfo($url,PATHINFO_EXTENSION));
1801 if ($ext=='jpg' || $ext=='jpeg' || $ext=='png' || $ext=='gif')
1802 {
1803 $thumburl = substr($url,0,strlen($url)-strlen($ext)).'th.'.$ext;
1804 return array('src'=>$thumburl,
1805 'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'imageshack.us thumbnail');
1806 }
1807 }
1808
1809 // Some other hosts are SLOW AS HELL and usually require an extra HTTP request to get the thumbnail URL.
1810 // So we deport the thumbnail generation in order not to slow down page generation
1811 // (and we also cache the thumbnail)
1812
1813 if (! $conf->get('thumbnail.enable_localcache')) return array(); // If local cache is disabled, no thumbnails for services which require the use a local cache.
1814
1815 if ($domain=='flickr.com' || endsWith($domain,'.flickr.com')
1816 || $domain=='vimeo.com'
1817 || $domain=='ted.com' || endsWith($domain,'.ted.com')
1818 || $domain=='xkcd.com' || endsWith($domain,'.xkcd.com')
1819 )
1820 {
1821 if ($domain=='vimeo.com')
1822 { // Make sure this vimeo URL points to a video (/xxx... where xxx is numeric)
1823 $path = parse_url($url,PHP_URL_PATH);
1824 if (!preg_match('!/\d+.+?!',$path)) return array(); // This is not a single video URL.
1825 }
1826 if ($domain=='xkcd.com' || endsWith($domain,'.xkcd.com'))
1827 { // Make sure this URL points to a single comic (/xxx... where xxx is numeric)
1828 $path = parse_url($url,PHP_URL_PATH);
1829 if (!preg_match('!/\d+.+?!',$path)) return array();
1830 }
1831 if ($domain=='ted.com' || endsWith($domain,'.ted.com'))
1832 { // Make sure this TED URL points to a video (/talks/...)
1833 $path = parse_url($url,PHP_URL_PATH);
1834 if ("/talks/" !== substr($path,0,7)) return array(); // This is not a single video URL.
1835 }
1836 $sign = hash_hmac('sha256', $url, $conf->get('credentials.salt')); // We use the salt to sign data (it's random, secret, and specific to each installation)
1837 return array('src'=>index_url($_SERVER).'?do=genthumbnail&hmac='.$sign.'&url='.urlencode($url),
1838 'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'thumbnail');
1839 }
1840
1841 // For all other, we try to make a thumbnail of links ending with .jpg/jpeg/png/gif
1842 // Technically speaking, we should download ALL links and check their Content-Type to see if they are images.
1843 // But using the extension will do.
1844 $ext=strtolower(pathinfo($url,PATHINFO_EXTENSION));
1845 if ($ext=='jpg' || $ext=='jpeg' || $ext=='png' || $ext=='gif')
1846 {
1847 $sign = hash_hmac('sha256', $url, $conf->get('credentials.salt')); // We use the salt to sign data (it's random, secret, and specific to each installation)
1848 return array('src'=>index_url($_SERVER).'?do=genthumbnail&hmac='.$sign.'&url='.urlencode($url),
1849 'href'=>$href,'width'=>'120','style'=>'height:auto;','alt'=>'thumbnail');
1850 }
1851 return array(); // No thumbnail.
1852
1853 }
1854
1855
1856 // Returns the HTML code to display a thumbnail for a link
1857 // with a link to the original URL.
1858 // Understands various services (youtube.com...)
1859 // Input: $url = URL for which the thumbnail must be found.
1860 // $href = if provided, this URL will be followed instead of $url
1861 // Returns '' if no thumbnail available.
1862 function thumbnail($url,$href=false)
1863 {
1864 // FIXME!
1865 global $conf;
1866 $t = computeThumbnail($conf, $url,$href);
1867 if (count($t)==0) return ''; // Empty array = no thumbnail for this URL.
