-ob_start(); // Output buffering for the page cache.
-
-// Prevent caching on client side or proxy: (yes, it's ugly)
-header("Last-Modified: " . gmdate("D, d M Y H:i:s") . " GMT");
-header("Cache-Control: no-store, no-cache, must-revalidate");
-header("Cache-Control: post-check=0, pre-check=0", false);
-header("Pragma: no-cache");
-
-if (! is_file($conf->getConfigFileExt())) {
- // Ensure Shaarli has proper access to its resources
- $errors = ApplicationUtils::checkResourcePermissions($conf);
-
- if ($errors != array()) {
- $message = '<p>'. t('Insufficient permissions:') .'</p><ul>';
-
- foreach ($errors as $error) {
- $message .= '<li>'.$error.'</li>';
- }
- $message .= '</ul>';
-
- header('Content-Type: text/html; charset=utf-8');
- echo $message;
- exit;
- }
-
- // Display the installation form if no existing config is found
- install($conf, $sessionManager, $loginManager);
-}
-
-$loginManager->checkLoginState($_COOKIE, $clientIpId);
-
-// ------------------------------------------------------------------------------------------
-// Process login form: Check if login/password is correct.
-if (isset($_POST['login'])) {
- if (! $loginManager->canLogin($_SERVER)) {
- die(t('I said: NO. You are banned for the moment. Go away.'));
- }
- if (isset($_POST['password'])
- && $sessionManager->checkToken($_POST['token'])
- && $loginManager->checkCredentials($_SERVER['REMOTE_ADDR'], $clientIpId, $_POST['login'], $_POST['password'])
- ) {
- $loginManager->handleSuccessfulLogin($_SERVER);
-
- $cookiedir = '';
- if (dirname($_SERVER['SCRIPT_NAME']) != '/') {
- // Note: Never forget the trailing slash on the cookie path!
- $cookiedir = dirname($_SERVER["SCRIPT_NAME"]) . '/';
- }
-
- if (!empty($_POST['longlastingsession'])) {
- // Keep the session cookie even after the browser closes
- $sessionManager->setStaySignedIn(true);
- $expirationTime = $sessionManager->extendSession();
-
- setcookie(
- $loginManager::$STAY_SIGNED_IN_COOKIE,
- $loginManager->getStaySignedInToken(),
- $expirationTime,
- WEB_PATH
- );
- } else {
- // Standard session expiration (=when browser closes)
- $expirationTime = 0;
- }
-
- // Send cookie with the new expiration date to the browser
- session_destroy();
- session_set_cookie_params($expirationTime, $cookiedir, $_SERVER['SERVER_NAME']);
- session_start();
- session_regenerate_id(true);
-
- // Optional redirect after login:
- if (isset($_GET['post'])) {
- $uri = './?post='. urlencode($_GET['post']);
- foreach (array('description', 'source', 'title', 'tags') as $param) {
- if (!empty($_GET[$param])) {
- $uri .= '&'.$param.'='.urlencode($_GET[$param]);
- }
- }
- header('Location: '. $uri);
- exit;
- }
-
- if (isset($_GET['edit_link'])) {
- header('Location: ./?edit_link='. escape($_GET['edit_link']));
- exit;
- }
-
- if (isset($_POST['returnurl'])) {
- // Prevent loops over login screen.
- if (strpos($_POST['returnurl'], '/login') === false) {
- header('Location: '. generateLocation($_POST['returnurl'], $_SERVER['HTTP_HOST']));
- exit;
- }
- }
- header('Location: ./?');
- exit;
- } else {
- $loginManager->handleFailedLogin($_SERVER);
- $redir = '?username='. urlencode($_POST['login']);
- if (isset($_GET['post'])) {
- $redir .= '&post=' . urlencode($_GET['post']);
- foreach (array('description', 'source', 'title', 'tags') as $param) {
- if (!empty($_GET[$param])) {
- $redir .= '&' . $param . '=' . urlencode($_GET[$param]);
- }
- }
- }
- // Redirect to login screen.
- echo '<script>alert("'. t("Wrong login/password.") .'");document.location=\'./login'.$redir.'\';</script>';
- exit;
- }
-}
-
-// ------------------------------------------------------------------------------------------
-// Token management for XSRF protection
-// Token should be used in any form which acts on data (create,update,delete,import...).
-if (!isset($_SESSION['tokens'])) {
- $_SESSION['tokens']=array(); // Token are attached to the session.
-}
-
-/**
- * Installation
- * This function should NEVER be called if the file data/config.php exists.
- *
- * @param ConfigManager $conf Configuration Manager instance.
- * @param SessionManager $sessionManager SessionManager instance
- * @param LoginManager $loginManager LoginManager instance
- */
-function install($conf, $sessionManager, $loginManager)
-{
- // On free.fr host, make sure the /sessions directory exists, otherwise login will not work.
- if (endsWith($_SERVER['HTTP_HOST'], '.free.fr') && !is_dir($_SERVER['DOCUMENT_ROOT'].'/sessions')) {
- mkdir($_SERVER['DOCUMENT_ROOT'].'/sessions', 0705);
- }
-
-
- // This part makes sure sessions works correctly.
- // (Because on some hosts, session.save_path may not be set correctly,
- // or we may not have write access to it.)
- if (isset($_GET['test_session'])
- && ( !isset($_SESSION) || !isset($_SESSION['session_tested']) || $_SESSION['session_tested']!='Working')) {
- // Step 2: Check if data in session is correct.
- $msg = t(
- '<pre>Sessions do not seem to work correctly on your server.<br>'.
- 'Make sure the variable "session.save_path" is set correctly in your PHP config, '.
- 'and that you have write access to it.<br>'.
- 'It currently points to %s.<br>'.
- 'On some browsers, accessing your server via a hostname like \'localhost\' '.
- 'or any custom hostname without a dot causes cookie storage to fail. '.
- 'We recommend accessing your server via it\'s IP address or Fully Qualified Domain Name.<br>'
- );
- $msg = sprintf($msg, session_save_path());
- echo $msg;
- echo '<br><a href="?">'. t('Click to try again.') .'</a></pre>';
- die;
- }
- if (!isset($_SESSION['session_tested'])) {
- // Step 1 : Try to store data in session and reload page.
- $_SESSION['session_tested'] = 'Working'; // Try to set a variable in session.
- header('Location: '.index_url($_SERVER).'?test_session'); // Redirect to check stored data.
- }
- if (isset($_GET['test_session'])) {
- // Step 3: Sessions are OK. Remove test parameter from URL.
- header('Location: '.index_url($_SERVER));
- }