*/
function nl2br_escaped($html)
{
- return str_replace('>','>',str_replace('<','<',nl2br($html)));
+ return str_replace('>', '>', str_replace('<', '<', nl2br($html)));
}
/**
*/
function generateLocation($referer, $host, $loopTerms = array())
{
- $final_referer = '?';
+ $finalReferer = '?';
// No referer if it contains any value in $loopCriteria.
foreach ($loopTerms as $value) {
if (strpos($referer, $value) !== false) {
- return $final_referer;
+ return $finalReferer;
}
}
$host = substr($host, 0, $pos);
}
- if (!empty($referer) && strpos(parse_url($referer, PHP_URL_HOST), $host) !== false) {
- $final_referer = $referer;
+ $refererHost = parse_url($referer, PHP_URL_HOST);
+ if (!empty($referer) && (strpos($refererHost, $host) !== false || startsWith('?', $refererHost))) {
+ $finalReferer = $referer;
}
- return $final_referer;
+ return $finalReferer;
+}
+
+/**
+ * Checks the PHP version to ensure Shaarli can run
+ *
+ * @param string $minVersion minimum PHP required version
+ * @param string $curVersion current PHP version (use PHP_VERSION)
+ *
+ * @throws Exception the PHP version is not supported
+ */
+function checkPHPVersion($minVersion, $curVersion)
+{
+ if (version_compare($curVersion, $minVersion) < 0) {
+ throw new Exception(
+ 'Your PHP version is obsolete!'
+ .' Shaarli requires at least PHP '.$minVersion.', and thus cannot run.'
+ .' Your PHP version has known security vulnerabilities and should be'
+ .' updated as soon as possible.'
+ );
+ }
+}
+
+/**
+ * Validate session ID to prevent Full Path Disclosure.
+ *
+ * See #298.
+ * The session ID's format depends on the hash algorithm set in PHP settings
+ *
+ * @param string $sessionId Session ID
+ *
+ * @return true if valid, false otherwise.
+ *
+ * @see http://php.net/manual/en/function.hash-algos.php
+ * @see http://php.net/manual/en/session.configuration.php
+ */
+function is_session_id_valid($sessionId)
+{
+ if (empty($sessionId)) {
+ return false;
+ }
+
+ if (!$sessionId) {
+ return false;
+ }
+
+ if (!preg_match('/^[a-zA-Z0-9,-]{2,128}$/', $sessionId)) {
+ return false;
+ }
+
+ return true;
}