1868
1869 $html='<a href="'.escape($t['href']).'"><img src="'.escape($t['src']).'"';
1870 if (!empty($t['width'])) $html.=' width="'.escape($t['width']).'"';
1871 if (!empty($t['height'])) $html.=' height="'.escape($t['height']).'"';
1872 if (!empty($t['style'])) $html.=' style="'.escape($t['style']).'"';
1873 if (!empty($t['alt'])) $html.=' alt="'.escape($t['alt']).'"';
1874 $html.='></a>';
1875 return $html;
1876 }
1877
1878 // Returns the HTML code to display a thumbnail for a link
1879 // for the picture wall (using lazy image loading)
1880 // Understands various services (youtube.com...)
1881 // Input: $url = URL for which the thumbnail must be found.
1882 // $href = if provided, this URL will be followed instead of $url
1883 // Returns '' if no thumbnail available.
1884 function lazyThumbnail($conf, $url,$href=false)
1885 {
1886 // FIXME!
1887 global $conf;
1888 $t = computeThumbnail($conf, $url,$href);
1889 if (count($t)==0) return ''; // Empty array = no thumbnail for this URL.
1890
1891 $html='<a href="'.escape($t['href']).'">';
1892
1893 // Lazy image
1894 $html.='<img class="b-lazy" src="#" data-src="'.escape($t['src']).'"';
1895
1896 if (!empty($t['width'])) $html.=' width="'.escape($t['width']).'"';
1897 if (!empty($t['height'])) $html.=' height="'.escape($t['height']).'"';
1898 if (!empty($t['style'])) $html.=' style="'.escape($t['style']).'"';
1899 if (!empty($t['alt'])) $html.=' alt="'.escape($t['alt']).'"';
1900 $html.='>';
1901
1902 // No-JavaScript fallback.
1903 $html.='<noscript><img src="'.escape($t['src']).'"';
1904 if (!empty($t['width'])) $html.=' width="'.escape($t['width']).'"';
1905 if (!empty($t['height'])) $html.=' height="'.escape($t['height']).'"';
1906 if (!empty($t['style'])) $html.=' style="'.escape($t['style']).'"';
1907 if (!empty($t['alt'])) $html.=' alt="'.escape($t['alt']).'"';
1908 $html.='></noscript></a>';
1909
1910 return $html;
1911 }
1912
1913
1914 /**
1915 * Installation
1916 * This function should NEVER be called if the file data/config.php exists.
1917 *
1918 * @param ConfigManager $conf Configuration Manager instance.
1919 * @param SessionManager $sessionManager SessionManager instance
1920 */
1921 function install($conf, $sessionManager) {
1922 // On free.fr host, make sure the /sessions directory exists, otherwise login will not work.
1923 if (endsWith($_SERVER['HTTP_HOST'],'.free.fr') && !is_dir($_SERVER['DOCUMENT_ROOT'].'/sessions')) mkdir($_SERVER['DOCUMENT_ROOT'].'/sessions',0705);
1924
1925
1926 // This part makes sure sessions works correctly.
1927 // (Because on some hosts, session.save_path may not be set correctly,
1928 // or we may not have write access to it.)
1929 if (isset($_GET['test_session']) && ( !isset($_SESSION) || !isset($_SESSION['session_tested']) || $_SESSION['session_tested']!='Working'))
1930 {
1931 // Step 2: Check if data in session is correct.
1932 $msg = t(
1933 '<pre>Sessions do not seem to work correctly on your server.<br>'.
1934 'Make sure the variable "session.save_path" is set correctly in your PHP config, '.
1935 'and that you have write access to it.<br>'.
1936 'It currently points to %s.<br>'.
1937 'On some browsers, accessing your server via a hostname like \'localhost\' '.
1938 'or any custom hostname without a dot causes cookie storage to fail. '.
1939 'We recommend accessing your server via it\'s IP address or Fully Qualified Domain Name.<br>'
1940 );
1941 $msg = sprintf($msg, session_save_path());
1942 echo $msg;
1943 echo '<br><a href="?">'. t('Click to try again.') .'</a></pre>';
1944 die;
1945 }
1946 if (!isset($_SESSION['session_tested']))
1947 { // Step 1 : Try to store data in session and reload page.
1948 $_SESSION['session_tested'] = 'Working'; // Try to set a variable in session.
1949 header('Location: '.index_url($_SERVER).'?test_session'); // Redirect to check stored data.
1950 }
1951 if (isset($_GET['test_session']))
1952 { // Step 3: Sessions are OK. Remove test parameter from URL.
1953 header('Location: '.index_url($_SERVER));
1954 }
1955
1956
1957 if (!empty($_POST['setlogin']) && !empty($_POST['setpassword']))
1958 {
1959 $tz = 'UTC';
1960 if (!empty($_POST['continent']) && !empty($_POST['city'])
1961 && isTimeZoneValid($_POST['continent'], $_POST['city'])
1962 ) {
1963 $tz = $_POST['continent'].'/'.$_POST['city'];
1964 }
1965 $conf->set('general.timezone', $tz);
1966 $login = $_POST['setlogin'];
1967 $conf->set('credentials.login', $login);
1968 $salt = sha1(uniqid('', true) .'_'. mt_rand());
1969 $conf->set('credentials.salt', $salt);
1970 $conf->set('credentials.hash', sha1($_POST['setpassword'] . $login . $salt));
1971 if (!empty($_POST['title'])) {
1972 $conf->set('general.title', escape($_POST['title']));
1973 } else {
1974 $conf->set('general.title', 'Shared links on '.escape(index_url($_SERVER)));
1975 }
1976 $conf->set('translation.language', escape($_POST['language']));
1977 $conf->set('updates.check_updates', !empty($_POST['updateCheck']));
1978 $conf->set('api.enabled', !empty($_POST['enableApi']));
1979 $conf->set(
1980 'api.secret',
1981 generate_api_secret(
1982 $conf->get('credentials.login'),
1983 $conf->get('credentials.salt')
1984 )
1985 );
1986 try {
1987 // Everything is ok, let's create config file.
1988 $conf->write(isLoggedIn());
1989 }
1990 catch(Exception $e) {
1991 error_log(
1992 'ERROR while writing config file after installation.' . PHP_EOL .
1993 $e->getMessage()
1994 );
1995
1996 // TODO: do not handle exceptions/errors in JS.
1997 echo '<script>alert("'. $e->getMessage() .'");document.location=\'?\';</script>';
1998 exit;
1999 }
2000 echo '<script>alert("Shaarli is now configured. Please enter your login/password and start shaaring your links!");document.location=\'?do=login\';</script>';
2001 exit;
2002 }
2003
2004 $PAGE = new PageBuilder($conf, null, $sessionManager->generateToken());
2005 list($continents, $cities) = generateTimeZoneData(timezone_identifiers_list(), date_default_timezone_get());
2006 $PAGE->assign('continents', $continents);
2007 $PAGE->assign('cities', $cities);
2008 $PAGE->assign('languages', Languages::getAvailableLanguages());
2009 $PAGE->renderPage('install');
2010 exit;
2011 }
2012
2013 /**
2014 * Because some f*cking services like flickr require an extra HTTP request to get the thumbnail URL,
2015 * I have deported the thumbnail URL code generation here, otherwise this would slow down page generation.
2016 * The following function takes the URL a link (e.g. a flickr page) and return the proper thumbnail.
2017 * This function is called by passing the URL:
2018 * http://mywebsite.com/shaarli/?do=genthumbnail&hmac=[HMAC]&url=[URL]
2019 * [URL] is the URL of the link (e.g. a flickr page)
2020 * [HMAC] is the signature for the [URL] (so that these URL cannot be forged).
2021 * The function below will fetch the image from the webservice and store it in the cache.
2022 *
2023 * @param ConfigManager $conf Configuration Manager instance,
2024 */
2025 function genThumbnail($conf)
2026 {
2027 // Make sure the parameters in the URL were generated by us.
2028 $sign = hash_hmac('sha256', $_GET['url'], $conf->get('credentials.salt'));
2029 if ($sign!=$_GET['hmac']) die('Naughty boy!');
2030
2031 $cacheDir = $conf->get('resource.thumbnails_cache', 'cache');
2032 // Let's see if we don't already have the image for this URL in the cache.
2033 $thumbname=hash('sha1',$_GET['url']).'.jpg';
2034 if (is_file($cacheDir .'/'. $thumbname))
2035 { // We have the thumbnail, just serve it:
2036 header('Content-Type: image/jpeg');
2037 echo file_get_contents($cacheDir .'/'. $thumbname);
2038 return;
2039 }
2040 // We may also serve a blank image (if service did not respond)
2041 $blankname=hash('sha1',$_GET['url']).'.gif';
2042 if (is_file($cacheDir .'/'. $blankname))
2043 {
2044 header('Content-Type: image/gif');
2045 echo file_get_contents($cacheDir .'/'. $blankname);
2046 return;
2047 }
2048
2049 // Otherwise, generate the thumbnail.
2050 $url = $_GET['url'];
2051 $domain = parse_url($url,PHP_URL_HOST);
2052
2053 if ($domain=='flickr.com' || endsWith($domain,'.flickr.com'))
2054 {
2055 // Crude replacement to handle new flickr domain policy (They prefer www. now)
2056 $url = str_replace('http://flickr.com/','http://www.flickr.com/',$url);
2057
2058 // Is this a link to an image, or to a flickr page ?
2059 $imageurl='';
2060 if (endsWith(parse_url($url, PHP_URL_PATH), '.jpg'))
2061 { // This is a direct link to an image. e.g. http://farm1.staticflickr.com/5/5921913_ac83ed27bd_o.jpg
2062 preg_match('!(http://farm\d+\.staticflickr\.com/\d+/\d+_\w+_)\w.jpg!',$url,$matches);
2063 if (!empty($matches[1])) $imageurl=$matches[1].'m.jpg';
2064 }
2065 else // This is a flickr page (html)
2066 {
2067 // Get the flickr html page.
2068 list($headers, $content) = get_http_response($url, 20);
2069 if (strpos($headers[0], '200 OK') !== false)
2070 {
2071 // flickr now nicely provides the URL of the thumbnail in each flickr page.
2072 preg_match('!<link rel=\"image_src\" href=\"(.+?)\"!', $content, $matches);
2073 if (!empty($matches[1])) $imageurl=$matches[1];
2074
2075 // In albums (and some other pages), the link rel="image_src" is not provided,
2076 // but flickr provides:
2077 // <meta property="og:image" content="http://farm4.staticflickr.com/3398/3239339068_25d13535ff_z.jpg" />
2078 if ($imageurl=='')
2079 {
2080 preg_match('!<meta property=\"og:image\" content=\"(.+?)\"!', $content, $matches);
2081 if (!empty($matches[1])) $imageurl=$matches[1];
2082 }
2083 }
2084 }
2085
2086 if ($imageurl!='')
2087 { // Let's download the image.
2088 // Image is 240x120, so 10 seconds to download should be enough.
2089 list($headers, $content) = get_http_response($imageurl, 10);
2090 if (strpos($headers[0], '200 OK') !== false) {
2091 // Save image to cache.
2092 file_put_contents($cacheDir .'/'. $thumbname, $content);
2093 header('Content-Type: image/jpeg');
2094 echo $content;
2095 return;
2096 }
2097 }
2098 }
2099
2100 elseif ($domain=='vimeo.com' )
2101 {
2102 // This is more complex: we have to perform a HTTP request, then parse the result.
2103 // Maybe we should deport this to JavaScript ? Example: http://stackoverflow.com/questions/1361149/get-img-thumbnails-from-vimeo/4285098#4285098
2104 $vid = substr(parse_url($url,PHP_URL_PATH),1);
2105 list($headers, $content) = get_http_response('https://vimeo.com/api/v2/video/'.escape($vid).'.php', 5);
2106 if (strpos($headers[0], '200 OK') !== false) {
2107 $t = unserialize($content);
2108 $imageurl = $t[0]['thumbnail_medium'];
2109 // Then we download the image and serve it to our client.
2110 list($headers, $content) = get_http_response($imageurl, 10);
2111 if (strpos($headers[0], '200 OK') !== false) {
2112 // Save image to cache.
2113 file_put_contents($cacheDir .'/'. $thumbname, $content);
2114 header('Content-Type: image/jpeg');
2115 echo $content;
2116 return;
2117 }
2118 }
2119 }
2120
2121 elseif ($domain=='ted.com' || endsWith($domain,'.ted.com'))
2122 {
2123 // The thumbnail for TED talks is located in the <link rel="image_src" [...]> tag on that page
2124 // http://www.ted.com/talks/mikko_hypponen_fighting_viruses_defending_the_net.html
2125 // <link rel="image_src" href="http://images.ted.com/images/ted/28bced335898ba54d4441809c5b1112ffaf36781_389x292.jpg" />
2126 list($headers, $content) = get_http_response($url, 5);
2127 if (strpos($headers[0], '200 OK') !== false) {
2128 // Extract the link to the thumbnail
2129 preg_match('!link rel="image_src" href="(http://images.ted.com/images/ted/.+_\d+x\d+\.jpg)"!', $content, $matches);
2130 if (!empty($matches[1]))
2131 { // Let's download the image.
2132 $imageurl=$matches[1];
2133 // No control on image size, so wait long enough
2134 list($headers, $content) = get_http_response($imageurl, 20);
2135 if (strpos($headers[0], '200 OK') !== false) {
2136 $filepath = $cacheDir .'/'. $thumbname;
2137 file_put_contents($filepath, $content); // Save image to cache.
2138 if (resizeImage($filepath))
2139 {
2140 header('Content-Type: image/jpeg');
2141 echo file_get_contents($filepath);
2142 return;
2143 }
2144 }
2145 }
2146 }
2147 }
2148
2149 elseif ($domain=='xkcd.com' || endsWith($domain,'.xkcd.com'))
2150 {
2151 // There is no thumbnail available for xkcd comics, so download the whole image and resize it.
2152 // http://xkcd.com/327/
2153 // <img src="http://imgs.xkcd.com/comics/exploits_of_a_mom.png" title="<BLABLA>" alt="<BLABLA>" />
2154 list($headers, $content) = get_http_response($url, 5);
2155 if (strpos($headers[0], '200 OK') !== false) {
2156 // Extract the link to the thumbnail
2157 preg_match('!<img src="(http://imgs.xkcd.com/comics/.*)" title="[^s]!', $content, $matches);
2158 if (!empty($matches[1]))
2159 { // Let's download the image.
2160 $imageurl=$matches[1];
2161 // No control on image size, so wait long enough
2162 list($headers, $content) = get_http_response($imageurl, 20);
2163 if (strpos($headers[0], '200 OK') !== false) {
2164 $filepath = $cacheDir.'/'.$thumbname;
2165 // Save image to cache.
2166 file_put_contents($filepath, $content);
2167 if (resizeImage($filepath))
2168 {
2169 header('Content-Type: image/jpeg');
2170 echo file_get_contents($filepath);
2171 return;
2172 }
2173 }
2174 }
2175 }
2176 }
2177
2178 else
2179 {
2180 // For all other domains, we try to download the image and make a thumbnail.
2181 // We allow 30 seconds max to download (and downloads are limited to 4 Mb)
2182 list($headers, $content) = get_http_response($url, 30);
2183 if (strpos($headers[0], '200 OK') !== false) {
2184 $filepath = $cacheDir .'/'.$thumbname;
2185 // Save image to cache.
2186 file_put_contents($filepath, $content);
2187 if (resizeImage($filepath))
2188 {
2189 header('Content-Type: image/jpeg');
2190 echo file_get_contents($filepath);
2191 return;
2192 }
2193 }
2194 }
2195
2196
2197 // Otherwise, return an empty image (8x8 transparent gif)
2198 $blankgif = base64_decode('R0lGODlhCAAIAIAAAP///////yH5BAEKAAEALAAAAAAIAAgAAAIHjI+py+1dAAA7');
2199 // Also put something in cache so that this URL is not requested twice.
2200 file_put_contents($cacheDir .'/'. $blankname, $blankgif);
2201 header('Content-Type: image/gif');
2202 echo $blankgif;
2203 }
2204
2205 // Make a thumbnail of the image (to width: 120 pixels)
2206 // Returns true if success, false otherwise.
2207 function resizeImage($filepath)
2208 {
2209 if (!function_exists('imagecreatefromjpeg')) return false; // GD not present: no thumbnail possible.
2210
2211 // Trick: some stupid people rename GIF as JPEG... or else.
2212 // So we really try to open each image type whatever the extension is.
2213 $header=file_get_contents($filepath,false,NULL,0,256); // Read first 256 bytes and try to sniff file type.
2214 $im=false;
2215 $i=strpos($header,'GIF8'); if (($i!==false) && ($i==0)) $im = imagecreatefromgif($filepath); // Well this is crude, but it should be enough.
2216 $i=strpos($header,'PNG'); if (($i!==false) && ($i==1)) $im = imagecreatefrompng($filepath);
2217 $i=strpos($header,'JFIF'); if ($i!==false) $im = imagecreatefromjpeg($filepath);
2218 if (!$im) return false; // Unable to open image (corrupted or not an image)
2219 $w = imagesx($im);
2220 $h = imagesy($im);
2221 $ystart = 0; $yheight=$h;
2222 if ($h>$w) { $ystart= ($h/2)-($w/2); $yheight=$w/2; }
2223 $nw = 120; // Desired width
2224 $nh = min(floor(($h*$nw)/$w),120); // Compute new width/height, but maximum 120 pixels height.
2225 // Resize image:
2226 $im2 = imagecreatetruecolor($nw,$nh);
2227 imagecopyresampled($im2, $im, 0, 0, 0, $ystart, $nw, $nh, $w, $yheight);
2228 imageinterlace($im2,true); // For progressive JPEG.
2229 $tempname=$filepath.'_TEMP.jpg';
2230 imagejpeg($im2, $tempname, 90);
2231 imagedestroy($im);
2232 imagedestroy($im2);
2233 unlink($filepath);
2234 rename($tempname,$filepath); // Overwrite original picture with thumbnail.
2235 return true;
2236 }
2237
2238 if (isset($_SERVER['QUERY_STRING']) && startsWith($_SERVER['QUERY_STRING'], 'do=genthumbnail')) { genThumbnail($conf); exit; } // Thumbnail generation/cache does not need the link database.
2239 if (isset($_SERVER['QUERY_STRING']) && startsWith($_SERVER['QUERY_STRING'], 'do=dailyrss')) { showDailyRSS($conf); exit; }
2240 if (!isset($_SESSION['LINKS_PER_PAGE'])) {
2241 $_SESSION['LINKS_PER_PAGE'] = $conf->get('general.links_per_page', 20);
2242 }
2243
2244 try {
2245 $history = new History($conf->get('resource.history'));
2246 } catch(Exception $e) {
2247 die($e->getMessage());
2248 }
2249
2250 $linkDb = new LinkDB(
2251 $conf->get('resource.datastore'),
2252 isLoggedIn(),
2253 $conf->get('privacy.hide_public_links'),
2254 $conf->get('redirector.url'),
2255 $conf->get('redirector.encode_url')
2256 );
2257
2258 $container = new \Slim\Container();
2259 $container['conf'] = $conf;
2260 $container['plugins'] = $pluginManager;
2261 $container['history'] = $history;
2262 $app = new \Slim\App($container);
2263
2264 // REST API routes
2265 $app->group('/api/v1', function() {
2266 $this->get('/info', '\Shaarli\Api\Controllers\Info:getInfo')->setName('getInfo');
2267 $this->get('/links', '\Shaarli\Api\Controllers\Links:getLinks')->setName('getLinks');
2268 $this->get('/links/{id:[\d]+}', '\Shaarli\Api\Controllers\Links:getLink')->setName('getLink');
2269 $this->post('/links', '\Shaarli\Api\Controllers\Links:postLink')->setName('postLink');
2270 $this->put('/links/{id:[\d]+}', '\Shaarli\Api\Controllers\Links:putLink')->setName('putLink');
2271 $this->delete('/links/{id:[\d]+}', '\Shaarli\Api\Controllers\Links:deleteLink')->setName('deleteLink');
2272 $this->get('/history', '\Shaarli\Api\Controllers\History:getHistory')->setName('getHistory');
2273 })->add('\Shaarli\Api\ApiMiddleware');
2274
2275 $response = $app->run(true);
2276 // Hack to make Slim and Shaarli router work together:
2277 // If a Slim route isn't found and NOT API call, we call renderPage().
2278 if ($response->getStatusCode() == 404 && strpos($_SERVER['REQUEST_URI'], '/api/v1') === false) {
2279 // We use UTF-8 for proper international characters handling.
2280 header('Content-Type: text/html; charset=utf-8');
2281 renderPage($conf, $pluginManager, $linkDb, $history, $sessionManager, $loginManager);
2282 } else {
2283 $app->respond($response);
2284 }